483 files changed, 6139 insertions, 3463 deletions

diff --git a/CREDITS b/CREDITS
index c322dcfb926d..28ee1514b9de 100644
--- a/CREDITS
+++ b/CREDITS
@@ -9,6 +9,10 @@
                         Linus
 ----------
 
+M: Matt Mackal
+E: mpm@selenic.com
+D: SLOB slab allocator
+
 N: Matti Aarnio
 E: mea@nic.funet.fi
 D: Alpha systems hacking, IPv6 and other network related stuff
diff --git a/Documentation/accounting/getdelays.c b/Documentation/accounting/getdelays.c
index c6a06b71594d..f40578026a04 100644
--- a/Documentation/accounting/getdelays.c
+++ b/Documentation/accounting/getdelays.c
@@ -314,6 +314,7 @@ int main(int argc, char *argv[])
                         break;
                 case 'm':
                         strncpy(cpumask, optarg, sizeof(cpumask));
+                        cpumask[sizeof(cpumask) - 1] = '\0';
                         maskset = 1;
                         printf("cpumask %s maskset %d\n", cpumask, maskset);
                         break;
diff --git a/Documentation/devicetree/bindings/arm/armada-38x.txt b/Documentation/devicetree/bindings/arm/armada-38x.txt
index 11f2330a6554..ad9f8ed4d9bd 100644
--- a/Documentation/devicetree/bindings/arm/armada-38x.txt
+++ b/Documentation/devicetree/bindings/arm/armada-38x.txt
@@ -6,5 +6,15 @@ following property:
 
 Required root node property:
 
- - compatible: must contain either "marvell,armada380" or
-   "marvell,armada385" depending on the variant of the SoC being used.
+ - compatible: must contain "marvell,armada380"
+
+In addition, boards using the Marvell Armada 385 SoC shall have the
+following property before the previous one:
+
+Required root node property:
+
+compatible: must contain "marvell,armada385"
+
+Example:
+
+compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
diff --git a/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt b/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
index 5d49f2b37f68..832fe8cc24d7 100644
--- a/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
+++ b/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
@@ -48,7 +48,7 @@ adc@12D10000 {
 
         /* NTC thermistor is a hwmon device */
         ncp15wb473@0 {
-                compatible = "ntc,ncp15wb473";
+                compatible = "murata,ncp15wb473";
                 pullup-uv = <1800000>;
                 pullup-ohm = <47000>;
                 pulldown-ohm = <0>;
diff --git a/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt b/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt
index c6f66674f19c..b117b2e9e1a7 100644
--- a/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt
+++ b/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt
@@ -3,11 +3,19 @@ NTC Thermistor hwmon sensors
 
 Requires node properties:
 - "compatible" value : one of
-        "ntc,ncp15wb473"
-        "ntc,ncp18wb473"
-        "ntc,ncp21wb473"
-        "ntc,ncp03wb473"
-        "ntc,ncp15wl333"
+        "murata,ncp15wb473"
+        "murata,ncp18wb473"
+        "murata,ncp21wb473"
+        "murata,ncp03wb473"
+        "murata,ncp15wl333"
+
+/* Usage of vendor name "ntc" is deprecated */
+<DEPRECATED>    "ntc,ncp15wb473"
+<DEPRECATED>    "ntc,ncp18wb473"
+<DEPRECATED>    "ntc,ncp21wb473"
+<DEPRECATED>    "ntc,ncp03wb473"
+<DEPRECATED>    "ntc,ncp15wl333"
+
 - "pullup-uv"   Pull up voltage in micro volts
 - "pullup-ohm"  Pull up resistor value in ohms
 - "pulldown-ohm" Pull down resistor value in ohms
@@ -21,7 +29,7 @@ Read more about iio bindings at
 
 Example:
         ncp15wb473@0 {
-                compatible = "ntc,ncp15wb473";
+                compatible = "murata,ncp15wb473";
                 pullup-uv = <1800000>;
                 pullup-ohm = <47000>;
                 pulldown-ohm = <0>;
diff --git a/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt b/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt
index b82a268f1bd4..bee6ff204baf 100644
--- a/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt
+++ b/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt
@@ -23,6 +23,12 @@ Optional properties:
 - spi-max-frequency: Specifies maximum SPI clock frequency,
                      Units - Hz. Definition as per
                      Documentation/devicetree/bindings/spi/spi-bus.txt
+- num-cs:       total number of chipselects
+- cs-gpios:     should specify GPIOs used for chipselects.
+                The gpios will be referred to as reg = <index> in the SPI child
+                nodes.  If unspecified, a single SPI device without a chip
+                select can be used.
+
 
 SPI slave nodes must be children of the SPI master node and can contain
 properties described in Documentation/devicetree/bindings/spi/spi-bus.txt
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 4d7f3758d1b4..46a311e728a8 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -83,6 +83,7 @@ mosaixtech	Mosaix Technologies, Inc.
 moxa    Moxa
 mpl     MPL AG
 mundoreader     Mundo Reader S.L.
+murata  Murata Manufacturing Co., Ltd.
 mxicy   Macronix International Co., Ltd.
 national        National Semiconductor
 neonode         Neonode Inc.
diff --git a/Documentation/email-clients.txt b/Documentation/email-clients.txt
index 4e30ebaa9e5b..9af538be3751 100644
--- a/Documentation/email-clients.txt
+++ b/Documentation/email-clients.txt
@@ -1,6 +1,17 @@
 Email clients info for Linux
 ======================================================================
 
+Git
+----------------------------------------------------------------------
+These days most developers use `git send-email` instead of regular
+email clients.  The man page for this is quite good.  On the receiving
+end, maintainers use `git am` to apply the patches.
+
+If you are new to git then send your first patch to yourself.  Save it
+as raw text including all the headers.  Run `git am raw_email.txt` and
+then review the changelog with `git log`.  When that works then send
+the patch to the appropriate mailing list(s).
+
 General Preferences
 ----------------------------------------------------------------------
 Patches for the Linux kernel are submitted via email, preferably as
diff --git a/Documentation/hwmon/ntc_thermistor b/Documentation/hwmon/ntc_thermistor
index 3bfda94096fd..057b77029f26 100644
--- a/Documentation/hwmon/ntc_thermistor
+++ b/Documentation/hwmon/ntc_thermistor
@@ -1,7 +1,7 @@
 Kernel driver ntc_thermistor
 =================
 
-Supported thermistors:
+Supported thermistors from Murata:
 * Murata NTC Thermistors NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, NCP15WL333
   Prefixes: 'ncp15wb473', 'ncp18wb473', 'ncp21wb473', 'ncp03wb473', 'ncp15wl333'
   Datasheet: Publicly available at Murata
@@ -15,9 +15,9 @@ Authors:
 Description
 -----------
 
-The NTC thermistor is a simple thermistor that requires users to provide the
-resistance and lookup the corresponding compensation table to get the
-temperature input.
+The NTC (Negative Temperature Coefficient) thermistor is a simple thermistor
+that requires users to provide the resistance and lookup the corresponding
+compensation table to get the temperature input.
 
 The NTC driver provides lookup tables with a linear approximation function
 and four circuit models with an option not to use any of the four models.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 884904975d0b..c1b9aa8c5a52 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3130,6 +3130,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         [KNL] Should the soft-lockup detector generate panics.
                         Format: <integer>
 
+        softlockup_all_cpu_backtrace=
+                        [KNL] Should the soft-lockup detector generate
+                        backtraces on all cpus.
+                        Format: <integer>
+
         sonypi.*=       [HW] Sony Programmable I/O Control Device driver
                         See Documentation/laptops/sonypi.txt
 
diff --git a/Documentation/memory-hotplug.txt b/Documentation/memory-hotplug.txt
index f304edb8fbe7..45134dc23854 100644
--- a/Documentation/memory-hotplug.txt
+++ b/Documentation/memory-hotplug.txt
@@ -209,15 +209,12 @@ If memory device is found, memory hotplug code will be called.
 
 4.2 Notify memory hot-add event by hand
 ------------
-On powerpc, the firmware does not notify a memory hotplug event to the kernel.
-Therefore, "probe" interface is supported to notify the event to the kernel.
-This interface depends on CONFIG_ARCH_MEMORY_PROBE.
-
-CONFIG_ARCH_MEMORY_PROBE is supported on powerpc only. On x86, this config
-option is disabled by default since ACPI notifies a memory hotplug event to
-the kernel, which performs its hotplug operation as the result. Please
-enable this option if you need the "probe" interface for testing purposes
-on x86.
+On some architectures, the firmware may not notify the kernel of a memory
+hotplug event.  Therefore, the memory "probe" interface is supported to
+explicitly notify the kernel.  This interface depends on
+CONFIG_ARCH_MEMORY_PROBE and can be configured on powerpc, sh, and x86
+if hotplug is supported, although for x86 this should be handled by ACPI
+notification.
 
 Probe interface is located at
 /sys/devices/system/memory/probe
diff --git a/Documentation/ptp/testptp.c b/Documentation/ptp/testptp.c
index f1ac2dae999e..ba1d50200c46 100644
--- a/Documentation/ptp/testptp.c
+++ b/Documentation/ptp/testptp.c
@@ -17,6 +17,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
+#define _GNU_SOURCE
 #include <errno.h>
 #include <fcntl.h>
 #include <inttypes.h>
@@ -46,12 +47,14 @@
 #define CLOCK_INVALID -1
 #endif
 
-/* When glibc offers the syscall, this will go away. */
+/* clock_adjtime is not available in GLIBC < 2.14 */
+#if !__GLIBC_PREREQ(2, 14)
 #include <sys/syscall.h>
 static int clock_adjtime(clockid_t id, struct timex *tx)
 {
         return syscall(__NR_clock_adjtime, id, tx);
 }
+#endif
 
 static clockid_t get_clockid(int fd)
 {
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index 85c362d8ea34..d1ab5e17eb13 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -286,6 +286,11 @@ STAC92HD83*
   hp-inv-led    HP with broken BIOS for inverted mute LED
   auto          BIOS setup (default)
 
+STAC92HD95
+==========
+  hp-led        LED support for HP laptops
+  hp-bass       Bass HPF setup for HP Spectre 13
+
 STAC9872
 ========
   vaio          VAIO laptop without SPDIF
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 708bb7f1b7e0..c14374e71775 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -75,6 +75,7 @@ show up in /proc/sys/kernel:
 - shmall
 - shmmax                      [ sysv ipc ]
 - shmmni
+- softlockup_all_cpu_backtrace
 - stop-a                      [ SPARC only ]
 - sysrq                       ==> Documentation/sysrq.txt
 - sysctl_writes_strict
@@ -783,6 +784,22 @@ via the /proc/sys interface:
 
 ==============================================================
 
+softlockup_all_cpu_backtrace:
+
+This value controls the soft lockup detector thread's behavior
+when a soft lockup condition is detected as to whether or not
+to gather further debug information. If enabled, each cpu will
+be issued an NMI and instructed to capture stack trace.
+
+This feature is only applicable for architectures which support
+NMI.
+
+0: do nothing. This is the default behavior.
+
+1: on detection capture more debug information.
+
+==============================================================
+
 tainted:
 
 Non-zero if the kernel has been tainted.  Numeric values, which
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index bd4b34c03738..4415aa915681 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -702,7 +702,8 @@ The batch value of each per cpu pagelist is also updated as a result.  It is
 set to pcp->high/4.  The upper limit of batch is (PAGE_SHIFT * 8)
 
 The initial value is zero.  Kernel does not use this value at boot time to set
-the high water marks for each per cpu page list.
+the high water marks for each per cpu page list.  If the user writes '0' to this
+sysctl, it will revert to this default behavior.
 
 ==============================================================
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 3f2e171047b9..702ca10a5a6c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2917,6 +2917,9 @@ L:	linux-doc@vger.kernel.org
 T:      quilt http://www.infradead.org/~rdunlap/Doc/patches/
 S:      Maintained
 F:      Documentation/
+X:      Documentation/ABI/
+X:      Documentation/devicetree/
+X:      Documentation/[a-z][a-z]_[A-Z][A-Z]/
 
 DOUBLETALK DRIVER
 M:      "James R. Van Zandt" <jrv@vanzandt.mv.com>
@@ -3189,14 +3192,6 @@ L:	linux-scsi@vger.kernel.org
 S:      Maintained
 F:      drivers/scsi/eata_pio.*
 
-EBTABLES
-L:      netfilter-devel@vger.kernel.org
-W:      http://ebtables.sourceforge.net/
-S:      Orphan
-F:      include/linux/netfilter_bridge/ebt_*.h
-F:      include/uapi/linux/netfilter_bridge/ebt_*.h
-F:      net/bridge/netfilter/ebt*.c
-
 EC100 MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
 L:      linux-media@vger.kernel.org
@@ -6105,12 +6100,11 @@ F:	Documentation/networking/s2io.txt
 F:      Documentation/networking/vxge.txt
 F:      drivers/net/ethernet/neterion/
 
-NETFILTER/IPTABLES
+NETFILTER ({IP,IP6,ARP,EB,NF}TABLES)
 M:      Pablo Neira Ayuso <pablo@netfilter.org>
 M:      Patrick McHardy <kaber@trash.net>
 M:      Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 L:      netfilter-devel@vger.kernel.org
-L:      netfilter@vger.kernel.org
 L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
@@ -8196,13 +8190,15 @@ S:	Maintained
 F:      drivers/usb/misc/sisusbvga/
 
 SLAB ALLOCATOR
-M:      Christoph Lameter <cl@linux-foundation.org>
+M:      Christoph Lameter <cl@linux.com>
 M:      Pekka Enberg <penberg@kernel.org>
-M:      Matt Mackall <mpm@selenic.com>
+M:      David Rientjes <rientjes@google.com>
+M:      Joonsoo Kim <iamjoonsoo.kim@lge.com>
+M:      Andrew Morton <akpm@linux-foundation.org>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      include/linux/sl?b*.h
-F:      mm/sl?b.c
+F:      mm/sl?b*
 
 SLEEPABLE READ-COPY UPDATE (SRCU)
 M:      Lai Jiangshan <laijs@cn.fujitsu.com>
diff --git a/Makefile b/Makefile
index b11e2d504a00..13175632137f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index c1d3d2da1191..b3c750979aa1 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -60,7 +60,7 @@ extern void read_decode_cache_bcr(void);
 #define ARC_REG_IC_IVIC         0x10
 #define ARC_REG_IC_CTRL         0x11
 #define ARC_REG_IC_IVIL         0x19
-#if defined(CONFIG_ARC_MMU_V3) || defined (CONFIG_ARC_MMU_V4)
+#if defined(CONFIG_ARC_MMU_V3)
 #define ARC_REG_IC_PTAG         0x1E
 #endif
 
@@ -74,7 +74,7 @@ extern void read_decode_cache_bcr(void);
 #define ARC_REG_DC_IVDL         0x4A
 #define ARC_REG_DC_FLSH         0x4B
 #define ARC_REG_DC_FLDL         0x4C
-#if defined(CONFIG_ARC_MMU_V3) || defined (CONFIG_ARC_MMU_V4)
+#if defined(CONFIG_ARC_MMU_V3)
 #define ARC_REG_DC_PTAG         0x5C
 #endif
 
diff --git a/arch/arc/include/uapi/asm/ptrace.h b/arch/arc/include/uapi/asm/ptrace.h
index 2618cc13ba75..76a7739aab1c 100644
--- a/arch/arc/include/uapi/asm/ptrace.h
+++ b/arch/arc/include/uapi/asm/ptrace.h
@@ -11,6 +11,7 @@
 #ifndef _UAPI__ASM_ARC_PTRACE_H
 #define _UAPI__ASM_ARC_PTRACE_H
 
+#define PTRACE_GET_THREAD_AREA  25
 
 #ifndef __ASSEMBLY__
 /*
diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S
index 2ff0347a2fd7..e248594097e7 100644
--- a/arch/arc/kernel/ctx_sw_asm.S
+++ b/arch/arc/kernel/ctx_sw_asm.S
@@ -10,9 +10,9 @@
  *  -This is the more "natural" hand written assembler
  */
 
+#include <linux/linkage.h>
 #include <asm/entry.h>       /* For the SAVE_* macros */
 #include <asm/asm-offsets.h>
-#include <asm/linkage.h>
 
 #define KSP_WORD_OFF    ((TASK_THREAD + THREAD_KSP) / 4)
 
diff --git a/arch/arc/kernel/devtree.c b/arch/arc/kernel/devtree.c
index 0b3ef4025d89..fffdb5e41b20 100644
--- a/arch/arc/kernel/devtree.c
+++ b/arch/arc/kernel/devtree.c
@@ -41,7 +41,7 @@ const struct machine_desc * __init setup_machine_fdt(void *dt)
 {
         const struct machine_desc *mdesc;
         unsigned long dt_root;
-        void *clk;
+        const void *clk;
         int len;
 
         if (!early_init_dt_scan(dt))
diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
index 07a58f2d3077..4d2481bd8b98 100644
--- a/arch/arc/kernel/head.S
+++ b/arch/arc/kernel/head.S
@@ -77,10 +77,11 @@ stext:
         ; Clear BSS before updating any globals
         ; XXX: use ZOL here
         mov     r5, __bss_start
-        mov     r6, __bss_stop
+        sub     r6, __bss_stop, r5
+        lsr.f   lp_count, r6, 2
+        lpnz    1f
+        st.ab   0, [r5, 4]
 1:
-        st.ab   0, [r5,4]
-        brlt    r5, r6, 1b
 
         ; Uboot - kernel ABI
         ;    r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2
diff --git a/arch/arc/kernel/ptrace.c b/arch/arc/kernel/ptrace.c
index 5d76706139dd..13b3ffb27a38 100644
--- a/arch/arc/kernel/ptrace.c
+++ b/arch/arc/kernel/ptrace.c
@@ -146,6 +146,10 @@ long arch_ptrace(struct task_struct *child, long request,
         pr_debug("REQ=%ld: ADDR =0x%lx, DATA=0x%lx)\n", request, addr, data);
 
         switch (request) {
+        case PTRACE_GET_THREAD_AREA:
+                ret = put_user(task_thread_info(child)->thr_ptr,
+                               (unsigned long __user *)data);
+                break;
         default:
                 ret = ptrace_request(child, request, addr, data);
                 break;
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index cf90b6f4d3e0..c802bb500602 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -337,8 +337,19 @@ irqreturn_t do_IPI(int irq, void *dev_id)
  * API called by platform code to hookup arch-common ISR to their IPI IRQ
  */
 static DEFINE_PER_CPU(int, ipi_dev);
+
+static struct irqaction arc_ipi_irq = {
+        .name    = "IPI Interrupt",
+        .flags   = IRQF_PERCPU,
+        .handler = do_IPI,
+};
+
 int smp_ipi_irq_setup(int cpu, int irq)
 {
-        int *dev_id = &per_cpu(ipi_dev, smp_processor_id());
-        return request_percpu_irq(irq, do_IPI, "IPI Interrupt", dev_id);
+        if (!cpu)
+                return setup_irq(irq, &arc_ipi_irq);
+        else
+                arch_unmask_irq(irq);
+
+        return 0;
 }
diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S
index 2555f5886af6..dd35bde39f69 100644
--- a/arch/arc/kernel/vmlinux.lds.S
+++ b/arch/arc/kernel/vmlinux.lds.S
@@ -116,7 +116,7 @@ SECTIONS
 
         _edata = .;
 
-        BSS_SECTION(0, 0, 0)
+        BSS_SECTION(4, 4, 4)
 
 #ifdef CONFIG_ARC_DW2_UNWIND
         . = ALIGN(PAGE_SIZE);
diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c
index 1f676c4794e0..353b202c37c9 100644
--- a/arch/arc/mm/cache_arc700.c
+++ b/arch/arc/mm/cache_arc700.c
@@ -389,7 +389,7 @@ static inline void __dc_line_op(unsigned long paddr, unsigned long vaddr,
 /***********************************************************
  * Machine specific helper for per line I-Cache invalidate.
  */
-static void __ic_line_inv_vaddr(unsigned long paddr, unsigned long vaddr,
+static void __ic_line_inv_vaddr_local(unsigned long paddr, unsigned long vaddr,
                                 unsigned long sz)
 {
         unsigned long flags;
@@ -405,6 +405,23 @@ static inline void __ic_entire_inv(void)
         read_aux_reg(ARC_REG_IC_CTRL);  /* blocks */
 }
 
+struct ic_line_inv_vaddr_ipi {
+        unsigned long paddr, vaddr;
+        int sz;
+};
+
+static void __ic_line_inv_vaddr_helper(void *info)
+{
+        struct ic_line_inv_vaddr_ipi *ic_inv = (struct ic_line_inv_vaddr_ipi*) info;
+        __ic_line_inv_vaddr_local(ic_inv->paddr, ic_inv->vaddr, ic_inv->sz);
+}
+
+static void __ic_line_inv_vaddr(unsigned long paddr, unsigned long vaddr,
+                                unsigned long sz)
+{
+        struct ic_line_inv_vaddr_ipi ic_inv = { paddr, vaddr , sz};
+        on_each_cpu(__ic_line_inv_vaddr_helper, &ic_inv, 1);
+}
 #else
 
 #define __ic_entire_inv()
@@ -553,12 +570,8 @@ void flush_icache_range(unsigned long kstart, unsigned long kend)
  */
 void __sync_icache_dcache(unsigned long paddr, unsigned long vaddr, int len)
 {
-        unsigned long flags;
-
-        local_irq_save(flags);
-        __ic_line_inv_vaddr(paddr, vaddr, len);
         __dc_line_op(paddr, vaddr, len, OP_FLUSH_N_INV);
-        local_irq_restore(flags);
+        __ic_line_inv_vaddr(paddr, vaddr, len);
 }
 
 /* wrapper to compile time eliminate alignment checks in flush loop */
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 7a14af6e3d2c..75b3b721347c 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -262,8 +262,22 @@ config NEED_MACH_MEMORY_H
 
 config PHYS_OFFSET
         hex "Physical address of main memory" if MMU
-        depends on !ARM_PATCH_PHYS_VIRT && !NEED_MACH_MEMORY_H
+        depends on !ARM_PATCH_PHYS_VIRT
         default DRAM_BASE if !MMU
+        default 0x00000000 if ARCH_EBSA110 || \
+                        EP93XX_SDCE3_SYNC_PHYS_OFFSET || \
+                        ARCH_FOOTBRIDGE || \
+                        ARCH_INTEGRATOR || \
+                        ARCH_IOP13XX || \
+                        ARCH_KS8695 || \
+                        (ARCH_REALVIEW && !REALVIEW_HIGH_PHYS_OFFSET)
+        default 0x10000000 if ARCH_OMAP1 || ARCH_RPC
+        default 0x20000000 if ARCH_S5PV210
+        default 0x70000000 if REALVIEW_HIGH_PHYS_OFFSET
+        default 0xc0000000 if EP93XX_SDCE0_PHYS_OFFSET || ARCH_SA1100
+        default 0xd0000000 if EP93XX_SDCE1_PHYS_OFFSET
+        default 0xe0000000 if EP93XX_SDCE2_PHYS_OFFSET
+        default 0xf0000000 if EP93XX_SDCE3_ASYNC_PHYS_OFFSET
         help
           Please provide the physical address corresponding to the
           location of main memory in your system.
@@ -435,7 +449,6 @@ config ARCH_EP93XX
         select ARM_VIC
         select CLKDEV_LOOKUP
         select CPU_ARM920T
-        select NEED_MACH_MEMORY_H
         help
           This enables support for the Cirrus EP93xx series of CPUs.
 
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 6721fab13734..718913dfe815 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -127,6 +127,9 @@ CHECKFLAGS	+= -D__arm__
 
 #Default value
 head-y          := arch/arm/kernel/head$(MMUEXT).o
+
+# Text offset. This list is sorted numerically by address in order to
+# provide a means to avoid/resolve conflicts in multi-arch kernels.
 textofs-y       := 0x00008000
 textofs-$(CONFIG_ARCH_CLPS711X) := 0x00028000
 # We don't want the htc bootloader to corrupt kernel during resume
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 68c918362b79..76a50ecae1c3 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -81,7 +81,7 @@ ZTEXTADDR	:= 0
 ZBSSADDR        := ALIGN(8)
 endif
 
-SEDFLAGS        = s/TEXT_START/$(ZTEXTADDR)/;s/BSS_START/$(ZBSSADDR)/
+CPPFLAGS_vmlinux.lds := -DTEXT_START="$(ZTEXTADDR)" -DBSS_START="$(ZBSSADDR)"
 
 suffix_$(CONFIG_KERNEL_GZIP) = gzip
 suffix_$(CONFIG_KERNEL_LZO)  = lzo
@@ -199,8 +199,5 @@ CFLAGS_font.o := -Dstatic=
 $(obj)/font.c: $(FONTC)
         $(call cmd,shipped)
 
-$(obj)/vmlinux.lds: $(obj)/vmlinux.lds.in arch/arm/boot/Makefile $(KCONFIG_CONFIG)
-        @sed "$(SEDFLAGS)" < $< > $@
-
 $(obj)/hyp-stub.S: $(srctree)/arch/$(SRCARCH)/kernel/hyp-stub.S
         $(call cmd,shipped)
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 3a8b32df6b31..413fd94b5301 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -125,9 +125,11 @@ start:
  THUMB(         adr     r12, BSYM(1f)   )
  THUMB(         bx      r12             )
 
-                .word   0x016f2818              @ Magic numbers to help the loader
-                .word   start                   @ absolute load/run zImage address
-                .word   _edata                  @ zImage end address
+                .word   _magic_sig      @ Magic numbers to help the loader
+                .word   _magic_start    @ absolute load/run zImage address
+                .word   _magic_end      @ zImage end address
+                .word   0x04030201      @ endianness flag
+
  THUMB(         .thumb                  )
 1:
  ARM_BE8(       setend  be )                    @ go BE8 if compiled for BE8
diff --git a/arch/arm/boot/compressed/vmlinux.lds.in b/arch/arm/boot/compressed/vmlinux.lds.S
index 4919f2ac8b89..2b60b843ac5e 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.in
+++ b/arch/arm/boot/compressed/vmlinux.lds.S
@@ -1,12 +1,20 @@
 /*
- *  linux/arch/arm/boot/compressed/vmlinux.lds.in
- *
  *  Copyright (C) 2000 Russell King
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+
+#ifdef CONFIG_CPU_ENDIAN_BE8
+#define ZIMAGE_MAGIC(x) ( (((x) >> 24) & 0x000000ff) | \
+                          (((x) >>  8) & 0x0000ff00) | \
+                          (((x) <<  8) & 0x00ff0000) | \
+                          (((x) << 24) & 0xff000000) )
+#else
+#define ZIMAGE_MAGIC(x) (x)
+#endif
+
 OUTPUT_ARCH(arm)
 ENTRY(_start)
 SECTIONS
@@ -57,6 +65,10 @@ SECTIONS
   .pad                  : { BYTE(0); . = ALIGN(8); }
   _edata = .;
 
+  _magic_sig = ZIMAGE_MAGIC(0x016f2818);
+  _magic_start = ZIMAGE_MAGIC(_start);
+  _magic_end = ZIMAGE_MAGIC(_edata);
+
   . = BSS_START;
   __bss_start = .;
   .bss                  : { *(.bss) }
@@ -73,4 +85,3 @@ SECTIONS
   .stab.indexstr 0      : { *(.stab.indexstr) }
   .comment 0            : { *(.comment) }
 }
-
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 5986ff63b901..adb5ed9e269e 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -357,7 +357,7 @@ dtb-$(CONFIG_ARCH_STI)+= stih407-b2120.dtb \
         stih415-b2020.dtb \
         stih416-b2000.dtb \
         stih416-b2020.dtb \
-        stih416-b2020-revE.dtb
+        stih416-b2020e.dtb
 dtb-$(CONFIG_MACH_SUN4I) += \
         sun4i-a10-a1000.dtb \
         sun4i-a10-cubieboard.dtb \
diff --git a/arch/arm/boot/dts/armada-380.dtsi b/arch/arm/boot/dts/armada-380.dtsi
index e69bc6759c39..4173a8ab34e7 100644
--- a/arch/arm/boot/dts/armada-380.dtsi
+++ b/arch/arm/boot/dts/armada-380.dtsi
@@ -16,7 +16,7 @@
 
 / {
         model = "Marvell Armada 380 family SoC";
-        compatible = "marvell,armada380", "marvell,armada38x";
+        compatible = "marvell,armada380";
 
         cpus {
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-385-db.dts b/arch/arm/boot/dts/armada-385-db.dts
index 5bae4731828b..1af886f1e486 100644
--- a/arch/arm/boot/dts/armada-385-db.dts
+++ b/arch/arm/boot/dts/armada-385-db.dts
@@ -16,7 +16,7 @@
 
 / {
         model = "Marvell Armada 385 Development Board";
-        compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada38x";
+        compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada380";
 
         chosen {
                 bootargs = "console=ttyS0,115200 earlyprintk";
diff --git a/arch/arm/boot/dts/armada-385-rd.dts b/arch/arm/boot/dts/armada-385-rd.dts
index 40893255a3f0..aaca2861dc87 100644
--- a/arch/arm/boot/dts/armada-385-rd.dts
+++ b/arch/arm/boot/dts/armada-385-rd.dts
@@ -17,7 +17,7 @@
 
 / {
         model = "Marvell Armada 385 Reference Design";
-        compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada38x";
+        compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
 
         chosen {
                 bootargs = "console=ttyS0,115200 earlyprintk";
diff --git a/arch/arm/boot/dts/armada-385.dtsi b/arch/arm/boot/dts/armada-385.dtsi
index f011009bf4cf..6283d7912f71 100644
--- a/arch/arm/boot/dts/armada-385.dtsi
+++ b/arch/arm/boot/dts/armada-385.dtsi
@@ -16,7 +16,7 @@
 
 / {
         model = "Marvell Armada 385 family SoC";
-        compatible = "marvell,armada385", "marvell,armada38x";
+        compatible = "marvell,armada385", "marvell,armada380";
 
         cpus {
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index 3de364e81b52..689fa1a46728 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -20,7 +20,7 @@
 
 / {
         model = "Marvell Armada 38x family SoC";
-        compatible = "marvell,armada38x";
+        compatible = "marvell,armada380";
 
         aliases {
                 gpio0 = &gpio0;
diff --git a/arch/arm/boot/dts/at91sam9261.dtsi b/arch/arm/boot/dts/at91sam9261.dtsi
index b309c1c6e848..04927db1d6bf 100644
--- a/arch/arm/boot/dts/at91sam9261.dtsi
+++ b/arch/arm/boot/dts/at91sam9261.dtsi
@@ -568,24 +568,17 @@
                                 #size-cells = <0>;
                                 #interrupt-cells = <1>;
 
-                                slow_rc_osc: slow_rc_osc {
-                                        compatible = "fixed-clock";
+                                main_osc: main_osc {
+                                        compatible = "atmel,at91rm9200-clk-main-osc";
                                         #clock-cells = <0>;
-                                        clock-frequency = <32768>;
-                                        clock-accuracy = <50000000>;
-                                };
-
-                                clk32k: slck {
-                                        compatible = "atmel,at91sam9260-clk-slow";
-                                        #clock-cells = <0>;
-                                        clocks = <&slow_rc_osc &slow_xtal>;
+                                        interrupts-extended = <&pmc AT91_PMC_MOSCS>;
+                                        clocks = <&main_xtal>;
                                 };
 
                                 main: mainck {
                                         compatible = "atmel,at91rm9200-clk-main";
                                         #clock-cells = <0>;
-                                        interrupts-extended = <&pmc AT91_PMC_MOSCS>;
-                                        clocks = <&main_xtal>;
+                                        clocks = <&main_osc>;
                                 };
 
                                 plla: pllack {
@@ -615,7 +608,7 @@
                                         compatible = "atmel,at91rm9200-clk-master";
                                         #clock-cells = <0>;
                                         interrupts-extended = <&pmc AT91_PMC_MCKRDY>;
-                                        clocks = <&clk32k>, <&main>, <&plla>, <&pllb>;
+                                        clocks = <&slow_xtal>, <&main>, <&plla>, <&pllb>;
                                         atmel,clk-output-range = <0 94000000>;
                                         atmel,clk-divisors = <1 2 4 0>;
                                 };
@@ -632,7 +625,7 @@
                                         #address-cells = <1>;
                                         #size-cells = <0>;
                                         interrupt-parent = <&pmc>;
-                                        clocks = <&clk32k>, <&main>, <&plla>, <&pllb>;
+                                        clocks = <&slow_xtal>, <&main>, <&plla>, <&pllb>;
 
                                         prog0: prog0 {
                                                 #clock-cells = <0>;
diff --git a/arch/arm/boot/dts/at91sam9261ek.dts b/arch/arm/boot/dts/at91sam9261ek.dts
index c6683ea8b743..aa35a7aec9a8 100644
--- a/arch/arm/boot/dts/at91sam9261ek.dts
+++ b/arch/arm/boot/dts/at91sam9261ek.dts
@@ -20,6 +20,10 @@
                 reg = <0x20000000 0x4000000>;
         };
 
+        slow_xtal {
+                clock-frequency = <32768>;
+        };
+
         main_xtal {
                 clock-frequency = <18432000>;
         };
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index d1b82e6635d5..287795985e32 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -132,8 +132,8 @@
                                                                       <595000000 650000000 3 0>,
                                                                       <545000000 600000000 0 1>,
                                                                       <495000000 555000000 1 1>,
-                                                                      <445000000 500000000 1 2>,
-                                                                      <400000000 450000000 1 3>;
+                                                                      <445000000 500000000 2 1>,
+                                                                      <400000000 450000000 3 1>;
                                 };
 
                                 plladiv: plladivck {
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 1a57298636a5..d6133f497207 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -140,8 +140,8 @@
                                                                        595000000 650000000 3 0
                                                                        545000000 600000000 0 1
                                                                        495000000 555000000 1 1
-                                                                       445000000 500000000 1 2
-                                                                       400000000 450000000 1 3>;
+                                                                       445000000 500000000 2 1
+                                                                       400000000 450000000 3 1>;
                                 };
 
                                 plladiv: plladivck {
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index b8ece4be41ca..fbaf426d2daa 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -113,7 +113,7 @@
                 compatible = "arm,cortex-a9-gic";
                 #interrupt-cells = <3>;
                 interrupt-controller;
-                reg = <0x10490000 0x1000>, <0x10480000 0x100>;
+                reg = <0x10490000 0x10000>, <0x10480000 0x10000>;
         };
 
         combiner: interrupt-controller@10440000 {
diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
index 6bc3243a80d3..181d77fa2fa6 100644
--- a/arch/arm/boot/dts/imx51-babbage.dts
+++ b/arch/arm/boot/dts/imx51-babbage.dts
@@ -315,15 +315,15 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
-        fsl,cd-controller;
-        fsl,wp-controller;
+        cd-gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 1 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
 &esdhc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc2>;
-        cd-gpios = <&gpio1 6 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
         wp-gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
@@ -468,8 +468,8 @@
                                 MX51_PAD_SD1_DATA1__SD1_DATA1           0x20d5
                                 MX51_PAD_SD1_DATA2__SD1_DATA2           0x20d5
                                 MX51_PAD_SD1_DATA3__SD1_DATA3           0x20d5
-                                MX51_PAD_GPIO1_0__SD1_CD                0x20d5
-                                MX51_PAD_GPIO1_1__SD1_WP                0x20d5
+                                MX51_PAD_GPIO1_0__GPIO1_0               0x100
+                                MX51_PAD_GPIO1_1__GPIO1_1               0x100
                         >;
                 };
 
diff --git a/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts b/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts
index 75e66c9c6144..31cfb7f2b02e 100644
--- a/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts
+++ b/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts
@@ -107,7 +107,7 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1 &pinctrl_esdhc1_cd>;
-        fsl,cd-controller;
+        cd-gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
@@ -206,7 +206,7 @@
 
                 pinctrl_esdhc1_cd: esdhc1_cd {
                         fsl,pins = <
-                                MX51_PAD_GPIO1_0__SD1_CD 0x20d5
+                                MX51_PAD_GPIO1_0__GPIO1_0 0xd5
                         >;
                 };
 
diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
index d5d146a8b149..c4956b0ffb35 100644
--- a/arch/arm/boot/dts/imx53-m53evk.dts
+++ b/arch/arm/boot/dts/imx53-m53evk.dts
@@ -21,27 +21,25 @@
                       <0xb0000000 0x20000000>;
         };
 
-        soc {
-                display1: display@di1 {
-                        compatible = "fsl,imx-parallel-display";
-                        interface-pix-fmt = "bgr666";
-                        pinctrl-names = "default";
-                        pinctrl-0 = <&pinctrl_ipu_disp1>;
-
-                        display-timings {
-                                800x480p60 {
-                                        native-mode;
-                                        clock-frequency = <31500000>;
-                                        hactive = <800>;
-                                        vactive = <480>;
-                                        hfront-porch = <40>;
-                                        hback-porch = <88>;
-                                        hsync-len = <128>;
-                                        vback-porch = <33>;
-                                        vfront-porch = <9>;
-                                        vsync-len = <3>;
-                                        vsync-active = <1>;
-                                };
+        display1: display@di1 {
+                compatible = "fsl,imx-parallel-display";
+                interface-pix-fmt = "bgr666";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_ipu_disp1>;
+
+                display-timings {
+                        800x480p60 {
+                                native-mode;
+                                clock-frequency = <31500000>;
+                                hactive = <800>;
+                                vactive = <480>;
+                                hfront-porch = <40>;
+                                hback-porch = <88>;
+                                hsync-len = <128>;
+                                vback-porch = <33>;
+                                vfront-porch = <9>;
+                                vsync-len = <3>;
+                                vsync-active = <1>;
                         };
                 };
 
diff --git a/arch/arm/boot/dts/imx6dl-hummingboard.dts b/arch/arm/boot/dts/imx6dl-hummingboard.dts
index 5373a5f2782b..c8e51dd41b8f 100644
--- a/arch/arm/boot/dts/imx6dl-hummingboard.dts
+++ b/arch/arm/boot/dts/imx6dl-hummingboard.dts
@@ -143,6 +143,14 @@
                         fsl,pins = <MX6QDL_PAD_GPIO_0__GPIO1_IO00 0x1b0b0>;
                 };
 
+                pinctrl_hummingboard_usbotg_id: hummingboard-usbotg-id {
+                        /*
+                         * Similar to pinctrl_usbotg_2, but we want it
+                         * pulled down for a fixed host connection.
+                         */
+                        fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
+                };
+
                 pinctrl_hummingboard_usbotg_vbus: hummingboard-usbotg-vbus {
                         fsl,pins = <MX6QDL_PAD_EIM_D22__GPIO3_IO22 0x1b0b0>;
                 };
@@ -178,6 +186,8 @@
 };
 
 &usbotg {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_hummingboard_usbotg_id>;
         vbus-supply = <&reg_usbotg_vbus>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6q-gw51xx.dts b/arch/arm/boot/dts/imx6q-gw51xx.dts
index af4929aee075..0e1406e58eff 100644
--- a/arch/arm/boot/dts/imx6q-gw51xx.dts
+++ b/arch/arm/boot/dts/imx6q-gw51xx.dts
@@ -11,7 +11,7 @@
 
 /dts-v1/;
 #include "imx6q.dtsi"
-#include "imx6qdl-gw54xx.dtsi"
+#include "imx6qdl-gw51xx.dtsi"
 
 / {
         model = "Gateworks Ventana i.MX6 Quad GW51XX";
diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
index 25da82a03110..e8e781656b3f 100644
--- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
@@ -12,6 +12,19 @@
                 pinctrl-0 = <&pinctrl_cubox_i_ir>;
         };
 
+        pwmleds {
+                compatible = "pwm-leds";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_cubox_i_pwm1>;
+
+                front {
+                        active-low;
+                        label = "imx6:red:front";
+                        max-brightness = <248>;
+                        pwms = <&pwm1 0 50000>;
+                };
+        };
+
         regulators {
                 compatible = "simple-bus";
 
@@ -109,6 +122,10 @@
                         >;
                 };
 
+                pinctrl_cubox_i_pwm1: cubox-i-pwm1-front-led {
+                        fsl,pins = <MX6QDL_PAD_DISP0_DAT8__PWM1_OUT 0x1b0b0>;
+                };
+
                 pinctrl_cubox_i_spdif: cubox-i-spdif {
                         fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x13091>;
                 };
@@ -117,6 +134,14 @@
                         fsl,pins = <MX6QDL_PAD_GPIO_0__GPIO1_IO00 0x4001b0b0>;
                 };
 
+                pinctrl_cubox_i_usbotg_id: cubox-i-usbotg-id {
+                        /*
+                         * The Cubox-i pulls this low, but as it's pointless
+                         * leaving it as a pull-up, even if it is just 10uA.
+                         */
+                        fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
+                };
+
                 pinctrl_cubox_i_usbotg_vbus: cubox-i-usbotg-vbus {
                         fsl,pins = <MX6QDL_PAD_EIM_D22__GPIO3_IO22 0x4001b0b0>;
                 };
@@ -153,6 +178,8 @@
 };
 
 &usbotg {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_cubox_i_usbotg_id>;
         vbus-supply = <&reg_usbotg_vbus>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
index 31665adcbf39..0db15af41cb1 100644
--- a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
@@ -161,7 +161,7 @@
         status = "okay";
 
         pmic: ltc3676@3c {
-                compatible = "ltc,ltc3676";
+                compatible = "lltc,ltc3676";
                 reg = <0x3c>;
 
                 regulators {
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index 367af3ec9435..744c8a2d81f6 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -220,7 +220,7 @@
         };
 
         pmic: ltc3676@3c {
-                compatible = "ltc,ltc3676";
+                compatible = "lltc,ltc3676";
                 reg = <0x3c>;
 
                 regulators {
@@ -288,7 +288,7 @@
         codec: sgtl5000@0a {
                 compatible = "fsl,sgtl5000";
                 reg = <0x0a>;
-                clocks = <&clks 169>;
+                clocks = <&clks 201>;
                 VDDA-supply = <&reg_1p8v>;
                 VDDIO-supply = <&reg_3p3v>;
         };
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index c91b5a6c769b..adf150c1be90 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -234,7 +234,7 @@
         };
 
         pmic: ltc3676@3c {
-                compatible = "ltc,ltc3676";
+                compatible = "lltc,ltc3676";
                 reg = <0x3c>;
 
                 regulators {
diff --git a/arch/arm/boot/dts/imx6qdl-microsom.dtsi b/arch/arm/boot/dts/imx6qdl-microsom.dtsi
index d729d0b15f25..79eac6849d4c 100644
--- a/arch/arm/boot/dts/imx6qdl-microsom.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-microsom.dtsi
@@ -10,14 +10,6 @@
                                 MX6QDL_PAD_CSI0_DAT11__UART1_RX_DATA    0x1b0b1
                         >;
                 };
-
-                pinctrl_microsom_usbotg: microsom-usbotg {
-                        /*
-                         * Similar to pinctrl_usbotg_2, but we want it
-                         * pulled down for a fixed host connection.
-                         */
-                        fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
-                };
         };
 };
 
@@ -26,8 +18,3 @@
         pinctrl-0 = <&pinctrl_microsom_uart1>;
         status = "okay";
 };
-
-&usbotg {
-        pinctrl-names = "default";
-        pinctrl-0 = <&pinctrl_microsom_usbotg>;
-};
diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
index 2d4e5285f3f3..57d4abe03a94 100644
--- a/arch/arm/boot/dts/imx6sl.dtsi
+++ b/arch/arm/boot/dts/imx6sl.dtsi
@@ -686,7 +686,7 @@
                                 compatible = "fsl,imx6sl-fec", "fsl,imx25-fec";
                                 reg = <0x02188000 0x4000>;
                                 interrupts = <0 114 IRQ_TYPE_LEVEL_HIGH>;
-                                clocks = <&clks IMX6SL_CLK_ENET_REF>,
+                                clocks = <&clks IMX6SL_CLK_ENET>,
                                          <&clks IMX6SL_CLK_ENET_REF>;
                                 clock-names = "ipg", "ahb";
                                 status = "disabled";
diff --git a/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts b/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts
index c5a1fc75c7a3..b2d9834bf458 100644
--- a/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts
+++ b/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts
@@ -105,7 +105,6 @@
                 compatible = "ethernet-phy-id0141.0cb0",
                              "ethernet-phy-ieee802.3-c22";
                 reg = <0>;
-                phy-connection-type = "rgmii-id";
         };
 
         ethphy1: ethernet-phy@1 {
@@ -113,7 +112,6 @@
                 compatible = "ethernet-phy-id0141.0cb0",
                              "ethernet-phy-ieee802.3-c22";
                 reg = <1>;
-                phy-connection-type = "rgmii-id";
         };
 };
 
@@ -121,6 +119,7 @@
         status = "okay";
         ethernet0-port@0 {
                 phy-handle = <&ethphy0>;
+                phy-connection-type = "rgmii-id";
         };
 };
 
@@ -128,5 +127,6 @@
         status = "okay";
         ethernet1-port@0 {
                 phy-handle = <&ethphy1>;
+                phy-connection-type = "rgmii-id";
         };
 };
diff --git a/arch/arm/boot/dts/stih415.dtsi b/arch/arm/boot/dts/stih415.dtsi
index d6f254f302fe..a0f6f75fe3b5 100644
--- a/arch/arm/boot/dts/stih415.dtsi
+++ b/arch/arm/boot/dts/stih415.dtsi
@@ -169,8 +169,8 @@
 
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii0>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a1_ls CLK_GMAC0_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a1_ls CLK_ICN_IF_2>, <&clk_s_a1_ls CLK_GMAC0_PHY>;
                 };
 
                 ethernet1: dwmac@fef08000 {
@@ -192,8 +192,8 @@
                         reset-names             = "stmmaceth";
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii1>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a0_ls CLK_ETH1_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a0_ls CLK_ICN_REG>, <&clk_s_a0_ls CLK_ETH1_PHY>;
                 };
 
                 rc: rc@fe518000 {
diff --git a/arch/arm/boot/dts/stih416-b2020-revE.dts b/arch/arm/boot/dts/stih416-b2020e.dts
index ba0fa2caaf18..ba0fa2caaf18 100644
--- a/arch/arm/boot/dts/stih416-b2020-revE.dts
+++ b/arch/arm/boot/dts/stih416-b2020e.dts
diff --git a/arch/arm/boot/dts/stih416.dtsi b/arch/arm/boot/dts/stih416.dtsi
index 06473c5d9ea9..84758d76d064 100644
--- a/arch/arm/boot/dts/stih416.dtsi
+++ b/arch/arm/boot/dts/stih416.dtsi
@@ -175,8 +175,8 @@
                         reset-names             = "stmmaceth";
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii0>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a1_ls CLK_GMAC0_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a1_ls CLK_ICN_IF_2>, <&clk_s_a1_ls CLK_GMAC0_PHY>;
                 };
 
                 ethernet1: dwmac@fef08000 {
@@ -197,8 +197,8 @@
                         reset-names     = "stmmaceth";
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii1>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a0_ls CLK_ETH1_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a0_ls CLK_ICN_REG>, <&clk_s_a0_ls CLK_ETH1_PHY>;
                 };
 
                 rc: rc@fe518000 {
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index f91136ab447e..3c165fc2dce2 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -12,11 +12,13 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/irqflags.h>
+#include <linux/cpu_pm.h>
 
 #include <asm/mcpm.h>
 #include <asm/cacheflush.h>
 #include <asm/idmap.h>
 #include <asm/cputype.h>
+#include <asm/suspend.h>
 
 extern unsigned long mcpm_entry_vectors[MAX_NR_CLUSTERS][MAX_CPUS_PER_CLUSTER];
 
@@ -146,6 +148,56 @@ int mcpm_cpu_powered_up(void)
         return 0;
 }
 
+#ifdef CONFIG_ARM_CPU_SUSPEND
+
+static int __init nocache_trampoline(unsigned long _arg)
+{
+        void (*cache_disable)(void) = (void *)_arg;
+        unsigned int mpidr = read_cpuid_mpidr();
+        unsigned int cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+        unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
+        phys_reset_t phys_reset;
+
+        mcpm_set_entry_vector(cpu, cluster, cpu_resume);
+        setup_mm_for_reboot();
+
+        __mcpm_cpu_going_down(cpu, cluster);
+        BUG_ON(!__mcpm_outbound_enter_critical(cpu, cluster));
+        cache_disable();
+        __mcpm_outbound_leave_critical(cluster, CLUSTER_DOWN);
+        __mcpm_cpu_down(cpu, cluster);
+
+        phys_reset = (phys_reset_t)(unsigned long)virt_to_phys(cpu_reset);
+        phys_reset(virt_to_phys(mcpm_entry_point));
+        BUG();
+}
+
+int __init mcpm_loopback(void (*cache_disable)(void))
+{
+        int ret;
+
+        /*
+         * We're going to soft-restart the current CPU through the
+         * low-level MCPM code by leveraging the suspend/resume
+         * infrastructure. Let's play it safe by using cpu_pm_enter()
+         * in case the CPU init code path resets the VFP or similar.
+         */
+        local_irq_disable();
+        local_fiq_disable();
+        ret = cpu_pm_enter();
+        if (!ret) {
+                ret = cpu_suspend((unsigned long)cache_disable, nocache_trampoline);
+                cpu_pm_exit();
+        }
+        local_fiq_enable();
+        local_irq_enable();
+        if (ret)
+                pr_err("%s returned %d\n", __func__, ret);
+        return ret;
+}
+
+#endif
+
 struct sync_struct mcpm_sync;
 
 /*
diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index ef8815327e5b..59b7e45142d8 100644
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -186,6 +186,7 @@ CONFIG_VIDEO_MX3=y
 CONFIG_V4L_MEM2MEM_DRIVERS=y
 CONFIG_VIDEO_CODA=y
 CONFIG_SOC_CAMERA_OV2640=y
+CONFIG_IMX_IPUV3_CORE=y
 CONFIG_DRM=y
 CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 17d9462b9fb9..be1a3455a9fe 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -353,6 +353,7 @@ CONFIG_MFD_NVEC=y
 CONFIG_KEYBOARD_NVEC=y
 CONFIG_SERIO_NVEC_PS2=y
 CONFIG_NVEC_POWER=y
+CONFIG_QCOM_GSBI=y
 CONFIG_COMMON_CLK_QCOM=y
 CONFIG_MSM_GCC_8660=y
 CONFIG_MSM_MMCC_8960=y
diff --git a/arch/arm/configs/mvebu_v7_defconfig b/arch/arm/configs/mvebu_v7_defconfig
index e11170e37442..b0bfefa23902 100644
--- a/arch/arm/configs/mvebu_v7_defconfig
+++ b/arch/arm/configs/mvebu_v7_defconfig
@@ -14,6 +14,7 @@ CONFIG_MACH_ARMADA_370=y
 CONFIG_MACH_ARMADA_375=y
 CONFIG_MACH_ARMADA_38X=y
 CONFIG_MACH_ARMADA_XP=y
+CONFIG_MACH_DOVE=y
 CONFIG_NEON=y
 # CONFIG_CACHE_L2X0 is not set
 # CONFIG_SWP_EMULATE is not set
@@ -52,6 +53,7 @@ CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_I2C=y
 CONFIG_SPI=y
 CONFIG_SPI_ORION=y
diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile
index 81cda39860c5..b48fa341648d 100644
--- a/arch/arm/crypto/Makefile
+++ b/arch/arm/crypto/Makefile
@@ -5,10 +5,14 @@
 obj-$(CONFIG_CRYPTO_AES_ARM) += aes-arm.o
 obj-$(CONFIG_CRYPTO_AES_ARM_BS) += aes-arm-bs.o
 obj-$(CONFIG_CRYPTO_SHA1_ARM) += sha1-arm.o
+obj-$(CONFIG_CRYPTO_SHA1_ARM_NEON) += sha1-arm-neon.o
+obj-$(CONFIG_CRYPTO_SHA512_ARM_NEON) += sha512-arm-neon.o
 
 aes-arm-y       := aes-armv4.o aes_glue.o
 aes-arm-bs-y    := aesbs-core.o aesbs-glue.o
 sha1-arm-y      := sha1-armv4-large.o sha1_glue.o
+sha1-arm-neon-y := sha1-armv7-neon.o sha1_neon_glue.o
+sha512-arm-neon-y := sha512-armv7-neon.o sha512_neon_glue.o
 
 quiet_cmd_perl = PERL    $@
       cmd_perl = $(PERL) $(<) > $(@)
diff --git a/arch/arm/crypto/aes-armv4.S b/arch/arm/crypto/aes-armv4.S
index 3a14ea8fe97e..ebb9761fb572 100644
--- a/arch/arm/crypto/aes-armv4.S
+++ b/arch/arm/crypto/aes-armv4.S
@@ -35,6 +35,7 @@
 @ that is being targetted.
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 
 .text
 
@@ -648,7 +649,7 @@ _armv4_AES_set_encrypt_key:
 
 .Ldone: mov     r0,#0
         ldmia   sp!,{r4-r12,lr}
-.Labrt: mov     pc,lr
+.Labrt: ret     lr
 ENDPROC(private_AES_set_encrypt_key)
 
 .align  5
diff --git a/arch/arm/crypto/sha1-armv7-neon.S b/arch/arm/crypto/sha1-armv7-neon.S
new file mode 100644
index 000000000000..50013c0e2864
--- /dev/null
+++ b/arch/arm/crypto/sha1-armv7-neon.S
@@ -0,0 +1,634 @@
+/* sha1-armv7-neon.S - ARM/NEON accelerated SHA-1 transform function
+ *
+ * Copyright © 2013-2014 Jussi Kivilinna <jussi.kivilinna@iki.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include <linux/linkage.h>
+
+
+.syntax unified
+.code   32
+.fpu neon
+
+.text
+
+
+/* Context structure */
+
+#define state_h0 0
+#define state_h1 4
+#define state_h2 8
+#define state_h3 12
+#define state_h4 16
+
+
+/* Constants */
+
+#define K1  0x5A827999
+#define K2  0x6ED9EBA1
+#define K3  0x8F1BBCDC
+#define K4  0xCA62C1D6
+.align 4
+.LK_VEC:
+.LK1:   .long K1, K1, K1, K1
+.LK2:   .long K2, K2, K2, K2
+.LK3:   .long K3, K3, K3, K3
+.LK4:   .long K4, K4, K4, K4
+
+
+/* Register macros */
+
+#define RSTATE r0
+#define RDATA r1
+#define RNBLKS r2
+#define ROLDSTACK r3
+#define RWK lr
+
+#define _a r4
+#define _b r5
+#define _c r6
+#define _d r7
+#define _e r8
+
+#define RT0 r9
+#define RT1 r10
+#define RT2 r11
+#define RT3 r12
+
+#define W0 q0
+#define W1 q1
+#define W2 q2
+#define W3 q3
+#define W4 q4
+#define W5 q5
+#define W6 q6
+#define W7 q7
+
+#define tmp0 q8
+#define tmp1 q9
+#define tmp2 q10
+#define tmp3 q11
+
+#define qK1 q12
+#define qK2 q13
+#define qK3 q14
+#define qK4 q15
+
+
+/* Round function macros. */
+
+#define WK_offs(i) (((i) & 15) * 4)
+
+#define _R_F1(a,b,c,d,e,i,pre1,pre2,pre3,i16,\
+              W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        ldr RT3, [sp, WK_offs(i)]; \
+                pre1(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        bic RT0, d, b; \
+        add e, e, a, ror #(32 - 5); \
+        and RT1, c, b; \
+                pre2(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        add RT0, RT0, RT3; \
+        add e, e, RT1; \
+        ror b, #(32 - 30); \
+                pre3(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        add e, e, RT0;
+
+#define _R_F2(a,b,c,d,e,i,pre1,pre2,pre3,i16,\
+              W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        ldr RT3, [sp, WK_offs(i)]; \
+                pre1(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        eor RT0, d, b; \
+        add e, e, a, ror #(32 - 5); \
+        eor RT0, RT0, c; \
+                pre2(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        add e, e, RT3; \
+        ror b, #(32 - 30); \
+                pre3(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        add e, e, RT0; \
+
+#define _R_F3(a,b,c,d,e,i,pre1,pre2,pre3,i16,\
+              W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        ldr RT3, [sp, WK_offs(i)]; \
+                pre1(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        eor RT0, b, c; \
+        and RT1, b, c; \
+        add e, e, a, ror #(32 - 5); \
+                pre2(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        and RT0, RT0, d; \
+        add RT1, RT1, RT3; \
+        add e, e, RT0; \
+        ror b, #(32 - 30); \
+                pre3(i16,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28); \
+        add e, e, RT1;
+
+#define _R_F4(a,b,c,d,e,i,pre1,pre2,pre3,i16,\
+              W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        _R_F2(a,b,c,d,e,i,pre1,pre2,pre3,i16,\
+              W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28)
+
+#define _R(a,b,c,d,e,f,i,pre1,pre2,pre3,i16,\
+           W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        _R_##f(a,b,c,d,e,i,pre1,pre2,pre3,i16,\
+               W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28)
+
+#define R(a,b,c,d,e,f,i) \
+        _R_##f(a,b,c,d,e,i,dummy,dummy,dummy,i16,\
+               W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28)
+
+#define dummy(...)
+
+
+/* Input expansion macros. */
+
+/********* Precalc macros for rounds 0-15 *************************************/
+
+#define W_PRECALC_00_15() \
+        add       RWK, sp, #(WK_offs(0));                       \
+        \
+        vld1.32   {tmp0, tmp1}, [RDATA]!;                       \
+        vrev32.8  W0, tmp0;             /* big => little */     \
+        vld1.32   {tmp2, tmp3}, [RDATA]!;                       \
+        vadd.u32  tmp0, W0, curK;                               \
+        vrev32.8  W7, tmp1;             /* big => little */     \
+        vrev32.8  W6, tmp2;             /* big => little */     \
+        vadd.u32  tmp1, W7, curK;                               \
+        vrev32.8  W5, tmp3;             /* big => little */     \
+        vadd.u32  tmp2, W6, curK;                               \
+        vst1.32   {tmp0, tmp1}, [RWK]!;                         \
+        vadd.u32  tmp3, W5, curK;                               \
+        vst1.32   {tmp2, tmp3}, [RWK];                          \
+
+#define WPRECALC_00_15_0(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vld1.32   {tmp0, tmp1}, [RDATA]!;                       \
+
+#define WPRECALC_00_15_1(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        add       RWK, sp, #(WK_offs(0));                       \
+
+#define WPRECALC_00_15_2(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vrev32.8  W0, tmp0;             /* big => little */     \
+
+#define WPRECALC_00_15_3(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vld1.32   {tmp2, tmp3}, [RDATA]!;                       \
+
+#define WPRECALC_00_15_4(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vadd.u32  tmp0, W0, curK;                               \
+
+#define WPRECALC_00_15_5(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vrev32.8  W7, tmp1;             /* big => little */     \
+
+#define WPRECALC_00_15_6(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vrev32.8  W6, tmp2;             /* big => little */     \
+
+#define WPRECALC_00_15_7(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vadd.u32  tmp1, W7, curK;                               \
+
+#define WPRECALC_00_15_8(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vrev32.8  W5, tmp3;             /* big => little */     \
+
+#define WPRECALC_00_15_9(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vadd.u32  tmp2, W6, curK;                               \
+
+#define WPRECALC_00_15_10(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vst1.32   {tmp0, tmp1}, [RWK]!;                         \
+
+#define WPRECALC_00_15_11(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vadd.u32  tmp3, W5, curK;                               \
+
+#define WPRECALC_00_15_12(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vst1.32   {tmp2, tmp3}, [RWK];                          \
+
+
+/********* Precalc macros for rounds 16-31 ************************************/
+
+#define WPRECALC_16_31_0(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor      tmp0, tmp0;                   \
+        vext.8    W, W_m16, W_m12, #8;          \
+
+#define WPRECALC_16_31_1(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        add       RWK, sp, #(WK_offs(i));       \
+        vext.8    tmp0, W_m04, tmp0, #4;        \
+
+#define WPRECALC_16_31_2(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor      tmp0, tmp0, W_m16;            \
+        veor.32   W, W, W_m08;                  \
+
+#define WPRECALC_16_31_3(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor      tmp1, tmp1;                   \
+        veor      W, W, tmp0;                   \
+
+#define WPRECALC_16_31_4(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vshl.u32  tmp0, W, #1;                  \
+
+#define WPRECALC_16_31_5(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vext.8    tmp1, tmp1, W, #(16-12);      \
+        vshr.u32  W, W, #31;                    \
+
+#define WPRECALC_16_31_6(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vorr      tmp0, tmp0, W;                \
+        vshr.u32  W, tmp1, #30;                 \
+
+#define WPRECALC_16_31_7(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vshl.u32  tmp1, tmp1, #2;               \
+
+#define WPRECALC_16_31_8(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor      tmp0, tmp0, W;                \
+
+#define WPRECALC_16_31_9(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor      W, tmp0, tmp1;                \
+
+#define WPRECALC_16_31_10(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vadd.u32  tmp0, W, curK;                \
+
+#define WPRECALC_16_31_11(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vst1.32   {tmp0}, [RWK];
+
+
+/********* Precalc macros for rounds 32-79 ************************************/
+
+#define WPRECALC_32_79_0(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor W, W_m28; \
+
+#define WPRECALC_32_79_1(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vext.8 tmp0, W_m08, W_m04, #8; \
+
+#define WPRECALC_32_79_2(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor W, W_m16; \
+
+#define WPRECALC_32_79_3(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        veor W, tmp0; \
+
+#define WPRECALC_32_79_4(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        add RWK, sp, #(WK_offs(i&~3)); \
+
+#define WPRECALC_32_79_5(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vshl.u32 tmp1, W, #2; \
+
+#define WPRECALC_32_79_6(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vshr.u32 tmp0, W, #30; \
+
+#define WPRECALC_32_79_7(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vorr W, tmp0, tmp1; \
+
+#define WPRECALC_32_79_8(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vadd.u32 tmp0, W, curK; \
+
+#define WPRECALC_32_79_9(i,W,W_m04,W_m08,W_m12,W_m16,W_m20,W_m24,W_m28) \
+        vst1.32 {tmp0}, [RWK];
+
+
+/*
+ * Transform nblks*64 bytes (nblks*16 32-bit words) at DATA.
+ *
+ * unsigned int
+ * sha1_transform_neon (void *ctx, const unsigned char *data,
+ *                      unsigned int nblks)
+ */
+.align 3
+ENTRY(sha1_transform_neon)
+  /* input:
+   *    r0: ctx, CTX
+   *    r1: data (64*nblks bytes)
+   *    r2: nblks
+   */
+
+  cmp RNBLKS, #0;
+  beq .Ldo_nothing;
+
+  push {r4-r12, lr};
+  /*vpush {q4-q7};*/
+
+  adr RT3, .LK_VEC;
+
+  mov ROLDSTACK, sp;
+
+  /* Align stack. */
+  sub RT0, sp, #(16*4);
+  and RT0, #(~(16-1));
+  mov sp, RT0;
+
+  vld1.32 {qK1-qK2}, [RT3]!; /* Load K1,K2 */
+
+  /* Get the values of the chaining variables. */
+  ldm RSTATE, {_a-_e};
+
+  vld1.32 {qK3-qK4}, [RT3]; /* Load K3,K4 */
+
+#undef curK
+#define curK qK1
+  /* Precalc 0-15. */
+  W_PRECALC_00_15();
+
+.Loop:
+  /* Transform 0-15 + Precalc 16-31. */
+  _R( _a, _b, _c, _d, _e, F1,  0,
+      WPRECALC_16_31_0, WPRECALC_16_31_1, WPRECALC_16_31_2, 16,
+      W4, W5, W6, W7, W0, _, _, _ );
+  _R( _e, _a, _b, _c, _d, F1,  1,
+      WPRECALC_16_31_3, WPRECALC_16_31_4, WPRECALC_16_31_5, 16,
+      W4, W5, W6, W7, W0, _, _, _ );
+  _R( _d, _e, _a, _b, _c, F1,  2,
+      WPRECALC_16_31_6, WPRECALC_16_31_7, WPRECALC_16_31_8, 16,
+      W4, W5, W6, W7, W0, _, _, _ );
+  _R( _c, _d, _e, _a, _b, F1,  3,
+      WPRECALC_16_31_9, WPRECALC_16_31_10,WPRECALC_16_31_11,16,
+      W4, W5, W6, W7, W0, _, _, _ );
+
+#undef curK
+#define curK qK2
+  _R( _b, _c, _d, _e, _a, F1,  4,
+      WPRECALC_16_31_0, WPRECALC_16_31_1, WPRECALC_16_31_2, 20,
+      W3, W4, W5, W6, W7, _, _, _ );
+  _R( _a, _b, _c, _d, _e, F1,  5,
+      WPRECALC_16_31_3, WPRECALC_16_31_4, WPRECALC_16_31_5, 20,
+      W3, W4, W5, W6, W7, _, _, _ );
+  _R( _e, _a, _b, _c, _d, F1,  6,
+      WPRECALC_16_31_6, WPRECALC_16_31_7, WPRECALC_16_31_8, 20,
+      W3, W4, W5, W6, W7, _, _, _ );
+  _R( _d, _e, _a, _b, _c, F1,  7,
+      WPRECALC_16_31_9, WPRECALC_16_31_10,WPRECALC_16_31_11,20,
+      W3, W4, W5, W6, W7, _, _, _ );
+
+  _R( _c, _d, _e, _a, _b, F1,  8,
+      WPRECALC_16_31_0, WPRECALC_16_31_1, WPRECALC_16_31_2, 24,
+      W2, W3, W4, W5, W6, _, _, _ );
+  _R( _b, _c, _d, _e, _a, F1,  9,
+      WPRECALC_16_31_3, WPRECALC_16_31_4, WPRECALC_16_31_5, 24,
+      W2, W3, W4, W5, W6, _, _, _ );
+  _R( _a, _b, _c, _d, _e, F1, 10,
+      WPRECALC_16_31_6, WPRECALC_16_31_7, WPRECALC_16_31_8, 24,
+      W2, W3, W4, W5, W6, _, _, _ );
+  _R( _e, _a, _b, _c, _d, F1, 11,
+      WPRECALC_16_31_9, WPRECALC_16_31_10,WPRECALC_16_31_11,24,
+      W2, W3, W4, W5, W6, _, _, _ );
+
+  _R( _d, _e, _a, _b, _c, F1, 12,
+      WPRECALC_16_31_0, WPRECALC_16_31_1, WPRECALC_16_31_2, 28,
+      W1, W2, W3, W4, W5, _, _, _ );
+  _R( _c, _d, _e, _a, _b, F1, 13,
+      WPRECALC_16_31_3, WPRECALC_16_31_4, WPRECALC_16_31_5, 28,
+      W1, W2, W3, W4, W5, _, _, _ );
+  _R( _b, _c, _d, _e, _a, F1, 14,
+      WPRECALC_16_31_6, WPRECALC_16_31_7, WPRECALC_16_31_8, 28,
+      W1, W2, W3, W4, W5, _, _, _ );
+  _R( _a, _b, _c, _d, _e, F1, 15,
+      WPRECALC_16_31_9, WPRECALC_16_31_10,WPRECALC_16_31_11,28,
+      W1, W2, W3, W4, W5, _, _, _ );
+
+  /* Transform 16-63 + Precalc 32-79. */
+  _R( _e, _a, _b, _c, _d, F1, 16,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 32,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+  _R( _d, _e, _a, _b, _c, F1, 17,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 32,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+  _R( _c, _d, _e, _a, _b, F1, 18,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 32,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+  _R( _b, _c, _d, _e, _a, F1, 19,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 32,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+
+  _R( _a, _b, _c, _d, _e, F2, 20,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 36,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+  _R( _e, _a, _b, _c, _d, F2, 21,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 36,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+  _R( _d, _e, _a, _b, _c, F2, 22,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 36,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+  _R( _c, _d, _e, _a, _b, F2, 23,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 36,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+
+#undef curK
+#define curK qK3
+  _R( _b, _c, _d, _e, _a, F2, 24,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 40,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+  _R( _a, _b, _c, _d, _e, F2, 25,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 40,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+  _R( _e, _a, _b, _c, _d, F2, 26,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 40,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+  _R( _d, _e, _a, _b, _c, F2, 27,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 40,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+
+  _R( _c, _d, _e, _a, _b, F2, 28,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 44,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+  _R( _b, _c, _d, _e, _a, F2, 29,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 44,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+  _R( _a, _b, _c, _d, _e, F2, 30,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 44,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+  _R( _e, _a, _b, _c, _d, F2, 31,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 44,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+
+  _R( _d, _e, _a, _b, _c, F2, 32,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 48,
+      W4, W5, W6, W7, W0, W1, W2, W3);
+  _R( _c, _d, _e, _a, _b, F2, 33,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 48,
+      W4, W5, W6, W7, W0, W1, W2, W3);
+  _R( _b, _c, _d, _e, _a, F2, 34,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 48,
+      W4, W5, W6, W7, W0, W1, W2, W3);
+  _R( _a, _b, _c, _d, _e, F2, 35,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 48,
+      W4, W5, W6, W7, W0, W1, W2, W3);
+
+  _R( _e, _a, _b, _c, _d, F2, 36,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 52,
+      W3, W4, W5, W6, W7, W0, W1, W2);
+  _R( _d, _e, _a, _b, _c, F2, 37,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 52,
+      W3, W4, W5, W6, W7, W0, W1, W2);
+  _R( _c, _d, _e, _a, _b, F2, 38,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 52,
+      W3, W4, W5, W6, W7, W0, W1, W2);
+  _R( _b, _c, _d, _e, _a, F2, 39,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 52,
+      W3, W4, W5, W6, W7, W0, W1, W2);
+
+  _R( _a, _b, _c, _d, _e, F3, 40,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 56,
+      W2, W3, W4, W5, W6, W7, W0, W1);
+  _R( _e, _a, _b, _c, _d, F3, 41,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 56,
+      W2, W3, W4, W5, W6, W7, W0, W1);
+  _R( _d, _e, _a, _b, _c, F3, 42,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 56,
+      W2, W3, W4, W5, W6, W7, W0, W1);
+  _R( _c, _d, _e, _a, _b, F3, 43,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 56,
+      W2, W3, W4, W5, W6, W7, W0, W1);
+
+#undef curK
+#define curK qK4
+  _R( _b, _c, _d, _e, _a, F3, 44,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 60,
+      W1, W2, W3, W4, W5, W6, W7, W0);
+  _R( _a, _b, _c, _d, _e, F3, 45,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 60,
+      W1, W2, W3, W4, W5, W6, W7, W0);
+  _R( _e, _a, _b, _c, _d, F3, 46,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 60,
+      W1, W2, W3, W4, W5, W6, W7, W0);
+  _R( _d, _e, _a, _b, _c, F3, 47,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 60,
+      W1, W2, W3, W4, W5, W6, W7, W0);
+
+  _R( _c, _d, _e, _a, _b, F3, 48,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 64,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+  _R( _b, _c, _d, _e, _a, F3, 49,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 64,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+  _R( _a, _b, _c, _d, _e, F3, 50,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 64,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+  _R( _e, _a, _b, _c, _d, F3, 51,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 64,
+      W0, W1, W2, W3, W4, W5, W6, W7);
+
+  _R( _d, _e, _a, _b, _c, F3, 52,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 68,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+  _R( _c, _d, _e, _a, _b, F3, 53,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 68,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+  _R( _b, _c, _d, _e, _a, F3, 54,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 68,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+  _R( _a, _b, _c, _d, _e, F3, 55,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 68,
+      W7, W0, W1, W2, W3, W4, W5, W6);
+
+  _R( _e, _a, _b, _c, _d, F3, 56,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 72,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+  _R( _d, _e, _a, _b, _c, F3, 57,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 72,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+  _R( _c, _d, _e, _a, _b, F3, 58,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 72,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+  _R( _b, _c, _d, _e, _a, F3, 59,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 72,
+      W6, W7, W0, W1, W2, W3, W4, W5);
+
+  subs RNBLKS, #1;
+
+  _R( _a, _b, _c, _d, _e, F4, 60,
+      WPRECALC_32_79_0, WPRECALC_32_79_1, WPRECALC_32_79_2, 76,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+  _R( _e, _a, _b, _c, _d, F4, 61,
+      WPRECALC_32_79_3, WPRECALC_32_79_4, WPRECALC_32_79_5, 76,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+  _R( _d, _e, _a, _b, _c, F4, 62,
+      WPRECALC_32_79_6, dummy,            WPRECALC_32_79_7, 76,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+  _R( _c, _d, _e, _a, _b, F4, 63,
+      WPRECALC_32_79_8, dummy,            WPRECALC_32_79_9, 76,
+      W5, W6, W7, W0, W1, W2, W3, W4);
+
+  beq .Lend;
+
+  /* Transform 64-79 + Precalc 0-15 of next block. */
+#undef curK
+#define curK qK1
+  _R( _b, _c, _d, _e, _a, F4, 64,
+      WPRECALC_00_15_0, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _a, _b, _c, _d, _e, F4, 65,
+      WPRECALC_00_15_1, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _e, _a, _b, _c, _d, F4, 66,
+      WPRECALC_00_15_2, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _d, _e, _a, _b, _c, F4, 67,
+      WPRECALC_00_15_3, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+
+  _R( _c, _d, _e, _a, _b, F4, 68,
+      dummy,            dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _b, _c, _d, _e, _a, F4, 69,
+      dummy,            dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _a, _b, _c, _d, _e, F4, 70,
+      WPRECALC_00_15_4, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _e, _a, _b, _c, _d, F4, 71,
+      WPRECALC_00_15_5, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+
+  _R( _d, _e, _a, _b, _c, F4, 72,
+      dummy,            dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _c, _d, _e, _a, _b, F4, 73,
+      dummy,            dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _b, _c, _d, _e, _a, F4, 74,
+      WPRECALC_00_15_6, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _a, _b, _c, _d, _e, F4, 75,
+      WPRECALC_00_15_7, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+
+  _R( _e, _a, _b, _c, _d, F4, 76,
+      WPRECALC_00_15_8, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _d, _e, _a, _b, _c, F4, 77,
+      WPRECALC_00_15_9, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _c, _d, _e, _a, _b, F4, 78,
+      WPRECALC_00_15_10, dummy, dummy, _, _, _, _, _, _, _, _, _ );
+  _R( _b, _c, _d, _e, _a, F4, 79,
+      WPRECALC_00_15_11, dummy, WPRECALC_00_15_12, _, _, _, _, _, _, _, _, _ );
+
+  /* Update the chaining variables. */
+  ldm RSTATE, {RT0-RT3};
+  add _a, RT0;
+  ldr RT0, [RSTATE, #state_h4];
+  add _b, RT1;
+  add _c, RT2;
+  add _d, RT3;
+  add _e, RT0;
+  stm RSTATE, {_a-_e};
+
+  b .Loop;
+
+.Lend:
+  /* Transform 64-79 */
+  R( _b, _c, _d, _e, _a, F4, 64 );
+  R( _a, _b, _c, _d, _e, F4, 65 );
+  R( _e, _a, _b, _c, _d, F4, 66 );
+  R( _d, _e, _a, _b, _c, F4, 67 );
+  R( _c, _d, _e, _a, _b, F4, 68 );
+  R( _b, _c, _d, _e, _a, F4, 69 );
+  R( _a, _b, _c, _d, _e, F4, 70 );
+  R( _e, _a, _b, _c, _d, F4, 71 );
+  R( _d, _e, _a, _b, _c, F4, 72 );
+  R( _c, _d, _e, _a, _b, F4, 73 );
+  R( _b, _c, _d, _e, _a, F4, 74 );
+  R( _a, _b, _c, _d, _e, F4, 75 );
+  R( _e, _a, _b, _c, _d, F4, 76 );
+  R( _d, _e, _a, _b, _c, F4, 77 );
+  R( _c, _d, _e, _a, _b, F4, 78 );
+  R( _b, _c, _d, _e, _a, F4, 79 );
+
+  mov sp, ROLDSTACK;
+
+  /* Update the chaining variables. */
+  ldm RSTATE, {RT0-RT3};
+  add _a, RT0;
+  ldr RT0, [RSTATE, #state_h4];
+  add _b, RT1;
+  add _c, RT2;
+  add _d, RT3;
+  /*vpop {q4-q7};*/
+  add _e, RT0;
+  stm RSTATE, {_a-_e};
+
+  pop {r4-r12, pc};
+
+.Ldo_nothing:
+  bx lr
+ENDPROC(sha1_transform_neon)
diff --git a/arch/arm/crypto/sha1_glue.c b/arch/arm/crypto/sha1_glue.c
index 76cd976230bc..84f2a756588b 100644
--- a/arch/arm/crypto/sha1_glue.c
+++ b/arch/arm/crypto/sha1_glue.c
@@ -23,32 +23,27 @@
 #include <linux/types.h>
 #include <crypto/sha.h>
 #include <asm/byteorder.h>
+#include <asm/crypto/sha1.h>
 
-struct SHA1_CTX {
-        uint32_t h0,h1,h2,h3,h4;
-        u64 count;
-        u8 data[SHA1_BLOCK_SIZE];
-};
 
-asmlinkage void sha1_block_data_order(struct SHA1_CTX *digest,
+asmlinkage void sha1_block_data_order(u32 *digest,
                 const unsigned char *data, unsigned int rounds);
 
 
 static int sha1_init(struct shash_desc *desc)
 {
-        struct SHA1_CTX *sctx = shash_desc_ctx(desc);
-        memset(sctx, 0, sizeof(*sctx));
-        sctx->h0 = SHA1_H0;
-        sctx->h1 = SHA1_H1;
-        sctx->h2 = SHA1_H2;
-        sctx->h3 = SHA1_H3;
-        sctx->h4 = SHA1_H4;
+        struct sha1_state *sctx = shash_desc_ctx(desc);
+
+        *sctx = (struct sha1_state){
+                .state = { SHA1_H0, SHA1_H1, SHA1_H2, SHA1_H3, SHA1_H4 },
+        };
+
         return 0;
 }
 
 
-static int __sha1_update(struct SHA1_CTX *sctx, const u8 *data,
-                               unsigned int len, unsigned int partial)
+static int __sha1_update(struct sha1_state *sctx, const u8 *data,
+                         unsigned int len, unsigned int partial)
 {
         unsigned int done = 0;
 
@@ -56,43 +51,44 @@ static int __sha1_update(struct SHA1_CTX *sctx, const u8 *data,
 
         if (partial) {
                 done = SHA1_BLOCK_SIZE - partial;
-                memcpy(sctx->data + partial, data, done);
-                sha1_block_data_order(sctx, sctx->data, 1);
+                memcpy(sctx->buffer + partial, data, done);
+                sha1_block_data_order(sctx->state, sctx->buffer, 1);
         }
 
         if (len - done >= SHA1_BLOCK_SIZE) {
                 const unsigned int rounds = (len - done) / SHA1_BLOCK_SIZE;
-                sha1_block_data_order(sctx, data + done, rounds);
+                sha1_block_data_order(sctx->state, data + done, rounds);
                 done += rounds * SHA1_BLOCK_SIZE;
         }
 
-        memcpy(sctx->data, data + done, len - done);
+        memcpy(sctx->buffer, data + done, len - done);
         return 0;
 }
 
 
-static int sha1_update(struct shash_desc *desc, const u8 *data,
-                             unsigned int len)
+int sha1_update_arm(struct shash_desc *desc, const u8 *data,
+                    unsigned int len)
 {
-        struct SHA1_CTX *sctx = shash_desc_ctx(desc);
+        struct sha1_state *sctx = shash_desc_ctx(desc);
         unsigned int partial = sctx->count % SHA1_BLOCK_SIZE;
         int res;
 
         /* Handle the fast case right here */
         if (partial + len < SHA1_BLOCK_SIZE) {
                 sctx->count += len;
-                memcpy(sctx->data + partial, data, len);
+                memcpy(sctx->buffer + partial, data, len);
                 return 0;
         }
         res = __sha1_update(sctx, data, len, partial);
         return res;
 }
+EXPORT_SYMBOL_GPL(sha1_update_arm);
 
 
 /* Add padding and return the message digest. */
 static int sha1_final(struct shash_desc *desc, u8 *out)
 {
-        struct SHA1_CTX *sctx = shash_desc_ctx(desc);
+        struct sha1_state *sctx = shash_desc_ctx(desc);
         unsigned int i, index, padlen;
         __be32 *dst = (__be32 *)out;
         __be64 bits;
@@ -106,7 +102,7 @@ static int sha1_final(struct shash_desc *desc, u8 *out)
         /* We need to fill a whole block for __sha1_update() */
         if (padlen <= 56) {
                 sctx->count += padlen;
-                memcpy(sctx->data + index, padding, padlen);
+                memcpy(sctx->buffer + index, padding, padlen);
         } else {
                 __sha1_update(sctx, padding, padlen, index);
         }
@@ -114,7 +110,7 @@ static int sha1_final(struct shash_desc *desc, u8 *out)
 
         /* Store state in digest */
         for (i = 0; i < 5; i++)
-                dst[i] = cpu_to_be32(((u32 *)sctx)[i]);
+                dst[i] = cpu_to_be32(sctx->state[i]);
 
         /* Wipe context */
         memset(sctx, 0, sizeof(*sctx));
@@ -124,7 +120,7 @@ static int sha1_final(struct shash_desc *desc, u8 *out)
 
 static int sha1_export(struct shash_desc *desc, void *out)
 {
-        struct SHA1_CTX *sctx = shash_desc_ctx(desc);
+        struct sha1_state *sctx = shash_desc_ctx(desc);
         memcpy(out, sctx, sizeof(*sctx));
         return 0;
 }
@@ -132,7 +128,7 @@ static int sha1_export(struct shash_desc *desc, void *out)
 
 static int sha1_import(struct shash_desc *desc, const void *in)
 {
-        struct SHA1_CTX *sctx = shash_desc_ctx(desc);
+        struct sha1_state *sctx = shash_desc_ctx(desc);
         memcpy(sctx, in, sizeof(*sctx));
         return 0;
 }
@@ -141,12 +137,12 @@ static int sha1_import(struct shash_desc *desc, const void *in)
 static struct shash_alg alg = {
         .digestsize     =       SHA1_DIGEST_SIZE,
         .init           =       sha1_init,
-        .update         =       sha1_update,
+        .update         =       sha1_update_arm,
         .final          =       sha1_final,
         .export         =       sha1_export,
         .import         =       sha1_import,
-        .descsize       =       sizeof(struct SHA1_CTX),
-        .statesize      =       sizeof(struct SHA1_CTX),
+        .descsize       =       sizeof(struct sha1_state),
+        .statesize      =       sizeof(struct sha1_state),
         .base           =       {
                 .cra_name       =       "sha1",
                 .cra_driver_name=       "sha1-asm",
diff --git a/arch/arm/crypto/sha1_neon_glue.c b/arch/arm/crypto/sha1_neon_glue.c
new file mode 100644
index 000000000000..6f1b411b1d55
--- /dev/null
+++ b/arch/arm/crypto/sha1_neon_glue.c
@@ -0,0 +1,197 @@
+/*
+ * Glue code for the SHA1 Secure Hash Algorithm assembler implementation using
+ * ARM NEON instructions.
+ *
+ * Copyright © 2014 Jussi Kivilinna <jussi.kivilinna@iki.fi>
+ *
+ * This file is based on sha1_generic.c and sha1_ssse3_glue.c:
+ *  Copyright (c) Alan Smithee.
+ *  Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk>
+ *  Copyright (c) Jean-Francois Dive <jef@linuxbe.org>
+ *  Copyright (c) Mathias Krause <minipli@googlemail.com>
+ *  Copyright (c) Chandramouli Narayanan <mouli@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#include <crypto/internal/hash.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/cryptohash.h>
+#include <linux/types.h>
+#include <crypto/sha.h>
+#include <asm/byteorder.h>
+#include <asm/neon.h>
+#include <asm/simd.h>
+#include <asm/crypto/sha1.h>
+
+
+asmlinkage void sha1_transform_neon(void *state_h, const char *data,
+                                    unsigned int rounds);
+
+
+static int sha1_neon_init(struct shash_desc *desc)
+{
+        struct sha1_state *sctx = shash_desc_ctx(desc);
+
+        *sctx = (struct sha1_state){
+                .state = { SHA1_H0, SHA1_H1, SHA1_H2, SHA1_H3, SHA1_H4 },
+        };
+
+        return 0;
+}
+
+static int __sha1_neon_update(struct shash_desc *desc, const u8 *data,
+                               unsigned int len, unsigned int partial)
+{
+        struct sha1_state *sctx = shash_desc_ctx(desc);
+        unsigned int done = 0;
+
+        sctx->count += len;
+
+        if (partial) {
+                done = SHA1_BLOCK_SIZE - partial;
+                memcpy(sctx->buffer + partial, data, done);
+                sha1_transform_neon(sctx->state, sctx->buffer, 1);
+        }
+
+        if (len - done >= SHA1_BLOCK_SIZE) {
+                const unsigned int rounds = (len - done) / SHA1_BLOCK_SIZE;
+
+                sha1_transform_neon(sctx->state, data + done, rounds);
+                done += rounds * SHA1_BLOCK_SIZE;
+        }
+
+        memcpy(sctx->buffer, data + done, len - done);
+
+        return 0;
+}
+
+static int sha1_neon_update(struct shash_desc *desc, const u8 *data,
+                             unsigned int len)
+{
+        struct sha1_state *sctx = shash_desc_ctx(desc);
+        unsigned int partial = sctx->count % SHA1_BLOCK_SIZE;
+        int res;
+
+        /* Handle the fast case right here */
+        if (partial + len < SHA1_BLOCK_SIZE) {
+                sctx->count += len;
+                memcpy(sctx->buffer + partial, data, len);
+
+                return 0;
+        }
+
+        if (!may_use_simd()) {
+                res = sha1_update_arm(desc, data, len);
+        } else {
+                kernel_neon_begin();
+                res = __sha1_neon_update(desc, data, len, partial);
+                kernel_neon_end();
+        }
+
+        return res;
+}
+
+
+/* Add padding and return the message digest. */
+static int sha1_neon_final(struct shash_desc *desc, u8 *out)
+{
+        struct sha1_state *sctx = shash_desc_ctx(desc);
+        unsigned int i, index, padlen;
+        __be32 *dst = (__be32 *)out;
+        __be64 bits;
+        static const u8 padding[SHA1_BLOCK_SIZE] = { 0x80, };
+
+        bits = cpu_to_be64(sctx->count << 3);
+
+        /* Pad out to 56 mod 64 and append length */
+        index = sctx->count % SHA1_BLOCK_SIZE;
+        padlen = (index < 56) ? (56 - index) : ((SHA1_BLOCK_SIZE+56) - index);
+        if (!may_use_simd()) {
+                sha1_update_arm(desc, padding, padlen);
+                sha1_update_arm(desc, (const u8 *)&bits, sizeof(bits));
+        } else {
+                kernel_neon_begin();
+                /* We need to fill a whole block for __sha1_neon_update() */
+                if (padlen <= 56) {
+                        sctx->count += padlen;
+                        memcpy(sctx->buffer + index, padding, padlen);
+                } else {
+                        __sha1_neon_update(desc, padding, padlen, index);
+                }
+                __sha1_neon_update(desc, (const u8 *)&bits, sizeof(bits), 56);
+                kernel_neon_end();
+        }
+
+        /* Store state in digest */
+        for (i = 0; i < 5; i++)
+                dst[i] = cpu_to_be32(sctx->state[i]);
+
+        /* Wipe context */
+        memset(sctx, 0, sizeof(*sctx));
+
+        return 0;
+}
+
+static int sha1_neon_export(struct shash_desc *desc, void *out)
+{
+        struct sha1_state *sctx = shash_desc_ctx(desc);
+
+        memcpy(out, sctx, sizeof(*sctx));
+
+        return 0;
+}
+
+static int sha1_neon_import(struct shash_desc *desc, const void *in)
+{
+        struct sha1_state *sctx = shash_desc_ctx(desc);
+
+        memcpy(sctx, in, sizeof(*sctx));
+
+        return 0;
+}
+
+static struct shash_alg alg = {
+        .digestsize     =       SHA1_DIGEST_SIZE,
+        .init           =       sha1_neon_init,
+        .update         =       sha1_neon_update,
+        .final          =       sha1_neon_final,
+        .export         =       sha1_neon_export,
+        .import         =       sha1_neon_import,
+        .descsize       =       sizeof(struct sha1_state),
+        .statesize      =       sizeof(struct sha1_state),
+        .base           =       {
+                .cra_name               = "sha1",
+                .cra_driver_name        = "sha1-neon",
+                .cra_priority           = 250,
+                .cra_flags              = CRYPTO_ALG_TYPE_SHASH,
+                .cra_blocksize          = SHA1_BLOCK_SIZE,
+                .cra_module             = THIS_MODULE,
+        }
+};
+
+static int __init sha1_neon_mod_init(void)
+{
+        if (!cpu_has_neon())
+                return -ENODEV;
+
+        return crypto_register_shash(&alg);
+}
+
+static void __exit sha1_neon_mod_fini(void)
+{
+        crypto_unregister_shash(&alg);
+}
+
+module_init(sha1_neon_mod_init);
+module_exit(sha1_neon_mod_fini);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, NEON accelerated");
+MODULE_ALIAS("sha1");
diff --git a/arch/arm/crypto/sha512-armv7-neon.S b/arch/arm/crypto/sha512-armv7-neon.S
new file mode 100644
index 000000000000..fe99472e507c
--- /dev/null
+++ b/arch/arm/crypto/sha512-armv7-neon.S
@@ -0,0 +1,455 @@
+/* sha512-armv7-neon.S  -  ARM/NEON assembly implementation of SHA-512 transform
+ *
+ * Copyright © 2013-2014 Jussi Kivilinna <jussi.kivilinna@iki.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include <linux/linkage.h>
+
+
+.syntax unified
+.code   32
+.fpu neon
+
+.text
+
+/* structure of SHA512_CONTEXT */
+#define hd_a 0
+#define hd_b ((hd_a) + 8)
+#define hd_c ((hd_b) + 8)
+#define hd_d ((hd_c) + 8)
+#define hd_e ((hd_d) + 8)
+#define hd_f ((hd_e) + 8)
+#define hd_g ((hd_f) + 8)
+
+/* register macros */
+#define RK %r2
+
+#define RA d0
+#define RB d1
+#define RC d2
+#define RD d3
+#define RE d4
+#define RF d5
+#define RG d6
+#define RH d7
+
+#define RT0 d8
+#define RT1 d9
+#define RT2 d10
+#define RT3 d11
+#define RT4 d12
+#define RT5 d13
+#define RT6 d14
+#define RT7 d15
+
+#define RT01q q4
+#define RT23q q5
+#define RT45q q6
+#define RT67q q7
+
+#define RW0 d16
+#define RW1 d17
+#define RW2 d18
+#define RW3 d19
+#define RW4 d20
+#define RW5 d21
+#define RW6 d22
+#define RW7 d23
+#define RW8 d24
+#define RW9 d25
+#define RW10 d26
+#define RW11 d27
+#define RW12 d28
+#define RW13 d29
+#define RW14 d30
+#define RW15 d31
+
+#define RW01q q8
+#define RW23q q9
+#define RW45q q10
+#define RW67q q11
+#define RW89q q12
+#define RW1011q q13
+#define RW1213q q14
+#define RW1415q q15
+
+/***********************************************************************
+ * ARM assembly implementation of sha512 transform
+ ***********************************************************************/
+#define rounds2_0_63(ra, rb, rc, rd, re, rf, rg, rh, rw0, rw1, rw01q, rw2, \
+                     rw23q, rw1415q, rw9, rw10, interleave_op, arg1) \
+        /* t1 = h + Sum1 (e) + Ch (e, f, g) + k[t] + w[t]; */ \
+        vshr.u64 RT2, re, #14; \
+        vshl.u64 RT3, re, #64 - 14; \
+        interleave_op(arg1); \
+        vshr.u64 RT4, re, #18; \
+        vshl.u64 RT5, re, #64 - 18; \
+        vld1.64 {RT0}, [RK]!; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, re, #41; \
+        vshl.u64 RT5, re, #64 - 41; \
+        vadd.u64 RT0, RT0, rw0; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vmov.64 RT7, re; \
+        veor.64 RT1, RT2, RT3; \
+        vbsl.64 RT7, rf, rg; \
+        \
+        vadd.u64 RT1, RT1, rh; \
+        vshr.u64 RT2, ra, #28; \
+        vshl.u64 RT3, ra, #64 - 28; \
+        vadd.u64 RT1, RT1, RT0; \
+        vshr.u64 RT4, ra, #34; \
+        vshl.u64 RT5, ra, #64 - 34; \
+        vadd.u64 RT1, RT1, RT7; \
+        \
+        /* h = Sum0 (a) + Maj (a, b, c); */ \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, ra, #39; \
+        vshl.u64 RT5, ra, #64 - 39; \
+        veor.64 RT0, ra, rb; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vbsl.64 RT0, rc, rb; \
+        vadd.u64 rd, rd, RT1; /* d+=t1; */ \
+        veor.64 rh, RT2, RT3; \
+        \
+        /* t1 = g + Sum1 (d) + Ch (d, e, f) + k[t] + w[t]; */ \
+        vshr.u64 RT2, rd, #14; \
+        vshl.u64 RT3, rd, #64 - 14; \
+        vadd.u64 rh, rh, RT0; \
+        vshr.u64 RT4, rd, #18; \
+        vshl.u64 RT5, rd, #64 - 18; \
+        vadd.u64 rh, rh, RT1; /* h+=t1; */ \
+        vld1.64 {RT0}, [RK]!; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, rd, #41; \
+        vshl.u64 RT5, rd, #64 - 41; \
+        vadd.u64 RT0, RT0, rw1; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vmov.64 RT7, rd; \
+        veor.64 RT1, RT2, RT3; \
+        vbsl.64 RT7, re, rf; \
+        \
+        vadd.u64 RT1, RT1, rg; \
+        vshr.u64 RT2, rh, #28; \
+        vshl.u64 RT3, rh, #64 - 28; \
+        vadd.u64 RT1, RT1, RT0; \
+        vshr.u64 RT4, rh, #34; \
+        vshl.u64 RT5, rh, #64 - 34; \
+        vadd.u64 RT1, RT1, RT7; \
+        \
+        /* g = Sum0 (h) + Maj (h, a, b); */ \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, rh, #39; \
+        vshl.u64 RT5, rh, #64 - 39; \
+        veor.64 RT0, rh, ra; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vbsl.64 RT0, rb, ra; \
+        vadd.u64 rc, rc, RT1; /* c+=t1; */ \
+        veor.64 rg, RT2, RT3; \
+        \
+        /* w[0] += S1 (w[14]) + w[9] + S0 (w[1]); */ \
+        /* w[1] += S1 (w[15]) + w[10] + S0 (w[2]); */ \
+        \
+        /**** S0(w[1:2]) */ \
+        \
+        /* w[0:1] += w[9:10] */ \
+        /* RT23q = rw1:rw2 */ \
+        vext.u64 RT23q, rw01q, rw23q, #1; \
+        vadd.u64 rw0, rw9; \
+        vadd.u64 rg, rg, RT0; \
+        vadd.u64 rw1, rw10;\
+        vadd.u64 rg, rg, RT1; /* g+=t1; */ \
+        \
+        vshr.u64 RT45q, RT23q, #1; \
+        vshl.u64 RT67q, RT23q, #64 - 1; \
+        vshr.u64 RT01q, RT23q, #8; \
+        veor.u64 RT45q, RT45q, RT67q; \
+        vshl.u64 RT67q, RT23q, #64 - 8; \
+        veor.u64 RT45q, RT45q, RT01q; \
+        vshr.u64 RT01q, RT23q, #7; \
+        veor.u64 RT45q, RT45q, RT67q; \
+        \
+        /**** S1(w[14:15]) */ \
+        vshr.u64 RT23q, rw1415q, #6; \
+        veor.u64 RT01q, RT01q, RT45q; \
+        vshr.u64 RT45q, rw1415q, #19; \
+        vshl.u64 RT67q, rw1415q, #64 - 19; \
+        veor.u64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT45q, rw1415q, #61; \
+        veor.u64 RT23q, RT23q, RT67q; \
+        vshl.u64 RT67q, rw1415q, #64 - 61; \
+        veor.u64 RT23q, RT23q, RT45q; \
+        vadd.u64 rw01q, RT01q; /* w[0:1] += S(w[1:2]) */ \
+        veor.u64 RT01q, RT23q, RT67q;
+#define vadd_RT01q(rw01q) \
+        /* w[0:1] += S(w[14:15]) */ \
+        vadd.u64 rw01q, RT01q;
+
+#define dummy(_) /*_*/
+
+#define rounds2_64_79(ra, rb, rc, rd, re, rf, rg, rh, rw0, rw1, \
+                      interleave_op1, arg1, interleave_op2, arg2) \
+        /* t1 = h + Sum1 (e) + Ch (e, f, g) + k[t] + w[t]; */ \
+        vshr.u64 RT2, re, #14; \
+        vshl.u64 RT3, re, #64 - 14; \
+        interleave_op1(arg1); \
+        vshr.u64 RT4, re, #18; \
+        vshl.u64 RT5, re, #64 - 18; \
+        interleave_op2(arg2); \
+        vld1.64 {RT0}, [RK]!; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, re, #41; \
+        vshl.u64 RT5, re, #64 - 41; \
+        vadd.u64 RT0, RT0, rw0; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vmov.64 RT7, re; \
+        veor.64 RT1, RT2, RT3; \
+        vbsl.64 RT7, rf, rg; \
+        \
+        vadd.u64 RT1, RT1, rh; \
+        vshr.u64 RT2, ra, #28; \
+        vshl.u64 RT3, ra, #64 - 28; \
+        vadd.u64 RT1, RT1, RT0; \
+        vshr.u64 RT4, ra, #34; \
+        vshl.u64 RT5, ra, #64 - 34; \
+        vadd.u64 RT1, RT1, RT7; \
+        \
+        /* h = Sum0 (a) + Maj (a, b, c); */ \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, ra, #39; \
+        vshl.u64 RT5, ra, #64 - 39; \
+        veor.64 RT0, ra, rb; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vbsl.64 RT0, rc, rb; \
+        vadd.u64 rd, rd, RT1; /* d+=t1; */ \
+        veor.64 rh, RT2, RT3; \
+        \
+        /* t1 = g + Sum1 (d) + Ch (d, e, f) + k[t] + w[t]; */ \
+        vshr.u64 RT2, rd, #14; \
+        vshl.u64 RT3, rd, #64 - 14; \
+        vadd.u64 rh, rh, RT0; \
+        vshr.u64 RT4, rd, #18; \
+        vshl.u64 RT5, rd, #64 - 18; \
+        vadd.u64 rh, rh, RT1; /* h+=t1; */ \
+        vld1.64 {RT0}, [RK]!; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, rd, #41; \
+        vshl.u64 RT5, rd, #64 - 41; \
+        vadd.u64 RT0, RT0, rw1; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vmov.64 RT7, rd; \
+        veor.64 RT1, RT2, RT3; \
+        vbsl.64 RT7, re, rf; \
+        \
+        vadd.u64 RT1, RT1, rg; \
+        vshr.u64 RT2, rh, #28; \
+        vshl.u64 RT3, rh, #64 - 28; \
+        vadd.u64 RT1, RT1, RT0; \
+        vshr.u64 RT4, rh, #34; \
+        vshl.u64 RT5, rh, #64 - 34; \
+        vadd.u64 RT1, RT1, RT7; \
+        \
+        /* g = Sum0 (h) + Maj (h, a, b); */ \
+        veor.64 RT23q, RT23q, RT45q; \
+        vshr.u64 RT4, rh, #39; \
+        vshl.u64 RT5, rh, #64 - 39; \
+        veor.64 RT0, rh, ra; \
+        veor.64 RT23q, RT23q, RT45q; \
+        vbsl.64 RT0, rb, ra; \
+        vadd.u64 rc, rc, RT1; /* c+=t1; */ \
+        veor.64 rg, RT2, RT3;
+#define vadd_rg_RT0(rg) \
+        vadd.u64 rg, rg, RT0;
+#define vadd_rg_RT1(rg) \
+        vadd.u64 rg, rg, RT1; /* g+=t1; */
+
+.align 3
+ENTRY(sha512_transform_neon)
+        /* Input:
+         *      %r0: SHA512_CONTEXT
+         *      %r1: data
+         *      %r2: u64 k[] constants
+         *      %r3: nblks
+         */
+        push {%lr};
+
+        mov %lr, #0;
+
+        /* Load context to d0-d7 */
+        vld1.64 {RA-RD}, [%r0]!;
+        vld1.64 {RE-RH}, [%r0];
+        sub %r0, #(4*8);
+
+        /* Load input to w[16], d16-d31 */
+        /* NOTE: Assumes that on ARMv7 unaligned accesses are always allowed. */
+        vld1.64 {RW0-RW3}, [%r1]!;
+        vld1.64 {RW4-RW7}, [%r1]!;
+        vld1.64 {RW8-RW11}, [%r1]!;
+        vld1.64 {RW12-RW15}, [%r1]!;
+#ifdef __ARMEL__
+        /* byteswap */
+        vrev64.8 RW01q, RW01q;
+        vrev64.8 RW23q, RW23q;
+        vrev64.8 RW45q, RW45q;
+        vrev64.8 RW67q, RW67q;
+        vrev64.8 RW89q, RW89q;
+        vrev64.8 RW1011q, RW1011q;
+        vrev64.8 RW1213q, RW1213q;
+        vrev64.8 RW1415q, RW1415q;
+#endif
+
+        /* EABI says that d8-d15 must be preserved by callee. */
+        /*vpush {RT0-RT7};*/
+
+.Loop:
+        rounds2_0_63(RA, RB, RC, RD, RE, RF, RG, RH, RW0, RW1, RW01q, RW2,
+                     RW23q, RW1415q, RW9, RW10, dummy, _);
+        b .Lenter_rounds;
+
+.Loop_rounds:
+        rounds2_0_63(RA, RB, RC, RD, RE, RF, RG, RH, RW0, RW1, RW01q, RW2,
+                     RW23q, RW1415q, RW9, RW10, vadd_RT01q, RW1415q);
+.Lenter_rounds:
+        rounds2_0_63(RG, RH, RA, RB, RC, RD, RE, RF, RW2, RW3, RW23q, RW4,
+                     RW45q, RW01q, RW11, RW12, vadd_RT01q, RW01q);
+        rounds2_0_63(RE, RF, RG, RH, RA, RB, RC, RD, RW4, RW5, RW45q, RW6,
+                     RW67q, RW23q, RW13, RW14, vadd_RT01q, RW23q);
+        rounds2_0_63(RC, RD, RE, RF, RG, RH, RA, RB, RW6, RW7, RW67q, RW8,
+                     RW89q, RW45q, RW15, RW0, vadd_RT01q, RW45q);
+        rounds2_0_63(RA, RB, RC, RD, RE, RF, RG, RH, RW8, RW9, RW89q, RW10,
+                     RW1011q, RW67q, RW1, RW2, vadd_RT01q, RW67q);
+        rounds2_0_63(RG, RH, RA, RB, RC, RD, RE, RF, RW10, RW11, RW1011q, RW12,
+                     RW1213q, RW89q, RW3, RW4, vadd_RT01q, RW89q);
+        add %lr, #16;
+        rounds2_0_63(RE, RF, RG, RH, RA, RB, RC, RD, RW12, RW13, RW1213q, RW14,
+                     RW1415q, RW1011q, RW5, RW6, vadd_RT01q, RW1011q);
+        cmp %lr, #64;
+        rounds2_0_63(RC, RD, RE, RF, RG, RH, RA, RB, RW14, RW15, RW1415q, RW0,
+                     RW01q, RW1213q, RW7, RW8, vadd_RT01q, RW1213q);
+        bne .Loop_rounds;
+
+        subs %r3, #1;
+
+        rounds2_64_79(RA, RB, RC, RD, RE, RF, RG, RH, RW0, RW1,
+                      vadd_RT01q, RW1415q, dummy, _);
+        rounds2_64_79(RG, RH, RA, RB, RC, RD, RE, RF, RW2, RW3,
+                      vadd_rg_RT0, RG, vadd_rg_RT1, RG);
+        beq .Lhandle_tail;
+        vld1.64 {RW0-RW3}, [%r1]!;
+        rounds2_64_79(RE, RF, RG, RH, RA, RB, RC, RD, RW4, RW5,
+                      vadd_rg_RT0, RE, vadd_rg_RT1, RE);
+        rounds2_64_79(RC, RD, RE, RF, RG, RH, RA, RB, RW6, RW7,
+                      vadd_rg_RT0, RC, vadd_rg_RT1, RC);
+#ifdef __ARMEL__
+        vrev64.8 RW01q, RW01q;
+        vrev64.8 RW23q, RW23q;
+#endif
+        vld1.64 {RW4-RW7}, [%r1]!;
+        rounds2_64_79(RA, RB, RC, RD, RE, RF, RG, RH, RW8, RW9,
+                      vadd_rg_RT0, RA, vadd_rg_RT1, RA);
+        rounds2_64_79(RG, RH, RA, RB, RC, RD, RE, RF, RW10, RW11,
+                      vadd_rg_RT0, RG, vadd_rg_RT1, RG);
+#ifdef __ARMEL__
+        vrev64.8 RW45q, RW45q;
+        vrev64.8 RW67q, RW67q;
+#endif
+        vld1.64 {RW8-RW11}, [%r1]!;
+        rounds2_64_79(RE, RF, RG, RH, RA, RB, RC, RD, RW12, RW13,
+                      vadd_rg_RT0, RE, vadd_rg_RT1, RE);
+        rounds2_64_79(RC, RD, RE, RF, RG, RH, RA, RB, RW14, RW15,
+                      vadd_rg_RT0, RC, vadd_rg_RT1, RC);
+#ifdef __ARMEL__
+        vrev64.8 RW89q, RW89q;
+        vrev64.8 RW1011q, RW1011q;
+#endif
+        vld1.64 {RW12-RW15}, [%r1]!;
+        vadd_rg_RT0(RA);
+        vadd_rg_RT1(RA);
+
+        /* Load context */
+        vld1.64 {RT0-RT3}, [%r0]!;
+        vld1.64 {RT4-RT7}, [%r0];
+        sub %r0, #(4*8);
+
+#ifdef __ARMEL__
+        vrev64.8 RW1213q, RW1213q;
+        vrev64.8 RW1415q, RW1415q;
+#endif
+
+        vadd.u64 RA, RT0;
+        vadd.u64 RB, RT1;
+        vadd.u64 RC, RT2;
+        vadd.u64 RD, RT3;
+        vadd.u64 RE, RT4;
+        vadd.u64 RF, RT5;
+        vadd.u64 RG, RT6;
+        vadd.u64 RH, RT7;
+
+        /* Store the first half of context */
+        vst1.64 {RA-RD}, [%r0]!;
+        sub RK, $(8*80);
+        vst1.64 {RE-RH}, [%r0]; /* Store the last half of context */
+        mov %lr, #0;
+        sub %r0, #(4*8);
+
+        b .Loop;
+
+.Lhandle_tail:
+        rounds2_64_79(RE, RF, RG, RH, RA, RB, RC, RD, RW4, RW5,
+                      vadd_rg_RT0, RE, vadd_rg_RT1, RE);
+        rounds2_64_79(RC, RD, RE, RF, RG, RH, RA, RB, RW6, RW7,
+                      vadd_rg_RT0, RC, vadd_rg_RT1, RC);
+        rounds2_64_79(RA, RB, RC, RD, RE, RF, RG, RH, RW8, RW9,
+                      vadd_rg_RT0, RA, vadd_rg_RT1, RA);
+        rounds2_64_79(RG, RH, RA, RB, RC, RD, RE, RF, RW10, RW11,
+                      vadd_rg_RT0, RG, vadd_rg_RT1, RG);
+        rounds2_64_79(RE, RF, RG, RH, RA, RB, RC, RD, RW12, RW13,
+                      vadd_rg_RT0, RE, vadd_rg_RT1, RE);
+        rounds2_64_79(RC, RD, RE, RF, RG, RH, RA, RB, RW14, RW15,
+                      vadd_rg_RT0, RC, vadd_rg_RT1, RC);
+
+        /* Load context to d16-d23 */
+        vld1.64 {RW0-RW3}, [%r0]!;
+        vadd_rg_RT0(RA);
+        vld1.64 {RW4-RW7}, [%r0];
+        vadd_rg_RT1(RA);
+        sub %r0, #(4*8);
+
+        vadd.u64 RA, RW0;
+        vadd.u64 RB, RW1;
+        vadd.u64 RC, RW2;
+        vadd.u64 RD, RW3;
+        vadd.u64 RE, RW4;
+        vadd.u64 RF, RW5;
+        vadd.u64 RG, RW6;
+        vadd.u64 RH, RW7;
+
+        /* Store the first half of context */
+        vst1.64 {RA-RD}, [%r0]!;
+
+        /* Clear used registers */
+        /* d16-d31 */
+        veor.u64 RW01q, RW01q;
+        veor.u64 RW23q, RW23q;
+        veor.u64 RW45q, RW45q;
+        veor.u64 RW67q, RW67q;
+        vst1.64 {RE-RH}, [%r0]; /* Store the last half of context */
+        veor.u64 RW89q, RW89q;
+        veor.u64 RW1011q, RW1011q;
+        veor.u64 RW1213q, RW1213q;
+        veor.u64 RW1415q, RW1415q;
+        /* d8-d15 */
+        /*vpop {RT0-RT7};*/
+        /* d0-d7 (q0-q3) */
+        veor.u64 %q0, %q0;
+        veor.u64 %q1, %q1;
+        veor.u64 %q2, %q2;
+        veor.u64 %q3, %q3;
+
+        pop {%pc};
+ENDPROC(sha512_transform_neon)
diff --git a/arch/arm/crypto/sha512_neon_glue.c b/arch/arm/crypto/sha512_neon_glue.c
new file mode 100644
index 000000000000..0d2758ff5e12
--- /dev/null
+++ b/arch/arm/crypto/sha512_neon_glue.c
@@ -0,0 +1,305 @@
+/*
+ * Glue code for the SHA512 Secure Hash Algorithm assembly implementation
+ * using NEON instructions.
+ *
+ * Copyright © 2014 Jussi Kivilinna <jussi.kivilinna@iki.fi>
+ *
+ * This file is based on sha512_ssse3_glue.c:
+ *   Copyright (C) 2013 Intel Corporation
+ *   Author: Tim Chen <tim.c.chen@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#include <crypto/internal/hash.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/cryptohash.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <crypto/sha.h>
+#include <asm/byteorder.h>
+#include <asm/simd.h>
+#include <asm/neon.h>
+
+
+static const u64 sha512_k[] = {
+        0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
+        0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
+        0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
+        0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
+        0xd807aa98a3030242ULL, 0x12835b0145706fbeULL,
+        0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
+        0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL,
+        0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
+        0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
+        0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL,
+        0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL,
+        0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
+        0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL,
+        0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL,
+        0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
+        0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
+        0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL,
+        0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
+        0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL,
+        0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
+        0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
+        0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL,
+        0xd192e819d6ef5218ULL, 0xd69906245565a910ULL,
+        0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
+        0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL,
+        0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL,
+        0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
+        0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
+        0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL,
+        0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
+        0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL,
+        0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
+        0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
+        0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL,
+        0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL,
+        0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
+        0x28db77f523047d84ULL, 0x32caab7b40c72493ULL,
+        0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL,
+        0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
+        0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
+};
+
+
+asmlinkage void sha512_transform_neon(u64 *digest, const void *data,
+                                      const u64 k[], unsigned int num_blks);
+
+
+static int sha512_neon_init(struct shash_desc *desc)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
+
+        sctx->state[0] = SHA512_H0;
+        sctx->state[1] = SHA512_H1;
+        sctx->state[2] = SHA512_H2;
+        sctx->state[3] = SHA512_H3;
+        sctx->state[4] = SHA512_H4;
+        sctx->state[5] = SHA512_H5;
+        sctx->state[6] = SHA512_H6;
+        sctx->state[7] = SHA512_H7;
+        sctx->count[0] = sctx->count[1] = 0;
+
+        return 0;
+}
+
+static int __sha512_neon_update(struct shash_desc *desc, const u8 *data,
+                                unsigned int len, unsigned int partial)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
+        unsigned int done = 0;
+
+        sctx->count[0] += len;
+        if (sctx->count[0] < len)
+                sctx->count[1]++;
+
+        if (partial) {
+                done = SHA512_BLOCK_SIZE - partial;
+                memcpy(sctx->buf + partial, data, done);
+                sha512_transform_neon(sctx->state, sctx->buf, sha512_k, 1);
+        }
+
+        if (len - done >= SHA512_BLOCK_SIZE) {
+                const unsigned int rounds = (len - done) / SHA512_BLOCK_SIZE;
+
+                sha512_transform_neon(sctx->state, data + done, sha512_k,
+                                      rounds);
+
+                done += rounds * SHA512_BLOCK_SIZE;
+        }
+
+        memcpy(sctx->buf, data + done, len - done);
+
+        return 0;
+}
+
+static int sha512_neon_update(struct shash_desc *desc, const u8 *data,
+                             unsigned int len)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
+        unsigned int partial = sctx->count[0] % SHA512_BLOCK_SIZE;
+        int res;
+
+        /* Handle the fast case right here */
+        if (partial + len < SHA512_BLOCK_SIZE) {
+                sctx->count[0] += len;
+                if (sctx->count[0] < len)
+                        sctx->count[1]++;
+                memcpy(sctx->buf + partial, data, len);
+
+                return 0;
+        }
+
+        if (!may_use_simd()) {
+                res = crypto_sha512_update(desc, data, len);
+        } else {
+                kernel_neon_begin();
+                res = __sha512_neon_update(desc, data, len, partial);
+                kernel_neon_end();
+        }
+
+        return res;
+}
+
+
+/* Add padding and return the message digest. */
+static int sha512_neon_final(struct shash_desc *desc, u8 *out)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
+        unsigned int i, index, padlen;
+        __be64 *dst = (__be64 *)out;
+        __be64 bits[2];
+        static const u8 padding[SHA512_BLOCK_SIZE] = { 0x80, };
+
+        /* save number of bits */
+        bits[1] = cpu_to_be64(sctx->count[0] << 3);
+        bits[0] = cpu_to_be64(sctx->count[1] << 3 | sctx->count[0] >> 61);
+
+        /* Pad out to 112 mod 128 and append length */
+        index = sctx->count[0] & 0x7f;
+        padlen = (index < 112) ? (112 - index) : ((128+112) - index);
+
+        if (!may_use_simd()) {
+                crypto_sha512_update(desc, padding, padlen);
+                crypto_sha512_update(desc, (const u8 *)&bits, sizeof(bits));
+        } else {
+                kernel_neon_begin();
+                /* We need to fill a whole block for __sha512_neon_update() */
+                if (padlen <= 112) {
+                        sctx->count[0] += padlen;
+                        if (sctx->count[0] < padlen)
+                                sctx->count[1]++;
+                        memcpy(sctx->buf + index, padding, padlen);
+                } else {
+                        __sha512_neon_update(desc, padding, padlen, index);
+                }
+                __sha512_neon_update(desc, (const u8 *)&bits,
+                                        sizeof(bits), 112);
+                kernel_neon_end();
+        }
+
+        /* Store state in digest */
+        for (i = 0; i < 8; i++)
+                dst[i] = cpu_to_be64(sctx->state[i]);
+
+        /* Wipe context */
+        memset(sctx, 0, sizeof(*sctx));
+
+        return 0;
+}
+
+static int sha512_neon_export(struct shash_desc *desc, void *out)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
+
+        memcpy(out, sctx, sizeof(*sctx));
+
+        return 0;
+}
+
+static int sha512_neon_import(struct shash_desc *desc, const void *in)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
+
+        memcpy(sctx, in, sizeof(*sctx));
+
+        return 0;
+}
+
+static int sha384_neon_init(struct shash_desc *desc)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
+
+        sctx->state[0] = SHA384_H0;
+        sctx->state[1] = SHA384_H1;
+        sctx->state[2] = SHA384_H2;
+        sctx->state[3] = SHA384_H3;
+        sctx->state[4] = SHA384_H4;
+        sctx->state[5] = SHA384_H5;
+        sctx->state[6] = SHA384_H6;
+        sctx->state[7] = SHA384_H7;
+
+        sctx->count[0] = sctx->count[1] = 0;
+
+        return 0;
+}
+
+static int sha384_neon_final(struct shash_desc *desc, u8 *hash)
+{
+        u8 D[SHA512_DIGEST_SIZE];
+
+        sha512_neon_final(desc, D);
+
+        memcpy(hash, D, SHA384_DIGEST_SIZE);
+        memset(D, 0, SHA512_DIGEST_SIZE);
+
+        return 0;
+}
+
+static struct shash_alg algs[] = { {
+        .digestsize     =       SHA512_DIGEST_SIZE,
+        .init           =       sha512_neon_init,
+        .update         =       sha512_neon_update,
+        .final          =       sha512_neon_final,
+        .export         =       sha512_neon_export,
+        .import         =       sha512_neon_import,
+        .descsize       =       sizeof(struct sha512_state),
+        .statesize      =       sizeof(struct sha512_state),
+        .base           =       {
+                .cra_name       =       "sha512",
+                .cra_driver_name =      "sha512-neon",
+                .cra_priority   =       250,
+                .cra_flags      =       CRYPTO_ALG_TYPE_SHASH,
+                .cra_blocksize  =       SHA512_BLOCK_SIZE,
+                .cra_module     =       THIS_MODULE,
+        }
+},  {
+        .digestsize     =       SHA384_DIGEST_SIZE,
+        .init           =       sha384_neon_init,
+        .update         =       sha512_neon_update,
+        .final          =       sha384_neon_final,
+        .export         =       sha512_neon_export,
+        .import         =       sha512_neon_import,
+        .descsize       =       sizeof(struct sha512_state),
+        .statesize      =       sizeof(struct sha512_state),
+        .base           =       {
+                .cra_name       =       "sha384",
+                .cra_driver_name =      "sha384-neon",
+                .cra_priority   =       250,
+                .cra_flags      =       CRYPTO_ALG_TYPE_SHASH,
+                .cra_blocksize  =       SHA384_BLOCK_SIZE,
+                .cra_module     =       THIS_MODULE,
+        }
+} };
+
+static int __init sha512_neon_mod_init(void)
+{
+        if (!cpu_has_neon())
+                return -ENODEV;
+
+        return crypto_register_shashes(algs, ARRAY_SIZE(algs));
+}
+
+static void __exit sha512_neon_mod_fini(void)
+{
+        crypto_unregister_shashes(algs, ARRAY_SIZE(algs));
+}
+
+module_init(sha512_neon_mod_init);
+module_exit(sha512_neon_mod_fini);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("SHA512 Secure Hash Algorithm, NEON accelerated");
+
+MODULE_ALIAS("sha512");
+MODULE_ALIAS("sha384");
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 57f0584e8d97..f67fd3afebdf 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -24,6 +24,8 @@
 #include <asm/domain.h>
 #include <asm/opcodes-virt.h>
 #include <asm/asm-offsets.h>
+#include <asm/page.h>
+#include <asm/thread_info.h>
 
 #define IOMEM(x)        (x)
 
@@ -179,10 +181,10 @@
  * Get current thread_info.
  */
         .macro  get_thread_info, rd
- ARM(   mov     \rd, sp, lsr #13        )
+ ARM(   mov     \rd, sp, lsr #THREAD_SIZE_ORDER + PAGE_SHIFT    )
  THUMB( mov     \rd, sp                 )
- THUMB( lsr     \rd, \rd, #13           )
-        mov     \rd, \rd, lsl #13
+ THUMB( lsr     \rd, \rd, #THREAD_SIZE_ORDER + PAGE_SHIFT       )
+        mov     \rd, \rd, lsl #THREAD_SIZE_ORDER + PAGE_SHIFT
         .endm
 
 /*
@@ -425,4 +427,25 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
 #endif
         .endm
 
+        .irp    c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
+        .macro  ret\c, reg
+#if __LINUX_ARM_ARCH__ < 6
+        mov\c   pc, \reg
+#else
+        .ifeqs  "\reg", "lr"
+        bx\c    \reg
+        .else
+        mov\c   pc, \reg
+        .endif
+#endif
+        .endm
+        .endr
+
+        .macro  ret.w, reg
+        ret     \reg
+#ifdef CONFIG_THUMB2_KERNEL
+        nop
+#endif
+        .endm
+
 #endif /* __ASM_ASSEMBLER_H__ */
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 8c2b7321a478..963a2515906d 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -62,17 +62,18 @@
 #define ARM_CPU_IMP_ARM                 0x41
 #define ARM_CPU_IMP_INTEL               0x69
 
-#define ARM_CPU_PART_ARM1136            0xB360
-#define ARM_CPU_PART_ARM1156            0xB560
-#define ARM_CPU_PART_ARM1176            0xB760
-#define ARM_CPU_PART_ARM11MPCORE        0xB020
-#define ARM_CPU_PART_CORTEX_A8          0xC080
-#define ARM_CPU_PART_CORTEX_A9          0xC090
-#define ARM_CPU_PART_CORTEX_A5          0xC050
-#define ARM_CPU_PART_CORTEX_A15         0xC0F0
-#define ARM_CPU_PART_CORTEX_A7          0xC070
-#define ARM_CPU_PART_CORTEX_A12         0xC0D0
-#define ARM_CPU_PART_CORTEX_A17         0xC0E0
+/* ARM implemented processors */
+#define ARM_CPU_PART_ARM1136            0x4100b360
+#define ARM_CPU_PART_ARM1156            0x4100b560
+#define ARM_CPU_PART_ARM1176            0x4100b760
+#define ARM_CPU_PART_ARM11MPCORE        0x4100b020
+#define ARM_CPU_PART_CORTEX_A8          0x4100c080
+#define ARM_CPU_PART_CORTEX_A9          0x4100c090
+#define ARM_CPU_PART_CORTEX_A5          0x4100c050
+#define ARM_CPU_PART_CORTEX_A7          0x4100c070
+#define ARM_CPU_PART_CORTEX_A12         0x4100c0d0
+#define ARM_CPU_PART_CORTEX_A17         0x4100c0e0
+#define ARM_CPU_PART_CORTEX_A15         0x4100c0f0
 
 #define ARM_CPU_XSCALE_ARCH_MASK        0xe000
 #define ARM_CPU_XSCALE_ARCH_V1          0x2000
@@ -171,14 +172,24 @@ static inline unsigned int __attribute_const__ read_cpuid_implementor(void)
         return (read_cpuid_id() & 0xFF000000) >> 24;
 }
 
-static inline unsigned int __attribute_const__ read_cpuid_part_number(void)
+/*
+ * The CPU part number is meaningless without referring to the CPU
+ * implementer: implementers are free to define their own part numbers
+ * which are permitted to clash with other implementer part numbers.
+ */
+static inline unsigned int __attribute_const__ read_cpuid_part(void)
+{
+        return read_cpuid_id() & 0xff00fff0;
+}
+
+static inline unsigned int __attribute_const__ __deprecated read_cpuid_part_number(void)
 {
         return read_cpuid_id() & 0xFFF0;
 }
 
 static inline unsigned int __attribute_const__ xscale_cpu_arch_version(void)
 {
-        return read_cpuid_part_number() & ARM_CPU_XSCALE_ARCH_MASK;
+        return read_cpuid_id() & ARM_CPU_XSCALE_ARCH_MASK;
 }
 
 static inline unsigned int __attribute_const__ read_cpuid_cachetype(void)
diff --git a/arch/arm/include/asm/crypto/sha1.h b/arch/arm/include/asm/crypto/sha1.h
new file mode 100644
index 000000000000..75e6a417416b
--- /dev/null
+++ b/arch/arm/include/asm/crypto/sha1.h
@@ -0,0 +1,10 @@
+#ifndef ASM_ARM_CRYPTO_SHA1_H
+#define ASM_ARM_CRYPTO_SHA1_H
+
+#include <linux/crypto.h>
+#include <crypto/sha.h>
+
+extern int sha1_update_arm(struct shash_desc *desc, const u8 *data,
+                           unsigned int len);
+
+#endif
diff --git a/arch/arm/include/asm/entry-macro-multi.S b/arch/arm/include/asm/entry-macro-multi.S
index 88d61815f0c0..469a2b30fa27 100644
--- a/arch/arm/include/asm/entry-macro-multi.S
+++ b/arch/arm/include/asm/entry-macro-multi.S
@@ -35,5 +35,5 @@
 \symbol_name:
         mov     r8, lr
         arch_irq_handler_default
-        mov     pc, r8
+        ret     r8
         .endm
diff --git a/arch/arm/include/asm/glue-proc.h b/arch/arm/include/asm/glue-proc.h
index 74a8b84f3cb1..74be7c22035a 100644
--- a/arch/arm/include/asm/glue-proc.h
+++ b/arch/arm/include/asm/glue-proc.h
@@ -221,15 +221,6 @@
 # endif
 #endif
 
-#ifdef CONFIG_CPU_V7
-# ifdef CPU_NAME
-#  undef  MULTI_CPU
-#  define MULTI_CPU
-# else
-#  define CPU_NAME cpu_v7
-# endif
-#endif
-
 #ifdef CONFIG_CPU_V7M
 # ifdef CPU_NAME
 #  undef  MULTI_CPU
@@ -248,6 +239,15 @@
 # endif
 #endif
 
+#ifdef CONFIG_CPU_V7
+/*
+ * Cortex-A9 needs a different suspend/resume function, so we need
+ * multiple CPU support for ARMv7 anyway.
+ */
+#  undef  MULTI_CPU
+#  define MULTI_CPU
+#endif
+
 #ifndef MULTI_CPU
 #define cpu_proc_init                   __glue(CPU_NAME,_proc_init)
 #define cpu_proc_fin                    __glue(CPU_NAME,_proc_fin)
diff --git a/arch/arm/include/asm/mcpm.h b/arch/arm/include/asm/mcpm.h
index 94060adba174..57ff7f2a3084 100644
--- a/arch/arm/include/asm/mcpm.h
+++ b/arch/arm/include/asm/mcpm.h
@@ -217,6 +217,22 @@ int __mcpm_cluster_state(unsigned int cluster);
 int __init mcpm_sync_init(
         void (*power_up_setup)(unsigned int affinity_level));
 
+/**
+ * mcpm_loopback - make a run through the MCPM low-level code
+ *
+ * @cache_disable: pointer to function performing cache disabling
+ *
+ * This exercises the MCPM machinery by soft resetting the CPU and branching
+ * to the MCPM low-level entry code before returning to the caller.
+ * The @cache_disable function must do the necessary cache disabling to
+ * let the regular kernel init code turn it back on as if the CPU was
+ * hotplugged in. The MCPM state machine is set as if the cluster was
+ * initialized meaning the power_up_setup callback passed to mcpm_sync_init()
+ * will be invoked for all affinity levels. This may be useful to initialize
+ * some resources such as enabling the CCI that requires the cache to be off, or simply for testing purposes.
+ */
+int __init mcpm_loopback(void (*cache_disable)(void));
+
 void __init mcpm_smp_set_ops(void);
 
 #else
diff --git a/arch/arm/include/asm/mcs_spinlock.h b/arch/arm/include/asm/mcs_spinlock.h
new file mode 100644
index 000000000000..f652ad65840a
--- /dev/null
+++ b/arch/arm/include/asm/mcs_spinlock.h
@@ -0,0 +1,23 @@
+#ifndef __ASM_MCS_LOCK_H
+#define __ASM_MCS_LOCK_H
+
+#ifdef CONFIG_SMP
+#include <asm/spinlock.h>
+
+/* MCS spin-locking. */
+#define arch_mcs_spin_lock_contended(lock)                              \
+do {                                                                    \
+        /* Ensure prior stores are observed before we enter wfe. */     \
+        smp_mb();                                                       \
+        while (!(smp_load_acquire(lock)))                               \
+                wfe();                                                  \
+} while (0)                                                             \
+
+#define arch_mcs_spin_unlock_contended(lock)                            \
+do {                                                                    \
+        smp_store_release(lock, 1);                                     \
+        dsb_sev();                                                      \
+} while (0)
+
+#endif  /* CONFIG_SMP */
+#endif  /* __ASM_MCS_LOCK_H */
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 2b751464d6ff..04ccf1c0a1af 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -150,13 +150,11 @@
 
 /*
  * PLAT_PHYS_OFFSET is the offset (from zero) of the start of physical
- * memory.  This is used for XIP and NoMMU kernels, or by kernels which
- * have their own mach/memory.h.  Assembly code must always use
+ * memory.  This is used for XIP and NoMMU kernels, and on platforms that don't
+ * have CONFIG_ARM_PATCH_PHYS_VIRT. Assembly code must always use
  * PLAT_PHYS_OFFSET and not PHYS_OFFSET.
  */
-#ifndef PLAT_PHYS_OFFSET
 #define PLAT_PHYS_OFFSET        UL(CONFIG_PHYS_OFFSET)
-#endif
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
index 626989fec4d3..9fd61c72a33a 100644
--- a/arch/arm/include/asm/pgtable-3level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
@@ -43,7 +43,7 @@
 #define PMD_SECT_BUFFERABLE     (_AT(pmdval_t, 1) << 2)
 #define PMD_SECT_CACHEABLE      (_AT(pmdval_t, 1) << 3)
 #define PMD_SECT_USER           (_AT(pmdval_t, 1) << 6)         /* AP[1] */
-#define PMD_SECT_RDONLY         (_AT(pmdval_t, 1) << 7)         /* AP[2] */
+#define PMD_SECT_AP2            (_AT(pmdval_t, 1) << 7)         /* read only */
 #define PMD_SECT_S              (_AT(pmdval_t, 3) << 8)
 #define PMD_SECT_AF             (_AT(pmdval_t, 1) << 10)
 #define PMD_SECT_nG             (_AT(pmdval_t, 1) << 11)
@@ -72,6 +72,7 @@
 #define PTE_TABLE_BIT           (_AT(pteval_t, 1) << 1)
 #define PTE_BUFFERABLE          (_AT(pteval_t, 1) << 2)         /* AttrIndx[0] */
 #define PTE_CACHEABLE           (_AT(pteval_t, 1) << 3)         /* AttrIndx[1] */
+#define PTE_AP2                 (_AT(pteval_t, 1) << 7)         /* AP[2] */
 #define PTE_EXT_SHARED          (_AT(pteval_t, 3) << 8)         /* SH[1:0], inner shareable */
 #define PTE_EXT_AF              (_AT(pteval_t, 1) << 10)        /* Access Flag */
 #define PTE_EXT_NG              (_AT(pteval_t, 1) << 11)        /* nG */
diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
index 85c60adc8b60..06e0bc0f8b00 100644
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -79,18 +79,19 @@
 #define L_PTE_PRESENT           (_AT(pteval_t, 3) << 0)         /* Present */
 #define L_PTE_FILE              (_AT(pteval_t, 1) << 2)         /* only when !PRESENT */
 #define L_PTE_USER              (_AT(pteval_t, 1) << 6)         /* AP[1] */
-#define L_PTE_RDONLY            (_AT(pteval_t, 1) << 7)         /* AP[2] */
 #define L_PTE_SHARED            (_AT(pteval_t, 3) << 8)         /* SH[1:0], inner shareable */
 #define L_PTE_YOUNG             (_AT(pteval_t, 1) << 10)        /* AF */
 #define L_PTE_XN                (_AT(pteval_t, 1) << 54)        /* XN */
-#define L_PTE_DIRTY             (_AT(pteval_t, 1) << 55)        /* unused */
-#define L_PTE_SPECIAL           (_AT(pteval_t, 1) << 56)        /* unused */
+#define L_PTE_DIRTY             (_AT(pteval_t, 1) << 55)
+#define L_PTE_SPECIAL           (_AT(pteval_t, 1) << 56)
 #define L_PTE_NONE              (_AT(pteval_t, 1) << 57)        /* PROT_NONE */
+#define L_PTE_RDONLY            (_AT(pteval_t, 1) << 58)        /* READ ONLY */
 
-#define PMD_SECT_VALID          (_AT(pmdval_t, 1) << 0)
-#define PMD_SECT_DIRTY          (_AT(pmdval_t, 1) << 55)
-#define PMD_SECT_SPLITTING      (_AT(pmdval_t, 1) << 56)
-#define PMD_SECT_NONE           (_AT(pmdval_t, 1) << 57)
+#define L_PMD_SECT_VALID        (_AT(pmdval_t, 1) << 0)
+#define L_PMD_SECT_DIRTY        (_AT(pmdval_t, 1) << 55)
+#define L_PMD_SECT_SPLITTING    (_AT(pmdval_t, 1) << 56)
+#define L_PMD_SECT_NONE         (_AT(pmdval_t, 1) << 57)
+#define L_PMD_SECT_RDONLY       (_AT(pteval_t, 1) << 58)
 
 /*
  * To be used in assembly code with the upper page attributes.
@@ -207,27 +208,32 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
 #define pte_huge(pte)           (pte_val(pte) && !(pte_val(pte) & PTE_TABLE_BIT))
 #define pte_mkhuge(pte)         (__pte(pte_val(pte) & ~PTE_TABLE_BIT))
 
-#define pmd_young(pmd)          (pmd_val(pmd) & PMD_SECT_AF)
+#define pmd_isset(pmd, val)     ((u32)(val) == (val) ? pmd_val(pmd) & (val) \
+                                                : !!(pmd_val(pmd) & (val)))
+#define pmd_isclear(pmd, val)   (!(pmd_val(pmd) & (val)))
+
+#define pmd_young(pmd)          (pmd_isset((pmd), PMD_SECT_AF))
 
 #define __HAVE_ARCH_PMD_WRITE
-#define pmd_write(pmd)          (!(pmd_val(pmd) & PMD_SECT_RDONLY))
+#define pmd_write(pmd)          (pmd_isclear((pmd), L_PMD_SECT_RDONLY))
+#define pmd_dirty(pmd)          (pmd_isset((pmd), L_PMD_SECT_DIRTY))
 
 #define pmd_hugewillfault(pmd)  (!pmd_young(pmd) || !pmd_write(pmd))
 #define pmd_thp_or_huge(pmd)    (pmd_huge(pmd) || pmd_trans_huge(pmd))
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-#define pmd_trans_huge(pmd)     (pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT))
-#define pmd_trans_splitting(pmd) (pmd_val(pmd) & PMD_SECT_SPLITTING)
+#define pmd_trans_huge(pmd)     (pmd_val(pmd) && !pmd_table(pmd))
+#define pmd_trans_splitting(pmd) (pmd_isset((pmd), L_PMD_SECT_SPLITTING))
 #endif
 
 #define PMD_BIT_FUNC(fn,op) \
 static inline pmd_t pmd_##fn(pmd_t pmd) { pmd_val(pmd) op; return pmd; }
 
-PMD_BIT_FUNC(wrprotect, |= PMD_SECT_RDONLY);
+PMD_BIT_FUNC(wrprotect, |= L_PMD_SECT_RDONLY);
 PMD_BIT_FUNC(mkold,     &= ~PMD_SECT_AF);
-PMD_BIT_FUNC(mksplitting, |= PMD_SECT_SPLITTING);
-PMD_BIT_FUNC(mkwrite,   &= ~PMD_SECT_RDONLY);
-PMD_BIT_FUNC(mkdirty,   |= PMD_SECT_DIRTY);
+PMD_BIT_FUNC(mksplitting, |= L_PMD_SECT_SPLITTING);
+PMD_BIT_FUNC(mkwrite,   &= ~L_PMD_SECT_RDONLY);
+PMD_BIT_FUNC(mkdirty,   |= L_PMD_SECT_DIRTY);
 PMD_BIT_FUNC(mkyoung,   |= PMD_SECT_AF);
 
 #define pmd_mkhuge(pmd)         (__pmd(pmd_val(pmd) & ~PMD_TABLE_BIT))
@@ -241,8 +247,8 @@ PMD_BIT_FUNC(mkyoung,   |= PMD_SECT_AF);
 
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
 {
-        const pmdval_t mask = PMD_SECT_USER | PMD_SECT_XN | PMD_SECT_RDONLY |
-                                PMD_SECT_VALID | PMD_SECT_NONE;
+        const pmdval_t mask = PMD_SECT_USER | PMD_SECT_XN | L_PMD_SECT_RDONLY |
+                                L_PMD_SECT_VALID | L_PMD_SECT_NONE;
         pmd_val(pmd) = (pmd_val(pmd) & ~mask) | (pgprot_val(newprot) & mask);
         return pmd;
 }
@@ -253,8 +259,13 @@ static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
         BUG_ON(addr >= TASK_SIZE);
 
         /* create a faulting entry if PROT_NONE protected */
-        if (pmd_val(pmd) & PMD_SECT_NONE)
-                pmd_val(pmd) &= ~PMD_SECT_VALID;
+        if (pmd_val(pmd) & L_PMD_SECT_NONE)
+                pmd_val(pmd) &= ~L_PMD_SECT_VALID;
+
+        if (pmd_write(pmd) && pmd_dirty(pmd))
+                pmd_val(pmd) &= ~PMD_SECT_AP2;
+        else
+                pmd_val(pmd) |= PMD_SECT_AP2;
 
         *pmdp = __pmd(pmd_val(pmd) | PMD_SECT_nG);
         flush_pmd_entry(pmdp);
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index 5478e5d6ad89..01baef07cd0c 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -214,18 +214,22 @@ static inline pte_t *pmd_page_vaddr(pmd_t pmd)
 
 #define pte_clear(mm,addr,ptep) set_pte_ext(ptep, __pte(0), 0)
 
+#define pte_isset(pte, val)     ((u32)(val) == (val) ? pte_val(pte) & (val) \
+                                                : !!(pte_val(pte) & (val)))
+#define pte_isclear(pte, val)   (!(pte_val(pte) & (val)))
+
 #define pte_none(pte)           (!pte_val(pte))
-#define pte_present(pte)        (pte_val(pte) & L_PTE_PRESENT)
-#define pte_valid(pte)          (pte_val(pte) & L_PTE_VALID)
+#define pte_present(pte)        (pte_isset((pte), L_PTE_PRESENT))
+#define pte_valid(pte)          (pte_isset((pte), L_PTE_VALID))
 #define pte_accessible(mm, pte) (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid(pte))
-#define pte_write(pte)          (!(pte_val(pte) & L_PTE_RDONLY))
-#define pte_dirty(pte)          (pte_val(pte) & L_PTE_DIRTY)
-#define pte_young(pte)          (pte_val(pte) & L_PTE_YOUNG)
-#define pte_exec(pte)           (!(pte_val(pte) & L_PTE_XN))
+#define pte_write(pte)          (pte_isclear((pte), L_PTE_RDONLY))
+#define pte_dirty(pte)          (pte_isset((pte), L_PTE_DIRTY))
+#define pte_young(pte)          (pte_isset((pte), L_PTE_YOUNG))
+#define pte_exec(pte)           (pte_isclear((pte), L_PTE_XN))
 #define pte_special(pte)        (0)
 
 #define pte_valid_user(pte)     \
-        (pte_valid(pte) && (pte_val(pte) & L_PTE_USER) && pte_young(pte))
+        (pte_valid(pte) && pte_isset((pte), L_PTE_USER) && pte_young(pte))
 
 #if __LINUX_ARM_ARCH__ < 6
 static inline void __sync_icache_dcache(pte_t pteval)
diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h
index c877654fe3bf..601264d983fa 100644
--- a/arch/arm/include/asm/ptrace.h
+++ b/arch/arm/include/asm/ptrace.h
@@ -84,6 +84,12 @@ static inline long regs_return_value(struct pt_regs *regs)
 
 #define instruction_pointer(regs)       (regs)->ARM_pc
 
+#ifdef CONFIG_THUMB2_KERNEL
+#define frame_pointer(regs) (regs)->ARM_r7
+#else
+#define frame_pointer(regs) (regs)->ARM_fp
+#endif
+
 static inline void instruction_pointer_set(struct pt_regs *regs,
                                            unsigned long val)
 {
diff --git a/arch/arm/include/asm/smp_scu.h b/arch/arm/include/asm/smp_scu.h
index 0393fbab8dd5..bfe163c40024 100644
--- a/arch/arm/include/asm/smp_scu.h
+++ b/arch/arm/include/asm/smp_scu.h
@@ -11,7 +11,7 @@
 
 static inline bool scu_a9_has_base(void)
 {
-        return read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9;
+        return read_cpuid_part() == ARM_CPU_PART_CORTEX_A9;
 }
 
 static inline unsigned long scu_a9_get_base(void)
diff --git a/arch/arm/include/asm/stacktrace.h b/arch/arm/include/asm/stacktrace.h
index 4d0a16441b29..7722201ead19 100644
--- a/arch/arm/include/asm/stacktrace.h
+++ b/arch/arm/include/asm/stacktrace.h
@@ -1,13 +1,28 @@
 #ifndef __ASM_STACKTRACE_H
 #define __ASM_STACKTRACE_H
 
+#include <asm/ptrace.h>
+
 struct stackframe {
+        /*
+         * FP member should hold R7 when CONFIG_THUMB2_KERNEL is enabled
+         * and R11 otherwise.
+         */
         unsigned long fp;
         unsigned long sp;
         unsigned long lr;
         unsigned long pc;
 };
 
+static __always_inline
+void arm_get_current_stackframe(struct pt_regs *regs, struct stackframe *frame)
+{
+                frame->fp = frame_pointer(regs);
+                frame->sp = regs->ARM_sp;
+                frame->lr = regs->ARM_lr;
+                frame->pc = regs->ARM_pc;
+}
+
 extern int unwind_frame(struct stackframe *frame);
 extern void walk_stackframe(struct stackframe *frame,
                             int (*fn)(struct stackframe *, void *), void *data);
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index e4e4208a9130..fc44d3761f9e 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -14,9 +14,10 @@
 
 #include <linux/compiler.h>
 #include <asm/fpstate.h>
+#include <asm/page.h>
 
 #define THREAD_SIZE_ORDER       1
-#define THREAD_SIZE             8192
+#define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)
 #define THREAD_START_SP         (THREAD_SIZE - 8)
 
 #ifndef __ASSEMBLY__
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 75d95799b6e6..7057cf8b87d0 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -107,6 +107,8 @@ static inline void set_fs(mm_segment_t fs)
 extern int __get_user_1(void *);
 extern int __get_user_2(void *);
 extern int __get_user_4(void *);
+extern int __get_user_lo8(void *);
+extern int __get_user_8(void *);
 
 #define __GUP_CLOBBER_1 "lr", "cc"
 #ifdef CONFIG_CPU_USE_DOMAINS
@@ -115,6 +117,8 @@ extern int __get_user_4(void *);
 #define __GUP_CLOBBER_2 "lr", "cc"
 #endif
 #define __GUP_CLOBBER_4 "lr", "cc"
+#define __GUP_CLOBBER_lo8 "lr", "cc"
+#define __GUP_CLOBBER_8 "lr", "cc"
 
 #define __get_user_x(__r2,__p,__e,__l,__s)                              \
            __asm__ __volatile__ (                                       \
@@ -125,11 +129,19 @@ extern int __get_user_4(void *);
                 : "0" (__p), "r" (__l)                                  \
                 : __GUP_CLOBBER_##__s)
 
+/* narrowing a double-word get into a single 32bit word register: */
+#ifdef __ARMEB__
+#define __get_user_xb(__r2, __p, __e, __l, __s)                         \
+        __get_user_x(__r2, __p, __e, __l, lo8)
+#else
+#define __get_user_xb __get_user_x
+#endif
+
 #define __get_user_check(x,p)                                                   \
         ({                                                              \
                 unsigned long __limit = current_thread_info()->addr_limit - 1; \
                 register const typeof(*(p)) __user *__p asm("r0") = (p);\
-                register unsigned long __r2 asm("r2");                  \
+                register typeof(x) __r2 asm("r2");                      \
                 register unsigned long __l asm("r1") = __limit;         \
                 register int __e asm("r0");                             \
                 switch (sizeof(*(__p))) {                               \
@@ -142,6 +154,12 @@ extern int __get_user_4(void *);
                 case 4:                                                 \
                         __get_user_x(__r2, __p, __e, __l, 4);           \
                         break;                                          \
+                case 8:                                                 \
+                        if (sizeof((x)) < 8)                            \
+                                __get_user_xb(__r2, __p, __e, __l, 4);  \
+                        else                                            \
+                                __get_user_x(__r2, __p, __e, __l, 8);   \
+                        break;                                          \
                 default: __e = __get_user_bad(); break;                 \
                 }                                                       \
                 x = (typeof(*(p))) __r2;                                \
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 43876245fc57..21ca0cebcab0 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -15,7 +15,17 @@
 
 #include <uapi/asm/unistd.h>
 
+/*
+ * This may need to be greater than __NR_last_syscall+1 in order to
+ * account for the padding in the syscall table
+ */
 #define __NR_syscalls  (384)
+
+/*
+ * *NOTE*: This is a ghost syscall private to the kernel.  Only the
+ * __kuser_cmpxchg code in entry-armv.S should be aware of its
+ * existence.  Don't ever use this from user code.
+ */
 #define __ARM_NR_cmpxchg                (__ARM_NR_BASE+0x00fff0)
 
 #define __ARCH_WANT_STAT64
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index ba94446c72d9..acd5b66ea3aa 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -411,11 +411,6 @@
 #define __NR_renameat2                  (__NR_SYSCALL_BASE+382)
 
 /*
- * This may need to be greater than __NR_last_syscall+1 in order to
- * account for the padding in the syscall table
- */
-
-/*
  * The following SWIs are ARM private.
  */
 #define __ARM_NR_BASE                   (__NR_SYSCALL_BASE+0x0f0000)
@@ -426,12 +421,6 @@
 #define __ARM_NR_set_tls                (__ARM_NR_BASE+5)
 
 /*
- * *NOTE*: This is a ghost syscall private to the kernel.  Only the
- * __kuser_cmpxchg code in entry-armv.S should be aware of its
- * existence.  Don't ever use this from user code.
- */
-
-/*
  * The following syscalls are obsolete and no longer available for EABI.
  */
 #if !defined(__KERNEL__)
diff --git a/arch/arm/kernel/debug.S b/arch/arm/kernel/debug.S
index 14f7c3b14632..78c91b5f97d4 100644
--- a/arch/arm/kernel/debug.S
+++ b/arch/arm/kernel/debug.S
@@ -90,7 +90,7 @@ ENTRY(printascii)
                 ldrneb  r1, [r0], #1
                 teqne   r1, #0
                 bne     1b
-                mov     pc, lr
+                ret     lr
 ENDPROC(printascii)
 
 ENTRY(printch)
@@ -105,7 +105,7 @@ ENTRY(debug_ll_addr)
                 addruart r2, r3, ip
                 str     r2, [r0]
                 str     r3, [r1]
-                mov     pc, lr
+                ret     lr
 ENDPROC(debug_ll_addr)
 #endif
 
@@ -116,7 +116,7 @@ ENTRY(printascii)
                 mov     r0, #0x04               @ SYS_WRITE0
         ARM(    svc     #0x123456       )
         THUMB(  svc     #0xab           )
-                mov     pc, lr
+                ret     lr
 ENDPROC(printascii)
 
 ENTRY(printch)
@@ -125,14 +125,14 @@ ENTRY(printch)
                 mov     r0, #0x03               @ SYS_WRITEC
         ARM(    svc     #0x123456       )
         THUMB(  svc     #0xab           )
-                mov     pc, lr
+                ret     lr
 ENDPROC(printch)
 
 ENTRY(debug_ll_addr)
                 mov     r2, #0
                 str     r2, [r0]
                 str     r2, [r1]
-                mov     pc, lr
+                ret     lr
 ENDPROC(debug_ll_addr)
 
 #endif
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 52a949a8077d..36276cdccfbc 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -224,7 +224,7 @@ svc_preempt:
 1:      bl      preempt_schedule_irq            @ irq en/disable is done inside
         ldr     r0, [tsk, #TI_FLAGS]            @ get new tasks TI_FLAGS
         tst     r0, #_TIF_NEED_RESCHED
-        moveq   pc, r8                          @ go again
+        reteq   r8                              @ go again
         b       1b
 #endif
 
@@ -490,7 +490,7 @@ ENDPROC(__und_usr)
         .pushsection .fixup, "ax"
         .align  2
 4:      str     r4, [sp, #S_PC]                 @ retry current instruction
-        mov     pc, r9
+        ret     r9
         .popsection
         .pushsection __ex_table,"a"
         .long   1b, 4b
@@ -552,7 +552,7 @@ call_fpe:
 #endif
         tst     r0, #0x08000000                 @ only CDP/CPRT/LDC/STC have bit 27
         tstne   r0, #0x04000000                 @ bit 26 set on both ARM and Thumb-2
-        moveq   pc, lr
+        reteq   lr
         and     r8, r0, #0x00000f00             @ mask out CP number
  THUMB( lsr     r8, r8, #8              )
         mov     r7, #1
@@ -571,33 +571,33 @@ call_fpe:
  THUMB( add     pc, r8                  )
         nop
 
-        movw_pc lr                              @ CP#0
+        ret.w   lr                              @ CP#0
         W(b)    do_fpe                          @ CP#1 (FPE)
         W(b)    do_fpe                          @ CP#2 (FPE)
-        movw_pc lr                              @ CP#3
+        ret.w   lr                              @ CP#3
 #ifdef CONFIG_CRUNCH
         b       crunch_task_enable              @ CP#4 (MaverickCrunch)
         b       crunch_task_enable              @ CP#5 (MaverickCrunch)
         b       crunch_task_enable              @ CP#6 (MaverickCrunch)
 #else
-        movw_pc lr                              @ CP#4
-        movw_pc lr                              @ CP#5
-        movw_pc lr                              @ CP#6
+        ret.w   lr                              @ CP#4
+        ret.w   lr                              @ CP#5
+        ret.w   lr                              @ CP#6
 #endif
-        movw_pc lr                              @ CP#7
-        movw_pc lr                              @ CP#8
-        movw_pc lr                              @ CP#9
+        ret.w   lr                              @ CP#7
+        ret.w   lr                              @ CP#8
+        ret.w   lr                              @ CP#9
 #ifdef CONFIG_VFP
         W(b)    do_vfp                          @ CP#10 (VFP)
         W(b)    do_vfp                          @ CP#11 (VFP)
 #else
-        movw_pc lr                              @ CP#10 (VFP)
-        movw_pc lr                              @ CP#11 (VFP)
+        ret.w   lr                              @ CP#10 (VFP)
+        ret.w   lr                              @ CP#11 (VFP)
 #endif
-        movw_pc lr                              @ CP#12
-        movw_pc lr                              @ CP#13
-        movw_pc lr                              @ CP#14 (Debug)
-        movw_pc lr                              @ CP#15 (Control)
+        ret.w   lr                              @ CP#12
+        ret.w   lr                              @ CP#13
+        ret.w   lr                              @ CP#14 (Debug)
+        ret.w   lr                              @ CP#15 (Control)
 
 #ifdef NEED_CPU_ARCHITECTURE
         .align  2
@@ -649,7 +649,7 @@ ENTRY(fp_enter)
         .popsection
 
 ENTRY(no_fp)
-        mov     pc, lr
+        ret     lr
 ENDPROC(no_fp)
 
 __und_usr_fault_32:
@@ -745,7 +745,7 @@ ENDPROC(__switch_to)
 #ifdef CONFIG_ARM_THUMB
         bx      \reg
 #else
-        mov     pc, \reg
+        ret     \reg
 #endif
         .endm
 
@@ -837,7 +837,7 @@ kuser_cmpxchg64_fixup:
 #if __LINUX_ARM_ARCH__ < 6
         bcc     kuser_cmpxchg32_fixup
 #endif
-        mov     pc, lr
+        ret     lr
         .previous
 
 #else
@@ -905,7 +905,7 @@ kuser_cmpxchg32_fixup:
         subs    r8, r4, r7
         rsbcss  r8, r8, #(2b - 1b)
         strcs   r7, [sp, #S_PC]
-        mov     pc, lr
+        ret     lr
         .previous
 
 #else
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 7139d4a7dea7..e52fe5a2d843 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -8,6 +8,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <asm/assembler.h>
 #include <asm/unistd.h>
 #include <asm/ftrace.h>
 #include <asm/unwind.h>
@@ -88,7 +89,7 @@ ENTRY(ret_from_fork)
         cmp     r5, #0
         movne   r0, r4
         adrne   lr, BSYM(1f)
-        movne   pc, r5
+        retne   r5
 1:      get_thread_info tsk
         b       ret_slow_syscall
 ENDPROC(ret_from_fork)
@@ -290,7 +291,7 @@ ENDPROC(ftrace_graph_caller_old)
 
 .macro mcount_exit
         ldmia   sp!, {r0-r3, ip, lr}
-        mov     pc, ip
+        ret     ip
 .endm
 
 ENTRY(__gnu_mcount_nc)
@@ -298,7 +299,7 @@ UNWIND(.fnstart)
 #ifdef CONFIG_DYNAMIC_FTRACE
         mov     ip, lr
         ldmia   sp!, {lr}
-        mov     pc, ip
+        ret     ip
 #else
         __mcount
 #endif
@@ -333,12 +334,12 @@ return_to_handler:
         bl      ftrace_return_to_handler
         mov     lr, r0                  @ r0 has real ret addr
         ldmia   sp!, {r0-r3}
-        mov     pc, lr
+        ret     lr
 #endif
 
 ENTRY(ftrace_stub)
 .Lftrace_stub:
-        mov     pc, lr
+        ret     lr
 ENDPROC(ftrace_stub)
 
 #endif /* CONFIG_FUNCTION_TRACER */
@@ -561,7 +562,7 @@ sys_mmap2:
                 streq   r5, [sp, #4]
                 beq     sys_mmap_pgoff
                 mov     r0, #-EINVAL
-                mov     pc, lr
+                ret     lr
 #else
                 str     r5, [sp, #4]
                 b       sys_mmap_pgoff
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 5d702f8900b1..8db307d0954b 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -240,12 +240,6 @@
         movs    pc, lr                          @ return & move spsr_svc into cpsr
         .endm
 
-        @
-        @ 32-bit wide "mov pc, reg"
-        @
-        .macro  movw_pc, reg
-        mov     pc, \reg
-        .endm
 #else   /* CONFIG_THUMB2_KERNEL */
         .macro  svc_exit, rpsr, irq = 0
         .if     \irq != 0
@@ -304,14 +298,6 @@
         movs    pc, lr                          @ return & move spsr_svc into cpsr
         .endm
 #endif  /* ifdef CONFIG_CPU_V7M / else */
-
-        @
-        @ 32-bit wide "mov pc, reg"
-        @
-        .macro  movw_pc, reg
-        mov     pc, \reg
-        nop
-        .endm
 #endif  /* !CONFIG_THUMB2_KERNEL */
 
 /*
diff --git a/arch/arm/kernel/fiqasm.S b/arch/arm/kernel/fiqasm.S
index 207f9d652010..8dd26e1a9bd6 100644
--- a/arch/arm/kernel/fiqasm.S
+++ b/arch/arm/kernel/fiqasm.S
@@ -32,7 +32,7 @@ ENTRY(__set_fiq_regs)
         ldr     lr, [r0]
         msr     cpsr_c, r1      @ return to SVC mode
         mov     r0, r0          @ avoid hazard prior to ARMv4
-        mov     pc, lr
+        ret     lr
 ENDPROC(__set_fiq_regs)
 
 ENTRY(__get_fiq_regs)
@@ -45,5 +45,5 @@ ENTRY(__get_fiq_regs)
         str     lr, [r0]
         msr     cpsr_c, r1      @ return to SVC mode
         mov     r0, r0          @ avoid hazard prior to ARMv4
-        mov     pc, lr
+        ret     lr
 ENDPROC(__get_fiq_regs)
diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
index 572a38335c96..8733012d231f 100644
--- a/arch/arm/kernel/head-common.S
+++ b/arch/arm/kernel/head-common.S
@@ -10,6 +10,7 @@
  * published by the Free Software Foundation.
  *
  */
+#include <asm/assembler.h>
 
 #define ATAG_CORE 0x54410001
 #define ATAG_CORE_SIZE ((2*4 + 3*4) >> 2)
@@ -61,10 +62,10 @@ __vet_atags:
         cmp     r5, r6
         bne     1f
 
-2:      mov     pc, lr                          @ atag/dtb pointer is ok
+2:      ret     lr                              @ atag/dtb pointer is ok
 
 1:      mov     r2, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__vet_atags)
 
 /*
@@ -162,7 +163,7 @@ __lookup_processor_type:
         cmp     r5, r6
         blo     1b
         mov     r5, #0                          @ unknown processor
-2:      mov     pc, lr
+2:      ret     lr
 ENDPROC(__lookup_processor_type)
 
 /*
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index 716249cc2ee1..cc176b67c134 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -82,7 +82,7 @@ ENTRY(stext)
         adr     lr, BSYM(1f)                    @ return (PIC) address
  ARM(   add     pc, r10, #PROCINFO_INITFUNC     )
  THUMB( add     r12, r10, #PROCINFO_INITFUNC    )
- THUMB( mov     pc, r12                         )
+ THUMB( ret     r12                             )
  1:     b       __after_proc_init
 ENDPROC(stext)
 
@@ -119,7 +119,7 @@ ENTRY(secondary_startup)
         mov     r13, r12                        @ __secondary_switched address
  ARM(   add     pc, r10, #PROCINFO_INITFUNC     )
  THUMB( add     r12, r10, #PROCINFO_INITFUNC    )
- THUMB( mov     pc, r12                         )
+ THUMB( ret     r12                             )
 ENDPROC(secondary_startup)
 
 ENTRY(__secondary_switched)
@@ -164,7 +164,7 @@ __after_proc_init:
 #endif
         mcr     p15, 0, r0, c1, c0, 0           @ write control reg
 #endif /* CONFIG_CPU_CP15 */
-        mov     pc, r13
+        ret     r13
 ENDPROC(__after_proc_init)
         .ltorg
 
@@ -254,7 +254,7 @@ ENTRY(__setup_mpu)
         orr     r0, r0, #CR_M                   @ Set SCTRL.M (MPU on)
         mcr     p15, 0, r0, c1, c0, 0           @ Enable MPU
         isb
-        mov pc,lr
+        ret     lr
 ENDPROC(__setup_mpu)
 #endif
 #include "head-common.S"
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 2c35f0ff2fdc..664eee8c4a26 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -140,7 +140,7 @@ ENTRY(stext)
         mov     r8, r4                          @ set TTBR1 to swapper_pg_dir
  ARM(   add     pc, r10, #PROCINFO_INITFUNC     )
  THUMB( add     r12, r10, #PROCINFO_INITFUNC    )
- THUMB( mov     pc, r12                         )
+ THUMB( ret     r12                             )
 1:      b       __enable_mmu
 ENDPROC(stext)
         .ltorg
@@ -335,7 +335,7 @@ __create_page_tables:
         sub     r4, r4, #0x1000         @ point to the PGD table
         mov     r4, r4, lsr #ARCH_PGD_SHIFT
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(__create_page_tables)
         .ltorg
         .align
@@ -383,7 +383,7 @@ ENTRY(secondary_startup)
  ARM(   add     pc, r10, #PROCINFO_INITFUNC     ) @ initialise processor
                                                   @ (return control reg)
  THUMB( add     r12, r10, #PROCINFO_INITFUNC    )
- THUMB( mov     pc, r12                         )
+ THUMB( ret     r12                             )
 ENDPROC(secondary_startup)
 
         /*
@@ -468,7 +468,7 @@ ENTRY(__turn_mmu_on)
         instr_sync
         mov     r3, r3
         mov     r3, r13
-        mov     pc, r3
+        ret     r3
 __turn_mmu_on_end:
 ENDPROC(__turn_mmu_on)
         .popsection
@@ -487,7 +487,7 @@ __fixup_smp:
         orr     r4, r4, #0x0000b000
         orr     r4, r4, #0x00000020     @ val 0x4100b020
         teq     r3, r4                  @ ARM 11MPCore?
-        moveq   pc, lr                  @ yes, assume SMP
+        reteq   lr                      @ yes, assume SMP
 
         mrc     p15, 0, r0, c0, c0, 5   @ read MPIDR
         and     r0, r0, #0xc0000000     @ multiprocessing extensions and
@@ -500,7 +500,7 @@ __fixup_smp:
         orr     r4, r4, #0x0000c000
         orr     r4, r4, #0x00000090
         teq     r3, r4                  @ Check for ARM Cortex-A9
-        movne   pc, lr                  @ Not ARM Cortex-A9,
+        retne   lr                      @ Not ARM Cortex-A9,
 
         @ If a future SoC *does* use 0x0 as the PERIPH_BASE, then the
         @ below address check will need to be #ifdef'd or equivalent
@@ -512,7 +512,7 @@ __fixup_smp:
 ARM_BE8(rev     r0, r0)                 @ byteswap if big endian
         and     r0, r0, #0x3            @ number of CPUs
         teq     r0, #0x0                @ is 1?
-        movne   pc, lr
+        retne   lr
 
 __fixup_smp_on_up:
         adr     r0, 1f
@@ -539,7 +539,7 @@ smp_on_up:
         .text
 __do_fixup_smp_on_up:
         cmp     r4, r5
-        movhs   pc, lr
+        reths   lr
         ldmia   r4!, {r0, r6}
  ARM(   str     r6, [r0, r3]    )
  THUMB( add     r0, r0, r3      )
@@ -672,7 +672,7 @@ ARM_BE8(rev16	ip, ip)
 2:      cmp     r4, r5
         ldrcc   r7, [r4], #4    @ use branch for delay slot
         bcc     1b
-        mov     pc, lr
+        ret     lr
 #endif
 ENDPROC(__fixup_a_pv_table)
 
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 797b1a6a4906..56ce6290c831 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -99,7 +99,7 @@ ENTRY(__hyp_stub_install_secondary)
          * immediately.
          */
         compare_cpu_mode_with_primary   r4, r5, r6, r7
-        movne   pc, lr
+        retne   lr
 
         /*
          * Once we have given up on one CPU, we do not try to install the
@@ -111,7 +111,7 @@ ENTRY(__hyp_stub_install_secondary)
          */
 
         cmp     r4, #HYP_MODE
-        movne   pc, lr                  @ give up if the CPU is not in HYP mode
+        retne   lr                      @ give up if the CPU is not in HYP mode
 
 /*
  * Configure HSCTLR to set correct exception endianness/instruction set
@@ -201,7 +201,7 @@ ENDPROC(__hyp_get_vectors)
         @ fall through
 ENTRY(__hyp_set_vectors)
         __HVC(0)
-        mov     pc, lr
+        ret     lr
 ENDPROC(__hyp_set_vectors)
 
 #ifndef ZIMAGE
diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
index 2b32978ae905..ad58e565fe98 100644
--- a/arch/arm/kernel/iwmmxt.S
+++ b/arch/arm/kernel/iwmmxt.S
@@ -100,7 +100,7 @@ ENTRY(iwmmxt_task_enable)
         get_thread_info r10
 #endif
 4:      dec_preempt_count r10, r3
-        mov     pc, r9                          @ normal exit from exception
+        ret     r9                              @ normal exit from exception
 
 concan_save:
 
@@ -144,7 +144,7 @@ concan_dump:
         wstrd   wR15, [r1, #MMX_WR15]
 
 2:      teq     r0, #0                          @ anything to load?
-        moveq   pc, lr                          @ if not, return
+        reteq   lr                              @ if not, return
 
 concan_load:
 
@@ -177,10 +177,10 @@ concan_load:
         @ clear CUP/MUP (only if r1 != 0)
         teq     r1, #0
         mov     r2, #0
-        moveq   pc, lr
+        reteq   lr
 
         tmcr    wCon, r2
-        mov     pc, lr
+        ret     lr
 
 /*
  * Back up Concan regs to save area and disable access to them
@@ -266,7 +266,7 @@ ENTRY(iwmmxt_task_copy)
         mov     r3, lr                          @ preserve return address
         bl      concan_dump
         msr     cpsr_c, ip                      @ restore interrupt mode
-        mov     pc, r3
+        ret     r3
 
 /*
  * Restore Concan state from given memory address
@@ -302,7 +302,7 @@ ENTRY(iwmmxt_task_restore)
         mov     r3, lr                          @ preserve return address
         bl      concan_load
         msr     cpsr_c, ip                      @ restore interrupt mode
-        mov     pc, r3
+        ret     r3
 
 /*
  * Concan handling on task switch
@@ -324,7 +324,7 @@ ENTRY(iwmmxt_task_switch)
         add     r3, r0, #TI_IWMMXT_STATE        @ get next task Concan save area
         ldr     r2, [r2]                        @ get current Concan owner
         teq     r2, r3                          @ next task owns it?
-        movne   pc, lr                          @ no: leave Concan disabled
+        retne   lr                              @ no: leave Concan disabled
 
 1:      @ flip Concan access
         XSC(eor r1, r1, #0x3)
@@ -351,7 +351,7 @@ ENTRY(iwmmxt_task_release)
         eors    r0, r0, r1                      @ if equal...
         streq   r0, [r3]                        @ then clear ownership
         msr     cpsr_c, r2                      @ restore interrupts
-        mov     pc, lr
+        ret     lr
 
         .data
 concan_owner:
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 4238bcba9d60..ae3e216a52c2 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -621,10 +621,7 @@ perf_callchain_kernel(struct perf_callchain_entry *entry, struct pt_regs *regs)
                 return;
         }
 
-        fr.fp = regs->ARM_fp;
-        fr.sp = regs->ARM_sp;
-        fr.lr = regs->ARM_lr;
-        fr.pc = regs->ARM_pc;
+        arm_get_current_stackframe(regs, &fr);
         walk_stackframe(&fr, callchain_trace, entry);
 }
 
diff --git a/arch/arm/kernel/perf_event_cpu.c b/arch/arm/kernel/perf_event_cpu.c
index af9e35e8836f..c02c2e8c877d 100644
--- a/arch/arm/kernel/perf_event_cpu.c
+++ b/arch/arm/kernel/perf_event_cpu.c
@@ -250,40 +250,39 @@ static struct platform_device_id cpu_pmu_plat_device_ids[] = {
 static int probe_current_pmu(struct arm_pmu *pmu)
 {
         int cpu = get_cpu();
-        unsigned long implementor = read_cpuid_implementor();
-        unsigned long part_number = read_cpuid_part_number();
         int ret = -ENODEV;
 
         pr_info("probing PMU on CPU %d\n", cpu);
 
+        switch (read_cpuid_part()) {
         /* ARM Ltd CPUs. */
-        if (implementor == ARM_CPU_IMP_ARM) {
-                switch (part_number) {
-                case ARM_CPU_PART_ARM1136:
-                case ARM_CPU_PART_ARM1156:
-                case ARM_CPU_PART_ARM1176:
-                        ret = armv6pmu_init(pmu);
-                        break;
-                case ARM_CPU_PART_ARM11MPCORE:
-                        ret = armv6mpcore_pmu_init(pmu);
-                        break;
-                case ARM_CPU_PART_CORTEX_A8:
-                        ret = armv7_a8_pmu_init(pmu);
-                        break;
-                case ARM_CPU_PART_CORTEX_A9:
-                        ret = armv7_a9_pmu_init(pmu);
-                        break;
-                }
-        /* Intel CPUs [xscale]. */
-        } else if (implementor == ARM_CPU_IMP_INTEL) {
-                switch (xscale_cpu_arch_version()) {
-                case ARM_CPU_XSCALE_ARCH_V1:
-                        ret = xscale1pmu_init(pmu);
-                        break;
-                case ARM_CPU_XSCALE_ARCH_V2:
-                        ret = xscale2pmu_init(pmu);
-                        break;
+        case ARM_CPU_PART_ARM1136:
+        case ARM_CPU_PART_ARM1156:
+        case ARM_CPU_PART_ARM1176:
+                ret = armv6pmu_init(pmu);
+                break;
+        case ARM_CPU_PART_ARM11MPCORE:
+                ret = armv6mpcore_pmu_init(pmu);
+                break;
+        case ARM_CPU_PART_CORTEX_A8:
+                ret = armv7_a8_pmu_init(pmu);
+                break;
+        case ARM_CPU_PART_CORTEX_A9:
+                ret = armv7_a9_pmu_init(pmu);
+                break;
+
+        default:
+                if (read_cpuid_implementor() == ARM_CPU_IMP_INTEL) {
+                        switch (xscale_cpu_arch_version()) {
+                        case ARM_CPU_XSCALE_ARCH_V1:
+                                ret = xscale1pmu_init(pmu);
+                                break;
+                        case ARM_CPU_XSCALE_ARCH_V2:
+                                ret = xscale2pmu_init(pmu);
+                                break;
+                        }
                 }
+                break;
         }
 
         put_cpu();
diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
index 95858966d84e..35e72585ec1d 100644
--- a/arch/arm/kernel/relocate_kernel.S
+++ b/arch/arm/kernel/relocate_kernel.S
@@ -3,6 +3,7 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/kexec.h>
 
         .align  3       /* not needed for this code, but keeps fncpy() happy */
@@ -59,7 +60,7 @@ ENTRY(relocate_new_kernel)
         mov r0,#0
         ldr r1,kexec_mach_type
         ldr r2,kexec_boot_atags
- ARM(   mov pc, lr      )
+ ARM(   ret lr  )
  THUMB( bx lr           )
 
         .align
diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
index 1b880db2a033..e1e60e5a7a27 100644
--- a/arch/arm/kernel/sleep.S
+++ b/arch/arm/kernel/sleep.S
@@ -107,7 +107,7 @@ ENTRY(cpu_resume_mmu)
         instr_sync
         mov     r0, r0
         mov     r0, r0
-        mov     pc, r3                  @ jump to virtual address
+        ret     r3                      @ jump to virtual address
 ENDPROC(cpu_resume_mmu)
         .popsection
 cpu_resume_after_mmu:
diff --git a/arch/arm/kernel/smp_scu.c b/arch/arm/kernel/smp_scu.c
index 1aafa0d785eb..72f9241ad5db 100644
--- a/arch/arm/kernel/smp_scu.c
+++ b/arch/arm/kernel/smp_scu.c
@@ -17,6 +17,8 @@
 #include <asm/cputype.h>
 
 #define SCU_CTRL                0x00
+#define SCU_ENABLE              (1 << 0)
+#define SCU_STANDBY_ENABLE      (1 << 5)
 #define SCU_CONFIG              0x04
 #define SCU_CPU_STATUS          0x08
 #define SCU_INVALIDATE          0x0c
@@ -50,10 +52,16 @@ void scu_enable(void __iomem *scu_base)
 
         scu_ctrl = readl_relaxed(scu_base + SCU_CTRL);
         /* already enabled? */
-        if (scu_ctrl & 1)
+        if (scu_ctrl & SCU_ENABLE)
                 return;
 
-        scu_ctrl |= 1;
+        scu_ctrl |= SCU_ENABLE;
+
+        /* Cortex-A9 earlier than r2p0 has no standby bit in SCU */
+        if ((read_cpuid_id() & 0xff0ffff0) == 0x410fc090 &&
+            (read_cpuid_id() & 0x00f0000f) >= 0x00200000)
+                scu_ctrl |= SCU_STANDBY_ENABLE;
+
         writel_relaxed(scu_ctrl, scu_base + SCU_CTRL);
 
         /*
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index 95d063620b76..2e72be4f623e 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -92,15 +92,19 @@ void erratum_a15_798181_init(void)
         unsigned int midr = read_cpuid_id();
         unsigned int revidr = read_cpuid(CPUID_REVIDR);
 
-        /* Cortex-A15 r0p0..r3p2 w/o ECO fix affected */
-        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2 ||
-            (revidr & 0x210) == 0x210) {
-                return;
-        }
-        if (revidr & 0x10)
-                erratum_a15_798181_handler = erratum_a15_798181_partial;
-        else
+        /* Brahma-B15 r0p0..r0p2 affected
+         * Cortex-A15 r0p0..r3p2 w/o ECO fix affected */
+        if ((midr & 0xff0ffff0) == 0x420f00f0 && midr <= 0x420f00f2)
                 erratum_a15_798181_handler = erratum_a15_798181_broadcast;
+        else if ((midr & 0xff0ffff0) == 0x410fc0f0 && midr <= 0x413fc0f2 &&
+                 (revidr & 0x210) != 0x210) {
+                if (revidr & 0x10)
+                        erratum_a15_798181_handler =
+                                erratum_a15_798181_partial;
+                else
+                        erratum_a15_798181_handler =
+                                erratum_a15_798181_broadcast;
+        }
 }
 #endif
 
diff --git a/arch/arm/kernel/time.c b/arch/arm/kernel/time.c
index 829a96d4a179..0cc7e58c47cc 100644
--- a/arch/arm/kernel/time.c
+++ b/arch/arm/kernel/time.c
@@ -50,10 +50,7 @@ unsigned long profile_pc(struct pt_regs *regs)
         if (!in_lock_functions(regs->ARM_pc))
                 return regs->ARM_pc;
 
-        frame.fp = regs->ARM_fp;
-        frame.sp = regs->ARM_sp;
-        frame.lr = regs->ARM_lr;
-        frame.pc = regs->ARM_pc;
+        arm_get_current_stackframe(regs, &frame);
         do {
                 int ret = unwind_frame(&frame);
                 if (ret < 0)
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index abd2fc067736..c8e4bb714944 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -31,11 +31,13 @@
 #include <asm/exception.h>
 #include <asm/unistd.h>
 #include <asm/traps.h>
+#include <asm/ptrace.h>
 #include <asm/unwind.h>
 #include <asm/tls.h>
 #include <asm/system_misc.h>
 #include <asm/opcodes.h>
 
+
 static const char *handler[]= {
         "prefetch abort",
         "data abort",
@@ -184,7 +186,7 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
                 tsk = current;
 
         if (regs) {
-                fp = regs->ARM_fp;
+                fp = frame_pointer(regs);
                 mode = processor_mode(regs);
         } else if (tsk != current) {
                 fp = thread_saved_fp(tsk);
@@ -719,7 +721,7 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
                 dump_instr("", regs);
                 if (user_mode(regs)) {
                         __show_regs(regs);
-                        c_backtrace(regs->ARM_fp, processor_mode(regs));
+                        c_backtrace(frame_pointer(regs), processor_mode(regs));
                 }
         }
 #endif
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index e67682f02cb2..a61a1dfbb0db 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -479,12 +479,10 @@ void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk)
                 tsk = current;
 
         if (regs) {
-                frame.fp = regs->ARM_fp;
-                frame.sp = regs->ARM_sp;
-                frame.lr = regs->ARM_lr;
+                arm_get_current_stackframe(regs, &frame);
                 /* PC might be corrupted, use LR in that case. */
-                frame.pc = kernel_text_address(regs->ARM_pc)
-                         ? regs->ARM_pc : regs->ARM_lr;
+                if (!kernel_text_address(regs->ARM_pc))
+                        frame.pc = regs->ARM_lr;
         } else if (tsk == current) {
                 frame.fp = (unsigned long)__builtin_frame_address(0);
                 frame.sp = current_sp;
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 7bcee5c9b604..6f57cb94367f 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -318,7 +318,6 @@ SECTIONS
         _end = .;
 
         STABS_DEBUG
-        .comment 0 : { *(.comment) }
 }
 
 /*
diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c
index b23a59c1c522..70bf49b8b244 100644
--- a/arch/arm/kvm/guest.c
+++ b/arch/arm/kvm/guest.c
@@ -274,13 +274,7 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
 
 int __attribute_const__ kvm_target_cpu(void)
 {
-        unsigned long implementor = read_cpuid_implementor();
-        unsigned long part_number = read_cpuid_part_number();
-
-        if (implementor != ARM_CPU_IMP_ARM)
-                return -EINVAL;
-
-        switch (part_number) {
+        switch (read_cpuid_part()) {
         case ARM_CPU_PART_CORTEX_A7:
                 return KVM_ARM_TARGET_CORTEX_A7;
         case ARM_CPU_PART_CORTEX_A15:
diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S
index 1b9844d369cc..b2d229f09c07 100644
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -17,6 +17,7 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/unified.h>
 #include <asm/asm-offsets.h>
 #include <asm/kvm_asm.h>
@@ -134,7 +135,7 @@ phase2:
         ldr     r0, =TRAMPOLINE_VA
         adr     r1, target
         bfi     r0, r1, #0, #PAGE_SHIFT
-        mov     pc, r0
+        ret     r0
 
 target: @ We're now in the trampoline code, switch page tables
         mcrr    p15, 4, r2, r3, c2
diff --git a/arch/arm/lib/ashldi3.S b/arch/arm/lib/ashldi3.S
index 638deb13da1c..b05e95840651 100644
--- a/arch/arm/lib/ashldi3.S
+++ b/arch/arm/lib/ashldi3.S
@@ -27,6 +27,7 @@ Boston, MA 02110-1301, USA.  */
 
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 
 #ifdef __ARMEB__
 #define al r1
@@ -47,7 +48,7 @@ ENTRY(__aeabi_llsl)
  THUMB( lsrmi   r3, al, ip              )
  THUMB( orrmi   ah, ah, r3              )
         mov     al, al, lsl r2
-        mov     pc, lr
+        ret     lr
 
 ENDPROC(__ashldi3)
 ENDPROC(__aeabi_llsl)
diff --git a/arch/arm/lib/ashrdi3.S b/arch/arm/lib/ashrdi3.S
index 015e8aa5a1d1..275d7d2341a4 100644
--- a/arch/arm/lib/ashrdi3.S
+++ b/arch/arm/lib/ashrdi3.S
@@ -27,6 +27,7 @@ Boston, MA 02110-1301, USA.  */
 
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 
 #ifdef __ARMEB__
 #define al r1
@@ -47,7 +48,7 @@ ENTRY(__aeabi_lasr)
  THUMB( lslmi   r3, ah, ip              )
  THUMB( orrmi   al, al, r3              )
         mov     ah, ah, asr r2
-        mov     pc, lr
+        ret     lr
 
 ENDPROC(__ashrdi3)
 ENDPROC(__aeabi_lasr)
diff --git a/arch/arm/lib/backtrace.S b/arch/arm/lib/backtrace.S
index 4102be617fce..fab5a50503ae 100644
--- a/arch/arm/lib/backtrace.S
+++ b/arch/arm/lib/backtrace.S
@@ -25,7 +25,7 @@
 ENTRY(c_backtrace)
 
 #if !defined(CONFIG_FRAME_POINTER) || !defined(CONFIG_PRINTK)
-                mov     pc, lr
+                ret     lr
 ENDPROC(c_backtrace)
 #else
                 stmfd   sp!, {r4 - r8, lr}      @ Save an extra register so we have a location...
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index 9f12ed1eea86..7d807cfd8ef5 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -1,3 +1,4 @@
+#include <asm/assembler.h>
 #include <asm/unwind.h>
 
 #if __LINUX_ARM_ARCH__ >= 6
@@ -70,7 +71,7 @@ UNWIND(	.fnstart	)
         \instr  r2, r2, r3
         str     r2, [r1, r0, lsl #2]
         restore_irqs ip
-        mov     pc, lr
+        ret     lr
 UNWIND( .fnend          )
 ENDPROC(\name           )
         .endm
@@ -98,7 +99,7 @@ UNWIND(	.fnstart	)
         \store  r2, [r1]
         moveq   r0, #0
         restore_irqs ip
-        mov     pc, lr
+        ret     lr
 UNWIND( .fnend          )
 ENDPROC(\name           )
         .endm
diff --git a/arch/arm/lib/bswapsdi2.S b/arch/arm/lib/bswapsdi2.S
index 9fcdd154eff9..07cda737bb11 100644
--- a/arch/arm/lib/bswapsdi2.S
+++ b/arch/arm/lib/bswapsdi2.S
@@ -1,4 +1,5 @@
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 
 #if __LINUX_ARM_ARCH__ >= 6
 ENTRY(__bswapsi2)
@@ -18,7 +19,7 @@ ENTRY(__bswapsi2)
         mov r3, r3, lsr #8
         bic r3, r3, #0xff00
         eor r0, r3, r0, ror #8
-        mov pc, lr
+        ret lr
 ENDPROC(__bswapsi2)
 
 ENTRY(__bswapdi2)
@@ -31,6 +32,6 @@ ENTRY(__bswapdi2)
         bic r1, r1, #0xff00
         eor r1, r1, r0, ror #8
         eor r0, r3, ip, ror #8
-        mov pc, lr
+        ret lr
 ENDPROC(__bswapdi2)
 #endif
diff --git a/arch/arm/lib/call_with_stack.S b/arch/arm/lib/call_with_stack.S
index 916c80f13ae7..ed1a421813cb 100644
--- a/arch/arm/lib/call_with_stack.S
+++ b/arch/arm/lib/call_with_stack.S
@@ -36,9 +36,9 @@ ENTRY(call_with_stack)
         mov     r0, r1
 
         adr     lr, BSYM(1f)
-        mov     pc, r2
+        ret     r2
 
 1:      ldr     lr, [sp]
         ldr     sp, [sp, #4]
-        mov     pc, lr
+        ret     lr
 ENDPROC(call_with_stack)
diff --git a/arch/arm/lib/csumpartial.S b/arch/arm/lib/csumpartial.S
index 31d3cb34740d..984e0f29d548 100644
--- a/arch/arm/lib/csumpartial.S
+++ b/arch/arm/lib/csumpartial.S
@@ -97,7 +97,7 @@ td3	.req	lr
 #endif
 #endif
                 adcnes  sum, sum, td0           @ update checksum
-                mov     pc, lr
+                ret     lr
 
 ENTRY(csum_partial)
                 stmfd   sp!, {buf, lr}
diff --git a/arch/arm/lib/csumpartialcopygeneric.S b/arch/arm/lib/csumpartialcopygeneric.S
index d6e742d24007..10b45909610c 100644
--- a/arch/arm/lib/csumpartialcopygeneric.S
+++ b/arch/arm/lib/csumpartialcopygeneric.S
@@ -7,6 +7,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <asm/assembler.h>
 
 /*
  * unsigned int
@@ -40,7 +41,7 @@ sum	.req	r3
                 adcs    sum, sum, ip, put_byte_1        @ update checksum
                 strb    ip, [dst], #1
                 tst     dst, #2
-                moveq   pc, lr                  @ dst is now 32bit aligned
+                reteq   lr                      @ dst is now 32bit aligned
 
 .Ldst_16bit:    load2b  r8, ip
                 sub     len, len, #2
@@ -48,7 +49,7 @@ sum	.req	r3
                 strb    r8, [dst], #1
                 adcs    sum, sum, ip, put_byte_1
                 strb    ip, [dst], #1
-                mov     pc, lr                  @ dst is now 32bit aligned
+                ret     lr                      @ dst is now 32bit aligned
 
                 /*
                  * Handle 0 to 7 bytes, with any alignment of source and
diff --git a/arch/arm/lib/delay-loop.S b/arch/arm/lib/delay-loop.S
index bc1033b897b4..518bf6e93f78 100644
--- a/arch/arm/lib/delay-loop.S
+++ b/arch/arm/lib/delay-loop.S
@@ -35,7 +35,7 @@ ENTRY(__loop_const_udelay)			@ 0 <= r0 <= 0x7fffff06
                 mul     r0, r2, r0              @ max = 2^32-1
                 add     r0, r0, r1, lsr #32-6
                 movs    r0, r0, lsr #6
-                moveq   pc, lr
+                reteq   lr
 
 /*
  * loops = r0 * HZ * loops_per_jiffy / 1000000
@@ -46,23 +46,23 @@ ENTRY(__loop_const_udelay)			@ 0 <= r0 <= 0x7fffff06
 ENTRY(__loop_delay)
                 subs    r0, r0, #1
 #if 0
-                movls   pc, lr
+                retls   lr
                 subs    r0, r0, #1
-                movls   pc, lr
+                retls   lr
                 subs    r0, r0, #1
-                movls   pc, lr
+                retls   lr
                 subs    r0, r0, #1
-                movls   pc, lr
+                retls   lr
                 subs    r0, r0, #1
-                movls   pc, lr
+                retls   lr
                 subs    r0, r0, #1
-                movls   pc, lr
+                retls   lr
                 subs    r0, r0, #1
-                movls   pc, lr
+                retls   lr
                 subs    r0, r0, #1
 #endif
                 bhi     __loop_delay
-                mov     pc, lr
+                ret     lr
 ENDPROC(__loop_udelay)
 ENDPROC(__loop_const_udelay)
 ENDPROC(__loop_delay)
diff --git a/arch/arm/lib/div64.S b/arch/arm/lib/div64.S
index e55c4842c290..a9eafe4981eb 100644
--- a/arch/arm/lib/div64.S
+++ b/arch/arm/lib/div64.S
@@ -13,6 +13,7 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/unwind.h>
 
 #ifdef __ARMEB__
@@ -97,7 +98,7 @@ UNWIND(.fnstart)
         mov     yl, #0
         cmpeq   xl, r4
         movlo   xh, xl
-        movlo   pc, lr
+        retlo   lr
 
         @ The division loop for lower bit positions.
         @ Here we shift remainer bits leftwards rather than moving the
@@ -111,14 +112,14 @@ UNWIND(.fnstart)
         subcs   xh, xh, r4
         movs    ip, ip, lsr #1
         bne     4b
-        mov     pc, lr
+        ret     lr
 
         @ The top part of remainder became zero.  If carry is set
         @ (the 33th bit) this is a false positive so resume the loop.
         @ Otherwise, if lower part is also null then we are done.
 6:      bcs     5b
         cmp     xl, #0
-        moveq   pc, lr
+        reteq   lr
 
         @ We still have remainer bits in the low part.  Bring them up.
 
@@ -144,7 +145,7 @@ UNWIND(.fnstart)
         movs    ip, ip, lsr #1
         mov     xh, #1
         bne     4b
-        mov     pc, lr
+        ret     lr
 
 8:      @ Division by a power of 2: determine what that divisor order is
         @ then simply shift values around
@@ -184,13 +185,13 @@ UNWIND(.fnstart)
  THUMB( orr     yl, yl, xh              )
         mov     xh, xl, lsl ip
         mov     xh, xh, lsr ip
-        mov     pc, lr
+        ret     lr
 
         @ eq -> division by 1: obvious enough...
 9:      moveq   yl, xl
         moveq   yh, xh
         moveq   xh, #0
-        moveq   pc, lr
+        reteq   lr
 UNWIND(.fnend)
 
 UNWIND(.fnstart)
diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S
index 64f6bc1a9132..7848780e8834 100644
--- a/arch/arm/lib/findbit.S
+++ b/arch/arm/lib/findbit.S
@@ -35,7 +35,7 @@ ENTRY(_find_first_zero_bit_le)
 2:              cmp     r2, r1                  @ any more?
                 blo     1b
 3:              mov     r0, r1                  @ no free bits
-                mov     pc, lr
+                ret     lr
 ENDPROC(_find_first_zero_bit_le)
 
 /*
@@ -76,7 +76,7 @@ ENTRY(_find_first_bit_le)
 2:              cmp     r2, r1                  @ any more?
                 blo     1b
 3:              mov     r0, r1                  @ no free bits
-                mov     pc, lr
+                ret     lr
 ENDPROC(_find_first_bit_le)
 
 /*
@@ -114,7 +114,7 @@ ENTRY(_find_first_zero_bit_be)
 2:              cmp     r2, r1                  @ any more?
                 blo     1b
 3:              mov     r0, r1                  @ no free bits
-                mov     pc, lr
+                ret     lr
 ENDPROC(_find_first_zero_bit_be)
 
 ENTRY(_find_next_zero_bit_be)
@@ -148,7 +148,7 @@ ENTRY(_find_first_bit_be)
 2:              cmp     r2, r1                  @ any more?
                 blo     1b
 3:              mov     r0, r1                  @ no free bits
-                mov     pc, lr
+                ret     lr
 ENDPROC(_find_first_bit_be)
 
 ENTRY(_find_next_bit_be)
@@ -192,5 +192,5 @@ ENDPROC(_find_next_bit_be)
 #endif
                 cmp     r1, r0                  @ Clamp to maxbit
                 movlo   r0, r1
-                mov     pc, lr
+                ret     lr
 
diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 9b06bb41fca6..938600098b88 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -18,7 +18,7 @@
  * Inputs:      r0 contains the address
  *              r1 contains the address limit, which must be preserved
  * Outputs:     r0 is the error code
- *              r2 contains the zero-extended value
+ *              r2, r3 contains the zero-extended value
  *              lr corrupted
  *
  * No other registers must be altered.  (see <asm/uaccess.h>
@@ -36,7 +36,7 @@ ENTRY(__get_user_1)
         check_uaccess r0, 1, r1, r2, __get_user_bad
 1: TUSER(ldrb)  r2, [r0]
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__get_user_1)
 
 ENTRY(__get_user_2)
@@ -56,25 +56,60 @@ rb	.req	r0
         orr     r2, rb, r2, lsl #8
 #endif
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__get_user_2)
 
 ENTRY(__get_user_4)
         check_uaccess r0, 4, r1, r2, __get_user_bad
 4: TUSER(ldr)   r2, [r0]
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__get_user_4)
 
+ENTRY(__get_user_8)
+        check_uaccess r0, 8, r1, r2, __get_user_bad
+#ifdef CONFIG_THUMB2_KERNEL
+5: TUSER(ldr)   r2, [r0]
+6: TUSER(ldr)   r3, [r0, #4]
+#else
+5: TUSER(ldr)   r2, [r0], #4
+6: TUSER(ldr)   r3, [r0]
+#endif
+        mov     r0, #0
+        ret     lr
+ENDPROC(__get_user_8)
+
+#ifdef __ARMEB__
+ENTRY(__get_user_lo8)
+        check_uaccess r0, 8, r1, r2, __get_user_bad
+#ifdef CONFIG_CPU_USE_DOMAINS
+        add     r0, r0, #4
+7:      ldrt    r2, [r0]
+#else
+7:      ldr     r2, [r0, #4]
+#endif
+        mov     r0, #0
+        ret     lr
+ENDPROC(__get_user_lo8)
+#endif
+
+__get_user_bad8:
+        mov     r3, #0
 __get_user_bad:
         mov     r2, #0
         mov     r0, #-EFAULT
-        mov     pc, lr
+        ret     lr
 ENDPROC(__get_user_bad)
+ENDPROC(__get_user_bad8)
 
 .pushsection __ex_table, "a"
         .long   1b, __get_user_bad
         .long   2b, __get_user_bad
         .long   3b, __get_user_bad
         .long   4b, __get_user_bad
+        .long   5b, __get_user_bad8
+        .long   6b, __get_user_bad8
+#ifdef __ARMEB__
+        .long   7b, __get_user_bad
+#endif
 .popsection
diff --git a/arch/arm/lib/io-readsb.S b/arch/arm/lib/io-readsb.S
index 9f4238987fe9..c31b2f3153f1 100644
--- a/arch/arm/lib/io-readsb.S
+++ b/arch/arm/lib/io-readsb.S
@@ -25,7 +25,7 @@
 
 ENTRY(__raw_readsb)
                 teq     r2, #0          @ do we have to check for the zero len?
-                moveq   pc, lr
+                reteq   lr
                 ands    ip, r1, #3
                 bne     .Linsb_align
 
diff --git a/arch/arm/lib/io-readsl.S b/arch/arm/lib/io-readsl.S
index 7a7430950c79..2ed86fa5465f 100644
--- a/arch/arm/lib/io-readsl.S
+++ b/arch/arm/lib/io-readsl.S
@@ -12,7 +12,7 @@
 
 ENTRY(__raw_readsl)
                 teq     r2, #0          @ do we have to check for the zero len?
-                moveq   pc, lr
+                reteq   lr
                 ands    ip, r1, #3
                 bne     3f
 
@@ -33,7 +33,7 @@ ENTRY(__raw_readsl)
                 stmcsia r1!, {r3, ip}
                 ldrne   r3, [r0, #0]
                 strne   r3, [r1, #0]
-                mov     pc, lr
+                ret     lr
 
 3:              ldr     r3, [r0]
                 cmp     ip, #2
@@ -75,5 +75,5 @@ ENTRY(__raw_readsl)
                 strb    r3, [r1, #1]
 8:              mov     r3, ip, get_byte_0
                 strb    r3, [r1, #0]
-                mov     pc, lr
+                ret     lr
 ENDPROC(__raw_readsl)
diff --git a/arch/arm/lib/io-readsw-armv3.S b/arch/arm/lib/io-readsw-armv3.S
index 88487c8c4f23..413da9914529 100644
--- a/arch/arm/lib/io-readsw-armv3.S
+++ b/arch/arm/lib/io-readsw-armv3.S
@@ -27,11 +27,11 @@
                 strb    r3, [r1], #1
 
                 subs    r2, r2, #1
-                moveq   pc, lr
+                reteq   lr
 
 ENTRY(__raw_readsw)
                 teq     r2, #0          @ do we have to check for the zero len?
-                moveq   pc, lr
+                reteq   lr
                 tst     r1, #3
                 bne     .Linsw_align
 
diff --git a/arch/arm/lib/io-readsw-armv4.S b/arch/arm/lib/io-readsw-armv4.S
index 1f393d42593d..d9a45e9692ae 100644
--- a/arch/arm/lib/io-readsw-armv4.S
+++ b/arch/arm/lib/io-readsw-armv4.S
@@ -26,7 +26,7 @@
 
 ENTRY(__raw_readsw)
                 teq     r2, #0
-                moveq   pc, lr
+                reteq   lr
                 tst     r1, #3
                 bne     .Linsw_align
 
diff --git a/arch/arm/lib/io-writesb.S b/arch/arm/lib/io-writesb.S
index 68b92f4acaeb..a46bbc9b168b 100644
--- a/arch/arm/lib/io-writesb.S
+++ b/arch/arm/lib/io-writesb.S
@@ -45,7 +45,7 @@
 
 ENTRY(__raw_writesb)
                 teq     r2, #0          @ do we have to check for the zero len?
-                moveq   pc, lr
+                reteq   lr
                 ands    ip, r1, #3
                 bne     .Loutsb_align
 
diff --git a/arch/arm/lib/io-writesl.S b/arch/arm/lib/io-writesl.S
index d0d104a0dd11..4ea2435988c1 100644
--- a/arch/arm/lib/io-writesl.S
+++ b/arch/arm/lib/io-writesl.S
@@ -12,7 +12,7 @@
 
 ENTRY(__raw_writesl)
                 teq     r2, #0          @ do we have to check for the zero len?
-                moveq   pc, lr
+                reteq   lr
                 ands    ip, r1, #3
                 bne     3f
 
@@ -33,7 +33,7 @@ ENTRY(__raw_writesl)
                 ldrne   r3, [r1, #0]
                 strcs   ip, [r0, #0]
                 strne   r3, [r0, #0]
-                mov     pc, lr
+                ret     lr
 
 3:              bic     r1, r1, #3
                 ldr     r3, [r1], #4
@@ -47,7 +47,7 @@ ENTRY(__raw_writesl)
                 orr     ip, ip, r3, lspush #16
                 str     ip, [r0]
                 bne     4b
-                mov     pc, lr
+                ret     lr
 
 5:              mov     ip, r3, lspull #8
                 ldr     r3, [r1], #4
@@ -55,7 +55,7 @@ ENTRY(__raw_writesl)
                 orr     ip, ip, r3, lspush #24
                 str     ip, [r0]
                 bne     5b
-                mov     pc, lr
+                ret     lr
 
 6:              mov     ip, r3, lspull #24
                 ldr     r3, [r1], #4
@@ -63,5 +63,5 @@ ENTRY(__raw_writesl)
                 orr     ip, ip, r3, lspush #8
                 str     ip, [r0]
                 bne     6b
-                mov     pc, lr
+                ret     lr
 ENDPROC(__raw_writesl)
diff --git a/arch/arm/lib/io-writesw-armv3.S b/arch/arm/lib/io-writesw-armv3.S
index 49b800419e32..121789eb6802 100644
--- a/arch/arm/lib/io-writesw-armv3.S
+++ b/arch/arm/lib/io-writesw-armv3.S
@@ -28,11 +28,11 @@
                 orr     r3, r3, r3, lsl #16
                 str     r3, [r0]
                 subs    r2, r2, #1
-                moveq   pc, lr
+                reteq   lr
 
 ENTRY(__raw_writesw)
                 teq     r2, #0          @ do we have to check for the zero len?
-                moveq   pc, lr
+                reteq   lr
                 tst     r1, #3
                 bne     .Loutsw_align
 
diff --git a/arch/arm/lib/io-writesw-armv4.S b/arch/arm/lib/io-writesw-armv4.S
index ff4f71b579ee..269f90c51ad2 100644
--- a/arch/arm/lib/io-writesw-armv4.S
+++ b/arch/arm/lib/io-writesw-armv4.S
@@ -31,7 +31,7 @@
 
 ENTRY(__raw_writesw)
                 teq     r2, #0
-                moveq   pc, lr
+                reteq   lr
                 ands    r3, r1, #3
                 bne     .Loutsw_align
 
@@ -96,5 +96,5 @@ ENTRY(__raw_writesw)
                 tst     r2, #1
 3:              movne   ip, r3, lsr #8
                 strneh  ip, [r0]
-                mov     pc, lr
+                ret     lr
 ENDPROC(__raw_writesw)
diff --git a/arch/arm/lib/lib1funcs.S b/arch/arm/lib/lib1funcs.S
index c562f649734c..947567ff67f9 100644
--- a/arch/arm/lib/lib1funcs.S
+++ b/arch/arm/lib/lib1funcs.S
@@ -210,7 +210,7 @@ ENTRY(__aeabi_uidiv)
 UNWIND(.fnstart)
 
         subs    r2, r1, #1
-        moveq   pc, lr
+        reteq   lr
         bcc     Ldiv0
         cmp     r0, r1
         bls     11f
@@ -220,16 +220,16 @@ UNWIND(.fnstart)
         ARM_DIV_BODY r0, r1, r2, r3
 
         mov     r0, r2
-        mov     pc, lr
+        ret     lr
 
 11:     moveq   r0, #1
         movne   r0, #0
-        mov     pc, lr
+        ret     lr
 
 12:     ARM_DIV2_ORDER r1, r2
 
         mov     r0, r0, lsr r2
-        mov     pc, lr
+        ret     lr
 
 UNWIND(.fnend)
 ENDPROC(__udivsi3)
@@ -244,11 +244,11 @@ UNWIND(.fnstart)
         moveq   r0, #0
         tsthi   r1, r2                          @ see if divisor is power of 2
         andeq   r0, r0, r2
-        movls   pc, lr
+        retls   lr
 
         ARM_MOD_BODY r0, r1, r2, r3
 
-        mov     pc, lr
+        ret     lr
 
 UNWIND(.fnend)
 ENDPROC(__umodsi3)
@@ -274,23 +274,23 @@ UNWIND(.fnstart)
 
         cmp     ip, #0
         rsbmi   r0, r0, #0
-        mov     pc, lr
+        ret     lr
 
 10:     teq     ip, r0                          @ same sign ?
         rsbmi   r0, r0, #0
-        mov     pc, lr
+        ret     lr
 
 11:     movlo   r0, #0
         moveq   r0, ip, asr #31
         orreq   r0, r0, #1
-        mov     pc, lr
+        ret     lr
 
 12:     ARM_DIV2_ORDER r1, r2
 
         cmp     ip, #0
         mov     r0, r3, lsr r2
         rsbmi   r0, r0, #0
-        mov     pc, lr
+        ret     lr
 
 UNWIND(.fnend)
 ENDPROC(__divsi3)
@@ -315,7 +315,7 @@ UNWIND(.fnstart)
 
 10:     cmp     ip, #0
         rsbmi   r0, r0, #0
-        mov     pc, lr
+        ret     lr
 
 UNWIND(.fnend)
 ENDPROC(__modsi3)
@@ -331,7 +331,7 @@ UNWIND(.save {r0, r1, ip, lr}	)
         ldmfd   sp!, {r1, r2, ip, lr}
         mul     r3, r0, r2
         sub     r1, r1, r3
-        mov     pc, lr
+        ret     lr
 
 UNWIND(.fnend)
 ENDPROC(__aeabi_uidivmod)
@@ -344,7 +344,7 @@ UNWIND(.save {r0, r1, ip, lr}	)
         ldmfd   sp!, {r1, r2, ip, lr}
         mul     r3, r0, r2
         sub     r1, r1, r3
-        mov     pc, lr
+        ret     lr
 
 UNWIND(.fnend)
 ENDPROC(__aeabi_idivmod)
diff --git a/arch/arm/lib/lshrdi3.S b/arch/arm/lib/lshrdi3.S
index f83d449141f7..922dcd88b02b 100644
--- a/arch/arm/lib/lshrdi3.S
+++ b/arch/arm/lib/lshrdi3.S
@@ -27,6 +27,7 @@ Boston, MA 02110-1301, USA.  */
 
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 
 #ifdef __ARMEB__
 #define al r1
@@ -47,7 +48,7 @@ ENTRY(__aeabi_llsr)
  THUMB( lslmi   r3, ah, ip              )
  THUMB( orrmi   al, al, r3              )
         mov     ah, ah, lsr r2
-        mov     pc, lr
+        ret     lr
 
 ENDPROC(__lshrdi3)
 ENDPROC(__aeabi_llsr)
diff --git a/arch/arm/lib/memchr.S b/arch/arm/lib/memchr.S
index 1da86991d700..74a5bed6d999 100644
--- a/arch/arm/lib/memchr.S
+++ b/arch/arm/lib/memchr.S
@@ -22,5 +22,5 @@ ENTRY(memchr)
         bne     1b
         sub     r0, r0, #1
 2:      movne   r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(memchr)
diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
index 94b0650ea98f..671455c854fa 100644
--- a/arch/arm/lib/memset.S
+++ b/arch/arm/lib/memset.S
@@ -110,7 +110,7 @@ ENTRY(memset)
         strneb  r1, [ip], #1
         tst     r2, #1
         strneb  r1, [ip], #1
-        mov     pc, lr
+        ret     lr
 
 6:      subs    r2, r2, #4              @ 1 do we have enough
         blt     5b                      @ 1 bytes to align with?
diff --git a/arch/arm/lib/memzero.S b/arch/arm/lib/memzero.S
index 3fbdef5f802a..385ccb306fa2 100644
--- a/arch/arm/lib/memzero.S
+++ b/arch/arm/lib/memzero.S
@@ -121,5 +121,5 @@ ENTRY(__memzero)
         strneb  r2, [r0], #1            @ 1
         tst     r1, #1                  @ 1 a byte left over
         strneb  r2, [r0], #1            @ 1
-        mov     pc, lr                  @ 1
+        ret     lr                      @ 1
 ENDPROC(__memzero)
diff --git a/arch/arm/lib/muldi3.S b/arch/arm/lib/muldi3.S
index 36c91b4957e2..204305956925 100644
--- a/arch/arm/lib/muldi3.S
+++ b/arch/arm/lib/muldi3.S
@@ -11,6 +11,7 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 
 #ifdef __ARMEB__
 #define xh r0
@@ -41,7 +42,7 @@ ENTRY(__aeabi_lmul)
         adc     xh, xh, yh, lsr #16
         adds    xl, xl, ip, lsl #16
         adc     xh, xh, ip, lsr #16
-        mov     pc, lr
+        ret     lr
 
 ENDPROC(__muldi3)
 ENDPROC(__aeabi_lmul)
diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
index 3d73dcb959b0..38d660d3705f 100644
--- a/arch/arm/lib/putuser.S
+++ b/arch/arm/lib/putuser.S
@@ -36,7 +36,7 @@ ENTRY(__put_user_1)
         check_uaccess r0, 1, r1, ip, __put_user_bad
 1: TUSER(strb)  r2, [r0]
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__put_user_1)
 
 ENTRY(__put_user_2)
@@ -60,14 +60,14 @@ ENTRY(__put_user_2)
 #endif
 #endif  /* CONFIG_THUMB2_KERNEL */
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__put_user_2)
 
 ENTRY(__put_user_4)
         check_uaccess r0, 4, r1, ip, __put_user_bad
 4: TUSER(str)   r2, [r0]
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__put_user_4)
 
 ENTRY(__put_user_8)
@@ -80,12 +80,12 @@ ENTRY(__put_user_8)
 6: TUSER(str)   r3, [r0]
 #endif
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(__put_user_8)
 
 __put_user_bad:
         mov     r0, #-EFAULT
-        mov     pc, lr
+        ret     lr
 ENDPROC(__put_user_bad)
 
 .pushsection __ex_table, "a"
diff --git a/arch/arm/lib/strchr.S b/arch/arm/lib/strchr.S
index d8f2a1c1aea4..013d64c71e8d 100644
--- a/arch/arm/lib/strchr.S
+++ b/arch/arm/lib/strchr.S
@@ -23,5 +23,5 @@ ENTRY(strchr)
                 teq     r2, r1
                 movne   r0, #0
                 subeq   r0, r0, #1
-                mov     pc, lr
+                ret     lr
 ENDPROC(strchr)
diff --git a/arch/arm/lib/strrchr.S b/arch/arm/lib/strrchr.S
index 302f20cd2423..3cec1c7482c4 100644
--- a/arch/arm/lib/strrchr.S
+++ b/arch/arm/lib/strrchr.S
@@ -22,5 +22,5 @@ ENTRY(strrchr)
                 teq     r2, #0
                 bne     1b
                 mov     r0, r3
-                mov     pc, lr
+                ret     lr
 ENDPROC(strrchr)
diff --git a/arch/arm/lib/ucmpdi2.S b/arch/arm/lib/ucmpdi2.S
index f0df6a91db04..ad4a6309141a 100644
--- a/arch/arm/lib/ucmpdi2.S
+++ b/arch/arm/lib/ucmpdi2.S
@@ -11,6 +11,7 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 
 #ifdef __ARMEB__
 #define xh r0
@@ -31,7 +32,7 @@ ENTRY(__ucmpdi2)
         movlo   r0, #0
         moveq   r0, #1
         movhi   r0, #2
-        mov     pc, lr
+        ret     lr
 
 ENDPROC(__ucmpdi2)
 
@@ -44,7 +45,7 @@ ENTRY(__aeabi_ulcmp)
         movlo   r0, #-1
         moveq   r0, #0
         movhi   r0, #1
-        mov     pc, lr
+        ret     lr
 
 ENDPROC(__aeabi_ulcmp)
 
diff --git a/arch/arm/mach-davinci/sleep.S b/arch/arm/mach-davinci/sleep.S
index d4e9316ecacb..a5336a5e2739 100644
--- a/arch/arm/mach-davinci/sleep.S
+++ b/arch/arm/mach-davinci/sleep.S
@@ -213,7 +213,7 @@ ddr2clk_stop_done:
         cmp     ip, r0
         bne     ddr2clk_stop_done
 
-        mov     pc, lr
+        ret     lr
 ENDPROC(davinci_ddr_psc_config)
 
 CACHE_FLUSH:
diff --git a/arch/arm/mach-ebsa110/include/mach/memory.h b/arch/arm/mach-ebsa110/include/mach/memory.h
index 8e49066ad850..866f8a1c6ff7 100644
--- a/arch/arm/mach-ebsa110/include/mach/memory.h
+++ b/arch/arm/mach-ebsa110/include/mach/memory.h
@@ -17,11 +17,6 @@
 #define __ASM_ARCH_MEMORY_H
 
 /*
- * Physical DRAM offset.
- */
-#define PLAT_PHYS_OFFSET        UL(0x00000000)
-
-/*
  * Cache flushing area - SRAM
  */
 #define FLUSH_BASE_PHYS         0x40000000
diff --git a/arch/arm/mach-ep93xx/crunch-bits.S b/arch/arm/mach-ep93xx/crunch-bits.S
index e96923a3017b..ee0be2af5c61 100644
--- a/arch/arm/mach-ep93xx/crunch-bits.S
+++ b/arch/arm/mach-ep93xx/crunch-bits.S
@@ -198,7 +198,7 @@ crunch_load:
         get_thread_info r10
 #endif
 2:      dec_preempt_count r10, r3
-        mov     pc, lr
+        ret     lr
 
 /*
  * Back up crunch regs to save area and disable access to them
@@ -277,7 +277,7 @@ ENTRY(crunch_task_copy)
         mov     r3, lr                          @ preserve return address
         bl      crunch_save
         msr     cpsr_c, ip                      @ restore interrupt mode
-        mov     pc, r3
+        ret     r3
 
 /*
  * Restore crunch state from given memory address
@@ -310,4 +310,4 @@ ENTRY(crunch_task_restore)
         mov     r3, lr                          @ preserve return address
         bl      crunch_load
         msr     cpsr_c, ip                      @ restore interrupt mode
-        mov     pc, r3
+        ret     r3
diff --git a/arch/arm/mach-ep93xx/include/mach/memory.h b/arch/arm/mach-ep93xx/include/mach/memory.h
deleted file mode 100644
index c9400cf0051c..000000000000
--- a/arch/arm/mach-ep93xx/include/mach/memory.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * arch/arm/mach-ep93xx/include/mach/memory.h
- */
-
-#ifndef __ASM_ARCH_MEMORY_H
-#define __ASM_ARCH_MEMORY_H
-
-#if defined(CONFIG_EP93XX_SDCE3_SYNC_PHYS_OFFSET)
-#define PLAT_PHYS_OFFSET                UL(0x00000000)
-#elif defined(CONFIG_EP93XX_SDCE0_PHYS_OFFSET)
-#define PLAT_PHYS_OFFSET                UL(0xc0000000)
-#elif defined(CONFIG_EP93XX_SDCE1_PHYS_OFFSET)
-#define PLAT_PHYS_OFFSET                UL(0xd0000000)
-#elif defined(CONFIG_EP93XX_SDCE2_PHYS_OFFSET)
-#define PLAT_PHYS_OFFSET                UL(0xe0000000)
-#elif defined(CONFIG_EP93XX_SDCE3_ASYNC_PHYS_OFFSET)
-#define PLAT_PHYS_OFFSET                UL(0xf0000000)
-#else
-#error "Kconfig bug: No EP93xx PHYS_OFFSET set"
-#endif
-
-#endif
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index 8f9b66c4ac78..5d4ff6571dcd 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -119,6 +119,7 @@ config EXYNOS5420_MCPM
         bool "Exynos5420 Multi-Cluster PM support"
         depends on MCPM && SOC_EXYNOS5420
         select ARM_CCI
+        select ARM_CPU_SUSPEND
         help
           This is needed to provide CPU and cluster power management
           on Exynos5420 implementing big.LITTLE.
diff --git a/arch/arm/mach-exynos/hotplug.c b/arch/arm/mach-exynos/hotplug.c
index 69fa48397394..8a134d019cb3 100644
--- a/arch/arm/mach-exynos/hotplug.c
+++ b/arch/arm/mach-exynos/hotplug.c
@@ -46,13 +46,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
                 if (cpu == 1)
                         exynos_cpu_power_down(cpu);
 
-                /*
-                 * here's the WFI
-                 */
-                asm(".word      0xe320f003\n"
-                    :
-                    :
-                    : "memory", "cc");
+                wfi();
 
                 if (pen_release == cpu_logical_map(cpu)) {
                         /*
diff --git a/arch/arm/mach-exynos/mcpm-exynos.c b/arch/arm/mach-exynos/mcpm-exynos.c
index 0498d0b887ef..a96b78f93f2b 100644
--- a/arch/arm/mach-exynos/mcpm-exynos.c
+++ b/arch/arm/mach-exynos/mcpm-exynos.c
@@ -25,7 +25,6 @@
 
 #define EXYNOS5420_CPUS_PER_CLUSTER     4
 #define EXYNOS5420_NR_CLUSTERS          2
-#define MCPM_BOOT_ADDR_OFFSET           0x1c
 
 /*
  * The common v7_exit_coherency_flush API could not be used because of the
@@ -197,7 +196,7 @@ static void exynos_power_down(void)
         if (last_man && __mcpm_outbound_enter_critical(cpu, cluster)) {
                 arch_spin_unlock(&exynos_mcpm_lock);
 
-                if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A15) {
+                if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A15) {
                         /*
                          * On the Cortex-A15 we need to disable
                          * L2 prefetching before flushing the cache.
@@ -290,6 +289,19 @@ static void __naked exynos_pm_power_up_setup(unsigned int affinity_level)
         "b      cci_enable_port_for_self");
 }
 
+static void __init exynos_cache_off(void)
+{
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A15) {
+                /* disable L2 prefetching on the Cortex-A15 */
+                asm volatile(
+                "mcr    p15, 1, %0, c15, c0, 3\n\t"
+                "isb\n\t"
+                "dsb"
+                : : "r" (0x400));
+        }
+        exynos_v7_exit_coherency_flush(all);
+}
+
 static const struct of_device_id exynos_dt_mcpm_match[] = {
         { .compatible = "samsung,exynos5420" },
         { .compatible = "samsung,exynos5800" },
@@ -333,6 +345,8 @@ static int __init exynos_mcpm_init(void)
         ret = mcpm_platform_register(&exynos_power_ops);
         if (!ret)
                 ret = mcpm_sync_init(exynos_pm_power_up_setup);
+        if (!ret)
+                ret = mcpm_loopback(exynos_cache_off); /* turn on the CCI */
         if (ret) {
                 iounmap(ns_sram_base_addr);
                 return ret;
@@ -343,11 +357,13 @@ static int __init exynos_mcpm_init(void)
         pr_info("Exynos MCPM support installed\n");
 
         /*
-         * Future entries into the kernel can now go
-         * through the cluster entry vectors.
+         * U-Boot SPL is hardcoded to jump to the start of ns_sram_base_addr
+         * as part of secondary_cpu_start().  Let's redirect it to the
+         * mcpm_entry_point().
          */
-        __raw_writel(virt_to_phys(mcpm_entry_point),
-                        ns_sram_base_addr + MCPM_BOOT_ADDR_OFFSET);
+        __raw_writel(0xe59f0000, ns_sram_base_addr);     /* ldr r0, [pc, #0] */
+        __raw_writel(0xe12fff10, ns_sram_base_addr + 4); /* bx  r0 */
+        __raw_writel(virt_to_phys(mcpm_entry_point), ns_sram_base_addr + 8);
 
         iounmap(ns_sram_base_addr);
 
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index 1c8d31e39520..8dc1d3a3a8bf 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -188,7 +188,7 @@ static void __init exynos_smp_init_cpus(void)
         void __iomem *scu_base = scu_base_addr();
         unsigned int i, ncores;
 
-        if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9)
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9)
                 ncores = scu_base ? scu_get_core_count(scu_base) : 1;
         else
                 /*
@@ -214,7 +214,7 @@ static void __init exynos_smp_prepare_cpus(unsigned int max_cpus)
 
         exynos_sysram_init();
 
-        if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9)
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9)
                 scu_enable(scu_base_addr());
 
         /*
diff --git a/arch/arm/mach-exynos/pm.c b/arch/arm/mach-exynos/pm.c
index 87c0d34c7fba..67d383de614f 100644
--- a/arch/arm/mach-exynos/pm.c
+++ b/arch/arm/mach-exynos/pm.c
@@ -300,7 +300,7 @@ static int exynos_pm_suspend(void)
         tmp = (S5P_USE_STANDBY_WFI0 | S5P_USE_STANDBY_WFE0);
         __raw_writel(tmp, S5P_CENTRAL_SEQ_OPTION);
 
-        if (!soc_is_exynos5250())
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9)
                 exynos_cpu_save_register();
 
         return 0;
@@ -334,7 +334,7 @@ static void exynos_pm_resume(void)
         if (exynos_pm_central_resume())
                 goto early_wakeup;
 
-        if (!soc_is_exynos5250())
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9)
                 exynos_cpu_restore_register();
 
         /* For release retention */
@@ -353,7 +353,7 @@ static void exynos_pm_resume(void)
 
         s3c_pm_do_restore_core(exynos_core_save, ARRAY_SIZE(exynos_core_save));
 
-        if (!soc_is_exynos5250())
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9)
                 scu_enable(S5P_VA_SCU);
 
 early_wakeup:
@@ -440,15 +440,17 @@ static int exynos_cpu_pm_notifier(struct notifier_block *self,
         case CPU_PM_ENTER:
                 if (cpu == 0) {
                         exynos_pm_central_suspend();
-                        exynos_cpu_save_register();
+                        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9)
+                                exynos_cpu_save_register();
                 }
                 break;
 
         case CPU_PM_EXIT:
                 if (cpu == 0) {
-                        if (!soc_is_exynos5250())
+                        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9) {
                                 scu_enable(S5P_VA_SCU);
-                        exynos_cpu_restore_register();
+                                exynos_cpu_restore_register();
+                        }
                         exynos_pm_central_resume();
                 }
                 break;
diff --git a/arch/arm/mach-footbridge/include/mach/memory.h b/arch/arm/mach-footbridge/include/mach/memory.h
index 5c6df377f969..6f2ecccdf323 100644
--- a/arch/arm/mach-footbridge/include/mach/memory.h
+++ b/arch/arm/mach-footbridge/include/mach/memory.h
@@ -59,11 +59,6 @@ extern unsigned long __bus_to_pfn(unsigned long);
  */
 #define FLUSH_BASE              0xf9000000
 
-/*
- * Physical DRAM offset.
- */
-#define PLAT_PHYS_OFFSET                UL(0x00000000)
-
 #define FLUSH_BASE_PHYS         0x50000000
 
 #endif
diff --git a/arch/arm/mach-imx/clk-imx6sl.c b/arch/arm/mach-imx/clk-imx6sl.c
index 21cf06cebade..5408ca70c8d6 100644
--- a/arch/arm/mach-imx/clk-imx6sl.c
+++ b/arch/arm/mach-imx/clk-imx6sl.c
@@ -312,6 +312,7 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
         clks[IMX6SL_CLK_ECSPI2]       = imx_clk_gate2("ecspi2",       "ecspi_root",        base + 0x6c, 2);
         clks[IMX6SL_CLK_ECSPI3]       = imx_clk_gate2("ecspi3",       "ecspi_root",        base + 0x6c, 4);
         clks[IMX6SL_CLK_ECSPI4]       = imx_clk_gate2("ecspi4",       "ecspi_root",        base + 0x6c, 6);
+        clks[IMX6SL_CLK_ENET]         = imx_clk_gate2("enet",         "ipg",               base + 0x6c, 10);
         clks[IMX6SL_CLK_EPIT1]        = imx_clk_gate2("epit1",        "perclk",            base + 0x6c, 12);
         clks[IMX6SL_CLK_EPIT2]        = imx_clk_gate2("epit2",        "perclk",            base + 0x6c, 14);
         clks[IMX6SL_CLK_EXTERN_AUDIO] = imx_clk_gate2("extern_audio", "extern_audio_podf", base + 0x6c, 16);
diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
index fe123b079c05..74b50f1982db 100644
--- a/arch/arm/mach-imx/suspend-imx6.S
+++ b/arch/arm/mach-imx/suspend-imx6.S
@@ -10,6 +10,7 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/asm-offsets.h>
 #include <asm/hardware/cache-l2x0.h>
 #include "hardware.h"
@@ -301,7 +302,7 @@ rbc_loop:
         resume_mmdc
 
         /* return to suspend finish */
-        mov     pc, lr
+        ret     lr
 
 resume:
         /* invalidate L1 I-cache first */
@@ -325,7 +326,7 @@ resume:
         mov     r5, #0x1
         resume_mmdc
 
-        mov     pc, lr
+        ret     lr
 ENDPROC(imx6_suspend)
 
 /*
diff --git a/arch/arm/mach-integrator/include/mach/memory.h b/arch/arm/mach-integrator/include/mach/memory.h
index 334d5e271889..7268cb50ded0 100644
--- a/arch/arm/mach-integrator/include/mach/memory.h
+++ b/arch/arm/mach-integrator/include/mach/memory.h
@@ -20,11 +20,6 @@
 #ifndef __ASM_ARCH_MEMORY_H
 #define __ASM_ARCH_MEMORY_H
 
-/*
- * Physical DRAM offset.
- */
-#define PLAT_PHYS_OFFSET        UL(0x00000000)
-
 #define BUS_OFFSET      UL(0x80000000)
 #define __virt_to_bus(x)        ((x) - PAGE_OFFSET + BUS_OFFSET)
 #define __bus_to_virt(x)        ((x) - BUS_OFFSET + PAGE_OFFSET)
diff --git a/arch/arm/mach-integrator/integrator_ap.c b/arch/arm/mach-integrator/integrator_ap.c
index dd0cc677d596..660ca6feff40 100644
--- a/arch/arm/mach-integrator/integrator_ap.c
+++ b/arch/arm/mach-integrator/integrator_ap.c
@@ -480,25 +480,18 @@ static const struct of_device_id ebi_match[] = {
 static void __init ap_init_of(void)
 {
         unsigned long sc_dec;
-        struct device_node *root;
         struct device_node *syscon;
         struct device_node *ebi;
         struct device *parent;
         struct soc_device *soc_dev;
         struct soc_device_attribute *soc_dev_attr;
         u32 ap_sc_id;
-        int err;
         int i;
 
-        /* Here we create an SoC device for the root node */
-        root = of_find_node_by_path("/");
-        if (!root)
-                return;
-
-        syscon = of_find_matching_node(root, ap_syscon_match);
+        syscon = of_find_matching_node(NULL, ap_syscon_match);
         if (!syscon)
                 return;
-        ebi = of_find_matching_node(root, ebi_match);
+        ebi = of_find_matching_node(NULL, ebi_match);
         if (!ebi)
                 return;
 
@@ -509,19 +502,17 @@ static void __init ap_init_of(void)
         if (!ebi_base)
                 return;
 
+        of_platform_populate(NULL, of_default_bus_match_table,
+                        ap_auxdata_lookup, NULL);
+
         ap_sc_id = readl(ap_syscon_base);
 
         soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
         if (!soc_dev_attr)
                 return;
 
-        err = of_property_read_string(root, "compatible",
-                                      &soc_dev_attr->soc_id);
-        if (err)
-                return;
-        err = of_property_read_string(root, "model", &soc_dev_attr->machine);
-        if (err)
-                return;
+        soc_dev_attr->soc_id = "XVC";
+        soc_dev_attr->machine = "Integrator/AP";
         soc_dev_attr->family = "Integrator";
         soc_dev_attr->revision = kasprintf(GFP_KERNEL, "%c",
                                            'A' + (ap_sc_id & 0x0f));
@@ -536,9 +527,6 @@ static void __init ap_init_of(void)
         parent = soc_device_to_device(soc_dev);
         integrator_init_sysfs(parent, ap_sc_id);
 
-        of_platform_populate(root, of_default_bus_match_table,
-                        ap_auxdata_lookup, parent);
-
         sc_dec = readl(ap_syscon_base + INTEGRATOR_SC_DEC_OFFSET);
         for (i = 0; i < 4; i++) {
                 struct lm_device *lmdev;
diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
index a938242b0c95..0e57f8f820a5 100644
--- a/arch/arm/mach-integrator/integrator_cp.c
+++ b/arch/arm/mach-integrator/integrator_cp.c
@@ -279,20 +279,13 @@ static const struct of_device_id intcp_syscon_match[] = {
 
 static void __init intcp_init_of(void)
 {
-        struct device_node *root;
         struct device_node *cpcon;
         struct device *parent;
         struct soc_device *soc_dev;
         struct soc_device_attribute *soc_dev_attr;
         u32 intcp_sc_id;
-        int err;
 
-        /* Here we create an SoC device for the root node */
-        root = of_find_node_by_path("/");
-        if (!root)
-                return;
-
-        cpcon = of_find_matching_node(root, intcp_syscon_match);
+        cpcon = of_find_matching_node(NULL, intcp_syscon_match);
         if (!cpcon)
                 return;
 
@@ -300,19 +293,17 @@ static void __init intcp_init_of(void)
         if (!intcp_con_base)
                 return;
 
+        of_platform_populate(NULL, of_default_bus_match_table,
+                             intcp_auxdata_lookup, NULL);
+
         intcp_sc_id = readl(intcp_con_base);
 
         soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
         if (!soc_dev_attr)
                 return;
 
-        err = of_property_read_string(root, "compatible",
-                                      &soc_dev_attr->soc_id);
-        if (err)
-                return;
-        err = of_property_read_string(root, "model", &soc_dev_attr->machine);
-        if (err)
-                return;
+        soc_dev_attr->soc_id = "XCV";
+        soc_dev_attr->machine = "Integrator/CP";
         soc_dev_attr->family = "Integrator";
         soc_dev_attr->revision = kasprintf(GFP_KERNEL, "%c",
                                            'A' + (intcp_sc_id & 0x0f));
@@ -326,8 +317,6 @@ static void __init intcp_init_of(void)
 
         parent = soc_device_to_device(soc_dev);
         integrator_init_sysfs(parent, intcp_sc_id);
-        of_platform_populate(root, of_default_bus_match_table,
-                        intcp_auxdata_lookup, parent);
 }
 
 static const char * intcp_dt_board_compat[] = {
diff --git a/arch/arm/mach-iop13xx/include/mach/iop13xx.h b/arch/arm/mach-iop13xx/include/mach/iop13xx.h
index 17b40279e0a4..9311ee2126d6 100644
--- a/arch/arm/mach-iop13xx/include/mach/iop13xx.h
+++ b/arch/arm/mach-iop13xx/include/mach/iop13xx.h
@@ -3,7 +3,7 @@
 
 #ifndef __ASSEMBLY__
 
-#include <linux/reboot.h>
+enum reboot_mode;
 
 /* The ATU offsets can change based on the strapping */
 extern u32 iop13xx_atux_pmmr_offset;
diff --git a/arch/arm/mach-iop13xx/include/mach/memory.h b/arch/arm/mach-iop13xx/include/mach/memory.h
index 7c032d0ab24a..59307e787588 100644
--- a/arch/arm/mach-iop13xx/include/mach/memory.h
+++ b/arch/arm/mach-iop13xx/include/mach/memory.h
@@ -3,11 +3,6 @@
 
 #include <mach/hardware.h>
 
-/*
- * Physical DRAM offset.
- */
-#define PLAT_PHYS_OFFSET        UL(0x00000000)
-
 #ifndef __ASSEMBLY__
 
 #if defined(CONFIG_ARCH_IOP13XX)
diff --git a/arch/arm/mach-iop13xx/setup.c b/arch/arm/mach-iop13xx/setup.c
index bca96f433495..53c316f7301e 100644
--- a/arch/arm/mach-iop13xx/setup.c
+++ b/arch/arm/mach-iop13xx/setup.c
@@ -20,6 +20,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/serial_8250.h>
 #include <linux/io.h>
+#include <linux/reboot.h>
 #ifdef CONFIG_MTD_PHYSMAP
 #include <linux/mtd/physmap.h>
 #endif
diff --git a/arch/arm/mach-ks8695/include/mach/memory.h b/arch/arm/mach-ks8695/include/mach/memory.h
index 95e731a7ed6a..ab0d27fa8969 100644
--- a/arch/arm/mach-ks8695/include/mach/memory.h
+++ b/arch/arm/mach-ks8695/include/mach/memory.h
@@ -15,11 +15,6 @@
 
 #include <mach/hardware.h>
 
-/*
- * Physical SRAM offset.
- */
-#define PLAT_PHYS_OFFSET                KS8695_SDRAM_PA
-
 #ifndef __ASSEMBLY__
 
 #ifdef CONFIG_PCI
diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig
index 4a7c250c9a30..b9bc599a5fd0 100644
--- a/arch/arm/mach-mvebu/Kconfig
+++ b/arch/arm/mach-mvebu/Kconfig
@@ -10,6 +10,7 @@ menuconfig ARCH_MVEBU
         select ZONE_DMA if ARM_LPAE
         select ARCH_REQUIRE_GPIOLIB
         select PCI_QUIRKS if PCI
+        select OF_ADDRESS_PCI
 
 if ARCH_MVEBU
 
@@ -17,6 +18,7 @@ config MACH_MVEBU_V7
         bool
         select ARMADA_370_XP_TIMER
         select CACHE_L2X0
+        select ARM_CPU_SUSPEND
 
 config MACH_ARMADA_370
         bool "Marvell Armada 370 boards" if ARCH_MULTI_V7
diff --git a/arch/arm/mach-mvebu/coherency_ll.S b/arch/arm/mach-mvebu/coherency_ll.S
index 510c29e079ca..f5d881b5d0f7 100644
--- a/arch/arm/mach-mvebu/coherency_ll.S
+++ b/arch/arm/mach-mvebu/coherency_ll.S
@@ -46,7 +46,7 @@ ENTRY(ll_get_coherency_base)
         ldr     r1, =coherency_base
         ldr     r1, [r1]
 2:
-        mov     pc, lr
+        ret     lr
 ENDPROC(ll_get_coherency_base)
 
 /*
@@ -63,7 +63,7 @@ ENTRY(ll_get_coherency_cpumask)
         mov     r2, #(1 << 24)
         lsl     r3, r2, r3
 ARM_BE8(rev     r3, r3)
-        mov     pc, lr
+        ret     lr
 ENDPROC(ll_get_coherency_cpumask)
 
 /*
@@ -94,7 +94,7 @@ ENTRY(ll_add_cpu_to_smp_group)
         strex   r1, r2, [r0]
         cmp     r1, #0
         bne     1b
-        mov     pc, lr
+        ret     lr
 ENDPROC(ll_add_cpu_to_smp_group)
 
 ENTRY(ll_enable_coherency)
@@ -118,7 +118,7 @@ ENTRY(ll_enable_coherency)
         bne     1b
         dsb
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(ll_enable_coherency)
 
 ENTRY(ll_disable_coherency)
@@ -141,7 +141,7 @@ ENTRY(ll_disable_coherency)
         cmp     r1, #0
         bne     1b
         dsb
-        mov     pc, lr
+        ret     lr
 ENDPROC(ll_disable_coherency)
 
         .align 2
diff --git a/arch/arm/mach-mvebu/headsmp-a9.S b/arch/arm/mach-mvebu/headsmp-a9.S
index 5925366bc03c..7c91ddb6f1f7 100644
--- a/arch/arm/mach-mvebu/headsmp-a9.S
+++ b/arch/arm/mach-mvebu/headsmp-a9.S
@@ -14,6 +14,7 @@
 
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 
         __CPUINIT
 #define CPU_RESUME_ADDR_REG 0xf10182d4
@@ -24,7 +25,7 @@
 armada_375_smp_cpu1_enable_code_start:
         ldr     r0, [pc, #4]
         ldr     r1, [r0]
-        mov     pc, r1
+        ret     r1
         .word   CPU_RESUME_ADDR_REG
 armada_375_smp_cpu1_enable_code_end:
 
diff --git a/arch/arm/mach-omap1/include/mach/memory.h b/arch/arm/mach-omap1/include/mach/memory.h
index 3c2530523111..058a4f7d44c5 100644
--- a/arch/arm/mach-omap1/include/mach/memory.h
+++ b/arch/arm/mach-omap1/include/mach/memory.h
@@ -6,11 +6,6 @@
 #define __ASM_ARCH_MEMORY_H
 
 /*
- * Physical DRAM offset.
- */
-#define PLAT_PHYS_OFFSET                UL(0x10000000)
-
-/*
  * Bus address is physical address, except for OMAP-1510 Local Bus.
  * OMAP-1510 bus address is translated into a Local Bus address if the
  * OMAP bus type is lbus. We do the address translation based on the
diff --git a/arch/arm/mach-omap2/sleep44xx.S b/arch/arm/mach-omap2/sleep44xx.S
index 9086ce03ae12..b84a0122d823 100644
--- a/arch/arm/mach-omap2/sleep44xx.S
+++ b/arch/arm/mach-omap2/sleep44xx.S
@@ -10,6 +10,7 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/smp_scu.h>
 #include <asm/memory.h>
 #include <asm/hardware/cache-l2x0.h>
@@ -334,7 +335,7 @@ ENDPROC(omap4_cpu_resume)
 
 #ifndef CONFIG_OMAP4_ERRATA_I688
 ENTRY(omap_bus_sync)
-        mov     pc, lr
+        ret     lr
 ENDPROC(omap_bus_sync)
 #endif
 
diff --git a/arch/arm/mach-omap2/sram242x.S b/arch/arm/mach-omap2/sram242x.S
index 680a7c56cc3e..2c88ff2d0236 100644
--- a/arch/arm/mach-omap2/sram242x.S
+++ b/arch/arm/mach-omap2/sram242x.S
@@ -101,7 +101,7 @@ i_dll_wait:
 i_dll_delay:
         subs    r4, r4, #0x1
         bne     i_dll_delay
-        mov     pc, lr
+        ret     lr
 
         /*
          * shift up or down voltage, use R9 as input to tell level.
@@ -125,7 +125,7 @@ volt_delay:
         ldr     r7, [r3]                @ get timer value
         cmp     r5, r7                  @ time up?
         bhi     volt_delay              @ not yet->branch
-        mov     pc, lr                  @ back to caller.
+        ret     lr                      @ back to caller.
 
 omap242x_sdi_cm_clksel2_pll:
         .word OMAP2420_CM_REGADDR(PLL_MOD, CM_CLKSEL2)
@@ -220,7 +220,7 @@ volt_delay_c:
         ldr     r7, [r10]               @ get timer value
         cmp     r8, r7                  @ time up?
         bhi     volt_delay_c            @ not yet->branch
-        mov     pc, lr                  @ back to caller
+        ret     lr                      @ back to caller
 
 omap242x_srs_cm_clksel2_pll:
         .word OMAP2420_CM_REGADDR(PLL_MOD, CM_CLKSEL2)
diff --git a/arch/arm/mach-omap2/sram243x.S b/arch/arm/mach-omap2/sram243x.S
index a1e9edd673f4..d5deb9761fc7 100644
--- a/arch/arm/mach-omap2/sram243x.S
+++ b/arch/arm/mach-omap2/sram243x.S
@@ -101,7 +101,7 @@ i_dll_wait:
 i_dll_delay:
         subs    r4, r4, #0x1
         bne     i_dll_delay
-        mov     pc, lr
+        ret     lr
 
         /*
          * shift up or down voltage, use R9 as input to tell level.
@@ -125,7 +125,7 @@ volt_delay:
         ldr     r7, [r3]                @ get timer value
         cmp     r5, r7                  @ time up?
         bhi     volt_delay              @ not yet->branch
-        mov     pc, lr                  @ back to caller.
+        ret     lr                      @ back to caller.
 
 omap243x_sdi_cm_clksel2_pll:
         .word OMAP2430_CM_REGADDR(PLL_MOD, CM_CLKSEL2)
@@ -220,7 +220,7 @@ volt_delay_c:
         ldr     r7, [r10]               @ get timer value
         cmp     r8, r7                  @ time up?
         bhi     volt_delay_c            @ not yet->branch
-        mov     pc, lr                  @ back to caller
+        ret     lr                      @ back to caller
 
 omap243x_srs_cm_clksel2_pll:
         .word OMAP2430_CM_REGADDR(PLL_MOD, CM_CLKSEL2)
diff --git a/arch/arm/mach-pxa/mioa701_bootresume.S b/arch/arm/mach-pxa/mioa701_bootresume.S
index 324d25a48c85..81591491ab94 100644
--- a/arch/arm/mach-pxa/mioa701_bootresume.S
+++ b/arch/arm/mach-pxa/mioa701_bootresume.S
@@ -29,7 +29,7 @@ ENTRY(mioa701_jumpaddr)
         str     r1, [r0]                @ Early disable resume for next boot
         ldr     r0, mioa701_jumpaddr    @ (Murphy's Law)
         ldr     r0, [r0]
-        mov     pc, r0
+        ret     r0
 2:
 
 ENTRY(mioa701_bootstrap_lg)
diff --git a/arch/arm/mach-pxa/standby.S b/arch/arm/mach-pxa/standby.S
index 29f5f5c180b7..eab1645bb4ad 100644
--- a/arch/arm/mach-pxa/standby.S
+++ b/arch/arm/mach-pxa/standby.S
@@ -29,7 +29,7 @@ ENTRY(pxa_cpu_standby)
         .align  5
 1:      mcr     p14, 0, r2, c7, c0, 0   @ put the system into Standby
         str     r1, [r0]                @ make sure PSSR_PH/STS are clear
-        mov     pc, lr
+        ret     lr
 
 #endif
 
@@ -108,7 +108,7 @@ ENTRY(pm_enter_standby_start)
         bic     r0, r0, #0x20000000
         str     r0, [r1, #PXA3_DMCIER]
 
-        mov     pc, lr
+        ret     lr
 ENTRY(pm_enter_standby_end)
 
 #endif
diff --git a/arch/arm/mach-realview/include/mach/memory.h b/arch/arm/mach-realview/include/mach/memory.h
index db09170e3832..23e7a313f75d 100644
--- a/arch/arm/mach-realview/include/mach/memory.h
+++ b/arch/arm/mach-realview/include/mach/memory.h
@@ -20,15 +20,6 @@
 #ifndef __ASM_ARCH_MEMORY_H
 #define __ASM_ARCH_MEMORY_H
 
-/*
- * Physical DRAM offset.
- */
-#ifdef CONFIG_REALVIEW_HIGH_PHYS_OFFSET
-#define PLAT_PHYS_OFFSET                UL(0x70000000)
-#else
-#define PLAT_PHYS_OFFSET                UL(0x00000000)
-#endif
-
 #ifdef CONFIG_SPARSEMEM
 
 /*
diff --git a/arch/arm/mach-rpc/include/mach/memory.h b/arch/arm/mach-rpc/include/mach/memory.h
index 18a221093bf5..b7e49571417d 100644
--- a/arch/arm/mach-rpc/include/mach/memory.h
+++ b/arch/arm/mach-rpc/include/mach/memory.h
@@ -19,11 +19,6 @@
 #define __ASM_ARCH_MEMORY_H
 
 /*
- * Physical DRAM offset.
- */
-#define PLAT_PHYS_OFFSET        UL(0x10000000)
-
-/*
  * Cache flushing area - ROM
  */
 #define FLUSH_BASE_PHYS         0x00000000
diff --git a/arch/arm/mach-s3c24xx/sleep-s3c2410.S b/arch/arm/mach-s3c24xx/sleep-s3c2410.S
index c9b91223697c..875ba8911127 100644
--- a/arch/arm/mach-s3c24xx/sleep-s3c2410.S
+++ b/arch/arm/mach-s3c24xx/sleep-s3c2410.S
@@ -66,4 +66,4 @@ s3c2410_do_sleep:
         streq   r8, [r5]                        @ SDRAM power-down config
         streq   r9, [r6]                        @ CPU sleep
 1:      beq     1b
-        mov     pc, r14
+        ret     lr
diff --git a/arch/arm/mach-s3c24xx/sleep-s3c2412.S b/arch/arm/mach-s3c24xx/sleep-s3c2412.S
index 5adaceb7da13..6bf5b4d8743c 100644
--- a/arch/arm/mach-s3c24xx/sleep-s3c2412.S
+++ b/arch/arm/mach-s3c24xx/sleep-s3c2412.S
@@ -65,4 +65,4 @@ s3c2412_sleep_enter1:
         strne   r9, [r3]
         bne     s3c2412_sleep_enter1
 
-        mov     pc, r14
+        ret     lr
diff --git a/arch/arm/mach-s5pv210/include/mach/memory.h b/arch/arm/mach-s5pv210/include/mach/memory.h
index 2d3cfa221d5f..d584fac9156b 100644
--- a/arch/arm/mach-s5pv210/include/mach/memory.h
+++ b/arch/arm/mach-s5pv210/include/mach/memory.h
@@ -13,8 +13,6 @@
 #ifndef __ASM_ARCH_MEMORY_H
 #define __ASM_ARCH_MEMORY_H
 
-#define PLAT_PHYS_OFFSET                UL(0x20000000)
-
 /*
  * Sparsemem support
  * Physical memory can be located from 0x20000000 to 0x7fffffff,
diff --git a/arch/arm/mach-sa1100/include/mach/memory.h b/arch/arm/mach-sa1100/include/mach/memory.h
index 12d376795abc..2054051eb797 100644
--- a/arch/arm/mach-sa1100/include/mach/memory.h
+++ b/arch/arm/mach-sa1100/include/mach/memory.h
@@ -10,11 +10,6 @@
 #include <asm/sizes.h>
 
 /*
- * Physical DRAM offset is 0xc0000000 on the SA1100
- */
-#define PLAT_PHYS_OFFSET        UL(0xc0000000)
-
-/*
  * Because of the wide memory address space between physical RAM banks on the
  * SA1100, it's much convenient to use Linux's SparseMEM support to implement
  * our memory map representation.  Assuming all memory nodes have equal access
diff --git a/arch/arm/mach-shmobile/headsmp.S b/arch/arm/mach-shmobile/headsmp.S
index e5be5c88644b..293007579b8e 100644
--- a/arch/arm/mach-shmobile/headsmp.S
+++ b/arch/arm/mach-shmobile/headsmp.S
@@ -12,6 +12,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/memory.h>
 
 ENTRY(shmobile_invalidate_start)
@@ -75,7 +76,7 @@ shmobile_smp_boot_next:
 
 shmobile_smp_boot_found:
         ldr     r0, [r7, r1, lsl #2]
-        mov     pc, r9
+        ret     r9
 ENDPROC(shmobile_smp_boot)
 
 ENTRY(shmobile_smp_sleep)
diff --git a/arch/arm/mach-tegra/sleep-tegra20.S b/arch/arm/mach-tegra/sleep-tegra20.S
index aaaf3abd2688..be4bc5f853f5 100644
--- a/arch/arm/mach-tegra/sleep-tegra20.S
+++ b/arch/arm/mach-tegra/sleep-tegra20.S
@@ -78,7 +78,7 @@ ENTRY(tegra20_hotplug_shutdown)
         /* Put this CPU down */
         cpu_id  r0
         bl      tegra20_cpu_shutdown
-        mov     pc, lr                  @ should never get here
+        ret     lr                      @ should never get here
 ENDPROC(tegra20_hotplug_shutdown)
 
 /*
@@ -96,7 +96,7 @@ ENDPROC(tegra20_hotplug_shutdown)
  */
 ENTRY(tegra20_cpu_shutdown)
         cmp     r0, #0
-        moveq   pc, lr                  @ must not be called for CPU 0
+        reteq   lr                      @ must not be called for CPU 0
         mov32   r1, TEGRA_PMC_VIRT + PMC_SCRATCH41
         mov     r12, #CPU_RESETTABLE
         str     r12, [r1]
@@ -117,7 +117,7 @@ ENTRY(tegra20_cpu_shutdown)
         cpu_id  r3
         cmp     r3, r0
         beq     .
-        mov     pc, lr
+        ret     lr
 ENDPROC(tegra20_cpu_shutdown)
 #endif
 
@@ -164,7 +164,7 @@ ENTRY(tegra_pen_lock)
         cmpeq   r12, r0                 @ !turn == cpu?
         beq     1b                      @ while !turn == cpu && flag[!cpu] == 1
 
-        mov     pc, lr                  @ locked
+        ret     lr                      @ locked
 ENDPROC(tegra_pen_lock)
 
 ENTRY(tegra_pen_unlock)
@@ -176,7 +176,7 @@ ENTRY(tegra_pen_unlock)
         addne   r2, r3, #PMC_SCRATCH39
         mov     r12, #0
         str     r12, [r2]
-        mov     pc, lr
+        ret     lr
 ENDPROC(tegra_pen_unlock)
 
 /*
@@ -189,7 +189,7 @@ ENTRY(tegra20_cpu_clear_resettable)
         mov32   r1, TEGRA_PMC_VIRT + PMC_SCRATCH41
         mov     r12, #CPU_NOT_RESETTABLE
         str     r12, [r1]
-        mov     pc, lr
+        ret     lr
 ENDPROC(tegra20_cpu_clear_resettable)
 
 /*
@@ -202,7 +202,7 @@ ENTRY(tegra20_cpu_set_resettable_soon)
         mov32   r1, TEGRA_PMC_VIRT + PMC_SCRATCH41
         mov     r12, #CPU_RESETTABLE_SOON
         str     r12, [r1]
-        mov     pc, lr
+        ret     lr
 ENDPROC(tegra20_cpu_set_resettable_soon)
 
 /*
@@ -217,7 +217,7 @@ ENTRY(tegra20_cpu_is_resettable_soon)
         cmp     r12, #CPU_RESETTABLE_SOON
         moveq   r0, #1
         movne   r0, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(tegra20_cpu_is_resettable_soon)
 
 /*
@@ -239,7 +239,7 @@ ENTRY(tegra20_sleep_core_finish)
         mov32   r1, TEGRA_IRAM_LPx_RESUME_AREA
         add     r0, r0, r1
 
-        mov     pc, r3
+        ret     r3
 ENDPROC(tegra20_sleep_core_finish)
 
 /*
@@ -402,7 +402,7 @@ exit_selfrefresh_loop:
 
         mov32   r0, TEGRA_PMC_BASE
         ldr     r0, [r0, #PMC_SCRATCH41]
-        mov     pc, r0                  @ jump to tegra_resume
+        ret     r0                      @ jump to tegra_resume
 ENDPROC(tegra20_lp1_reset)
 
 /*
@@ -455,7 +455,7 @@ tegra20_switch_cpu_to_clk32k:
         mov     r0, #0  /* brust policy = 32KHz */
         str     r0, [r5, #CLK_RESET_SCLK_BURST]
 
-        mov     pc, lr
+        ret     lr
 
 /*
  * tegra20_enter_sleep
@@ -535,7 +535,7 @@ padsave_done:
         adr     r2, tegra20_sclk_save
         str     r0, [r2]
         dsb
-        mov     pc, lr
+        ret     lr
 
 tegra20_sdram_pad_address:
         .word   TEGRA_APB_MISC_BASE + APB_MISC_XM2CFGCPADCTRL
diff --git a/arch/arm/mach-tegra/sleep-tegra30.S b/arch/arm/mach-tegra/sleep-tegra30.S
index b16d4a57fa59..09cad9b071de 100644
--- a/arch/arm/mach-tegra/sleep-tegra30.S
+++ b/arch/arm/mach-tegra/sleep-tegra30.S
@@ -142,7 +142,7 @@ ENTRY(tegra30_hotplug_shutdown)
         /* Powergate this CPU */
         mov     r0, #TEGRA30_POWER_HOTPLUG_SHUTDOWN
         bl      tegra30_cpu_shutdown
-        mov     pc, lr                  @ should never get here
+        ret     lr                      @ should never get here
 ENDPROC(tegra30_hotplug_shutdown)
 
 /*
@@ -161,7 +161,7 @@ ENTRY(tegra30_cpu_shutdown)
         bne     _no_cpu0_chk    @ It's not Tegra30
 
         cmp     r3, #0
-        moveq   pc, lr          @ Must never be called for CPU 0
+        reteq   lr              @ Must never be called for CPU 0
 _no_cpu0_chk:
 
         ldr     r12, =TEGRA_FLOW_CTRL_VIRT
@@ -266,7 +266,7 @@ ENTRY(tegra30_sleep_core_finish)
         mov32   r1, TEGRA_IRAM_LPx_RESUME_AREA
         add     r0, r0, r1
 
-        mov     pc, r3
+        ret     r3
 ENDPROC(tegra30_sleep_core_finish)
 
 /*
@@ -285,7 +285,7 @@ ENTRY(tegra30_sleep_cpu_secondary_finish)
         mov     r0, #0                          @ power mode flags (!hotplug)
         bl      tegra30_cpu_shutdown
         mov     r0, #1                          @ never return here
-        mov     pc, r7
+        ret     r7
 ENDPROC(tegra30_sleep_cpu_secondary_finish)
 
 /*
@@ -529,7 +529,7 @@ __no_dual_emc_chanl:
 
         mov32   r0, TEGRA_PMC_BASE
         ldr     r0, [r0, #PMC_SCRATCH41]
-        mov     pc, r0                  @ jump to tegra_resume
+        ret     r0                      @ jump to tegra_resume
 ENDPROC(tegra30_lp1_reset)
 
         .align  L1_CACHE_SHIFT
@@ -659,7 +659,7 @@ _no_pll_in_iddq:
         mov     r0, #0  /* brust policy = 32KHz */
         str     r0, [r5, #CLK_RESET_SCLK_BURST]
 
-        mov     pc, lr
+        ret     lr
 
 /*
  * tegra30_enter_sleep
@@ -819,7 +819,7 @@ pmc_io_dpd_skip:
 
         dsb
 
-        mov     pc, lr
+        ret     lr
 
         .ltorg
 /* dummy symbol for end of IRAM */
diff --git a/arch/arm/mach-tegra/sleep.S b/arch/arm/mach-tegra/sleep.S
index 8d06213fbc47..f024a5109e8e 100644
--- a/arch/arm/mach-tegra/sleep.S
+++ b/arch/arm/mach-tegra/sleep.S
@@ -87,7 +87,7 @@ ENTRY(tegra_init_l2_for_a15)
         mcrne   p15, 0x1, r0, c9, c0, 2
 _exit_init_l2_a15:
 
-        mov     pc, lr
+        ret     lr
 ENDPROC(tegra_init_l2_for_a15)
 
 /*
@@ -111,7 +111,7 @@ ENTRY(tegra_sleep_cpu_finish)
         add     r3, r3, r0
         mov     r0, r1
 
-        mov     pc, r3
+        ret     r3
 ENDPROC(tegra_sleep_cpu_finish)
 
 /*
@@ -139,7 +139,7 @@ ENTRY(tegra_shut_off_mmu)
         moveq   r3, #0
         streq   r3, [r2, #L2X0_CTRL]
 #endif
-        mov     pc, r0
+        ret     r0
 ENDPROC(tegra_shut_off_mmu)
         .popsection
 
@@ -156,6 +156,6 @@ ENTRY(tegra_switch_cpu_to_pllp)
         str     r0, [r5, #CLK_RESET_CCLK_BURST]
         mov     r0, #0
         str     r0, [r5, #CLK_RESET_CCLK_DIVIDER]
-        mov     pc, lr
+        ret     lr
 ENDPROC(tegra_switch_cpu_to_pllp)
 #endif
diff --git a/arch/arm/mach-vexpress/tc2_pm.c b/arch/arm/mach-vexpress/tc2_pm.c
index b743a0ae02ce..2fb78b4648cb 100644
--- a/arch/arm/mach-vexpress/tc2_pm.c
+++ b/arch/arm/mach-vexpress/tc2_pm.c
@@ -152,7 +152,7 @@ static void tc2_pm_down(u64 residency)
         if (last_man && __mcpm_outbound_enter_critical(cpu, cluster)) {
                 arch_spin_unlock(&tc2_pm_lock);
 
-                if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A15) {
+                if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A15) {
                         /*
                          * On the Cortex-A15 we need to disable
                          * L2 prefetching before flushing the cache.
@@ -323,6 +323,21 @@ static void __naked tc2_pm_power_up_setup(unsigned int affinity_level)
 "       b       cci_enable_port_for_self ");
 }
 
+static void __init tc2_cache_off(void)
+{
+        pr_info("TC2: disabling cache during MCPM loopback test\n");
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A15) {
+                /* disable L2 prefetching on the Cortex-A15 */
+                asm volatile(
+                "mcr    p15, 1, %0, c15, c0, 3 \n\t"
+                "isb    \n\t"
+                "dsb    "
+                : : "r" (0x400) );
+        }
+        v7_exit_coherency_flush(all);
+        cci_disable_port_by_cpu(read_cpuid_mpidr());
+}
+
 static int __init tc2_pm_init(void)
 {
         int ret, irq;
@@ -370,6 +385,8 @@ static int __init tc2_pm_init(void)
         ret = mcpm_platform_register(&tc2_pm_power_ops);
         if (!ret) {
                 mcpm_sync_init(tc2_pm_power_up_setup);
+                /* test if we can (re)enable the CCI on our own */
+                BUG_ON(mcpm_loopback(tc2_cache_off) != 0);
                 pr_info("TC2 power management initialized\n");
         }
         return ret;
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index c348eaee7ee2..df46620206af 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -907,8 +907,8 @@ config PL310_ERRATA_588369
            They are architecturally defined to behave as the execution of a
            clean operation followed immediately by an invalidate operation,
            both performing to the same memory location. This functionality
-           is not correctly implemented in PL310 as clean lines are not
-           invalidated as a result of these operations.
+           is not correctly implemented in PL310 prior to r2p0 (fixed in r2p0)
+           as clean lines are not invalidated as a result of these operations.
 
 config PL310_ERRATA_727915
         bool "PL310 errata: Background Clean & Invalidate by Way operation can cause data corruption"
@@ -918,7 +918,8 @@ config PL310_ERRATA_727915
           PL310 can handle normal accesses while it is in progress. Under very
           rare circumstances, due to this erratum, write data can be lost when
           PL310 treats a cacheable write transaction during a Clean &
-          Invalidate by Way operation.
+          Invalidate by Way operation.  Revisions prior to r3p1 are affected by
+          this errata (fixed in r3p1).
 
 config PL310_ERRATA_753970
         bool "PL310 errata: cache sync operation may be faulty"
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index b8cb1a2688a0..0c1ab49e5f7b 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -76,6 +76,7 @@
 
 static unsigned long ai_user;
 static unsigned long ai_sys;
+static void *ai_sys_last_pc;
 static unsigned long ai_skipped;
 static unsigned long ai_half;
 static unsigned long ai_word;
@@ -130,7 +131,7 @@ static const char *usermode_action[] = {
 static int alignment_proc_show(struct seq_file *m, void *v)
 {
         seq_printf(m, "User:\t\t%lu\n", ai_user);
-        seq_printf(m, "System:\t\t%lu\n", ai_sys);
+        seq_printf(m, "System:\t\t%lu (%pF)\n", ai_sys, ai_sys_last_pc);
         seq_printf(m, "Skipped:\t%lu\n", ai_skipped);
         seq_printf(m, "Half:\t\t%lu\n", ai_half);
         seq_printf(m, "Word:\t\t%lu\n", ai_word);
@@ -794,6 +795,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
                 goto user;
 
         ai_sys += 1;
+        ai_sys_last_pc = (void *)instruction_pointer(regs);
 
  fixup:
 
diff --git a/arch/arm/mm/cache-fa.S b/arch/arm/mm/cache-fa.S
index e505befe51b5..2f0c58836ae7 100644
--- a/arch/arm/mm/cache-fa.S
+++ b/arch/arm/mm/cache-fa.S
@@ -15,6 +15,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/memory.h>
 #include <asm/page.h>
 
@@ -45,7 +46,7 @@
 ENTRY(fa_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(fa_flush_icache_all)
 
 /*
@@ -71,7 +72,7 @@ __flush_whole_cache:
         mcrne   p15, 0, ip, c7, c5, 6           @ invalidate BTB
         mcrne   p15, 0, ip, c7, c10, 4          @ drain write buffer
         mcrne   p15, 0, ip, c7, c5, 4           @ prefetch flush
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -99,7 +100,7 @@ ENTRY(fa_flush_user_cache_range)
         mcrne   p15, 0, ip, c7, c5, 6           @ invalidate BTB
         mcrne   p15, 0, ip, c7, c10, 4          @ data write barrier
         mcrne   p15, 0, ip, c7, c5, 4           @ prefetch flush
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -135,7 +136,7 @@ ENTRY(fa_coherent_user_range)
         mcr     p15, 0, r0, c7, c5, 6           @ invalidate BTB
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
         mcr     p15, 0, r0, c7, c5, 4           @ prefetch flush
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -155,7 +156,7 @@ ENTRY(fa_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -181,7 +182,7 @@ fa_dma_inv_range:
         blo     1b
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -199,7 +200,7 @@ fa_dma_clean_range:
         blo     1b
         mov     r0, #0  
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start,end)
@@ -214,7 +215,7 @@ ENTRY(fa_dma_flush_range)
         blo     1b
         mov     r0, #0  
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -237,7 +238,7 @@ ENDPROC(fa_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(fa_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(fa_dma_unmap_area)
 
         .globl  fa_flush_kern_cache_louis
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index 7c3fb41a462e..5f2c988a06ac 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -665,7 +665,7 @@ static int l2c310_cpu_enable_flz(struct notifier_block *nb, unsigned long act, v
 static void __init l2c310_enable(void __iomem *base, u32 aux, unsigned num_lock)
 {
         unsigned rev = readl_relaxed(base + L2X0_CACHE_ID) & L2X0_CACHE_ID_RTL_MASK;
-        bool cortex_a9 = read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9;
+        bool cortex_a9 = read_cpuid_part() == ARM_CPU_PART_CORTEX_A9;
 
         if (rev >= L310_CACHE_ID_RTL_R2P0) {
                 if (cortex_a9) {
diff --git a/arch/arm/mm/cache-nop.S b/arch/arm/mm/cache-nop.S
index 8e12ddca0031..f1cc9861031f 100644
--- a/arch/arm/mm/cache-nop.S
+++ b/arch/arm/mm/cache-nop.S
@@ -5,11 +5,12 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 
 #include "proc-macros.S"
 
 ENTRY(nop_flush_icache_all)
-        mov     pc, lr
+        ret     lr
 ENDPROC(nop_flush_icache_all)
 
         .globl nop_flush_kern_cache_all
@@ -29,7 +30,7 @@ ENDPROC(nop_flush_icache_all)
 
 ENTRY(nop_coherent_user_range)
         mov     r0, 0
-        mov     pc, lr
+        ret     lr
 ENDPROC(nop_coherent_user_range)
 
         .globl nop_flush_kern_dcache_area
diff --git a/arch/arm/mm/cache-v4.S b/arch/arm/mm/cache-v4.S
index a7ba68f59f0c..91e3adf155cb 100644
--- a/arch/arm/mm/cache-v4.S
+++ b/arch/arm/mm/cache-v4.S
@@ -9,6 +9,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/page.h>
 #include "proc-macros.S"
 
@@ -18,7 +19,7 @@
  *      Unconditionally clean and invalidate the entire icache.
  */
 ENTRY(v4_flush_icache_all)
-        mov     pc, lr
+        ret     lr
 ENDPROC(v4_flush_icache_all)
 
 /*
@@ -40,7 +41,7 @@ ENTRY(v4_flush_kern_cache_all)
 #ifdef CONFIG_CPU_CP15
         mov     r0, #0
         mcr     p15, 0, r0, c7, c7, 0           @ flush ID cache
-        mov     pc, lr
+        ret     lr
 #else
         /* FALLTHROUGH */
 #endif
@@ -59,7 +60,7 @@ ENTRY(v4_flush_user_cache_range)
 #ifdef CONFIG_CPU_CP15
         mov     ip, #0
         mcr     p15, 0, ip, c7, c7, 0           @ flush ID cache
-        mov     pc, lr
+        ret     lr
 #else
         /* FALLTHROUGH */
 #endif
@@ -89,7 +90,7 @@ ENTRY(v4_coherent_kern_range)
  */
 ENTRY(v4_coherent_user_range)
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -116,7 +117,7 @@ ENTRY(v4_dma_flush_range)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c7, 0           @ flush ID cache
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_unmap_area(start, size, dir)
@@ -136,7 +137,7 @@ ENTRY(v4_dma_unmap_area)
  *      - dir   - DMA direction
  */
 ENTRY(v4_dma_map_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(v4_dma_unmap_area)
 ENDPROC(v4_dma_map_area)
 
diff --git a/arch/arm/mm/cache-v4wb.S b/arch/arm/mm/cache-v4wb.S
index cd4945321407..2522f8c8fbb1 100644
--- a/arch/arm/mm/cache-v4wb.S
+++ b/arch/arm/mm/cache-v4wb.S
@@ -9,6 +9,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/memory.h>
 #include <asm/page.h>
 #include "proc-macros.S"
@@ -58,7 +59,7 @@ flush_base:
 ENTRY(v4wb_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(v4wb_flush_icache_all)
 
 /*
@@ -94,7 +95,7 @@ __flush_whole_cache:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -122,7 +123,7 @@ ENTRY(v4wb_flush_user_cache_range)
         blo     1b
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -170,7 +171,7 @@ ENTRY(v4wb_coherent_user_range)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 
 /*
@@ -195,7 +196,7 @@ v4wb_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -212,7 +213,7 @@ v4wb_dma_clean_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -248,7 +249,7 @@ ENDPROC(v4wb_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(v4wb_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(v4wb_dma_unmap_area)
 
         .globl  v4wb_flush_kern_cache_louis
diff --git a/arch/arm/mm/cache-v4wt.S b/arch/arm/mm/cache-v4wt.S
index 11e5e5838bc5..a0982ce49007 100644
--- a/arch/arm/mm/cache-v4wt.S
+++ b/arch/arm/mm/cache-v4wt.S
@@ -13,6 +13,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/page.h>
 #include "proc-macros.S"
 
@@ -48,7 +49,7 @@
 ENTRY(v4wt_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(v4wt_flush_icache_all)
 
 /*
@@ -71,7 +72,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, ip, c7, c6, 0           @ invalidate D cache
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -94,7 +95,7 @@ ENTRY(v4wt_flush_user_cache_range)
         add     r0, r0, #CACHE_DLINESIZE
         cmp     r0, r1
         blo     1b
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -126,7 +127,7 @@ ENTRY(v4wt_coherent_user_range)
         cmp     r0, r1
         blo     1b
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -160,7 +161,7 @@ v4wt_dma_inv_range:
         add     r0, r0, #CACHE_DLINESIZE
         cmp     r0, r1
         blo     1b
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -192,7 +193,7 @@ ENTRY(v4wt_dma_unmap_area)
  *      - dir   - DMA direction
  */
 ENTRY(v4wt_dma_map_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(v4wt_dma_unmap_area)
 ENDPROC(v4wt_dma_map_area)
 
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index d8fd4d4bd3d4..24659952c278 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -51,7 +51,7 @@ ENTRY(v6_flush_icache_all)
 #else
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I-cache
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(v6_flush_icache_all)
 
 /*
@@ -73,7 +73,7 @@ ENTRY(v6_flush_kern_cache_all)
 #else
         mcr     p15, 0, r0, c7, c15, 0          @ Cache clean+invalidate
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  *      v6_flush_cache_all()
@@ -98,7 +98,7 @@ ENTRY(v6_flush_user_cache_all)
  *      - we have a VIPT cache.
  */
 ENTRY(v6_flush_user_cache_range)
-        mov     pc, lr
+        ret     lr
 
 /*
  *      v6_coherent_kern_range(start,end)
@@ -150,7 +150,7 @@ ENTRY(v6_coherent_user_range)
 #else
         mcr     p15, 0, r0, c7, c5, 6           @ invalidate BTB
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  * Fault handling for the cache operation above. If the virtual address in r0
@@ -158,7 +158,7 @@ ENTRY(v6_coherent_user_range)
  */
 9001:
         mov     r0, #-EFAULT
-        mov     pc, lr
+        ret     lr
  UNWIND(.fnend          )
 ENDPROC(v6_coherent_user_range)
 ENDPROC(v6_coherent_kern_range)
@@ -188,7 +188,7 @@ ENTRY(v6_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4
 #endif
-        mov     pc, lr
+        ret     lr
 
 
 /*
@@ -239,7 +239,7 @@ v6_dma_inv_range:
         blo     1b
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      v6_dma_clean_range(start,end)
@@ -262,7 +262,7 @@ v6_dma_clean_range:
         blo     1b
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      v6_dma_flush_range(start,end)
@@ -290,7 +290,7 @@ ENTRY(v6_dma_flush_range)
         blo     1b
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -323,7 +323,7 @@ ENTRY(v6_dma_unmap_area)
         teq     r2, #DMA_TO_DEVICE
         bne     v6_dma_inv_range
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(v6_dma_unmap_area)
 
         .globl  v6_flush_kern_cache_louis
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 615c99e38ba1..b966656d2c2d 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -61,7 +61,7 @@ ENTRY(v7_invalidate_l1)
        bgt     1b
        dsb     st
        isb
-       mov     pc, lr
+       ret     lr
 ENDPROC(v7_invalidate_l1)
 
 /*
@@ -76,7 +76,7 @@ ENTRY(v7_flush_icache_all)
         mov     r0, #0
         ALT_SMP(mcr     p15, 0, r0, c7, c1, 0)          @ invalidate I-cache inner shareable
         ALT_UP(mcr      p15, 0, r0, c7, c5, 0)          @ I+BTB cache invalidate
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_flush_icache_all)
 
  /*
@@ -94,7 +94,7 @@ ENTRY(v7_flush_dcache_louis)
         ALT_UP(ands     r3, r0, #(7 << 27))     @ extract LoUU from clidr
 #ifdef CONFIG_ARM_ERRATA_643719
         ALT_SMP(mrceq   p15, 0, r2, c0, c0, 0)  @ read main ID register
-        ALT_UP(moveq    pc, lr)                 @ LoUU is zero, so nothing to do
+        ALT_UP(reteq    lr)                     @ LoUU is zero, so nothing to do
         ldreq   r1, =0x410fc090                 @ ID of ARM Cortex A9 r0p?
         biceq   r2, r2, #0x0000000f             @ clear minor revision number
         teqeq   r2, r1                          @ test for errata affected core and if so...
@@ -102,7 +102,7 @@ ENTRY(v7_flush_dcache_louis)
 #endif
         ALT_SMP(mov     r3, r3, lsr #20)        @ r3 = LoUIS * 2
         ALT_UP(mov      r3, r3, lsr #26)        @ r3 = LoUU * 2
-        moveq   pc, lr                          @ return if level == 0
+        reteq   lr                              @ return if level == 0
         mov     r10, #0                         @ r10 (starting level) = 0
         b       flush_levels                    @ start flushing cache levels
 ENDPROC(v7_flush_dcache_louis)
@@ -168,7 +168,7 @@ finished:
         mcr     p15, 2, r10, c0, c0, 0          @ select current cache level in cssr
         dsb     st
         isb
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_flush_dcache_all)
 
 /*
@@ -191,7 +191,7 @@ ENTRY(v7_flush_kern_cache_all)
         ALT_UP(mcr      p15, 0, r0, c7, c5, 0)  @ I+BTB cache invalidate
  ARM(   ldmfd   sp!, {r4-r5, r7, r9-r11, lr}    )
  THUMB( ldmfd   sp!, {r4-r7, r9-r11, lr}        )
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_flush_kern_cache_all)
 
  /*
@@ -209,7 +209,7 @@ ENTRY(v7_flush_kern_cache_louis)
         ALT_UP(mcr      p15, 0, r0, c7, c5, 0)  @ I+BTB cache invalidate
  ARM(   ldmfd   sp!, {r4-r5, r7, r9-r11, lr}    )
  THUMB( ldmfd   sp!, {r4-r7, r9-r11, lr}        )
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_flush_kern_cache_louis)
 
 /*
@@ -235,7 +235,7 @@ ENTRY(v7_flush_user_cache_all)
  *      - we have a VIPT cache.
  */
 ENTRY(v7_flush_user_cache_range)
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_flush_user_cache_all)
 ENDPROC(v7_flush_user_cache_range)
 
@@ -296,7 +296,7 @@ ENTRY(v7_coherent_user_range)
         ALT_UP(mcr      p15, 0, r0, c7, c5, 6)  @ invalidate BTB
         dsb     ishst
         isb
-        mov     pc, lr
+        ret     lr
 
 /*
  * Fault handling for the cache operation above. If the virtual address in r0
@@ -307,7 +307,7 @@ ENTRY(v7_coherent_user_range)
         dsb
 #endif
         mov     r0, #-EFAULT
-        mov     pc, lr
+        ret     lr
  UNWIND(.fnend          )
 ENDPROC(v7_coherent_kern_range)
 ENDPROC(v7_coherent_user_range)
@@ -336,7 +336,7 @@ ENTRY(v7_flush_kern_dcache_area)
         cmp     r0, r1
         blo     1b
         dsb     st
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_flush_kern_dcache_area)
 
 /*
@@ -369,7 +369,7 @@ v7_dma_inv_range:
         cmp     r0, r1
         blo     1b
         dsb     st
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_dma_inv_range)
 
 /*
@@ -391,7 +391,7 @@ v7_dma_clean_range:
         cmp     r0, r1
         blo     1b
         dsb     st
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_dma_clean_range)
 
 /*
@@ -413,7 +413,7 @@ ENTRY(v7_dma_flush_range)
         cmp     r0, r1
         blo     1b
         dsb     st
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_dma_flush_range)
 
 /*
@@ -439,7 +439,7 @@ ENTRY(v7_dma_unmap_area)
         add     r1, r1, r0
         teq     r2, #DMA_TO_DEVICE
         bne     v7_dma_inv_range
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7_dma_unmap_area)
 
         __INITDATA
diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index c508f41a43bc..59424937e52b 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -126,8 +126,8 @@ static const struct prot_bits section_bits[] = {
                 .val    = PMD_SECT_USER,
                 .set    = "USR",
         }, {
-                .mask   = PMD_SECT_RDONLY,
-                .val    = PMD_SECT_RDONLY,
+                .mask   = L_PMD_SECT_RDONLY,
+                .val    = L_PMD_SECT_RDONLY,
                 .set    = "ro",
                 .clear  = "RW",
 #elif __LINUX_ARM_ARCH__ >= 6
diff --git a/arch/arm/mm/l2c-l2x0-resume.S b/arch/arm/mm/l2c-l2x0-resume.S
index 99b05f21a59a..fda415e4ca8f 100644
--- a/arch/arm/mm/l2c-l2x0-resume.S
+++ b/arch/arm/mm/l2c-l2x0-resume.S
@@ -6,6 +6,7 @@
  * This code can only be used to if you are running in the secure world.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/hardware/cache-l2x0.h>
 
         .text
@@ -27,7 +28,7 @@ ENTRY(l2c310_early_resume)
 
         @ Check that the address has been initialised
         teq     r1, #0
-        moveq   pc, lr
+        reteq   lr
 
         @ The prefetch and power control registers are revision dependent
         @ and can be written whether or not the L2 cache is enabled
@@ -41,7 +42,7 @@ ENTRY(l2c310_early_resume)
         @ Don't setup the L2 cache if it is already enabled
         ldr     r0, [r1, #L2X0_CTRL]
         tst     r0, #L2X0_CTRL_EN
-        movne   pc, lr
+        retne   lr
 
         str     r3, [r1, #L310_TAG_LATENCY_CTRL]
         str     r4, [r1, #L310_DATA_LATENCY_CTRL]
@@ -51,7 +52,7 @@ ENTRY(l2c310_early_resume)
         str     r2, [r1, #L2X0_AUX_CTRL]
         mov     r9, #L2X0_CTRL_EN
         str     r9, [r1, #L2X0_CTRL]
-        mov     pc, lr
+        ret     lr
 ENDPROC(l2c310_early_resume)
 
         .align
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 6e3ba8d112a2..8348ed6b2efe 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1434,23 +1434,64 @@ void __init early_paging_init(const struct machine_desc *mdesc,
         dsb(ishst);
         isb();
 
-        /* remap level 1 table */
+        /*
+         * FIXME: This code is not architecturally compliant: we modify
+         * the mappings in-place, indeed while they are in use by this
+         * very same code.  This may lead to unpredictable behaviour of
+         * the CPU.
+         *
+         * Even modifying the mappings in a separate page table does
+         * not resolve this.
+         *
+         * The architecture strongly recommends that when a mapping is
+         * changed, that it is changed by first going via an invalid
+         * mapping and back to the new mapping.  This is to ensure that
+         * no TLB conflicts (caused by the TLB having more than one TLB
+         * entry match a translation) can occur.  However, doing that
+         * here will result in unmapping the code we are running.
+         */
+        pr_warn("WARNING: unsafe modification of in-place page tables - tainting kernel\n");
+        add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
+
+        /*
+         * Remap level 1 table.  This changes the physical addresses
+         * used to refer to the level 2 page tables to the high
+         * physical address alias, leaving everything else the same.
+         */
         for (i = 0; i < PTRS_PER_PGD; pud0++, i++) {
                 set_pud(pud0,
                         __pud(__pa(pmd0) | PMD_TYPE_TABLE | L_PGD_SWAPPER));
                 pmd0 += PTRS_PER_PMD;
         }
 
-        /* remap pmds for kernel mapping */
+        /*
+         * Remap the level 2 table, pointing the mappings at the high
+         * physical address alias of these pages.
+         */
         phys = __pa(map_start);
         do {
                 *pmdk++ = __pmd(phys | pmdprot);
                 phys += PMD_SIZE;
         } while (phys < map_end);
 
+        /*
+         * Ensure that the above updates are flushed out of the cache.
+         * This is not strictly correct; on a system where the caches
+         * are coherent with each other, but the MMU page table walks
+         * may not be coherent, flush_cache_all() may be a no-op, and
+         * this will fail.
+         */
         flush_cache_all();
+
+        /*
+         * Re-write the TTBR values to point them at the high physical
+         * alias of the page tables.  We expect __va() will work on
+         * cpu_get_pgd(), which returns the value of TTBR0.
+         */
         cpu_switch_mm(pgd0, &init_mm);
         cpu_set_ttbr(1, __pa(pgd0) + TTBR1_OFFSET);
+
+        /* Finally flush any stale TLB values. */
         local_flush_bp_all();
         local_flush_tlb_all();
 }
diff --git a/arch/arm/mm/proc-arm1020.S b/arch/arm/mm/proc-arm1020.S
index d1a2d05971e0..86ee5d47ce3c 100644
--- a/arch/arm/mm/proc-arm1020.S
+++ b/arch/arm/mm/proc-arm1020.S
@@ -73,7 +73,7 @@
  * cpu_arm1020_proc_init()
  */
 ENTRY(cpu_arm1020_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1020_proc_fin()
@@ -83,7 +83,7 @@ ENTRY(cpu_arm1020_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1020_reset(loc)
@@ -107,7 +107,7 @@ ENTRY(cpu_arm1020_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm1020_reset)
         .popsection
 
@@ -117,7 +117,7 @@ ENDPROC(cpu_arm1020_reset)
         .align  5
 ENTRY(cpu_arm1020_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -133,7 +133,7 @@ ENTRY(arm1020_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1020_flush_icache_all)
 
 /*
@@ -169,7 +169,7 @@ __flush_whole_cache:
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -200,7 +200,7 @@ ENTRY(arm1020_flush_user_cache_range)
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -242,7 +242,7 @@ ENTRY(arm1020_coherent_user_range)
         blo     1b
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -264,7 +264,7 @@ ENTRY(arm1020_flush_kern_dcache_area)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -297,7 +297,7 @@ arm1020_dma_inv_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -320,7 +320,7 @@ arm1020_dma_clean_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -342,7 +342,7 @@ ENTRY(arm1020_dma_flush_range)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -365,7 +365,7 @@ ENDPROC(arm1020_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm1020_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1020_dma_unmap_area)
 
         .globl  arm1020_flush_kern_cache_louis
@@ -384,7 +384,7 @@ ENTRY(cpu_arm1020_dcache_clean_area)
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -423,7 +423,7 @@ ENTRY(cpu_arm1020_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, r1, c8, c7, 0           @ invalidate I & D TLBs
 #endif /* CONFIG_MMU */
-        mov     pc, lr
+        ret     lr
         
 /*
  * cpu_arm1020_set_pte(ptep, pte)
@@ -441,7 +441,7 @@ ENTRY(cpu_arm1020_set_pte_ext)
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif /* CONFIG_MMU */
-        mov     pc, lr
+        ret     lr
 
         .type   __arm1020_setup, #function
 __arm1020_setup:
@@ -460,7 +460,7 @@ __arm1020_setup:
 #ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
         orr     r0, r0, #0x4000                 @ .R.. .... .... ....
 #endif
-        mov     pc, lr
+        ret     lr
         .size   __arm1020_setup, . - __arm1020_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm1020e.S b/arch/arm/mm/proc-arm1020e.S
index 9d89405c3d03..a6331d78601f 100644
--- a/arch/arm/mm/proc-arm1020e.S
+++ b/arch/arm/mm/proc-arm1020e.S
@@ -73,7 +73,7 @@
  * cpu_arm1020e_proc_init()
  */
 ENTRY(cpu_arm1020e_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1020e_proc_fin()
@@ -83,7 +83,7 @@ ENTRY(cpu_arm1020e_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1020e_reset(loc)
@@ -107,7 +107,7 @@ ENTRY(cpu_arm1020e_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm1020e_reset)
         .popsection
 
@@ -117,7 +117,7 @@ ENDPROC(cpu_arm1020e_reset)
         .align  5
 ENTRY(cpu_arm1020e_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -133,7 +133,7 @@ ENTRY(arm1020e_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1020e_flush_icache_all)
 
 /*
@@ -168,7 +168,7 @@ __flush_whole_cache:
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -197,7 +197,7 @@ ENTRY(arm1020e_flush_user_cache_range)
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -236,7 +236,7 @@ ENTRY(arm1020e_coherent_user_range)
         blo     1b
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -257,7 +257,7 @@ ENTRY(arm1020e_flush_kern_dcache_area)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -286,7 +286,7 @@ arm1020e_dma_inv_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -308,7 +308,7 @@ arm1020e_dma_clean_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -328,7 +328,7 @@ ENTRY(arm1020e_dma_flush_range)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -351,7 +351,7 @@ ENDPROC(arm1020e_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm1020e_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1020e_dma_unmap_area)
 
         .globl  arm1020e_flush_kern_cache_louis
@@ -369,7 +369,7 @@ ENTRY(cpu_arm1020e_dcache_clean_area)
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -407,7 +407,7 @@ ENTRY(cpu_arm1020e_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, r1, c8, c7, 0           @ invalidate I & D TLBs
 #endif
-        mov     pc, lr
+        ret     lr
         
 /*
  * cpu_arm1020e_set_pte(ptep, pte)
@@ -423,7 +423,7 @@ ENTRY(cpu_arm1020e_set_pte_ext)
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
 #endif
 #endif /* CONFIG_MMU */
-        mov     pc, lr
+        ret     lr
 
         .type   __arm1020e_setup, #function
 __arm1020e_setup:
@@ -441,7 +441,7 @@ __arm1020e_setup:
 #ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
         orr     r0, r0, #0x4000                 @ .R.. .... .... ....
 #endif
-        mov     pc, lr
+        ret     lr
         .size   __arm1020e_setup, . - __arm1020e_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm1022.S b/arch/arm/mm/proc-arm1022.S
index 6f01a0ae3b30..a126b7a59928 100644
--- a/arch/arm/mm/proc-arm1022.S
+++ b/arch/arm/mm/proc-arm1022.S
@@ -62,7 +62,7 @@
  * cpu_arm1022_proc_init()
  */
 ENTRY(cpu_arm1022_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1022_proc_fin()
@@ -72,7 +72,7 @@ ENTRY(cpu_arm1022_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1022_reset(loc)
@@ -96,7 +96,7 @@ ENTRY(cpu_arm1022_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm1022_reset)
         .popsection
 
@@ -106,7 +106,7 @@ ENDPROC(cpu_arm1022_reset)
         .align  5
 ENTRY(cpu_arm1022_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -122,7 +122,7 @@ ENTRY(arm1022_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1022_flush_icache_all)
 
 /*
@@ -156,7 +156,7 @@ __flush_whole_cache:
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -185,7 +185,7 @@ ENTRY(arm1022_flush_user_cache_range)
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -225,7 +225,7 @@ ENTRY(arm1022_coherent_user_range)
         blo     1b
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -246,7 +246,7 @@ ENTRY(arm1022_flush_kern_dcache_area)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -275,7 +275,7 @@ arm1022_dma_inv_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -297,7 +297,7 @@ arm1022_dma_clean_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -317,7 +317,7 @@ ENTRY(arm1022_dma_flush_range)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -340,7 +340,7 @@ ENDPROC(arm1022_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm1022_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1022_dma_unmap_area)
 
         .globl  arm1022_flush_kern_cache_louis
@@ -358,7 +358,7 @@ ENTRY(cpu_arm1022_dcache_clean_area)
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -389,7 +389,7 @@ ENTRY(cpu_arm1022_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, r1, c8, c7, 0           @ invalidate I & D TLBs
 #endif
-        mov     pc, lr
+        ret     lr
         
 /*
  * cpu_arm1022_set_pte_ext(ptep, pte, ext)
@@ -405,7 +405,7 @@ ENTRY(cpu_arm1022_set_pte_ext)
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
 #endif
 #endif /* CONFIG_MMU */
-        mov     pc, lr
+        ret     lr
 
         .type   __arm1022_setup, #function
 __arm1022_setup:
@@ -423,7 +423,7 @@ __arm1022_setup:
 #ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
         orr     r0, r0, #0x4000                 @ .R..............
 #endif
-        mov     pc, lr
+        ret     lr
         .size   __arm1022_setup, . - __arm1022_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm1026.S b/arch/arm/mm/proc-arm1026.S
index 4799a24b43e6..fc294067e977 100644
--- a/arch/arm/mm/proc-arm1026.S
+++ b/arch/arm/mm/proc-arm1026.S
@@ -62,7 +62,7 @@
  * cpu_arm1026_proc_init()
  */
 ENTRY(cpu_arm1026_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1026_proc_fin()
@@ -72,7 +72,7 @@ ENTRY(cpu_arm1026_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm1026_reset(loc)
@@ -96,7 +96,7 @@ ENTRY(cpu_arm1026_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm1026_reset)
         .popsection
 
@@ -106,7 +106,7 @@ ENDPROC(cpu_arm1026_reset)
         .align  5
 ENTRY(cpu_arm1026_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -122,7 +122,7 @@ ENTRY(arm1026_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1026_flush_icache_all)
 
 /*
@@ -151,7 +151,7 @@ __flush_whole_cache:
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -180,7 +180,7 @@ ENTRY(arm1026_flush_user_cache_range)
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
 #endif
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -219,7 +219,7 @@ ENTRY(arm1026_coherent_user_range)
         blo     1b
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -240,7 +240,7 @@ ENTRY(arm1026_flush_kern_dcache_area)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -269,7 +269,7 @@ arm1026_dma_inv_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -291,7 +291,7 @@ arm1026_dma_clean_range:
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -311,7 +311,7 @@ ENTRY(arm1026_dma_flush_range)
         blo     1b
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -334,7 +334,7 @@ ENDPROC(arm1026_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm1026_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm1026_dma_unmap_area)
 
         .globl  arm1026_flush_kern_cache_louis
@@ -352,7 +352,7 @@ ENTRY(cpu_arm1026_dcache_clean_area)
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -378,7 +378,7 @@ ENTRY(cpu_arm1026_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, r1, c8, c7, 0           @ invalidate I & D TLBs
 #endif
-        mov     pc, lr
+        ret     lr
         
 /*
  * cpu_arm1026_set_pte_ext(ptep, pte, ext)
@@ -394,7 +394,7 @@ ENTRY(cpu_arm1026_set_pte_ext)
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
 #endif
 #endif /* CONFIG_MMU */
-        mov     pc, lr
+        ret     lr
 
         .type   __arm1026_setup, #function
 __arm1026_setup:
@@ -417,7 +417,7 @@ __arm1026_setup:
 #ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
         orr     r0, r0, #0x4000                 @ .R.. .... .... ....
 #endif
-        mov     pc, lr
+        ret     lr
         .size   __arm1026_setup, . - __arm1026_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm720.S b/arch/arm/mm/proc-arm720.S
index d42c37f9f5bc..2baa66b3ac9b 100644
--- a/arch/arm/mm/proc-arm720.S
+++ b/arch/arm/mm/proc-arm720.S
@@ -51,14 +51,14 @@
  */
 ENTRY(cpu_arm720_dcache_clean_area)
 ENTRY(cpu_arm720_proc_init)
-                mov     pc, lr
+                ret     lr
 
 ENTRY(cpu_arm720_proc_fin)
                 mrc     p15, 0, r0, c1, c0, 0
                 bic     r0, r0, #0x1000                 @ ...i............
                 bic     r0, r0, #0x000e                 @ ............wca.
                 mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-                mov     pc, lr
+                ret     lr
 
 /*
  * Function: arm720_proc_do_idle(void)
@@ -66,7 +66,7 @@ ENTRY(cpu_arm720_proc_fin)
  * Purpose : put the processor in proper idle mode
  */
 ENTRY(cpu_arm720_do_idle)
-                mov     pc, lr
+                ret     lr
 
 /*
  * Function: arm720_switch_mm(unsigned long pgd_phys)
@@ -81,7 +81,7 @@ ENTRY(cpu_arm720_switch_mm)
                 mcr     p15, 0, r0, c2, c0, 0           @ update page table ptr
                 mcr     p15, 0, r1, c8, c7, 0           @ flush TLB (v4)
 #endif
-                mov     pc, lr
+                ret     lr
 
 /*
  * Function: arm720_set_pte_ext(pte_t *ptep, pte_t pte, unsigned int ext)
@@ -94,7 +94,7 @@ ENTRY(cpu_arm720_set_pte_ext)
 #ifdef CONFIG_MMU
         armv3_set_pte_ext wc_disable=0
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  * Function: arm720_reset
@@ -112,7 +112,7 @@ ENTRY(cpu_arm720_reset)
                 bic     ip, ip, #0x000f                 @ ............wcam
                 bic     ip, ip, #0x2100                 @ ..v....s........
                 mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-                mov     pc, r0
+                ret     r0
 ENDPROC(cpu_arm720_reset)
                 .popsection
 
@@ -128,7 +128,7 @@ __arm710_setup:
         bic     r0, r0, r5
         ldr     r5, arm710_cr1_set
         orr     r0, r0, r5
-        mov     pc, lr                          @ __ret (head.S)
+        ret     lr                              @ __ret (head.S)
         .size   __arm710_setup, . - __arm710_setup
 
         /*
@@ -156,7 +156,7 @@ __arm720_setup:
         mrc     p15, 0, r0, c1, c0              @ get control register
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr                          @ __ret (head.S)
+        ret     lr                              @ __ret (head.S)
         .size   __arm720_setup, . - __arm720_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm740.S b/arch/arm/mm/proc-arm740.S
index 9b0ae90cbf17..ac1ea6b3bce4 100644
--- a/arch/arm/mm/proc-arm740.S
+++ b/arch/arm/mm/proc-arm740.S
@@ -32,7 +32,7 @@ ENTRY(cpu_arm740_proc_init)
 ENTRY(cpu_arm740_do_idle)
 ENTRY(cpu_arm740_dcache_clean_area)
 ENTRY(cpu_arm740_switch_mm)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm740_proc_fin()
@@ -42,7 +42,7 @@ ENTRY(cpu_arm740_proc_fin)
         bic     r0, r0, #0x3f000000             @ bank/f/lock/s
         bic     r0, r0, #0x0000000c             @ w-buffer/cache
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm740_reset(loc)
@@ -56,7 +56,7 @@ ENTRY(cpu_arm740_reset)
         mrc     p15, 0, ip, c1, c0, 0           @ get ctrl register
         bic     ip, ip, #0x0000000c             @ ............wc..
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm740_reset)
         .popsection
 
@@ -115,7 +115,7 @@ __arm740_setup:
                                                 @ need some benchmark
         orr     r0, r0, #0x0000000d             @ MPU/Cache/WB
 
-        mov     pc, lr
+        ret     lr
 
         .size   __arm740_setup, . - __arm740_setup
 
diff --git a/arch/arm/mm/proc-arm7tdmi.S b/arch/arm/mm/proc-arm7tdmi.S
index f6cc3f63ce39..bf6ba4bc30ff 100644
--- a/arch/arm/mm/proc-arm7tdmi.S
+++ b/arch/arm/mm/proc-arm7tdmi.S
@@ -32,13 +32,13 @@ ENTRY(cpu_arm7tdmi_proc_init)
 ENTRY(cpu_arm7tdmi_do_idle)
 ENTRY(cpu_arm7tdmi_dcache_clean_area)
 ENTRY(cpu_arm7tdmi_switch_mm)
-                mov     pc, lr
+                ret     lr
 
 /*
  * cpu_arm7tdmi_proc_fin()
  */
 ENTRY(cpu_arm7tdmi_proc_fin)
-                mov     pc, lr
+                ret     lr
 
 /*
  * Function: cpu_arm7tdmi_reset(loc)
@@ -47,13 +47,13 @@ ENTRY(cpu_arm7tdmi_proc_fin)
  */
                 .pushsection    .idmap.text, "ax"
 ENTRY(cpu_arm7tdmi_reset)
-                mov     pc, r0
+                ret     r0
 ENDPROC(cpu_arm7tdmi_reset)
                 .popsection
 
                 .type   __arm7tdmi_setup, #function
 __arm7tdmi_setup:
-                mov     pc, lr
+                ret     lr
                 .size   __arm7tdmi_setup, . - __arm7tdmi_setup
 
                 __INITDATA
diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
index 549557df6d57..22bf8dde4f84 100644
--- a/arch/arm/mm/proc-arm920.S
+++ b/arch/arm/mm/proc-arm920.S
@@ -63,7 +63,7 @@
  * cpu_arm920_proc_init()
  */
 ENTRY(cpu_arm920_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm920_proc_fin()
@@ -73,7 +73,7 @@ ENTRY(cpu_arm920_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm920_reset(loc)
@@ -97,7 +97,7 @@ ENTRY(cpu_arm920_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm920_reset)
         .popsection
 
@@ -107,7 +107,7 @@ ENDPROC(cpu_arm920_reset)
         .align  5
 ENTRY(cpu_arm920_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 
 #ifndef CONFIG_CPU_DCACHE_WRITETHROUGH
@@ -120,7 +120,7 @@ ENTRY(cpu_arm920_do_idle)
 ENTRY(arm920_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm920_flush_icache_all)
 
 /*
@@ -151,7 +151,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -177,7 +177,7 @@ ENTRY(arm920_flush_user_cache_range)
         blo     1b
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -211,7 +211,7 @@ ENTRY(arm920_coherent_user_range)
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -231,7 +231,7 @@ ENTRY(arm920_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -257,7 +257,7 @@ arm920_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -276,7 +276,7 @@ arm920_dma_clean_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -293,7 +293,7 @@ ENTRY(arm920_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -316,7 +316,7 @@ ENDPROC(arm920_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm920_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm920_dma_unmap_area)
 
         .globl  arm920_flush_kern_cache_louis
@@ -332,7 +332,7 @@ ENTRY(cpu_arm920_dcache_clean_area)
         add     r0, r0, #CACHE_DLINESIZE
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -367,7 +367,7 @@ ENTRY(cpu_arm920_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm920_set_pte(ptep, pte, ext)
@@ -382,7 +382,7 @@ ENTRY(cpu_arm920_set_pte_ext)
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm920_suspend_size
@@ -423,7 +423,7 @@ __arm920_setup:
         mrc     p15, 0, r0, c1, c0              @ get control register v4
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr
+        ret     lr
         .size   __arm920_setup, . - __arm920_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm922.S b/arch/arm/mm/proc-arm922.S
index 2a758b06c6f6..0c6d5ac5a6d4 100644
--- a/arch/arm/mm/proc-arm922.S
+++ b/arch/arm/mm/proc-arm922.S
@@ -65,7 +65,7 @@
  * cpu_arm922_proc_init()
  */
 ENTRY(cpu_arm922_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm922_proc_fin()
@@ -75,7 +75,7 @@ ENTRY(cpu_arm922_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm922_reset(loc)
@@ -99,7 +99,7 @@ ENTRY(cpu_arm922_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm922_reset)
         .popsection
 
@@ -109,7 +109,7 @@ ENDPROC(cpu_arm922_reset)
         .align  5
 ENTRY(cpu_arm922_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 
 #ifndef CONFIG_CPU_DCACHE_WRITETHROUGH
@@ -122,7 +122,7 @@ ENTRY(cpu_arm922_do_idle)
 ENTRY(arm922_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm922_flush_icache_all)
 
 /*
@@ -153,7 +153,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -179,7 +179,7 @@ ENTRY(arm922_flush_user_cache_range)
         blo     1b
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -213,7 +213,7 @@ ENTRY(arm922_coherent_user_range)
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -233,7 +233,7 @@ ENTRY(arm922_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -259,7 +259,7 @@ arm922_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -278,7 +278,7 @@ arm922_dma_clean_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -295,7 +295,7 @@ ENTRY(arm922_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -318,7 +318,7 @@ ENDPROC(arm922_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm922_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm922_dma_unmap_area)
 
         .globl  arm922_flush_kern_cache_louis
@@ -336,7 +336,7 @@ ENTRY(cpu_arm922_dcache_clean_area)
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -371,7 +371,7 @@ ENTRY(cpu_arm922_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm922_set_pte_ext(ptep, pte, ext)
@@ -386,7 +386,7 @@ ENTRY(cpu_arm922_set_pte_ext)
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif /* CONFIG_MMU */
-        mov     pc, lr
+        ret     lr
 
         .type   __arm922_setup, #function
 __arm922_setup:
@@ -401,7 +401,7 @@ __arm922_setup:
         mrc     p15, 0, r0, c1, c0              @ get control register v4
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr
+        ret     lr
         .size   __arm922_setup, . - __arm922_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm925.S b/arch/arm/mm/proc-arm925.S
index ba0d58e1a2a2..c32d073282ea 100644
--- a/arch/arm/mm/proc-arm925.S
+++ b/arch/arm/mm/proc-arm925.S
@@ -86,7 +86,7 @@
  * cpu_arm925_proc_init()
  */
 ENTRY(cpu_arm925_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm925_proc_fin()
@@ -96,7 +96,7 @@ ENTRY(cpu_arm925_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm925_reset(loc)
@@ -129,7 +129,7 @@ ENDPROC(cpu_arm925_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 
 /*
  * cpu_arm925_do_idle()
@@ -145,7 +145,7 @@ ENTRY(cpu_arm925_do_idle)
         mcr     p15, 0, r2, c1, c0, 0           @ Disable I cache
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
         mcr     p15, 0, r1, c1, c0, 0           @ Restore ICache enable
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_icache_all()
@@ -155,7 +155,7 @@ ENTRY(cpu_arm925_do_idle)
 ENTRY(arm925_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm925_flush_icache_all)
 
 /*
@@ -188,7 +188,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -225,7 +225,7 @@ ENTRY(arm925_flush_user_cache_range)
         blo     1b
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -259,7 +259,7 @@ ENTRY(arm925_coherent_user_range)
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -279,7 +279,7 @@ ENTRY(arm925_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -307,7 +307,7 @@ arm925_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -328,7 +328,7 @@ arm925_dma_clean_range:
         blo     1b
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -350,7 +350,7 @@ ENTRY(arm925_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -373,7 +373,7 @@ ENDPROC(arm925_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm925_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm925_dma_unmap_area)
 
         .globl  arm925_flush_kern_cache_louis
@@ -390,7 +390,7 @@ ENTRY(cpu_arm925_dcache_clean_area)
         bhi     1b
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -419,7 +419,7 @@ ENTRY(cpu_arm925_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm925_set_pte_ext(ptep, pte, ext)
@@ -436,7 +436,7 @@ ENTRY(cpu_arm925_set_pte_ext)
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif /* CONFIG_MMU */
-        mov     pc, lr
+        ret     lr
 
         .type   __arm925_setup, #function
 __arm925_setup:
@@ -469,7 +469,7 @@ __arm925_setup:
 #ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
         orr     r0, r0, #0x4000                 @ .1.. .... .... ....
 #endif
-        mov     pc, lr
+        ret     lr
         .size   __arm925_setup, . - __arm925_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
index 0f098f407c9f..252b2503038d 100644
--- a/arch/arm/mm/proc-arm926.S
+++ b/arch/arm/mm/proc-arm926.S
@@ -55,7 +55,7 @@
  * cpu_arm926_proc_init()
  */
 ENTRY(cpu_arm926_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm926_proc_fin()
@@ -65,7 +65,7 @@ ENTRY(cpu_arm926_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm926_reset(loc)
@@ -89,7 +89,7 @@ ENTRY(cpu_arm926_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm926_reset)
         .popsection
 
@@ -111,7 +111,7 @@ ENTRY(cpu_arm926_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
         mcr     p15, 0, r1, c1, c0, 0           @ Restore ICache enable
         msr     cpsr_c, r3                      @ Restore FIQ state
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_icache_all()
@@ -121,7 +121,7 @@ ENTRY(cpu_arm926_do_idle)
 ENTRY(arm926_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm926_flush_icache_all)
 
 /*
@@ -151,7 +151,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -188,7 +188,7 @@ ENTRY(arm926_flush_user_cache_range)
         blo     1b
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -222,7 +222,7 @@ ENTRY(arm926_coherent_user_range)
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -242,7 +242,7 @@ ENTRY(arm926_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -270,7 +270,7 @@ arm926_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -291,7 +291,7 @@ arm926_dma_clean_range:
         blo     1b
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -313,7 +313,7 @@ ENTRY(arm926_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -336,7 +336,7 @@ ENDPROC(arm926_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm926_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm926_dma_unmap_area)
 
         .globl  arm926_flush_kern_cache_louis
@@ -353,7 +353,7 @@ ENTRY(cpu_arm926_dcache_clean_area)
         bhi     1b
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -380,7 +380,7 @@ ENTRY(cpu_arm926_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm926_set_pte_ext(ptep, pte, ext)
@@ -397,7 +397,7 @@ ENTRY(cpu_arm926_set_pte_ext)
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm926_suspend_size
@@ -448,7 +448,7 @@ __arm926_setup:
 #ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
         orr     r0, r0, #0x4000                 @ .1.. .... .... ....
 #endif
-        mov     pc, lr
+        ret     lr
         .size   __arm926_setup, . - __arm926_setup
 
         /*
diff --git a/arch/arm/mm/proc-arm940.S b/arch/arm/mm/proc-arm940.S
index 1c39a704ff6e..e5212d489377 100644
--- a/arch/arm/mm/proc-arm940.S
+++ b/arch/arm/mm/proc-arm940.S
@@ -31,7 +31,7 @@
  */
 ENTRY(cpu_arm940_proc_init)
 ENTRY(cpu_arm940_switch_mm)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm940_proc_fin()
@@ -41,7 +41,7 @@ ENTRY(cpu_arm940_proc_fin)
         bic     r0, r0, #0x00001000             @ i-cache
         bic     r0, r0, #0x00000004             @ d-cache
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm940_reset(loc)
@@ -58,7 +58,7 @@ ENTRY(cpu_arm940_reset)
         bic     ip, ip, #0x00000005             @ .............c.p
         bic     ip, ip, #0x00001000             @ i-cache
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm940_reset)
         .popsection
 
@@ -68,7 +68,7 @@ ENDPROC(cpu_arm940_reset)
         .align  5
 ENTRY(cpu_arm940_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_icache_all()
@@ -78,7 +78,7 @@ ENTRY(cpu_arm940_do_idle)
 ENTRY(arm940_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm940_flush_icache_all)
 
 /*
@@ -122,7 +122,7 @@ ENTRY(arm940_flush_user_cache_range)
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -170,7 +170,7 @@ ENTRY(arm940_flush_kern_dcache_area)
         bcs     1b                              @ segments 7 to 0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -191,7 +191,7 @@ arm940_dma_inv_range:
         subs    r1, r1, #1 << 4
         bcs     1b                              @ segments 7 to 0
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -215,7 +215,7 @@ ENTRY(cpu_arm940_dcache_clean_area)
         bcs     1b                              @ segments 7 to 0
 #endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -241,7 +241,7 @@ ENTRY(arm940_dma_flush_range)
         subs    r1, r1, #1 << 4
         bcs     1b                              @ segments 7 to 0
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -264,7 +264,7 @@ ENDPROC(arm940_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm940_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm940_dma_unmap_area)
 
         .globl  arm940_flush_kern_cache_louis
@@ -337,7 +337,7 @@ __arm940_setup:
         orr     r0, r0, #0x00001000             @ I-cache
         orr     r0, r0, #0x00000005             @ MPU/D-cache
 
-        mov     pc, lr
+        ret     lr
 
         .size   __arm940_setup, . - __arm940_setup
 
diff --git a/arch/arm/mm/proc-arm946.S b/arch/arm/mm/proc-arm946.S
index 0289cd905e73..b3dd9b2d0b8e 100644
--- a/arch/arm/mm/proc-arm946.S
+++ b/arch/arm/mm/proc-arm946.S
@@ -38,7 +38,7 @@
  */
 ENTRY(cpu_arm946_proc_init)
 ENTRY(cpu_arm946_switch_mm)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm946_proc_fin()
@@ -48,7 +48,7 @@ ENTRY(cpu_arm946_proc_fin)
         bic     r0, r0, #0x00001000             @ i-cache
         bic     r0, r0, #0x00000004             @ d-cache
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_arm946_reset(loc)
@@ -65,7 +65,7 @@ ENTRY(cpu_arm946_reset)
         bic     ip, ip, #0x00000005             @ .............c.p
         bic     ip, ip, #0x00001000             @ i-cache
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_arm946_reset)
         .popsection
 
@@ -75,7 +75,7 @@ ENDPROC(cpu_arm946_reset)
         .align  5
 ENTRY(cpu_arm946_do_idle)
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_icache_all()
@@ -85,7 +85,7 @@ ENTRY(cpu_arm946_do_idle)
 ENTRY(arm946_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm946_flush_icache_all)
 
 /*
@@ -117,7 +117,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ flush I cache
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -156,7 +156,7 @@ ENTRY(arm946_flush_user_cache_range)
         blo     1b
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -191,7 +191,7 @@ ENTRY(arm946_coherent_user_range)
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -212,7 +212,7 @@ ENTRY(arm946_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -239,7 +239,7 @@ arm946_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -260,7 +260,7 @@ arm946_dma_clean_range:
         blo     1b
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -284,7 +284,7 @@ ENTRY(arm946_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -307,7 +307,7 @@ ENDPROC(arm946_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(arm946_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(arm946_dma_unmap_area)
 
         .globl  arm946_flush_kern_cache_louis
@@ -324,7 +324,7 @@ ENTRY(cpu_arm946_dcache_clean_area)
         bhi     1b
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
         .type   __arm946_setup, #function
 __arm946_setup:
@@ -392,7 +392,7 @@ __arm946_setup:
 #ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
         orr     r0, r0, #0x00004000             @ .1.. .... .... ....
 #endif
-        mov     pc, lr
+        ret     lr
 
         .size   __arm946_setup, . - __arm946_setup
 
diff --git a/arch/arm/mm/proc-arm9tdmi.S b/arch/arm/mm/proc-arm9tdmi.S
index f51197ba754a..8227322bbb8f 100644
--- a/arch/arm/mm/proc-arm9tdmi.S
+++ b/arch/arm/mm/proc-arm9tdmi.S
@@ -32,13 +32,13 @@ ENTRY(cpu_arm9tdmi_proc_init)
 ENTRY(cpu_arm9tdmi_do_idle)
 ENTRY(cpu_arm9tdmi_dcache_clean_area)
 ENTRY(cpu_arm9tdmi_switch_mm)
-                mov     pc, lr
+                ret     lr
 
 /*
  * cpu_arm9tdmi_proc_fin()
  */
 ENTRY(cpu_arm9tdmi_proc_fin)
-                mov     pc, lr
+                ret     lr
 
 /*
  * Function: cpu_arm9tdmi_reset(loc)
@@ -47,13 +47,13 @@ ENTRY(cpu_arm9tdmi_proc_fin)
  */
                 .pushsection    .idmap.text, "ax"
 ENTRY(cpu_arm9tdmi_reset)
-                mov     pc, r0
+                ret     r0
 ENDPROC(cpu_arm9tdmi_reset)
                 .popsection
 
                 .type   __arm9tdmi_setup, #function
 __arm9tdmi_setup:
-                mov     pc, lr
+                ret     lr
                 .size   __arm9tdmi_setup, . - __arm9tdmi_setup
 
                 __INITDATA
diff --git a/arch/arm/mm/proc-fa526.S b/arch/arm/mm/proc-fa526.S
index 2dfc0f1d3bfd..c494886892ba 100644
--- a/arch/arm/mm/proc-fa526.S
+++ b/arch/arm/mm/proc-fa526.S
@@ -32,7 +32,7 @@
  * cpu_fa526_proc_init()
  */
 ENTRY(cpu_fa526_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_fa526_proc_fin()
@@ -44,7 +44,7 @@ ENTRY(cpu_fa526_proc_fin)
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
         nop
         nop
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_fa526_reset(loc)
@@ -72,7 +72,7 @@ ENTRY(cpu_fa526_reset)
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
         nop
         nop
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_fa526_reset)
         .popsection
 
@@ -81,7 +81,7 @@ ENDPROC(cpu_fa526_reset)
  */
         .align  4
 ENTRY(cpu_fa526_do_idle)
-        mov     pc, lr
+        ret     lr
 
 
 ENTRY(cpu_fa526_dcache_clean_area)
@@ -90,7 +90,7 @@ ENTRY(cpu_fa526_dcache_clean_area)
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -117,7 +117,7 @@ ENTRY(cpu_fa526_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate UTLB
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_fa526_set_pte_ext(ptep, pte, ext)
@@ -133,7 +133,7 @@ ENTRY(cpu_fa526_set_pte_ext)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif
-        mov     pc, lr
+        ret     lr
 
         .type   __fa526_setup, #function
 __fa526_setup:
@@ -162,7 +162,7 @@ __fa526_setup:
         bic     r0, r0, r5
         ldr     r5, fa526_cr1_set
         orr     r0, r0, r5
-        mov     pc, lr
+        ret     lr
         .size   __fa526_setup, . - __fa526_setup
 
         /*
diff --git a/arch/arm/mm/proc-feroceon.S b/arch/arm/mm/proc-feroceon.S
index db79b62c92fb..03a1b75f2e16 100644
--- a/arch/arm/mm/proc-feroceon.S
+++ b/arch/arm/mm/proc-feroceon.S
@@ -69,7 +69,7 @@ ENTRY(cpu_feroceon_proc_init)
         movne   r2, r2, lsr #2                  @ turned into # of sets
         sub     r2, r2, #(1 << 5)
         stmia   r1, {r2, r3}
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_feroceon_proc_fin()
@@ -86,7 +86,7 @@ ENTRY(cpu_feroceon_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_feroceon_reset(loc)
@@ -110,7 +110,7 @@ ENTRY(cpu_feroceon_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_feroceon_reset)
         .popsection
 
@@ -124,7 +124,7 @@ ENTRY(cpu_feroceon_do_idle)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ Drain write buffer
         mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_icache_all()
@@ -134,7 +134,7 @@ ENTRY(cpu_feroceon_do_idle)
 ENTRY(feroceon_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(feroceon_flush_icache_all)
 
 /*
@@ -169,7 +169,7 @@ __flush_whole_cache:
         mov     ip, #0
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -198,7 +198,7 @@ ENTRY(feroceon_flush_user_cache_range)
         tst     r2, #VM_EXEC
         mov     ip, #0
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -233,7 +233,7 @@ ENTRY(feroceon_coherent_user_range)
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -254,7 +254,7 @@ ENTRY(feroceon_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
         .align  5
 ENTRY(feroceon_range_flush_kern_dcache_area)
@@ -268,7 +268,7 @@ ENTRY(feroceon_range_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -295,7 +295,7 @@ feroceon_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
         .align  5
 feroceon_range_dma_inv_range:
@@ -311,7 +311,7 @@ feroceon_range_dma_inv_range:
         mcr     p15, 5, r0, c15, c14, 0         @ D inv range start
         mcr     p15, 5, r1, c15, c14, 1         @ D inv range top
         msr     cpsr_c, r2                      @ restore interrupts
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -331,7 +331,7 @@ feroceon_dma_clean_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
         .align  5
 feroceon_range_dma_clean_range:
@@ -344,7 +344,7 @@ feroceon_range_dma_clean_range:
         mcr     p15, 5, r1, c15, c13, 1         @ D clean range top
         msr     cpsr_c, r2                      @ restore interrupts
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -362,7 +362,7 @@ ENTRY(feroceon_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
         .align  5
 ENTRY(feroceon_range_dma_flush_range)
@@ -375,7 +375,7 @@ ENTRY(feroceon_range_dma_flush_range)
         mcr     p15, 5, r1, c15, c15, 1         @ D clean/inv range top
         msr     cpsr_c, r2                      @ restore interrupts
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -412,7 +412,7 @@ ENDPROC(feroceon_range_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(feroceon_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(feroceon_dma_unmap_area)
 
         .globl  feroceon_flush_kern_cache_louis
@@ -461,7 +461,7 @@ ENTRY(cpu_feroceon_dcache_clean_area)
         bhi     1b
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -490,9 +490,9 @@ ENTRY(cpu_feroceon_switch_mm)
 
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
-        mov     pc, r2
+        ret     r2
 #else
-        mov     pc, lr
+        ret     lr
 #endif
 
 /*
@@ -512,7 +512,7 @@ ENTRY(cpu_feroceon_set_pte_ext)
 #endif
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* Suspend/resume support: taken from arch/arm/mm/proc-arm926.S */
 .globl  cpu_feroceon_suspend_size
@@ -554,7 +554,7 @@ __feroceon_setup:
         mrc     p15, 0, r0, c1, c0              @ get control register v4
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr
+        ret     lr
         .size   __feroceon_setup, . - __feroceon_setup
 
         /*
diff --git a/arch/arm/mm/proc-mohawk.S b/arch/arm/mm/proc-mohawk.S
index 40acba595731..53d393455f13 100644
--- a/arch/arm/mm/proc-mohawk.S
+++ b/arch/arm/mm/proc-mohawk.S
@@ -45,7 +45,7 @@
  * cpu_mohawk_proc_init()
  */
 ENTRY(cpu_mohawk_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_mohawk_proc_fin()
@@ -55,7 +55,7 @@ ENTRY(cpu_mohawk_proc_fin)
         bic     r0, r0, #0x1800                 @ ...iz...........
         bic     r0, r0, #0x0006                 @ .............ca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_mohawk_reset(loc)
@@ -79,7 +79,7 @@ ENTRY(cpu_mohawk_reset)
         bic     ip, ip, #0x0007                 @ .............cam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_mohawk_reset)
         .popsection
 
@@ -93,7 +93,7 @@ ENTRY(cpu_mohawk_do_idle)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
         mcr     p15, 0, r0, c7, c0, 4           @ wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_icache_all()
@@ -103,7 +103,7 @@ ENTRY(cpu_mohawk_do_idle)
 ENTRY(mohawk_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(mohawk_flush_icache_all)
 
 /*
@@ -128,7 +128,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
         mcrne   p15, 0, ip, c7, c10, 0          @ drain write buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, flags)
@@ -158,7 +158,7 @@ ENTRY(mohawk_flush_user_cache_range)
         blo     1b
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -194,7 +194,7 @@ ENTRY(mohawk_coherent_user_range)
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
         mov     r0, #0
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -214,7 +214,7 @@ ENTRY(mohawk_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -240,7 +240,7 @@ mohawk_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -259,7 +259,7 @@ mohawk_dma_clean_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -277,7 +277,7 @@ ENTRY(mohawk_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -300,7 +300,7 @@ ENDPROC(mohawk_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(mohawk_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(mohawk_dma_unmap_area)
 
         .globl  mohawk_flush_kern_cache_louis
@@ -315,7 +315,7 @@ ENTRY(cpu_mohawk_dcache_clean_area)
         subs    r1, r1, #CACHE_DLINESIZE
         bhi     1b
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_mohawk_switch_mm(pgd)
@@ -333,7 +333,7 @@ ENTRY(cpu_mohawk_switch_mm)
         orr     r0, r0, #0x18                   @ cache the page table in L2
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_mohawk_set_pte_ext(ptep, pte, ext)
@@ -346,7 +346,7 @@ ENTRY(cpu_mohawk_set_pte_ext)
         mov     r0, r0
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
-        mov     pc, lr
+        ret     lr
 
 .globl  cpu_mohawk_suspend_size
 .equ    cpu_mohawk_suspend_size, 4 * 6
@@ -400,7 +400,7 @@ __mohawk_setup:
         mrc     p15, 0, r0, c1, c0              @ get control register
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr
+        ret     lr
 
         .size   __mohawk_setup, . - __mohawk_setup
 
diff --git a/arch/arm/mm/proc-sa110.S b/arch/arm/mm/proc-sa110.S
index c45319c8f1d9..8008a0461cf5 100644
--- a/arch/arm/mm/proc-sa110.S
+++ b/arch/arm/mm/proc-sa110.S
@@ -38,7 +38,7 @@
 ENTRY(cpu_sa110_proc_init)
         mov     r0, #0
         mcr     p15, 0, r0, c15, c1, 2          @ Enable clock switching
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_sa110_proc_fin()
@@ -50,7 +50,7 @@ ENTRY(cpu_sa110_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_sa110_reset(loc)
@@ -74,7 +74,7 @@ ENTRY(cpu_sa110_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_sa110_reset)
         .popsection
 
@@ -103,7 +103,7 @@ ENTRY(cpu_sa110_do_idle)
         mov     r0, r0                          @ safety
         mov     r0, r0                          @ safety
         mcr     p15, 0, r0, c15, c1, 2          @ enable clock switching
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -121,7 +121,7 @@ ENTRY(cpu_sa110_dcache_clean_area)
         add     r0, r0, #DCACHELINESIZE
         subs    r1, r1, #DCACHELINESIZE
         bhi     1b
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -141,7 +141,7 @@ ENTRY(cpu_sa110_switch_mm)
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
         ldr     pc, [sp], #4
 #else
-        mov     pc, lr
+        ret     lr
 #endif
 
 /*
@@ -157,7 +157,7 @@ ENTRY(cpu_sa110_set_pte_ext)
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif
-        mov     pc, lr
+        ret     lr
 
         .type   __sa110_setup, #function
 __sa110_setup:
@@ -173,7 +173,7 @@ __sa110_setup:
         mrc     p15, 0, r0, c1, c0              @ get control register v4
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr
+        ret     lr
         .size   __sa110_setup, . - __sa110_setup
 
         /*
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index 09d241ae2dbe..89f97ac648a9 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -43,7 +43,7 @@ ENTRY(cpu_sa1100_proc_init)
         mov     r0, #0
         mcr     p15, 0, r0, c15, c1, 2          @ Enable clock switching
         mcr     p15, 0, r0, c9, c0, 5           @ Allow read-buffer operations from userland
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_sa1100_proc_fin()
@@ -58,7 +58,7 @@ ENTRY(cpu_sa1100_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_sa1100_reset(loc)
@@ -82,7 +82,7 @@ ENTRY(cpu_sa1100_reset)
         bic     ip, ip, #0x000f                 @ ............wcam
         bic     ip, ip, #0x1100                 @ ...i...s........
         mcr     p15, 0, ip, c1, c0, 0           @ ctrl register
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_sa1100_reset)
         .popsection
 
@@ -113,7 +113,7 @@ ENTRY(cpu_sa1100_do_idle)
         mcr     p15, 0, r0, c15, c8, 2          @ wait for interrupt
         mov     r0, r0                          @ safety
         mcr     p15, 0, r0, c15, c1, 2          @ enable clock switching
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -131,7 +131,7 @@ ENTRY(cpu_sa1100_dcache_clean_area)
         add     r0, r0, #DCACHELINESIZE
         subs    r1, r1, #DCACHELINESIZE
         bhi     1b
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -152,7 +152,7 @@ ENTRY(cpu_sa1100_switch_mm)
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
         ldr     pc, [sp], #4
 #else
-        mov     pc, lr
+        ret     lr
 #endif
 
 /*
@@ -168,7 +168,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
         mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         mcr     p15, 0, r0, c7, c10, 4          @ drain WB
 #endif
-        mov     pc, lr
+        ret     lr
 
 .globl  cpu_sa1100_suspend_size
 .equ    cpu_sa1100_suspend_size, 4 * 3
@@ -211,7 +211,7 @@ __sa1100_setup:
         mrc     p15, 0, r0, c1, c0              @ get control register v4
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr
+        ret     lr
         .size   __sa1100_setup, . - __sa1100_setup
 
         /*
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 32b3558321c4..d0390f4b3f18 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -36,14 +36,14 @@
 #define PMD_FLAGS_SMP   PMD_SECT_WBWA|PMD_SECT_S
 
 ENTRY(cpu_v6_proc_init)
-        mov     pc, lr
+        ret     lr
 
 ENTRY(cpu_v6_proc_fin)
         mrc     p15, 0, r0, c1, c0, 0           @ ctrl register
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x0006                 @ .............ca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  *      cpu_v6_reset(loc)
@@ -62,7 +62,7 @@ ENTRY(cpu_v6_reset)
         mcr     p15, 0, r1, c1, c0, 0           @ disable MMU
         mov     r1, #0
         mcr     p15, 0, r1, c7, c5, 4           @ ISB
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_v6_reset)
         .popsection
 
@@ -77,14 +77,14 @@ ENTRY(cpu_v6_do_idle)
         mov     r1, #0
         mcr     p15, 0, r1, c7, c10, 4          @ DWB - WFI may enter a low-power mode
         mcr     p15, 0, r1, c7, c0, 4           @ wait for interrupt
-        mov     pc, lr
+        ret     lr
 
 ENTRY(cpu_v6_dcache_clean_area)
 1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         add     r0, r0, #D_CACHE_LINE_SIZE
         subs    r1, r1, #D_CACHE_LINE_SIZE
         bhi     1b
-        mov     pc, lr
+        ret     lr
 
 /*
  *      cpu_v6_switch_mm(pgd_phys, tsk)
@@ -113,7 +113,7 @@ ENTRY(cpu_v6_switch_mm)
 #endif
         mcr     p15, 0, r1, c13, c0, 1          @ set context ID
 #endif
-        mov     pc, lr
+        ret     lr
 
 /*
  *      cpu_v6_set_pte_ext(ptep, pte, ext)
@@ -131,7 +131,7 @@ ENTRY(cpu_v6_set_pte_ext)
 #ifdef CONFIG_MMU
         armv6_set_pte_ext cpu_v6
 #endif
-        mov     pc, lr
+        ret     lr
 
 /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
 .globl  cpu_v6_suspend_size
@@ -241,7 +241,7 @@ __v6_setup:
         mcreq   p15, 0, r5, c1, c0, 1           @ write aux control reg
         orreq   r0, r0, #(1 << 21)              @ low interrupt latency configuration
 #endif
-        mov     pc, lr                          @ return to head.S:__ret
+        ret     lr                              @ return to head.S:__ret
 
         /*
          *         V X F   I D LR
diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
index 1f52915f2b28..ed448d8a596b 100644
--- a/arch/arm/mm/proc-v7-2level.S
+++ b/arch/arm/mm/proc-v7-2level.S
@@ -59,7 +59,7 @@ ENTRY(cpu_v7_switch_mm)
         mcr     p15, 0, r0, c2, c0, 0           @ set TTB 0
         isb
 #endif
-        mov     pc, lr
+        bx      lr
 ENDPROC(cpu_v7_switch_mm)
 
 /*
@@ -106,7 +106,7 @@ ENTRY(cpu_v7_set_pte_ext)
         ALT_SMP(W(nop))
         ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
-        mov     pc, lr
+        bx      lr
 ENDPROC(cpu_v7_set_pte_ext)
 
         /*
diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
index 22e3ad63500c..e4c8acfc1323 100644
--- a/arch/arm/mm/proc-v7-3level.S
+++ b/arch/arm/mm/proc-v7-3level.S
@@ -19,6 +19,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
+#include <asm/assembler.h>
 
 #define TTB_IRGN_NC     (0 << 8)
 #define TTB_IRGN_WBWA   (1 << 8)
@@ -61,7 +62,7 @@ ENTRY(cpu_v7_switch_mm)
         mcrr    p15, 0, rpgdl, rpgdh, c2                @ set TTB 0
         isb
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7_switch_mm)
 
 #ifdef __ARMEB__
@@ -86,13 +87,18 @@ ENTRY(cpu_v7_set_pte_ext)
         tst     rh, #1 << (57 - 32)             @ L_PTE_NONE
         bicne   rl, #L_PTE_VALID
         bne     1f
-        tst     rh, #1 << (55 - 32)             @ L_PTE_DIRTY
-        orreq   rl, #L_PTE_RDONLY
+
+        eor     ip, rh, #1 << (55 - 32) @ toggle L_PTE_DIRTY in temp reg to
+                                        @ test for !L_PTE_DIRTY || L_PTE_RDONLY
+        tst     ip, #1 << (55 - 32) | 1 << (58 - 32)
+        orrne   rl, #PTE_AP2
+        biceq   rl, #PTE_AP2
+
 1:      strd    r2, r3, [r0]
         ALT_SMP(W(nop))
         ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7_set_pte_ext)
 
         /*
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 3db2c2f04a30..b5d67db20897 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -26,7 +26,7 @@
 #endif
 
 ENTRY(cpu_v7_proc_init)
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7_proc_init)
 
 ENTRY(cpu_v7_proc_fin)
@@ -34,7 +34,7 @@ ENTRY(cpu_v7_proc_fin)
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x0006                 @ .............ca.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7_proc_fin)
 
 /*
@@ -71,20 +71,20 @@ ENDPROC(cpu_v7_reset)
 ENTRY(cpu_v7_do_idle)
         dsb                                     @ WFI may enter a low-power mode
         wfi
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7_do_idle)
 
 ENTRY(cpu_v7_dcache_clean_area)
         ALT_SMP(W(nop))                 @ MP extensions imply L1 PTW
         ALT_UP_B(1f)
-        mov     pc, lr
+        ret     lr
 1:      dcache_line_size r2, r3
 2:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         add     r0, r0, r2
         subs    r1, r1, r2
         bhi     2b
         dsb     ishst
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7_dcache_clean_area)
 
         string  cpu_v7_name, "ARMv7 Processor"
@@ -152,6 +152,40 @@ ENTRY(cpu_v7_do_resume)
 ENDPROC(cpu_v7_do_resume)
 #endif
 
+/*
+ * Cortex-A9 processor functions
+ */
+        globl_equ       cpu_ca9mp_proc_init,    cpu_v7_proc_init
+        globl_equ       cpu_ca9mp_proc_fin,     cpu_v7_proc_fin
+        globl_equ       cpu_ca9mp_reset,        cpu_v7_reset
+        globl_equ       cpu_ca9mp_do_idle,      cpu_v7_do_idle
+        globl_equ       cpu_ca9mp_dcache_clean_area, cpu_v7_dcache_clean_area
+        globl_equ       cpu_ca9mp_switch_mm,    cpu_v7_switch_mm
+        globl_equ       cpu_ca9mp_set_pte_ext,  cpu_v7_set_pte_ext
+.globl  cpu_ca9mp_suspend_size
+.equ    cpu_ca9mp_suspend_size, cpu_v7_suspend_size + 4 * 2
+#ifdef CONFIG_ARM_CPU_SUSPEND
+ENTRY(cpu_ca9mp_do_suspend)
+        stmfd   sp!, {r4 - r5}
+        mrc     p15, 0, r4, c15, c0, 1          @ Diagnostic register
+        mrc     p15, 0, r5, c15, c0, 0          @ Power register
+        stmia   r0!, {r4 - r5}
+        ldmfd   sp!, {r4 - r5}
+        b       cpu_v7_do_suspend
+ENDPROC(cpu_ca9mp_do_suspend)
+
+ENTRY(cpu_ca9mp_do_resume)
+        ldmia   r0!, {r4 - r5}
+        mrc     p15, 0, r10, c15, c0, 1         @ Read Diagnostic register
+        teq     r4, r10                         @ Already restored?
+        mcrne   p15, 0, r4, c15, c0, 1          @ No, so restore it
+        mrc     p15, 0, r10, c15, c0, 0         @ Read Power register
+        teq     r5, r10                         @ Already restored?
+        mcrne   p15, 0, r5, c15, c0, 0          @ No, so restore it
+        b       cpu_v7_do_resume
+ENDPROC(cpu_ca9mp_do_resume)
+#endif
+
 #ifdef CONFIG_CPU_PJ4B
         globl_equ       cpu_pj4b_switch_mm,     cpu_v7_switch_mm
         globl_equ       cpu_pj4b_set_pte_ext,   cpu_v7_set_pte_ext
@@ -163,7 +197,7 @@ ENTRY(cpu_pj4b_do_idle)
         dsb                                     @ WFI may enter a low-power mode
         wfi
         dsb                                     @barrier
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_pj4b_do_idle)
 #else
         globl_equ       cpu_pj4b_do_idle,       cpu_v7_do_idle
@@ -184,16 +218,16 @@ ENDPROC(cpu_pj4b_do_suspend)
 
 ENTRY(cpu_pj4b_do_resume)
         ldmia   r0!, {r6 - r10}
-        mcr     p15, 1, r6, c15, c1, 0  @ save CP15 - extra features
-        mcr     p15, 1, r7, c15, c2, 0  @ save CP15 - Aux Func Modes Ctrl 0
-        mcr     p15, 1, r8, c15, c1, 2  @ save CP15 - Aux Debug Modes Ctrl 2
-        mcr     p15, 1, r9, c15, c1, 1  @ save CP15 - Aux Debug Modes Ctrl 1
-        mcr     p15, 0, r10, c9, c14, 0  @ save CP15 - PMC
+        mcr     p15, 1, r6, c15, c1, 0  @ restore CP15 - extra features
+        mcr     p15, 1, r7, c15, c2, 0  @ restore CP15 - Aux Func Modes Ctrl 0
+        mcr     p15, 1, r8, c15, c1, 2  @ restore CP15 - Aux Debug Modes Ctrl 2
+        mcr     p15, 1, r9, c15, c1, 1  @ restore CP15 - Aux Debug Modes Ctrl 1
+        mcr     p15, 0, r10, c9, c14, 0  @ restore CP15 - PMC
         b cpu_v7_do_resume
 ENDPROC(cpu_pj4b_do_resume)
 #endif
 .globl  cpu_pj4b_suspend_size
-.equ    cpu_pj4b_suspend_size, 4 * 14
+.equ    cpu_pj4b_suspend_size, cpu_v7_suspend_size + 4 * 5
 
 #endif
 
@@ -216,6 +250,7 @@ __v7_cr7mp_setup:
 __v7_ca7mp_setup:
 __v7_ca12mp_setup:
 __v7_ca15mp_setup:
+__v7_b15mp_setup:
 __v7_ca17mp_setup:
         mov     r10, #0
 1:
@@ -407,7 +442,7 @@ __v7_setup:
         bic     r0, r0, r5                      @ clear bits them
         orr     r0, r0, r6                      @ set them
  THUMB( orr     r0, r0, #1 << 30        )       @ Thumb exceptions
-        mov     pc, lr                          @ return to head.S:__ret
+        ret     lr                              @ return to head.S:__ret
 ENDPROC(__v7_setup)
 
         .align  2
@@ -418,6 +453,7 @@ __v7_setup_stack:
 
         @ define struct processor (see <asm/proc-fns.h> and proc-macros.S)
         define_processor_functions v7, dabort=v7_early_abort, pabort=v7_pabort, suspend=1
+        define_processor_functions ca9mp, dabort=v7_early_abort, pabort=v7_pabort, suspend=1
 #ifdef CONFIG_CPU_PJ4B
         define_processor_functions pj4b, dabort=v7_early_abort, pabort=v7_pabort, suspend=1
 #endif
@@ -470,7 +506,7 @@ __v7_ca5mp_proc_info:
 __v7_ca9mp_proc_info:
         .long   0x410fc090
         .long   0xff0ffff0
-        __v7_proc __v7_ca9mp_setup
+        __v7_proc __v7_ca9mp_setup, proc_fns = ca9mp_processor_functions
         .size   __v7_ca9mp_proc_info, . - __v7_ca9mp_proc_info
 
 #endif  /* CONFIG_ARM_LPAE */
@@ -528,6 +564,16 @@ __v7_ca15mp_proc_info:
         .size   __v7_ca15mp_proc_info, . - __v7_ca15mp_proc_info
 
         /*
+         * Broadcom Corporation Brahma-B15 processor.
+         */
+        .type   __v7_b15mp_proc_info, #object
+__v7_b15mp_proc_info:
+        .long   0x420f00f0
+        .long   0xff0ffff0
+        __v7_proc __v7_b15mp_setup, hwcaps = HWCAP_IDIV
+        .size   __v7_b15mp_proc_info, . - __v7_b15mp_proc_info
+
+        /*
          * ARM Ltd. Cortex A17 processor.
          */
         .type   __v7_ca17mp_proc_info, #object
diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
index 1ca37c72f12f..d1e68b553d3b 100644
--- a/arch/arm/mm/proc-v7m.S
+++ b/arch/arm/mm/proc-v7m.S
@@ -16,11 +16,11 @@
 #include "proc-macros.S"
 
 ENTRY(cpu_v7m_proc_init)
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7m_proc_init)
 
 ENTRY(cpu_v7m_proc_fin)
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7m_proc_fin)
 
 /*
@@ -34,7 +34,7 @@ ENDPROC(cpu_v7m_proc_fin)
  */
         .align  5
 ENTRY(cpu_v7m_reset)
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_v7m_reset)
 
 /*
@@ -46,18 +46,18 @@ ENDPROC(cpu_v7m_reset)
  */
 ENTRY(cpu_v7m_do_idle)
         wfi
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7m_do_idle)
 
 ENTRY(cpu_v7m_dcache_clean_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7m_dcache_clean_area)
 
 /*
  * There is no MMU, so here is nothing to do.
  */
 ENTRY(cpu_v7m_switch_mm)
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7m_switch_mm)
 
 .globl  cpu_v7m_suspend_size
@@ -65,11 +65,11 @@ ENDPROC(cpu_v7m_switch_mm)
 
 #ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_v7m_do_suspend)
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7m_do_suspend)
 
 ENTRY(cpu_v7m_do_resume)
-        mov     pc, lr
+        ret     lr
 ENDPROC(cpu_v7m_do_resume)
 #endif
 
@@ -120,7 +120,7 @@ __v7m_setup:
         ldr     r12, [r0, V7M_SCB_CCR]  @ system control register
         orr     r12, #V7M_SCB_CCR_STKALIGN
         str     r12, [r0, V7M_SCB_CCR]
-        mov     pc, lr
+        ret     lr
 ENDPROC(__v7m_setup)
 
         .align 2
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index dc1645890042..f8acdfece036 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -83,7 +83,7 @@
  * Nothing too exciting at the moment
  */
 ENTRY(cpu_xsc3_proc_init)
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_xsc3_proc_fin()
@@ -93,7 +93,7 @@ ENTRY(cpu_xsc3_proc_fin)
         bic     r0, r0, #0x1800                 @ ...IZ...........
         bic     r0, r0, #0x0006                 @ .............CA.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_xsc3_reset(loc)
@@ -119,7 +119,7 @@ ENTRY(cpu_xsc3_reset)
         @ CAUTION: MMU turned off from this point.  We count on the pipeline
         @ already containing those two last instructions to survive.
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I and D TLBs
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_xsc3_reset)
         .popsection
 
@@ -138,7 +138,7 @@ ENDPROC(cpu_xsc3_reset)
 ENTRY(cpu_xsc3_do_idle)
         mov     r0, #1
         mcr     p14, 0, r0, c7, c0, 0           @ go to idle
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -150,7 +150,7 @@ ENTRY(cpu_xsc3_do_idle)
 ENTRY(xsc3_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(xsc3_flush_icache_all)
 
 /*
@@ -176,7 +176,7 @@ __flush_whole_cache:
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate L1 I cache and BTB
         mcrne   p15, 0, ip, c7, c10, 4          @ data write barrier
         mcrne   p15, 0, ip, c7, c5, 4           @ prefetch flush
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, vm_flags)
@@ -205,7 +205,7 @@ ENTRY(xsc3_flush_user_cache_range)
         mcrne   p15, 0, ip, c7, c5, 6           @ invalidate BTB
         mcrne   p15, 0, ip, c7, c10, 4          @ data write barrier
         mcrne   p15, 0, ip, c7, c5, 4           @ prefetch flush
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -232,7 +232,7 @@ ENTRY(xsc3_coherent_user_range)
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate L1 I cache and BTB
         mcr     p15, 0, r0, c7, c10, 4          @ data write barrier
         mcr     p15, 0, r0, c7, c5, 4           @ prefetch flush
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -253,7 +253,7 @@ ENTRY(xsc3_flush_kern_dcache_area)
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate L1 I cache and BTB
         mcr     p15, 0, r0, c7, c10, 4          @ data write barrier
         mcr     p15, 0, r0, c7, c5, 4           @ prefetch flush
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -277,7 +277,7 @@ xsc3_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ data write barrier
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -294,7 +294,7 @@ xsc3_dma_clean_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ data write barrier
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -311,7 +311,7 @@ ENTRY(xsc3_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ data write barrier
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -334,7 +334,7 @@ ENDPROC(xsc3_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(xsc3_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(xsc3_dma_unmap_area)
 
         .globl  xsc3_flush_kern_cache_louis
@@ -348,7 +348,7 @@ ENTRY(cpu_xsc3_dcache_clean_area)
         add     r0, r0, #CACHELINESIZE
         subs    r1, r1, #CACHELINESIZE
         bhi     1b
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -406,7 +406,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
         orr     r2, r2, ip
 
         xscale_set_pte_ext_epilogue
-        mov     pc, lr
+        ret     lr
 
         .ltorg
         .align
@@ -478,7 +478,7 @@ __xsc3_setup:
         bic     r0, r0, r5                      @ ..V. ..R. .... ..A.
         orr     r0, r0, r6                      @ ..VI Z..S .... .C.M (mmu)
                                                 @ ...I Z..S .... .... (uc)
-        mov     pc, lr
+        ret     lr
 
         .size   __xsc3_setup, . - __xsc3_setup
 
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index d19b1cfcad91..23259f104c66 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -118,7 +118,7 @@ ENTRY(cpu_xscale_proc_init)
         mrc     p15, 0, r1, c1, c0, 1
         bic     r1, r1, #1
         mcr     p15, 0, r1, c1, c0, 1
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_xscale_proc_fin()
@@ -128,7 +128,7 @@ ENTRY(cpu_xscale_proc_fin)
         bic     r0, r0, #0x1800                 @ ...IZ...........
         bic     r0, r0, #0x0006                 @ .............CA.
         mcr     p15, 0, r0, c1, c0, 0           @ disable caches
-        mov     pc, lr
+        ret     lr
 
 /*
  * cpu_xscale_reset(loc)
@@ -160,7 +160,7 @@ ENTRY(cpu_xscale_reset)
         @ CAUTION: MMU turned off from this point. We count on the pipeline
         @ already containing those two last instructions to survive.
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
-        mov     pc, r0
+        ret     r0
 ENDPROC(cpu_xscale_reset)
         .popsection
 
@@ -179,7 +179,7 @@ ENDPROC(cpu_xscale_reset)
 ENTRY(cpu_xscale_do_idle)
         mov     r0, #1
         mcr     p14, 0, r0, c7, c0, 0           @ Go to IDLE
-        mov     pc, lr
+        ret     lr
 
 /* ================================= CACHE ================================ */
 
@@ -191,7 +191,7 @@ ENTRY(cpu_xscale_do_idle)
 ENTRY(xscale_flush_icache_all)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
-        mov     pc, lr
+        ret     lr
 ENDPROC(xscale_flush_icache_all)
 
 /*
@@ -216,7 +216,7 @@ __flush_whole_cache:
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 0           @ Invalidate I cache & BTB
         mcrne   p15, 0, ip, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_user_cache_range(start, end, vm_flags)
@@ -245,7 +245,7 @@ ENTRY(xscale_flush_user_cache_range)
         tst     r2, #VM_EXEC
         mcrne   p15, 0, ip, c7, c5, 6           @ Invalidate BTB
         mcrne   p15, 0, ip, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_kern_range(start, end)
@@ -269,7 +269,7 @@ ENTRY(xscale_coherent_kern_range)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ Invalidate I cache & BTB
         mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      coherent_user_range(start, end)
@@ -291,7 +291,7 @@ ENTRY(xscale_coherent_user_range)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 6           @ Invalidate BTB
         mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      flush_kern_dcache_area(void *addr, size_t size)
@@ -312,7 +312,7 @@ ENTRY(xscale_flush_kern_dcache_area)
         mov     r0, #0
         mcr     p15, 0, r0, c7, c5, 0           @ Invalidate I cache & BTB
         mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_inv_range(start, end)
@@ -336,7 +336,7 @@ xscale_dma_inv_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_clean_range(start, end)
@@ -353,7 +353,7 @@ xscale_dma_clean_range:
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_flush_range(start, end)
@@ -371,7 +371,7 @@ ENTRY(xscale_dma_flush_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     pc, lr
+        ret     lr
 
 /*
  *      dma_map_area(start, size, dir)
@@ -407,7 +407,7 @@ ENDPROC(xscale_80200_A0_A1_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(xscale_dma_unmap_area)
-        mov     pc, lr
+        ret     lr
 ENDPROC(xscale_dma_unmap_area)
 
         .globl  xscale_flush_kern_cache_louis
@@ -458,7 +458,7 @@ ENTRY(cpu_xscale_dcache_clean_area)
         add     r0, r0, #CACHELINESIZE
         subs    r1, r1, #CACHELINESIZE
         bhi     1b
-        mov     pc, lr
+        ret     lr
 
 /* =============================== PageTable ============================== */
 
@@ -521,7 +521,7 @@ ENTRY(cpu_xscale_set_pte_ext)
         orr     r2, r2, ip
 
         xscale_set_pte_ext_epilogue
-        mov     pc, lr
+        ret     lr
 
         .ltorg
         .align
@@ -572,7 +572,7 @@ __xscale_setup:
         mrc     p15, 0, r0, c1, c0, 0           @ get control register
         bic     r0, r0, r5
         orr     r0, r0, r6
-        mov     pc, lr
+        ret     lr
         .size   __xscale_setup, . - __xscale_setup
 
         /*
diff --git a/arch/arm/mm/tlb-fa.S b/arch/arm/mm/tlb-fa.S
index d3ddcf9a76ca..d2d9ecbe0aac 100644
--- a/arch/arm/mm/tlb-fa.S
+++ b/arch/arm/mm/tlb-fa.S
@@ -18,6 +18,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/asm-offsets.h>
 #include <asm/tlbflush.h>
 #include "proc-macros.S"
@@ -37,7 +38,7 @@ ENTRY(fa_flush_user_tlb_range)
         vma_vm_mm ip, r2
         act_mm  r3                              @ get current->active_mm
         eors    r3, ip, r3                      @ == mm ?
-        movne   pc, lr                          @ no, we dont do anything
+        retne   lr                              @ no, we dont do anything
         mov     r3, #0
         mcr     p15, 0, r3, c7, c10, 4          @ drain WB
         bic     r0, r0, #0x0ff
@@ -47,7 +48,7 @@ ENTRY(fa_flush_user_tlb_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, r3, c7, c10, 4          @ data write barrier
-        mov     pc, lr
+        ret     lr
 
 
 ENTRY(fa_flush_kern_tlb_range)
@@ -61,7 +62,7 @@ ENTRY(fa_flush_kern_tlb_range)
         blo     1b
         mcr     p15, 0, r3, c7, c10, 4          @ data write barrier
         mcr     p15, 0, r3, c7, c5, 4           @ prefetch flush (isb)
-        mov     pc, lr
+        ret     lr
 
         __INITDATA
 
diff --git a/arch/arm/mm/tlb-v4.S b/arch/arm/mm/tlb-v4.S
index 17a025ade573..a2b5dca42048 100644
--- a/arch/arm/mm/tlb-v4.S
+++ b/arch/arm/mm/tlb-v4.S
@@ -14,6 +14,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/asm-offsets.h>
 #include <asm/tlbflush.h>
 #include "proc-macros.S"
@@ -33,7 +34,7 @@ ENTRY(v4_flush_user_tlb_range)
         vma_vm_mm ip, r2
         act_mm  r3                              @ get current->active_mm
         eors    r3, ip, r3                              @ == mm ?
-        movne   pc, lr                          @ no, we dont do anything
+        retne   lr                              @ no, we dont do anything
 .v4_flush_kern_tlb_range:
         bic     r0, r0, #0x0ff
         bic     r0, r0, #0xf00
@@ -41,7 +42,7 @@ ENTRY(v4_flush_user_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
-        mov     pc, lr
+        ret     lr
 
 /*
  *      v4_flush_kern_tlb_range(start, end)
diff --git a/arch/arm/mm/tlb-v4wb.S b/arch/arm/mm/tlb-v4wb.S
index c04598fa4d4a..5a093b458dbc 100644
--- a/arch/arm/mm/tlb-v4wb.S
+++ b/arch/arm/mm/tlb-v4wb.S
@@ -14,6 +14,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/asm-offsets.h>
 #include <asm/tlbflush.h>
 #include "proc-macros.S"
@@ -33,7 +34,7 @@ ENTRY(v4wb_flush_user_tlb_range)
         vma_vm_mm ip, r2
         act_mm  r3                              @ get current->active_mm
         eors    r3, ip, r3                              @ == mm ?
-        movne   pc, lr                          @ no, we dont do anything
+        retne   lr                              @ no, we dont do anything
         vma_vm_flags r2, r2
         mcr     p15, 0, r3, c7, c10, 4          @ drain WB
         tst     r2, #VM_EXEC
@@ -44,7 +45,7 @@ ENTRY(v4wb_flush_user_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
-        mov     pc, lr
+        ret     lr
 
 /*
  *      v4_flush_kern_tlb_range(start, end)
@@ -65,7 +66,7 @@ ENTRY(v4wb_flush_kern_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
-        mov     pc, lr
+        ret     lr
 
         __INITDATA
 
diff --git a/arch/arm/mm/tlb-v4wbi.S b/arch/arm/mm/tlb-v4wbi.S
index 1f6062b6c1c1..058861548f68 100644
--- a/arch/arm/mm/tlb-v4wbi.S
+++ b/arch/arm/mm/tlb-v4wbi.S
@@ -14,6 +14,7 @@
  */
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 #include <asm/asm-offsets.h>
 #include <asm/tlbflush.h>
 #include "proc-macros.S"
@@ -32,7 +33,7 @@ ENTRY(v4wbi_flush_user_tlb_range)
         vma_vm_mm ip, r2
         act_mm  r3                              @ get current->active_mm
         eors    r3, ip, r3                      @ == mm ?
-        movne   pc, lr                          @ no, we dont do anything
+        retne   lr                              @ no, we dont do anything
         mov     r3, #0
         mcr     p15, 0, r3, c7, c10, 4          @ drain WB
         vma_vm_flags r2, r2
@@ -44,7 +45,7 @@ ENTRY(v4wbi_flush_user_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
-        mov     pc, lr
+        ret     lr
 
 ENTRY(v4wbi_flush_kern_tlb_range)
         mov     r3, #0
@@ -56,7 +57,7 @@ ENTRY(v4wbi_flush_kern_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
-        mov     pc, lr
+        ret     lr
 
         __INITDATA
 
diff --git a/arch/arm/mm/tlb-v6.S b/arch/arm/mm/tlb-v6.S
index eca07f550a0b..6f689be638bd 100644
--- a/arch/arm/mm/tlb-v6.S
+++ b/arch/arm/mm/tlb-v6.S
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/linkage.h>
 #include <asm/asm-offsets.h>
+#include <asm/assembler.h>
 #include <asm/page.h>
 #include <asm/tlbflush.h>
 #include "proc-macros.S"
@@ -55,7 +56,7 @@ ENTRY(v6wbi_flush_user_tlb_range)
         cmp     r0, r1
         blo     1b
         mcr     p15, 0, ip, c7, c10, 4          @ data synchronization barrier
-        mov     pc, lr
+        ret     lr
 
 /*
  *      v6wbi_flush_kern_tlb_range(start,end)
@@ -84,7 +85,7 @@ ENTRY(v6wbi_flush_kern_tlb_range)
         blo     1b
         mcr     p15, 0, r2, c7, c10, 4          @ data synchronization barrier
         mcr     p15, 0, r2, c7, c5, 4           @ prefetch flush (isb)
-        mov     pc, lr
+        ret     lr
 
         __INIT
 
diff --git a/arch/arm/mm/tlb-v7.S b/arch/arm/mm/tlb-v7.S
index 355308767bae..e5101a3bc57c 100644
--- a/arch/arm/mm/tlb-v7.S
+++ b/arch/arm/mm/tlb-v7.S
@@ -57,7 +57,7 @@ ENTRY(v7wbi_flush_user_tlb_range)
         cmp     r0, r1
         blo     1b
         dsb     ish
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7wbi_flush_user_tlb_range)
 
 /*
@@ -86,7 +86,7 @@ ENTRY(v7wbi_flush_kern_tlb_range)
         blo     1b
         dsb     ish
         isb
-        mov     pc, lr
+        ret     lr
 ENDPROC(v7wbi_flush_kern_tlb_range)
 
         __INIT
diff --git a/arch/arm/nwfpe/entry.S b/arch/arm/nwfpe/entry.S
index d18dde95b8aa..5d65be1f1e8a 100644
--- a/arch/arm/nwfpe/entry.S
+++ b/arch/arm/nwfpe/entry.S
@@ -19,7 +19,7 @@
     along with this program; if not, write to the Free Software
     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
-
+#include <asm/assembler.h>
 #include <asm/opcodes.h>
 
 /* This is the kernel's entry point into the floating point emulator.
@@ -92,7 +92,7 @@ emulate:
         mov     r0, r6                  @ prepare for EmulateAll()
         bl      EmulateAll              @ emulate the instruction
         cmp     r0, #0                  @ was emulation successful
-        moveq   pc, r4                  @ no, return failure
+        reteq   r4                      @ no, return failure
 
 next:
 .Lx1:   ldrt    r6, [r5], #4            @ get the next instruction and
@@ -102,7 +102,7 @@ next:
         teq     r2, #0x0C000000
         teqne   r2, #0x0D000000
         teqne   r2, #0x0E000000
-        movne   pc, r9                  @ return ok if not a fp insn
+        retne   r9                      @ return ok if not a fp insn
 
         str     r5, [sp, #S_PC]         @ update PC copy in regs
 
@@ -115,7 +115,7 @@ next:
         @ plain LDR instruction.  Weird, but it seems harmless.
         .pushsection .fixup,"ax"
         .align  2
-.Lfix:  mov     pc, r9                  @ let the user eat segfaults
+.Lfix:  ret     r9                      @ let the user eat segfaults
         .popsection
 
         .pushsection __ex_table,"a"
diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
index 99c63d4b6af8..e6a3c4c92163 100644
--- a/arch/arm/oprofile/common.c
+++ b/arch/arm/oprofile/common.c
@@ -107,10 +107,7 @@ static void arm_backtrace(struct pt_regs * const regs, unsigned int depth)
 
         if (!user_mode(regs)) {
                 struct stackframe frame;
-                frame.fp = regs->ARM_fp;
-                frame.sp = regs->ARM_sp;
-                frame.lr = regs->ARM_lr;
-                frame.pc = regs->ARM_pc;
+                arm_get_current_stackframe(regs, &frame);
                 walk_stackframe(&frame, report_trace, &depth);
                 return;
         }
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index b5608b1f9fbd..1c98659bbf89 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -698,6 +698,8 @@ int omap_request_dma(int dev_id, const char *dev_name,
         unsigned long flags;
         struct omap_dma_lch *chan;
 
+        WARN(strcmp(dev_name, "DMA engine"), "Using deprecated platform DMA API - please update to DMA engine");
+
         spin_lock_irqsave(&dma_chan_lock, flags);
         for (ch = 0; ch < dma_chan_count; ch++) {
                 if (free_ch == -1 && dma_chan[ch].dev_id == -1) {
diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
index fe6ca574d093..2e78760f3495 100644
--- a/arch/arm/vfp/entry.S
+++ b/arch/arm/vfp/entry.S
@@ -34,7 +34,7 @@ ENDPROC(do_vfp)
 
 ENTRY(vfp_null_entry)
         dec_preempt_count_ti r10, r4
-        mov     pc, lr
+        ret     lr
 ENDPROC(vfp_null_entry)
 
         .align  2
@@ -49,7 +49,7 @@ ENTRY(vfp_testing_entry)
         dec_preempt_count_ti r10, r4
         ldr     r0, VFP_arch_address
         str     r0, [r0]                @ set to non-zero value
-        mov     pc, r9                  @ we have handled the fault
+        ret     r9                      @ we have handled the fault
 ENDPROC(vfp_testing_entry)
 
         .align  2
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index be807625ed8c..cda654cbf2c2 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -183,7 +183,7 @@ vfp_hw_state_valid:
                                         @ always subtract 4 from the following
                                         @ instruction address.
         dec_preempt_count_ti r10, r4
-        mov     pc, r9                  @ we think we have handled things
+        ret     r9                      @ we think we have handled things
 
 
 look_for_VFP_exceptions:
@@ -202,7 +202,7 @@ look_for_VFP_exceptions:
 
         DBGSTR  "not VFP"
         dec_preempt_count_ti r10, r4
-        mov     pc, lr
+        ret     lr
 
 process_exception:
         DBGSTR  "bounce"
@@ -234,7 +234,7 @@ ENTRY(vfp_save_state)
         VFPFMRX r12, FPINST2            @ FPINST2 if needed (and present)
 1:
         stmia   r0, {r1, r2, r3, r12}   @ save FPEXC, FPSCR, FPINST, FPINST2
-        mov     pc, lr
+        ret     lr
 ENDPROC(vfp_save_state)
 
         .align
@@ -245,7 +245,7 @@ vfp_current_hw_state_address:
 #ifdef CONFIG_THUMB2_KERNEL
         adr     \tmp, 1f
         add     \tmp, \tmp, \base, lsl \shift
-        mov     pc, \tmp
+        ret     \tmp
 #else
         add     pc, pc, \base, lsl \shift
         mov     r0, r0
@@ -257,10 +257,10 @@ ENTRY(vfp_get_float)
         tbl_branch r0, r3, #3
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
 1:      mrc     p10, 0, r0, c\dr, c0, 0 @ fmrs  r0, s0
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
 1:      mrc     p10, 0, r0, c\dr, c0, 4 @ fmrs  r0, s1
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
         .endr
 ENDPROC(vfp_get_float)
@@ -269,10 +269,10 @@ ENTRY(vfp_put_float)
         tbl_branch r1, r3, #3
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
 1:      mcr     p10, 0, r0, c\dr, c0, 0 @ fmsr  r0, s0
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
 1:      mcr     p10, 0, r0, c\dr, c0, 4 @ fmsr  r0, s1
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
         .endr
 ENDPROC(vfp_put_float)
@@ -281,14 +281,14 @@ ENTRY(vfp_get_double)
         tbl_branch r0, r3, #3
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
 1:      fmrrd   r0, r1, d\dr
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
         .endr
 #ifdef CONFIG_VFPv3
         @ d16 - d31 registers
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
 1:      mrrc    p11, 3, r0, r1, c\dr    @ fmrrd r0, r1, d\dr
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
         .endr
 #endif
@@ -296,21 +296,21 @@ ENTRY(vfp_get_double)
         @ virtual register 16 (or 32 if VFPv3) for compare with zero
         mov     r0, #0
         mov     r1, #0
-        mov     pc, lr
+        ret     lr
 ENDPROC(vfp_get_double)
 
 ENTRY(vfp_put_double)
         tbl_branch r2, r3, #3
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
 1:      fmdrr   d\dr, r0, r1
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
         .endr
 #ifdef CONFIG_VFPv3
         @ d16 - d31 registers
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
 1:      mcrr    p11, 3, r0, r1, c\dr    @ fmdrr r0, r1, d\dr
-        mov     pc, lr
+        ret     lr
         .org    1b + 8
         .endr
 #endif
diff --git a/arch/arm/xen/hypercall.S b/arch/arm/xen/hypercall.S
index 44e3a5f10c4c..f00e08075938 100644
--- a/arch/arm/xen/hypercall.S
+++ b/arch/arm/xen/hypercall.S
@@ -58,7 +58,7 @@
 ENTRY(HYPERVISOR_##hypercall)                   \
         mov r12, #__HYPERVISOR_##hypercall;     \
         __HVC(XEN_IMM);                                         \
-        mov pc, lr;                                                     \
+        ret lr;                                 \
 ENDPROC(HYPERVISOR_##hypercall)
 
 #define HYPERCALL0 HYPERCALL_SIMPLE
@@ -74,7 +74,7 @@ ENTRY(HYPERVISOR_##hypercall)			\
         mov r12, #__HYPERVISOR_##hypercall;     \
         __HVC(XEN_IMM);                                         \
         ldm sp!, {r4}                                           \
-        mov pc, lr                                                      \
+        ret lr                                  \
 ENDPROC(HYPERVISOR_##hypercall)
 
                 .text
@@ -101,5 +101,5 @@ ENTRY(privcmd_call)
         ldr r4, [sp, #4]
         __HVC(XEN_IMM)
         ldm sp!, {r4}
-        mov pc, lr
+        ret lr
 ENDPROC(privcmd_call);
diff --git a/arch/ia64/include/uapi/asm/fcntl.h b/arch/ia64/include/uapi/asm/fcntl.h
index 1dd275dc8f65..7b485876cad4 100644
--- a/arch/ia64/include/uapi/asm/fcntl.h
+++ b/arch/ia64/include/uapi/asm/fcntl.h
@@ -8,6 +8,7 @@
 #define force_o_largefile()     \
                 (personality(current->personality) != PER_LINUX32)
 
+#include <linux/personality.h>
 #include <asm-generic/fcntl.h>
 
 #endif /* _ASM_IA64_FCNTL_H */
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 7a469acee33c..4e238e6e661c 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -269,6 +269,7 @@ config LANTIQ
 config LASAT
         bool "LASAT Networks platforms"
         select CEVT_R4K
+        select CRC32
         select CSRC_R4K
         select DMA_NONCOHERENT
         select SYS_HAS_EARLY_PRINTK
diff --git a/arch/mips/include/asm/sigcontext.h b/arch/mips/include/asm/sigcontext.h
index f54bdbe85c0d..eeeb0f48c767 100644
--- a/arch/mips/include/asm/sigcontext.h
+++ b/arch/mips/include/asm/sigcontext.h
@@ -32,8 +32,6 @@ struct sigcontext32 {
         __u32           sc_lo2;
         __u32           sc_hi3;
         __u32           sc_lo3;
-        __u64           sc_msaregs[32]; /* Most significant 64 bits */
-        __u32           sc_msa_csr;
 };
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 || _MIPS_SIM == _MIPS_SIM_NABI32 */
 #endif /* _ASM_SIGCONTEXT_H */
diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index f8d63b3b40b4..708c5d414905 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -67,6 +67,9 @@ void ISAOPC(op)(u32 **buf, unsigned int a, unsigned int b, signed int c)
 #define Ip_u2s3u1(op)                                                   \
 void ISAOPC(op)(u32 **buf, unsigned int a, signed int b, unsigned int c)
 
+#define Ip_s3s1s2(op)                                                   \
+void ISAOPC(op)(u32 **buf, int a, int b, int c)
+
 #define Ip_u2u1s3(op)                                                   \
 void ISAOPC(op)(u32 **buf, unsigned int a, unsigned int b, signed int c)
 
@@ -147,6 +150,7 @@ Ip_u2s3u1(_scd);
 Ip_u2s3u1(_sd);
 Ip_u2u1u3(_sll);
 Ip_u3u2u1(_sllv);
+Ip_s3s1s2(_slt);
 Ip_u2u1s3(_sltiu);
 Ip_u3u1u2(_sltu);
 Ip_u2u1u3(_sra);
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index 4b7160259292..4bfdb9d4c186 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -273,6 +273,7 @@ enum mm_32a_minor_op {
         mm_and_op = 0x250,
         mm_or32_op = 0x290,
         mm_xor32_op = 0x310,
+        mm_slt_op = 0x350,
         mm_sltu_op = 0x390,
 };
 
diff --git a/arch/mips/include/uapi/asm/sigcontext.h b/arch/mips/include/uapi/asm/sigcontext.h
index 681c17603a48..6c9906f59c6e 100644
--- a/arch/mips/include/uapi/asm/sigcontext.h
+++ b/arch/mips/include/uapi/asm/sigcontext.h
@@ -12,10 +12,6 @@
 #include <linux/types.h>
 #include <asm/sgidefs.h>
 
-/* Bits which may be set in sc_used_math */
-#define USEDMATH_FP     (1 << 0)
-#define USEDMATH_MSA    (1 << 1)
-
 #if _MIPS_SIM == _MIPS_SIM_ABI32
 
 /*
@@ -41,8 +37,6 @@ struct sigcontext {
         unsigned long           sc_lo2;
         unsigned long           sc_hi3;
         unsigned long           sc_lo3;
-        unsigned long long      sc_msaregs[32]; /* Most significant 64 bits */
-        unsigned long           sc_msa_csr;
 };
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
@@ -76,8 +70,6 @@ struct sigcontext {
         __u32   sc_used_math;
         __u32   sc_dsp;
         __u32   sc_reserved;
-        __u64   sc_msaregs[32];
-        __u32   sc_msa_csr;
 };
 
 
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 02f075df8f2e..4bb5107511e2 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -293,7 +293,6 @@ void output_sc_defines(void)
         OFFSET(SC_LO2, sigcontext, sc_lo2);
         OFFSET(SC_HI3, sigcontext, sc_hi3);
         OFFSET(SC_LO3, sigcontext, sc_lo3);
-        OFFSET(SC_MSAREGS, sigcontext, sc_msaregs);
         BLANK();
 }
 #endif
@@ -308,7 +307,6 @@ void output_sc_defines(void)
         OFFSET(SC_MDLO, sigcontext, sc_mdlo);
         OFFSET(SC_PC, sigcontext, sc_pc);
         OFFSET(SC_FPC_CSR, sigcontext, sc_fpc_csr);
-        OFFSET(SC_MSAREGS, sigcontext, sc_msaregs);
         BLANK();
 }
 #endif
@@ -320,7 +318,6 @@ void output_sc32_defines(void)
         OFFSET(SC32_FPREGS, sigcontext32, sc_fpregs);
         OFFSET(SC32_FPC_CSR, sigcontext32, sc_fpc_csr);
         OFFSET(SC32_FPC_EIR, sigcontext32, sc_fpc_eir);
-        OFFSET(SC32_MSAREGS, sigcontext32, sc_msaregs);
         BLANK();
 }
 #endif
diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c
index 4858642d543d..a734b2c2f9ea 100644
--- a/arch/mips/kernel/irq-msc01.c
+++ b/arch/mips/kernel/irq-msc01.c
@@ -126,7 +126,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma
 
         board_bind_eic_interrupt = &msc_bind_eic_interrupt;
 
-        for (; nirq >= 0; nirq--, imp++) {
+        for (; nirq > 0; nirq--, imp++) {
                 int n = imp->im_irq;
 
                 switch (imp->im_type) {
diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c
index 5aa4c6f8cf83..c4c2069d3a20 100644
--- a/arch/mips/kernel/pm-cps.c
+++ b/arch/mips/kernel/pm-cps.c
@@ -101,7 +101,7 @@ static void coupled_barrier(atomic_t *a, unsigned online)
         if (!coupled_coherence)
                 return;
 
-        smp_mb__before_atomic_inc();
+        smp_mb__before_atomic();
         atomic_inc(a);
 
         while (atomic_read(a) < online)
@@ -158,7 +158,7 @@ int cps_pm_enter_state(enum cps_pm_state state)
 
         /* Indicate that this CPU might not be coherent */
         cpumask_clear_cpu(cpu, &cpu_coherent_mask);
-        smp_mb__after_clear_bit();
+        smp_mb__after_atomic();
 
         /* Create a non-coherent mapping of the core ready_count */
         core_ready_count = per_cpu(ready_count, core);
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 71814272d148..8352523568e6 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -13,7 +13,6 @@
  * Copyright (C) 1999, 2001 Silicon Graphics, Inc.
  */
 #include <asm/asm.h>
-#include <asm/asmmacro.h>
 #include <asm/errno.h>
 #include <asm/fpregdef.h>
 #include <asm/mipsregs.h>
@@ -246,218 +245,6 @@ LEAF(_restore_fp_context32)
         END(_restore_fp_context32)
 #endif
 
-#ifdef CONFIG_CPU_HAS_MSA
-
-        .macro  save_sc_msareg  wr, off, sc, tmp
-#ifdef CONFIG_64BIT
-        copy_u_d \tmp, \wr, 1
-        EX sd   \tmp, (\off+(\wr*8))(\sc)
-#elif defined(CONFIG_CPU_LITTLE_ENDIAN)
-        copy_u_w \tmp, \wr, 2
-        EX sw   \tmp, (\off+(\wr*8)+0)(\sc)
-        copy_u_w \tmp, \wr, 3
-        EX sw   \tmp, (\off+(\wr*8)+4)(\sc)
-#else /* CONFIG_CPU_BIG_ENDIAN */
-        copy_u_w \tmp, \wr, 2
-        EX sw   \tmp, (\off+(\wr*8)+4)(\sc)
-        copy_u_w \tmp, \wr, 3
-        EX sw   \tmp, (\off+(\wr*8)+0)(\sc)
-#endif
-        .endm
-
-/*
- * int _save_msa_context(struct sigcontext *sc)
- *
- * Save the upper 64 bits of each vector register along with the MSA_CSR
- * register into sc. Returns zero on success, else non-zero.
- */
-LEAF(_save_msa_context)
-        save_sc_msareg  0, SC_MSAREGS, a0, t0
-        save_sc_msareg  1, SC_MSAREGS, a0, t0
-        save_sc_msareg  2, SC_MSAREGS, a0, t0
-        save_sc_msareg  3, SC_MSAREGS, a0, t0
-        save_sc_msareg  4, SC_MSAREGS, a0, t0
-        save_sc_msareg  5, SC_MSAREGS, a0, t0
-        save_sc_msareg  6, SC_MSAREGS, a0, t0
-        save_sc_msareg  7, SC_MSAREGS, a0, t0
-        save_sc_msareg  8, SC_MSAREGS, a0, t0
-        save_sc_msareg  9, SC_MSAREGS, a0, t0
-        save_sc_msareg  10, SC_MSAREGS, a0, t0
-        save_sc_msareg  11, SC_MSAREGS, a0, t0
-        save_sc_msareg  12, SC_MSAREGS, a0, t0
-        save_sc_msareg  13, SC_MSAREGS, a0, t0
-        save_sc_msareg  14, SC_MSAREGS, a0, t0
-        save_sc_msareg  15, SC_MSAREGS, a0, t0
-        save_sc_msareg  16, SC_MSAREGS, a0, t0
-        save_sc_msareg  17, SC_MSAREGS, a0, t0
-        save_sc_msareg  18, SC_MSAREGS, a0, t0
-        save_sc_msareg  19, SC_MSAREGS, a0, t0
-        save_sc_msareg  20, SC_MSAREGS, a0, t0
-        save_sc_msareg  21, SC_MSAREGS, a0, t0
-        save_sc_msareg  22, SC_MSAREGS, a0, t0
-        save_sc_msareg  23, SC_MSAREGS, a0, t0
-        save_sc_msareg  24, SC_MSAREGS, a0, t0
-        save_sc_msareg  25, SC_MSAREGS, a0, t0
-        save_sc_msareg  26, SC_MSAREGS, a0, t0
-        save_sc_msareg  27, SC_MSAREGS, a0, t0
-        save_sc_msareg  28, SC_MSAREGS, a0, t0
-        save_sc_msareg  29, SC_MSAREGS, a0, t0
-        save_sc_msareg  30, SC_MSAREGS, a0, t0
-        save_sc_msareg  31, SC_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_save_msa_context)
-
-#ifdef CONFIG_MIPS32_COMPAT
-
-/*
- * int _save_msa_context32(struct sigcontext32 *sc)
- *
- * Save the upper 64 bits of each vector register along with the MSA_CSR
- * register into sc. Returns zero on success, else non-zero.
- */
-LEAF(_save_msa_context32)
-        save_sc_msareg  0, SC32_MSAREGS, a0, t0
-        save_sc_msareg  1, SC32_MSAREGS, a0, t0
-        save_sc_msareg  2, SC32_MSAREGS, a0, t0
-        save_sc_msareg  3, SC32_MSAREGS, a0, t0
-        save_sc_msareg  4, SC32_MSAREGS, a0, t0
-        save_sc_msareg  5, SC32_MSAREGS, a0, t0
-        save_sc_msareg  6, SC32_MSAREGS, a0, t0
-        save_sc_msareg  7, SC32_MSAREGS, a0, t0
-        save_sc_msareg  8, SC32_MSAREGS, a0, t0
-        save_sc_msareg  9, SC32_MSAREGS, a0, t0
-        save_sc_msareg  10, SC32_MSAREGS, a0, t0
-        save_sc_msareg  11, SC32_MSAREGS, a0, t0
-        save_sc_msareg  12, SC32_MSAREGS, a0, t0
-        save_sc_msareg  13, SC32_MSAREGS, a0, t0
-        save_sc_msareg  14, SC32_MSAREGS, a0, t0
-        save_sc_msareg  15, SC32_MSAREGS, a0, t0
-        save_sc_msareg  16, SC32_MSAREGS, a0, t0
-        save_sc_msareg  17, SC32_MSAREGS, a0, t0
-        save_sc_msareg  18, SC32_MSAREGS, a0, t0
-        save_sc_msareg  19, SC32_MSAREGS, a0, t0
-        save_sc_msareg  20, SC32_MSAREGS, a0, t0
-        save_sc_msareg  21, SC32_MSAREGS, a0, t0
-        save_sc_msareg  22, SC32_MSAREGS, a0, t0
-        save_sc_msareg  23, SC32_MSAREGS, a0, t0
-        save_sc_msareg  24, SC32_MSAREGS, a0, t0
-        save_sc_msareg  25, SC32_MSAREGS, a0, t0
-        save_sc_msareg  26, SC32_MSAREGS, a0, t0
-        save_sc_msareg  27, SC32_MSAREGS, a0, t0
-        save_sc_msareg  28, SC32_MSAREGS, a0, t0
-        save_sc_msareg  29, SC32_MSAREGS, a0, t0
-        save_sc_msareg  30, SC32_MSAREGS, a0, t0
-        save_sc_msareg  31, SC32_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_save_msa_context32)
-
-#endif /* CONFIG_MIPS32_COMPAT */
-
-        .macro restore_sc_msareg        wr, off, sc, tmp
-#ifdef CONFIG_64BIT
-        EX ld   \tmp, (\off+(\wr*8))(\sc)
-        insert_d \wr, 1, \tmp
-#elif defined(CONFIG_CPU_LITTLE_ENDIAN)
-        EX lw   \tmp, (\off+(\wr*8)+0)(\sc)
-        insert_w \wr, 2, \tmp
-        EX lw   \tmp, (\off+(\wr*8)+4)(\sc)
-        insert_w \wr, 3, \tmp
-#else /* CONFIG_CPU_BIG_ENDIAN */
-        EX lw   \tmp, (\off+(\wr*8)+4)(\sc)
-        insert_w \wr, 2, \tmp
-        EX lw   \tmp, (\off+(\wr*8)+0)(\sc)
-        insert_w \wr, 3, \tmp
-#endif
-        .endm
-
-/*
- * int _restore_msa_context(struct sigcontext *sc)
- */
-LEAF(_restore_msa_context)
-        restore_sc_msareg       0, SC_MSAREGS, a0, t0
-        restore_sc_msareg       1, SC_MSAREGS, a0, t0
-        restore_sc_msareg       2, SC_MSAREGS, a0, t0
-        restore_sc_msareg       3, SC_MSAREGS, a0, t0
-        restore_sc_msareg       4, SC_MSAREGS, a0, t0
-        restore_sc_msareg       5, SC_MSAREGS, a0, t0
-        restore_sc_msareg       6, SC_MSAREGS, a0, t0
-        restore_sc_msareg       7, SC_MSAREGS, a0, t0
-        restore_sc_msareg       8, SC_MSAREGS, a0, t0
-        restore_sc_msareg       9, SC_MSAREGS, a0, t0
-        restore_sc_msareg       10, SC_MSAREGS, a0, t0
-        restore_sc_msareg       11, SC_MSAREGS, a0, t0
-        restore_sc_msareg       12, SC_MSAREGS, a0, t0
-        restore_sc_msareg       13, SC_MSAREGS, a0, t0
-        restore_sc_msareg       14, SC_MSAREGS, a0, t0
-        restore_sc_msareg       15, SC_MSAREGS, a0, t0
-        restore_sc_msareg       16, SC_MSAREGS, a0, t0
-        restore_sc_msareg       17, SC_MSAREGS, a0, t0
-        restore_sc_msareg       18, SC_MSAREGS, a0, t0
-        restore_sc_msareg       19, SC_MSAREGS, a0, t0
-        restore_sc_msareg       20, SC_MSAREGS, a0, t0
-        restore_sc_msareg       21, SC_MSAREGS, a0, t0
-        restore_sc_msareg       22, SC_MSAREGS, a0, t0
-        restore_sc_msareg       23, SC_MSAREGS, a0, t0
-        restore_sc_msareg       24, SC_MSAREGS, a0, t0
-        restore_sc_msareg       25, SC_MSAREGS, a0, t0
-        restore_sc_msareg       26, SC_MSAREGS, a0, t0
-        restore_sc_msareg       27, SC_MSAREGS, a0, t0
-        restore_sc_msareg       28, SC_MSAREGS, a0, t0
-        restore_sc_msareg       29, SC_MSAREGS, a0, t0
-        restore_sc_msareg       30, SC_MSAREGS, a0, t0
-        restore_sc_msareg       31, SC_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_restore_msa_context)
-
-#ifdef CONFIG_MIPS32_COMPAT
-
-/*
- * int _restore_msa_context32(struct sigcontext32 *sc)
- */
-LEAF(_restore_msa_context32)
-        restore_sc_msareg       0, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       1, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       2, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       3, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       4, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       5, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       6, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       7, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       8, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       9, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       10, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       11, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       12, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       13, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       14, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       15, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       16, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       17, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       18, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       19, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       20, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       21, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       22, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       23, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       24, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       25, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       26, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       27, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       28, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       29, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       30, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       31, SC32_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_restore_msa_context32)
-
-#endif /* CONFIG_MIPS32_COMPAT */
-
-#endif /* CONFIG_CPU_HAS_MSA */
-
         .set    reorder
 
         .type   fault@function
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 33133d3df3e5..9e60d117e41e 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -31,7 +31,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/fpu.h>
-#include <asm/msa.h>
 #include <asm/sim.h>
 #include <asm/ucontext.h>
 #include <asm/cpu-features.h>
@@ -48,9 +47,6 @@ static int (*restore_fp_context)(struct sigcontext __user *sc);
 extern asmlinkage int _save_fp_context(struct sigcontext __user *sc);
 extern asmlinkage int _restore_fp_context(struct sigcontext __user *sc);
 
-extern asmlinkage int _save_msa_context(struct sigcontext __user *sc);
-extern asmlinkage int _restore_msa_context(struct sigcontext __user *sc);
-
 struct sigframe {
         u32 sf_ass[4];          /* argument save space for o32 */
         u32 sf_pad[2];          /* Was: signal trampoline */
@@ -100,60 +96,20 @@ static int copy_fp_from_sigcontext(struct sigcontext __user *sc)
 }
 
 /*
- * These functions will save only the upper 64 bits of the vector registers,
- * since the lower 64 bits have already been saved as the scalar FP context.
- */
-static int copy_msa_to_sigcontext(struct sigcontext __user *sc)
-{
-        int i;
-        int err = 0;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |=
-                    __put_user(get_fpr64(&current->thread.fpu.fpr[i], 1),
-                               &sc->sc_msaregs[i]);
-        }
-        err |= __put_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-static int copy_msa_from_sigcontext(struct sigcontext __user *sc)
-{
-        int i;
-        int err = 0;
-        u64 val;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |= __get_user(val, &sc->sc_msaregs[i]);
-                set_fpr64(&current->thread.fpu.fpr[i], 1, val);
-        }
-        err |= __get_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-/*
  * Helper routines
  */
-static int protected_save_fp_context(struct sigcontext __user *sc,
-                                     unsigned used_math)
+static int protected_save_fp_context(struct sigcontext __user *sc)
 {
         int err;
-        bool save_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
 #ifndef CONFIG_EVA
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = save_fp_context(sc);
-                        if (save_msa && !err)
-                                err = _save_msa_context(sc);
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_to_sigcontext(sc);
-                        if (save_msa && !err)
-                                err = copy_msa_to_sigcontext(sc);
                 }
                 if (likely(!err))
                         break;
@@ -169,38 +125,24 @@ static int protected_save_fp_context(struct sigcontext __user *sc,
          * EVA does not have FPU EVA instructions so saving fpu context directly
          * does not work.
          */
-        disable_msa();
         lose_fpu(1);
         err = save_fp_context(sc); /* this might fail */
-        if (save_msa && !err)
-                err = copy_msa_to_sigcontext(sc);
 #endif
         return err;
 }
 
-static int protected_restore_fp_context(struct sigcontext __user *sc,
-                                        unsigned used_math)
+static int protected_restore_fp_context(struct sigcontext __user *sc)
 {
         int err, tmp __maybe_unused;
-        bool restore_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
 #ifndef CONFIG_EVA
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = restore_fp_context(sc);
-                        if (restore_msa && !err) {
-                                enable_msa();
-                                err = _restore_msa_context(sc);
-                        } else {
-                                /* signal handler may have used MSA */
-                                disable_msa();
-                        }
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_from_sigcontext(sc);
-                        if (!err && (used_math & USEDMATH_MSA))
-                                err = copy_msa_from_sigcontext(sc);
                 }
                 if (likely(!err))
                         break;
@@ -216,11 +158,8 @@ static int protected_restore_fp_context(struct sigcontext __user *sc,
          * EVA does not have FPU EVA instructions so restoring fpu context
          * directly does not work.
          */
-        enable_msa();
         lose_fpu(0);
         err = restore_fp_context(sc); /* this might fail */
-        if (restore_msa && !err)
-                err = copy_msa_from_sigcontext(sc);
 #endif
         return err;
 }
@@ -252,8 +191,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                 err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
         }
 
-        used_math = used_math() ? USEDMATH_FP : 0;
-        used_math |= thread_msa_context_live() ? USEDMATH_MSA : 0;
+        used_math = !!used_math();
         err |= __put_user(used_math, &sc->sc_used_math);
 
         if (used_math) {
@@ -261,7 +199,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                  * Save FPU state to signal context. Signal handler
                  * will "inherit" current FPU state.
                  */
-                err |= protected_save_fp_context(sc, used_math);
+                err |= protected_save_fp_context(sc);
         }
         return err;
 }
@@ -286,14 +224,14 @@ int fpcsr_pending(unsigned int __user *fpcsr)
 }
 
 static int
-check_and_restore_fp_context(struct sigcontext __user *sc, unsigned used_math)
+check_and_restore_fp_context(struct sigcontext __user *sc)
 {
         int err, sig;
 
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= protected_restore_fp_context(sc, used_math);
+        err |= protected_restore_fp_context(sc);
         return err ?: sig;
 }
 
@@ -333,10 +271,9 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
         if (used_math) {
                 /* restore fpu context if we have used it before */
                 if (!err)
-                        err = check_and_restore_fp_context(sc, used_math);
+                        err = check_and_restore_fp_context(sc);
         } else {
-                /* signal handler may have used FPU or MSA. Disable them. */
-                disable_msa();
+                /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
         }
 
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 299f956e4db3..bae2e6ee2109 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -30,7 +30,6 @@
 #include <asm/sim.h>
 #include <asm/ucontext.h>
 #include <asm/fpu.h>
-#include <asm/msa.h>
 #include <asm/war.h>
 #include <asm/vdso.h>
 #include <asm/dsp.h>
@@ -43,9 +42,6 @@ static int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 extern asmlinkage int _save_fp_context32(struct sigcontext32 __user *sc);
 extern asmlinkage int _restore_fp_context32(struct sigcontext32 __user *sc);
 
-extern asmlinkage int _save_msa_context32(struct sigcontext32 __user *sc);
-extern asmlinkage int _restore_msa_context32(struct sigcontext32 __user *sc);
-
 /*
  * Including <asm/unistd.h> would give use the 64-bit syscall numbers ...
  */
@@ -115,59 +111,19 @@ static int copy_fp_from_sigcontext32(struct sigcontext32 __user *sc)
 }
 
 /*
- * These functions will save only the upper 64 bits of the vector registers,
- * since the lower 64 bits have already been saved as the scalar FP context.
- */
-static int copy_msa_to_sigcontext32(struct sigcontext32 __user *sc)
-{
-        int i;
-        int err = 0;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |=
-                    __put_user(get_fpr64(&current->thread.fpu.fpr[i], 1),
-                               &sc->sc_msaregs[i]);
-        }
-        err |= __put_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-static int copy_msa_from_sigcontext32(struct sigcontext32 __user *sc)
-{
-        int i;
-        int err = 0;
-        u64 val;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |= __get_user(val, &sc->sc_msaregs[i]);
-                set_fpr64(&current->thread.fpu.fpr[i], 1, val);
-        }
-        err |= __get_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-/*
  * sigcontext handlers
  */
-static int protected_save_fp_context32(struct sigcontext32 __user *sc,
-                                       unsigned used_math)
+static int protected_save_fp_context32(struct sigcontext32 __user *sc)
 {
         int err;
-        bool save_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = save_fp_context32(sc);
-                        if (save_msa && !err)
-                                err = _save_msa_context32(sc);
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_to_sigcontext32(sc);
-                        if (save_msa && !err)
-                                err = copy_msa_to_sigcontext32(sc);
                 }
                 if (likely(!err))
                         break;
@@ -181,28 +137,17 @@ static int protected_save_fp_context32(struct sigcontext32 __user *sc,
         return err;
 }
 
-static int protected_restore_fp_context32(struct sigcontext32 __user *sc,
-                                          unsigned used_math)
+static int protected_restore_fp_context32(struct sigcontext32 __user *sc)
 {
         int err, tmp __maybe_unused;
-        bool restore_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = restore_fp_context32(sc);
-                        if (restore_msa && !err) {
-                                enable_msa();
-                                err = _restore_msa_context32(sc);
-                        } else {
-                                /* signal handler may have used MSA */
-                                disable_msa();
-                        }
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_from_sigcontext32(sc);
-                        if (restore_msa && !err)
-                                err = copy_msa_from_sigcontext32(sc);
                 }
                 if (likely(!err))
                         break;
@@ -241,8 +186,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
                 err |= __put_user(mflo3(), &sc->sc_lo3);
         }
 
-        used_math = used_math() ? USEDMATH_FP : 0;
-        used_math |= thread_msa_context_live() ? USEDMATH_MSA : 0;
+        used_math = !!used_math();
         err |= __put_user(used_math, &sc->sc_used_math);
 
         if (used_math) {
@@ -250,21 +194,20 @@ static int setup_sigcontext32(struct pt_regs *regs,
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                err |= protected_save_fp_context32(sc, used_math);
+                err |= protected_save_fp_context32(sc);
         }
         return err;
 }
 
 static int
-check_and_restore_fp_context32(struct sigcontext32 __user *sc,
-                               unsigned used_math)
+check_and_restore_fp_context32(struct sigcontext32 __user *sc)
 {
         int err, sig;
 
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= protected_restore_fp_context32(sc, used_math);
+        err |= protected_restore_fp_context32(sc);
         return err ?: sig;
 }
 
@@ -301,10 +244,9 @@ static int restore_sigcontext32(struct pt_regs *regs,
         if (used_math) {
                 /* restore fpu context if we have used it before */
                 if (!err)
-                        err = check_and_restore_fp_context32(sc, used_math);
+                        err = check_and_restore_fp_context32(sc);
         } else {
-                /* signal handler may have used FPU or MSA. Disable them. */
-                disable_msa();
+                /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
         }
 
diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
index df0598d9bfdd..949f2c6827a0 100644
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@@ -301,7 +301,7 @@ static int cps_cpu_disable(void)
 
         core_cfg = &mips_cps_core_bootcfg[current_cpu_data.core];
         atomic_sub(1 << cpu_vpe_id(&current_cpu_data), &core_cfg->vpe_mask);
-        smp_mb__after_atomic_dec();
+        smp_mb__after_atomic();
         set_cpu_online(cpu, false);
         cpu_clear(cpu, cpu_callin_map);
 
diff --git a/arch/mips/math-emu/ieee754.c b/arch/mips/math-emu/ieee754.c
index 53f1d2287084..8e97acbbe22c 100644
--- a/arch/mips/math-emu/ieee754.c
+++ b/arch/mips/math-emu/ieee754.c
@@ -34,13 +34,22 @@
  * Special constants
  */
 
-#define DPCNST(s, b, m)                                                 \
+/*
+ * Older GCC requires the inner braces for initialization of union ieee754dp's
+ * anonymous struct member.  Without an error will result.
+ */
+#define xPCNST(s, b, m, ebias)                                          \
 {                                                                       \
-        .sign   = (s),                                                  \
-        .bexp   = (b) + DP_EBIAS,                                       \
-        .mant   = (m)                                                   \
+        {                                                               \
+                .sign   = (s),                                          \
+                .bexp   = (b) + ebias,                                  \
+                .mant   = (m)                                           \
+        }                                                               \
 }
 
+#define DPCNST(s, b, m)                                                 \
+        xPCNST(s, b, m, DP_EBIAS)
+
 const union ieee754dp __ieee754dp_spcvals[] = {
         DPCNST(0, DP_EMIN - 1, 0x0000000000000ULL),     /* + zero   */
         DPCNST(1, DP_EMIN - 1, 0x0000000000000ULL),     /* - zero   */
@@ -62,11 +71,7 @@ const union ieee754dp __ieee754dp_spcvals[] = {
 };
 
 #define SPCNST(s, b, m)                                                 \
-{                                                                       \
-        .sign   = (s),                                                  \
-        .bexp   = (b) + SP_EBIAS,                                       \
-        .mant   = (m)                                                   \
-}
+        xPCNST(s, b, m, SP_EBIAS)
 
 const union ieee754sp __ieee754sp_spcvals[] = {
         SPCNST(0, SP_EMIN - 1, 0x000000),       /* + zero   */
diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c
index 775c2800cba2..8399ddf03a02 100644
--- a/arch/mips/mm/uasm-micromips.c
+++ b/arch/mips/mm/uasm-micromips.c
@@ -102,6 +102,7 @@ static struct insn insn_table_MM[] = {
         { insn_sd, 0, 0 },
         { insn_sll, M(mm_pool32a_op, 0, 0, 0, 0, mm_sll32_op), RT | RS | RD },
         { insn_sllv, M(mm_pool32a_op, 0, 0, 0, 0, mm_sllv32_op), RT | RS | RD },
+        { insn_slt, M(mm_pool32a_op, 0, 0, 0, 0, mm_slt_op), RT | RS | RD },
         { insn_sltiu, M(mm_sltiu32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
         { insn_sltu, M(mm_pool32a_op, 0, 0, 0, 0, mm_sltu_op), RT | RS | RD },
         { insn_sra, M(mm_pool32a_op, 0, 0, 0, 0, mm_sra_op), RT | RS | RD },
diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
index 38792c2364f5..6708a2dbf934 100644
--- a/arch/mips/mm/uasm-mips.c
+++ b/arch/mips/mm/uasm-mips.c
@@ -89,7 +89,7 @@ static struct insn insn_table[] = {
         { insn_lb, M(lb_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
         { insn_ld,  M(ld_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_ldx, M(spec3_op, 0, 0, 0, ldx_op, lx_op), RS | RT | RD },
-        { insn_lh,  M(lw_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
+        { insn_lh,  M(lh_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_lld,  M(lld_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_ll,  M(ll_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_lui,  M(lui_op, 0, 0, 0, 0, 0),  RT | SIMM },
@@ -110,6 +110,7 @@ static struct insn insn_table[] = {
         { insn_sd,  M(sd_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_sll,  M(spec_op, 0, 0, 0, 0, sll_op),  RT | RD | RE },
         { insn_sllv,  M(spec_op, 0, 0, 0, 0, sllv_op),  RS | RT | RD },
+        { insn_slt,  M(spec_op, 0, 0, 0, 0, slt_op),  RS | RT | RD },
         { insn_sltiu, M(sltiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
         { insn_sltu, M(spec_op, 0, 0, 0, 0, sltu_op), RS | RT | RD },
         { insn_sra,  M(spec_op, 0, 0, 0, 0, sra_op),  RT | RD | RE },
diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
index 00515805fe41..a01b0d6cedd2 100644
--- a/arch/mips/mm/uasm.c
+++ b/arch/mips/mm/uasm.c
@@ -53,7 +53,7 @@ enum opcode {
         insn_ld, insn_ldx, insn_lh, insn_ll, insn_lld, insn_lui, insn_lw,
         insn_lwx, insn_mfc0, insn_mfhi, insn_mflo, insn_mtc0, insn_mul,
         insn_or, insn_ori, insn_pref, insn_rfe, insn_rotr, insn_sc, insn_scd,
-        insn_sd, insn_sll, insn_sllv, insn_sltiu, insn_sltu, insn_sra,
+        insn_sd, insn_sll, insn_sllv, insn_slt, insn_sltiu, insn_sltu, insn_sra,
         insn_srl, insn_srlv, insn_subu, insn_sw, insn_sync, insn_syscall,
         insn_tlbp, insn_tlbr, insn_tlbwi, insn_tlbwr, insn_wait, insn_wsbh,
         insn_xor, insn_xori, insn_yield,
@@ -139,6 +139,13 @@ Ip_u1u2u3(op)						\
 }                                                       \
 UASM_EXPORT_SYMBOL(uasm_i##op);
 
+#define I_s3s1s2(op)                                    \
+Ip_s3s1s2(op)                                           \
+{                                                       \
+        build_insn(buf, insn##op, b, c, a);             \
+}                                                       \
+UASM_EXPORT_SYMBOL(uasm_i##op);
+
 #define I_u2u1u3(op)                                    \
 Ip_u2u1u3(op)                                           \
 {                                                       \
@@ -289,6 +296,7 @@ I_u2s3u1(_scd)
 I_u2s3u1(_sd)
 I_u2u1u3(_sll)
 I_u3u2u1(_sllv)
+I_s3s1s2(_slt)
 I_u2u1s3(_sltiu)
 I_u3u1u2(_sltu)
 I_u2u1u3(_sra)
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index a67b9753330b..b87390a56a2f 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -119,8 +119,6 @@
 /* Arguments used by JIT */
 #define ARGS_USED_BY_JIT        2 /* only applicable to 64-bit */
 
-#define FLAG_NEED_X_RESET       (1 << 0)
-
 #define SBIT(x)                 (1 << (x)) /* Signed version of BIT() */
 
 /**
@@ -153,6 +151,8 @@ static inline int optimize_div(u32 *k)
         return 0;
 }
 
+static inline void emit_jit_reg_move(ptr dst, ptr src, struct jit_ctx *ctx);
+
 /* Simply emit the instruction if the JIT memory space has been allocated */
 #define emit_instr(ctx, func, ...)                      \
 do {                                                    \
@@ -166,9 +166,7 @@ do {							\
 /* Determine if immediate is within the 16-bit signed range */
 static inline bool is_range16(s32 imm)
 {
-        if (imm >= SBIT(15) || imm < -SBIT(15))
-                return true;
-        return false;
+        return !(imm >= SBIT(15) || imm < -SBIT(15));
 }
 
 static inline void emit_addu(unsigned int dst, unsigned int src1,
@@ -187,7 +185,7 @@ static inline void emit_load_imm(unsigned int dst, u32 imm, struct jit_ctx *ctx)
 {
         if (ctx->target != NULL) {
                 /* addiu can only handle s16 */
-                if (is_range16(imm)) {
+                if (!is_range16(imm)) {
                         u32 *p = &ctx->target[ctx->idx];
                         uasm_i_lui(&p, r_tmp_imm, (s32)imm >> 16);
                         p = &ctx->target[ctx->idx + 1];
@@ -199,7 +197,7 @@ static inline void emit_load_imm(unsigned int dst, u32 imm, struct jit_ctx *ctx)
         }
         ctx->idx++;
 
-        if (is_range16(imm))
+        if (!is_range16(imm))
                 ctx->idx++;
 }
 
@@ -240,7 +238,7 @@ static inline void emit_daddiu(unsigned int dst, unsigned int src,
 static inline void emit_addiu(unsigned int dst, unsigned int src,
                               u32 imm, struct jit_ctx *ctx)
 {
-        if (is_range16(imm)) {
+        if (!is_range16(imm)) {
                 emit_load_imm(r_tmp, imm, ctx);
                 emit_addu(dst, r_tmp, src, ctx);
         } else {
@@ -313,8 +311,11 @@ static inline void emit_sll(unsigned int dst, unsigned int src,
                             unsigned int sa, struct jit_ctx *ctx)
 {
         /* sa is 5-bits long */
-        BUG_ON(sa >= BIT(5));
-        emit_instr(ctx, sll, dst, src, sa);
+        if (sa >= BIT(5))
+                /* Shifting >= 32 results in zero */
+                emit_jit_reg_move(dst, r_zero, ctx);
+        else
+                emit_instr(ctx, sll, dst, src, sa);
 }
 
 static inline void emit_srlv(unsigned int dst, unsigned int src,
@@ -327,8 +328,17 @@ static inline void emit_srl(unsigned int dst, unsigned int src,
                             unsigned int sa, struct jit_ctx *ctx)
 {
         /* sa is 5-bits long */
-        BUG_ON(sa >= BIT(5));
-        emit_instr(ctx, srl, dst, src, sa);
+        if (sa >= BIT(5))
+                /* Shifting >= 32 results in zero */
+                emit_jit_reg_move(dst, r_zero, ctx);
+        else
+                emit_instr(ctx, srl, dst, src, sa);
+}
+
+static inline void emit_slt(unsigned int dst, unsigned int src1,
+                            unsigned int src2, struct jit_ctx *ctx)
+{
+        emit_instr(ctx, slt, dst, src1, src2);
 }
 
 static inline void emit_sltu(unsigned int dst, unsigned int src1,
@@ -341,7 +351,7 @@ static inline void emit_sltiu(unsigned dst, unsigned int src,
                               unsigned int imm, struct jit_ctx *ctx)
 {
         /* 16 bit immediate */
-        if (is_range16((s32)imm)) {
+        if (!is_range16((s32)imm)) {
                 emit_load_imm(r_tmp, imm, ctx);
                 emit_sltu(dst, src, r_tmp, ctx);
         } else {
@@ -408,7 +418,7 @@ static inline void emit_div(unsigned int dst, unsigned int src,
                 u32 *p = &ctx->target[ctx->idx];
                 uasm_i_divu(&p, dst, src);
                 p = &ctx->target[ctx->idx + 1];
-                uasm_i_mfhi(&p, dst);
+                uasm_i_mflo(&p, dst);
         }
         ctx->idx += 2; /* 2 insts */
 }
@@ -443,6 +453,17 @@ static inline void emit_wsbh(unsigned int dst, unsigned int src,
         emit_instr(ctx, wsbh, dst, src);
 }
 
+/* load pointer to register */
+static inline void emit_load_ptr(unsigned int dst, unsigned int src,
+                                     int imm, struct jit_ctx *ctx)
+{
+        /* src contains the base addr of the 32/64-pointer */
+        if (config_enabled(CONFIG_64BIT))
+                emit_instr(ctx, ld, dst, imm, src);
+        else
+                emit_instr(ctx, lw, dst, imm, src);
+}
+
 /* load a function pointer to register */
 static inline void emit_load_func(unsigned int reg, ptr imm,
                                   struct jit_ctx *ctx)
@@ -545,29 +566,13 @@ static inline u16 align_sp(unsigned int num)
         return num;
 }
 
-static inline void update_on_xread(struct jit_ctx *ctx)
-{
-        if (!(ctx->flags & SEEN_X))
-                ctx->flags |= FLAG_NEED_X_RESET;
-
-        ctx->flags |= SEEN_X;
-}
-
 static bool is_load_to_a(u16 inst)
 {
         switch (inst) {
-        case BPF_S_LD_W_LEN:
-        case BPF_S_LD_W_ABS:
-        case BPF_S_LD_H_ABS:
-        case BPF_S_LD_B_ABS:
-        case BPF_S_ANC_CPU:
-        case BPF_S_ANC_IFINDEX:
-        case BPF_S_ANC_MARK:
-        case BPF_S_ANC_PROTOCOL:
-        case BPF_S_ANC_RXHASH:
-        case BPF_S_ANC_VLAN_TAG:
-        case BPF_S_ANC_VLAN_TAG_PRESENT:
-        case BPF_S_ANC_QUEUE:
+        case BPF_LD | BPF_W | BPF_LEN:
+        case BPF_LD | BPF_W | BPF_ABS:
+        case BPF_LD | BPF_H | BPF_ABS:
+        case BPF_LD | BPF_B | BPF_ABS:
                 return true;
         default:
                 return false;
@@ -618,7 +623,10 @@ static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset)
         if (ctx->flags & SEEN_MEM) {
                 if (real_off % (RSIZE * 2))
                         real_off += RSIZE;
-                emit_addiu(r_M, r_sp, real_off, ctx);
+                if (config_enabled(CONFIG_64BIT))
+                        emit_daddiu(r_M, r_sp, real_off, ctx);
+                else
+                        emit_addiu(r_M, r_sp, real_off, ctx);
         }
 }
 
@@ -705,11 +713,11 @@ static void build_prologue(struct jit_ctx *ctx)
         if (ctx->flags & SEEN_SKB)
                 emit_reg_move(r_skb, MIPS_R_A0, ctx);
 
-        if (ctx->flags & FLAG_NEED_X_RESET)
+        if (ctx->flags & SEEN_X)
                 emit_jit_reg_move(r_X, r_zero, ctx);
 
         /* Do not leak kernel data to userspace */
-        if ((first_inst != BPF_S_RET_K) && !(is_load_to_a(first_inst)))
+        if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
                 emit_jit_reg_move(r_A, r_zero, ctx);
 }
 
@@ -757,13 +765,17 @@ static u64 jit_get_skb_w(struct sk_buff *skb, unsigned offset)
         return (u64)err << 32 | ntohl(ret);
 }
 
-#define PKT_TYPE_MAX 7
+#ifdef __BIG_ENDIAN_BITFIELD
+#define PKT_TYPE_MAX    (7 << 5)
+#else
+#define PKT_TYPE_MAX    7
+#endif
 static int pkt_type_offset(void)
 {
         struct sk_buff skb_probe = {
                 .pkt_type = ~0,
         };
-        char *ct = (char *)&skb_probe;
+        u8 *ct = (u8 *)&skb_probe;
         unsigned int off;
 
         for (off = 0; off < sizeof(struct sk_buff); off++) {
@@ -783,46 +795,62 @@ static int build_body(struct jit_ctx *ctx)
         u32 k, b_off __maybe_unused;
 
         for (i = 0; i < prog->len; i++) {
+                u16 code;
+
                 inst = &(prog->insns[i]);
                 pr_debug("%s: code->0x%02x, jt->0x%x, jf->0x%x, k->0x%x\n",
                          __func__, inst->code, inst->jt, inst->jf, inst->k);
                 k = inst->k;
+                code = bpf_anc_helper(inst);
 
                 if (ctx->target == NULL)
                         ctx->offsets[i] = ctx->idx * 4;
 
-                switch (inst->code) {
-                case BPF_S_LD_IMM:
+                switch (code) {
+                case BPF_LD | BPF_IMM:
                         /* A <- k ==> li r_A, k */
                         ctx->flags |= SEEN_A;
                         emit_load_imm(r_A, k, ctx);
                         break;
-                case BPF_S_LD_W_LEN:
+                case BPF_LD | BPF_W | BPF_LEN:
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
                         /* A <- len ==> lw r_A, offset(skb) */
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         off = offsetof(struct sk_buff, len);
                         emit_load(r_A, r_skb, off, ctx);
                         break;
-                case BPF_S_LD_MEM:
+                case BPF_LD | BPF_MEM:
                         /* A <- M[k] ==> lw r_A, offset(M) */
                         ctx->flags |= SEEN_MEM | SEEN_A;
                         emit_load(r_A, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_LD_W_ABS:
+                case BPF_LD | BPF_W | BPF_ABS:
                         /* A <- P[k:4] */
                         load_order = 2;
                         goto load;
-                case BPF_S_LD_H_ABS:
+                case BPF_LD | BPF_H | BPF_ABS:
                         /* A <- P[k:2] */
                         load_order = 1;
                         goto load;
-                case BPF_S_LD_B_ABS:
+                case BPF_LD | BPF_B | BPF_ABS:
                         /* A <- P[k:1] */
                         load_order = 0;
 load:
+                        /* the interpreter will deal with the negative K */
+                        if ((int)k < 0)
+                                return -ENOTSUPP;
+
                         emit_load_imm(r_off, k, ctx);
 load_common:
+                        /*
+                         * We may got here from the indirect loads so
+                         * return if offset is negative.
+                         */
+                        emit_slt(r_s0, r_off, r_zero, ctx);
+                        emit_bcond(MIPS_COND_NE, r_s0, r_zero,
+                                   b_imm(prog->len, ctx), ctx);
+                        emit_reg_move(r_ret, r_zero, ctx);
+
                         ctx->flags |= SEEN_CALL | SEEN_OFF | SEEN_S0 |
                                 SEEN_SKB | SEEN_A;
 
@@ -852,39 +880,42 @@ load_common:
                         emit_b(b_imm(prog->len, ctx), ctx);
                         emit_reg_move(r_ret, r_zero, ctx);
                         break;
-                case BPF_S_LD_W_IND:
+                case BPF_LD | BPF_W | BPF_IND:
                         /* A <- P[X + k:4] */
                         load_order = 2;
                         goto load_ind;
-                case BPF_S_LD_H_IND:
+                case BPF_LD | BPF_H | BPF_IND:
                         /* A <- P[X + k:2] */
                         load_order = 1;
                         goto load_ind;
-                case BPF_S_LD_B_IND:
+                case BPF_LD | BPF_B | BPF_IND:
                         /* A <- P[X + k:1] */
                         load_order = 0;
 load_ind:
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_OFF | SEEN_X;
                         emit_addiu(r_off, r_X, k, ctx);
                         goto load_common;
-                case BPF_S_LDX_IMM:
+                case BPF_LDX | BPF_IMM:
                         /* X <- k */
                         ctx->flags |= SEEN_X;
                         emit_load_imm(r_X, k, ctx);
                         break;
-                case BPF_S_LDX_MEM:
+                case BPF_LDX | BPF_MEM:
                         /* X <- M[k] */
                         ctx->flags |= SEEN_X | SEEN_MEM;
                         emit_load(r_X, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_LDX_W_LEN:
+                case BPF_LDX | BPF_W | BPF_LEN:
                         /* X <- len */
                         ctx->flags |= SEEN_X | SEEN_SKB;
                         off = offsetof(struct sk_buff, len);
                         emit_load(r_X, r_skb, off, ctx);
                         break;
-                case BPF_S_LDX_B_MSH:
+                case BPF_LDX | BPF_B | BPF_MSH:
+                        /* the interpreter will deal with the negative K */
+                        if ((int)k < 0)
+                                return -ENOTSUPP;
+
                         /* X <- 4 * (P[k:1] & 0xf) */
                         ctx->flags |= SEEN_X | SEEN_CALL | SEEN_S0 | SEEN_SKB;
                         /* Load offset to a1 */
@@ -917,50 +948,49 @@ load_ind:
                         emit_b(b_imm(prog->len, ctx), ctx);
                         emit_load_imm(r_ret, 0, ctx); /* delay slot */
                         break;
-                case BPF_S_ST:
+                case BPF_ST:
                         /* M[k] <- A */
                         ctx->flags |= SEEN_MEM | SEEN_A;
                         emit_store(r_A, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_STX:
+                case BPF_STX:
                         /* M[k] <- X */
                         ctx->flags |= SEEN_MEM | SEEN_X;
                         emit_store(r_X, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_ALU_ADD_K:
+                case BPF_ALU | BPF_ADD | BPF_K:
                         /* A += K */
                         ctx->flags |= SEEN_A;
                         emit_addiu(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_ADD_X:
+                case BPF_ALU | BPF_ADD | BPF_X:
                         /* A += X */
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_addu(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_SUB_K:
+                case BPF_ALU | BPF_SUB | BPF_K:
                         /* A -= K */
                         ctx->flags |= SEEN_A;
                         emit_addiu(r_A, r_A, -k, ctx);
                         break;
-                case BPF_S_ALU_SUB_X:
+                case BPF_ALU | BPF_SUB | BPF_X:
                         /* A -= X */
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_subu(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_MUL_K:
+                case BPF_ALU | BPF_MUL | BPF_K:
                         /* A *= K */
                         /* Load K to scratch register before MUL */
                         ctx->flags |= SEEN_A | SEEN_S0;
                         emit_load_imm(r_s0, k, ctx);
                         emit_mul(r_A, r_A, r_s0, ctx);
                         break;
-                case BPF_S_ALU_MUL_X:
+                case BPF_ALU | BPF_MUL | BPF_X:
                         /* A *= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_mul(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_DIV_K:
+                case BPF_ALU | BPF_DIV | BPF_K:
                         /* A /= k */
                         if (k == 1)
                                 break;
@@ -973,7 +1003,7 @@ load_ind:
                         emit_load_imm(r_s0, k, ctx);
                         emit_div(r_A, r_s0, ctx);
                         break;
-                case BPF_S_ALU_MOD_K:
+                case BPF_ALU | BPF_MOD | BPF_K:
                         /* A %= k */
                         if (k == 1 || optimize_div(&k)) {
                                 ctx->flags |= SEEN_A;
@@ -984,9 +1014,8 @@ load_ind:
                                 emit_mod(r_A, r_s0, ctx);
                         }
                         break;
-                case BPF_S_ALU_DIV_X:
+                case BPF_ALU | BPF_DIV | BPF_X:
                         /* A /= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_X | SEEN_A;
                         /* Check if r_X is zero */
                         emit_bcond(MIPS_COND_EQ, r_X, r_zero,
@@ -994,9 +1023,8 @@ load_ind:
                         emit_load_imm(r_val, 0, ctx); /* delay slot */
                         emit_div(r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_MOD_X:
+                case BPF_ALU | BPF_MOD | BPF_X:
                         /* A %= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_X | SEEN_A;
                         /* Check if r_X is zero */
                         emit_bcond(MIPS_COND_EQ, r_X, r_zero,
@@ -1004,94 +1032,89 @@ load_ind:
                         emit_load_imm(r_val, 0, ctx); /* delay slot */
                         emit_mod(r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_OR_K:
+                case BPF_ALU | BPF_OR | BPF_K:
                         /* A |= K */
                         ctx->flags |= SEEN_A;
                         emit_ori(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_OR_X:
+                case BPF_ALU | BPF_OR | BPF_X:
                         /* A |= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A;
                         emit_ori(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_XOR_K:
+                case BPF_ALU | BPF_XOR | BPF_K:
                         /* A ^= k */
                         ctx->flags |= SEEN_A;
                         emit_xori(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ANC_ALU_XOR_X:
-                case BPF_S_ALU_XOR_X:
+                case BPF_ANC | SKF_AD_ALU_XOR_X:
+                case BPF_ALU | BPF_XOR | BPF_X:
                         /* A ^= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A;
                         emit_xor(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_AND_K:
+                case BPF_ALU | BPF_AND | BPF_K:
                         /* A &= K */
                         ctx->flags |= SEEN_A;
                         emit_andi(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_AND_X:
+                case BPF_ALU | BPF_AND | BPF_X:
                         /* A &= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_and(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_LSH_K:
+                case BPF_ALU | BPF_LSH | BPF_K:
                         /* A <<= K */
                         ctx->flags |= SEEN_A;
                         emit_sll(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_LSH_X:
+                case BPF_ALU | BPF_LSH | BPF_X:
                         /* A <<= X */
                         ctx->flags |= SEEN_A | SEEN_X;
-                        update_on_xread(ctx);
                         emit_sllv(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_RSH_K:
+                case BPF_ALU | BPF_RSH | BPF_K:
                         /* A >>= K */
                         ctx->flags |= SEEN_A;
                         emit_srl(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_RSH_X:
+                case BPF_ALU | BPF_RSH | BPF_X:
                         ctx->flags |= SEEN_A | SEEN_X;
-                        update_on_xread(ctx);
                         emit_srlv(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_NEG:
+                case BPF_ALU | BPF_NEG:
                         /* A = -A */
                         ctx->flags |= SEEN_A;
                         emit_neg(r_A, ctx);
                         break;
-                case BPF_S_JMP_JA:
+                case BPF_JMP | BPF_JA:
                         /* pc += K */
                         emit_b(b_imm(i + k + 1, ctx), ctx);
                         emit_nop(ctx);
                         break;
-                case BPF_S_JMP_JEQ_K:
+                case BPF_JMP | BPF_JEQ | BPF_K:
                         /* pc += ( A == K ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_EQ | MIPS_COND_K;
                         goto jmp_cmp;
-                case BPF_S_JMP_JEQ_X:
+                case BPF_JMP | BPF_JEQ | BPF_X:
                         ctx->flags |= SEEN_X;
                         /* pc += ( A == X ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_EQ | MIPS_COND_X;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGE_K:
+                case BPF_JMP | BPF_JGE | BPF_K:
                         /* pc += ( A >= K ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GE | MIPS_COND_K;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGE_X:
+                case BPF_JMP | BPF_JGE | BPF_X:
                         ctx->flags |= SEEN_X;
                         /* pc += ( A >= X ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GE | MIPS_COND_X;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGT_K:
+                case BPF_JMP | BPF_JGT | BPF_K:
                         /* pc += ( A > K ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GT | MIPS_COND_K;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGT_X:
+                case BPF_JMP | BPF_JGT | BPF_X:
                         ctx->flags |= SEEN_X;
                         /* pc += ( A > X ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GT | MIPS_COND_X;
@@ -1109,7 +1132,7 @@ jmp_cmp:
                                 }
                                 /* A < (K|X) ? r_scrach = 1 */
                                 b_off = b_imm(i + inst->jf + 1, ctx);
-                                emit_bcond(MIPS_COND_GT, r_s0, r_zero, b_off,
+                                emit_bcond(MIPS_COND_NE, r_s0, r_zero, b_off,
                                            ctx);
                                 emit_nop(ctx);
                                 /* A > (K|X) ? scratch = 0 */
@@ -1167,7 +1190,7 @@ jmp_cmp:
                                 }
                         }
                         break;
-                case BPF_S_JMP_JSET_K:
+                case BPF_JMP | BPF_JSET | BPF_K:
                         ctx->flags |= SEEN_S0 | SEEN_S1 | SEEN_A;
                         /* pc += (A & K) ? pc -> jt : pc -> jf */
                         emit_load_imm(r_s1, k, ctx);
@@ -1181,7 +1204,7 @@ jmp_cmp:
                         emit_b(b_off, ctx);
                         emit_nop(ctx);
                         break;
-                case BPF_S_JMP_JSET_X:
+                case BPF_JMP | BPF_JSET | BPF_X:
                         ctx->flags |= SEEN_S0 | SEEN_X | SEEN_A;
                         /* pc += (A & X) ? pc -> jt : pc -> jf */
                         emit_and(r_s0, r_A, r_X, ctx);
@@ -1194,7 +1217,7 @@ jmp_cmp:
                         emit_b(b_off, ctx);
                         emit_nop(ctx);
                         break;
-                case BPF_S_RET_A:
+                case BPF_RET | BPF_A:
                         ctx->flags |= SEEN_A;
                         if (i != prog->len - 1)
                                 /*
@@ -1204,7 +1227,7 @@ jmp_cmp:
                                 emit_b(b_imm(prog->len, ctx), ctx);
                         emit_reg_move(r_ret, r_A, ctx); /* delay slot */
                         break;
-                case BPF_S_RET_K:
+                case BPF_RET | BPF_K:
                         /*
                          * It can emit two instructions so it does not fit on
                          * the delay slot.
@@ -1219,19 +1242,18 @@ jmp_cmp:
                                 emit_nop(ctx);
                         }
                         break;
-                case BPF_S_MISC_TAX:
+                case BPF_MISC | BPF_TAX:
                         /* X = A */
                         ctx->flags |= SEEN_X | SEEN_A;
                         emit_jit_reg_move(r_X, r_A, ctx);
                         break;
-                case BPF_S_MISC_TXA:
+                case BPF_MISC | BPF_TXA:
                         /* A = X */
                         ctx->flags |= SEEN_A | SEEN_X;
-                        update_on_xread(ctx);
                         emit_jit_reg_move(r_A, r_X, ctx);
                         break;
                 /* AUX */
-                case BPF_S_ANC_PROTOCOL:
+                case BPF_ANC | SKF_AD_PROTOCOL:
                         /* A = ntohs(skb->protocol */
                         ctx->flags |= SEEN_SKB | SEEN_OFF | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff,
@@ -1256,7 +1278,7 @@ jmp_cmp:
                         }
 #endif
                         break;
-                case BPF_S_ANC_CPU:
+                case BPF_ANC | SKF_AD_CPU:
                         ctx->flags |= SEEN_A | SEEN_OFF;
                         /* A = current_thread_info()->cpu */
                         BUILD_BUG_ON(FIELD_SIZEOF(struct thread_info,
@@ -1265,11 +1287,12 @@ jmp_cmp:
                         /* $28/gp points to the thread_info struct */
                         emit_load(r_A, 28, off, ctx);
                         break;
-                case BPF_S_ANC_IFINDEX:
+                case BPF_ANC | SKF_AD_IFINDEX:
                         /* A = skb->dev->ifindex */
                         ctx->flags |= SEEN_SKB | SEEN_A | SEEN_S0;
                         off = offsetof(struct sk_buff, dev);
-                        emit_load(r_s0, r_skb, off, ctx);
+                        /* Load *dev pointer */
+                        emit_load_ptr(r_s0, r_skb, off, ctx);
                         /* error (0) in the delay slot */
                         emit_bcond(MIPS_COND_EQ, r_s0, r_zero,
                                    b_imm(prog->len, ctx), ctx);
@@ -1279,31 +1302,36 @@ jmp_cmp:
                         off = offsetof(struct net_device, ifindex);
                         emit_load(r_A, r_s0, off, ctx);
                         break;
-                case BPF_S_ANC_MARK:
+                case BPF_ANC | SKF_AD_MARK:
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4);
                         off = offsetof(struct sk_buff, mark);
                         emit_load(r_A, r_skb, off, ctx);
                         break;
-                case BPF_S_ANC_RXHASH:
+                case BPF_ANC | SKF_AD_RXHASH:
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, hash) != 4);
                         off = offsetof(struct sk_buff, hash);
                         emit_load(r_A, r_skb, off, ctx);
                         break;
-                case BPF_S_ANC_VLAN_TAG:
-                case BPF_S_ANC_VLAN_TAG_PRESENT:
+                case BPF_ANC | SKF_AD_VLAN_TAG:
+                case BPF_ANC | SKF_AD_VLAN_TAG_PRESENT:
                         ctx->flags |= SEEN_SKB | SEEN_S0 | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff,
                                                   vlan_tci) != 2);
                         off = offsetof(struct sk_buff, vlan_tci);
                         emit_half_load(r_s0, r_skb, off, ctx);
-                        if (inst->code == BPF_S_ANC_VLAN_TAG)
-                                emit_and(r_A, r_s0, VLAN_VID_MASK, ctx);
-                        else
-                                emit_and(r_A, r_s0, VLAN_TAG_PRESENT, ctx);
+                        if (code == (BPF_ANC | SKF_AD_VLAN_TAG)) {
+                                emit_andi(r_A, r_s0, (u16)~VLAN_TAG_PRESENT, ctx);
+                        } else {
+                                emit_andi(r_A, r_s0, VLAN_TAG_PRESENT, ctx);
+                                /* return 1 if present */
+                                emit_sltu(r_A, r_zero, r_A, ctx);
+                        }
                         break;
-                case BPF_S_ANC_PKTTYPE:
+                case BPF_ANC | SKF_AD_PKTTYPE:
+                        ctx->flags |= SEEN_SKB;
+
                         off = pkt_type_offset();
 
                         if (off < 0)
@@ -1311,8 +1339,12 @@ jmp_cmp:
                         emit_load_byte(r_tmp, r_skb, off, ctx);
                         /* Keep only the last 3 bits */
                         emit_andi(r_A, r_tmp, PKT_TYPE_MAX, ctx);
+#ifdef __BIG_ENDIAN_BITFIELD
+                        /* Get the actual packet type to the lower 3 bits */
+                        emit_srl(r_A, r_A, 5, ctx);
+#endif
                         break;
-                case BPF_S_ANC_QUEUE:
+                case BPF_ANC | SKF_AD_QUEUE:
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff,
                                                   queue_mapping) != 2);
@@ -1322,8 +1354,8 @@ jmp_cmp:
                         emit_half_load(r_A, r_skb, off, ctx);
                         break;
                 default:
-                        pr_warn("%s: Unhandled opcode: 0x%02x\n", __FILE__,
-                                inst->code);
+                        pr_debug("%s: Unhandled opcode: 0x%02x\n", __FILE__,
+                                 inst->code);
                         return -1;
                 }
         }
diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 790352f93700..35d16bd2760b 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -303,7 +303,6 @@ config PPC_EARLY_DEBUG_OPAL_VTERMNO
           This correspond to which /dev/hvcN you want to use for early
           debug.
 
-          On OPAL v1 (takeover) this should always be 0
           On OPAL v2, this will be 0 for network console and 1 or 2 for
           the machine built-in serial ports.
 
diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
index 37991e154ef8..840a5509b3f1 100644
--- a/arch/powerpc/include/asm/code-patching.h
+++ b/arch/powerpc/include/asm/code-patching.h
@@ -88,4 +88,15 @@ static inline unsigned long ppc_function_entry(void *func)
 #endif
 }
 
+static inline unsigned long ppc_global_function_entry(void *func)
+{
+#if defined(CONFIG_PPC64) && defined(_CALL_ELF) && _CALL_ELF == 2
+        /* PPC64 ABIv2 the global entry point is at the address */
+        return (unsigned long)func;
+#else
+        /* All other cases there is no change vs ppc_function_entry() */
+        return ppc_function_entry(func);
+#endif
+}
+
 #endif /* _ASM_POWERPC_CODE_PATCHING_H */
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index 460018889ba9..0da1dbd42e02 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -12,27 +12,7 @@
 #ifndef __OPAL_H
 #define __OPAL_H
 
-/****** Takeover interface ********/
-
-/* PAPR H-Call used to querty the HAL existence and/or instanciate
- * it from within pHyp (tech preview only).
- *
- * This is exclusively used in prom_init.c
- */
-
 #ifndef __ASSEMBLY__
-
-struct opal_takeover_args {
-        u64     k_image;                /* r4 */
-        u64     k_size;                 /* r5 */
-        u64     k_entry;                /* r6 */
-        u64     k_entry2;               /* r7 */
-        u64     hal_addr;               /* r8 */
-        u64     rd_image;               /* r9 */
-        u64     rd_size;                /* r10 */
-        u64     rd_loc;                 /* r11 */
-};
-
 /*
  * SG entry
  *
@@ -55,15 +35,6 @@ struct opal_sg_list {
 /* We calculate number of sg entries based on PAGE_SIZE */
 #define SG_ENTRIES_PER_NODE ((PAGE_SIZE - 16) / sizeof(struct opal_sg_entry))
 
-extern long opal_query_takeover(u64 *hal_size, u64 *hal_align);
-
-extern long opal_do_takeover(struct opal_takeover_args *args);
-
-struct rtas_args;
-extern int opal_enter_rtas(struct rtas_args *args,
-                           unsigned long data,
-                           unsigned long entry);
-
 #endif /* __ASSEMBLY__ */
 
 /****** OPAL APIs ******/
diff --git a/arch/powerpc/include/asm/swab.h b/arch/powerpc/include/asm/swab.h
index b9bd1ca944d0..96f59de61855 100644
--- a/arch/powerpc/include/asm/swab.h
+++ b/arch/powerpc/include/asm/swab.h
@@ -9,10 +9,6 @@
 
 #include <uapi/asm/swab.h>
 
-#ifdef __GNUC__
-#ifndef __powerpc64__
-#endif /* __powerpc64__ */
-
 static __inline__ __u16 ld_le16(const volatile __u16 *addr)
 {
         __u16 val;
@@ -20,19 +16,12 @@ static __inline__ __u16 ld_le16(const volatile __u16 *addr)
         __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (addr), "m" (*addr));
         return val;
 }
-#define __arch_swab16p ld_le16
 
 static __inline__ void st_le16(volatile __u16 *addr, const __u16 val)
 {
         __asm__ __volatile__ ("sthbrx %1,0,%2" : "=m" (*addr) : "r" (val), "r" (addr));
 }
 
-static inline void __arch_swab16s(__u16 *addr)
-{
-        st_le16(addr, *addr);
-}
-#define __arch_swab16s __arch_swab16s
-
 static __inline__ __u32 ld_le32(const volatile __u32 *addr)
 {
         __u32 val;
@@ -40,42 +29,10 @@ static __inline__ __u32 ld_le32(const volatile __u32 *addr)
         __asm__ __volatile__ ("lwbrx %0,0,%1" : "=r" (val) : "r" (addr), "m" (*addr));
         return val;
 }
-#define __arch_swab32p ld_le32
 
 static __inline__ void st_le32(volatile __u32 *addr, const __u32 val)
 {
         __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*addr) : "r" (val), "r" (addr));
 }
 
-static inline void __arch_swab32s(__u32 *addr)
-{
-        st_le32(addr, *addr);
-}
-#define __arch_swab32s __arch_swab32s
-
-static inline __attribute_const__ __u16 __arch_swab16(__u16 value)
-{
-        __u16 result;
-
-        __asm__("rlwimi %0,%1,8,16,23"
-            : "=r" (result)
-            : "r" (value), "0" (value >> 8));
-        return result;
-}
-#define __arch_swab16 __arch_swab16
-
-static inline __attribute_const__ __u32 __arch_swab32(__u32 value)
-{
-        __u32 result;
-
-        __asm__("rlwimi %0,%1,24,16,23\n\t"
-            "rlwimi %0,%1,8,8,15\n\t"
-            "rlwimi %0,%1,24,0,7"
-            : "=r" (result)
-            : "r" (value), "0" (value >> 24));
-        return result;
-}
-#define __arch_swab32 __arch_swab32
-
-#endif /* __GNUC__ */
 #endif /* _ASM_POWERPC_SWAB_H */
diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
index f202d0731b06..d178834fe508 100644
--- a/arch/powerpc/kernel/ftrace.c
+++ b/arch/powerpc/kernel/ftrace.c
@@ -10,6 +10,8 @@
  *
  */
 
+#define pr_fmt(fmt) "ftrace-powerpc: " fmt
+
 #include <linux/spinlock.h>
 #include <linux/hardirq.h>
 #include <linux/uaccess.h>
@@ -105,7 +107,7 @@ __ftrace_make_nop(struct module *mod,
                   struct dyn_ftrace *rec, unsigned long addr)
 {
         unsigned int op;
-        unsigned long ptr;
+        unsigned long entry, ptr;
         unsigned long ip = rec->ip;
         void *tramp;
 
@@ -115,7 +117,7 @@ __ftrace_make_nop(struct module *mod,
 
         /* Make sure that that this is still a 24bit jump */
         if (!is_bl_op(op)) {
-                printk(KERN_ERR "Not expected bl: opcode is %x\n", op);
+                pr_err("Not expected bl: opcode is %x\n", op);
                 return -EINVAL;
         }
 
@@ -125,21 +127,21 @@ __ftrace_make_nop(struct module *mod,
         pr_devel("ip:%lx jumps to %p", ip, tramp);
 
         if (!is_module_trampoline(tramp)) {
-                printk(KERN_ERR "Not a trampoline\n");
+                pr_err("Not a trampoline\n");
                 return -EINVAL;
         }
 
         if (module_trampoline_target(mod, tramp, &ptr)) {
-                printk(KERN_ERR "Failed to get trampoline target\n");
+                pr_err("Failed to get trampoline target\n");
                 return -EFAULT;
         }
 
         pr_devel("trampoline target %lx", ptr);
 
+        entry = ppc_global_function_entry((void *)addr);
         /* This should match what was called */
-        if (ptr != ppc_function_entry((void *)addr)) {
-                printk(KERN_ERR "addr %lx does not match expected %lx\n",
-                        ptr, ppc_function_entry((void *)addr));
+        if (ptr != entry) {
+                pr_err("addr %lx does not match expected %lx\n", ptr, entry);
                 return -EINVAL;
         }
 
@@ -179,7 +181,7 @@ __ftrace_make_nop(struct module *mod,
 
         /* Make sure that that this is still a 24bit jump */
         if (!is_bl_op(op)) {
-                printk(KERN_ERR "Not expected bl: opcode is %x\n", op);
+                pr_err("Not expected bl: opcode is %x\n", op);
                 return -EINVAL;
         }
 
@@ -198,7 +200,7 @@ __ftrace_make_nop(struct module *mod,
 
         /* Find where the trampoline jumps to */
         if (probe_kernel_read(jmp, (void *)tramp, sizeof(jmp))) {
-                printk(KERN_ERR "Failed to read %lx\n", tramp);
+                pr_err("Failed to read %lx\n", tramp);
                 return -EFAULT;
         }
 
@@ -209,7 +211,7 @@ __ftrace_make_nop(struct module *mod,
             ((jmp[1] & 0xffff0000) != 0x398c0000) ||
             (jmp[2] != 0x7d8903a6) ||
             (jmp[3] != 0x4e800420)) {
-                printk(KERN_ERR "Not a trampoline\n");
+                pr_err("Not a trampoline\n");
                 return -EINVAL;
         }
 
@@ -221,8 +223,7 @@ __ftrace_make_nop(struct module *mod,
         pr_devel(" %lx ", tramp);
 
         if (tramp != addr) {
-                printk(KERN_ERR
-                       "Trampoline location %08lx does not match addr\n",
+                pr_err("Trampoline location %08lx does not match addr\n",
                        tramp);
                 return -EINVAL;
         }
@@ -263,15 +264,13 @@ int ftrace_make_nop(struct module *mod,
          */
         if (!rec->arch.mod) {
                 if (!mod) {
-                        printk(KERN_ERR "No module loaded addr=%lx\n",
-                               addr);
+                        pr_err("No module loaded addr=%lx\n", addr);
                         return -EFAULT;
                 }
                 rec->arch.mod = mod;
         } else if (mod) {
                 if (mod != rec->arch.mod) {
-                        printk(KERN_ERR
-                               "Record mod %p not equal to passed in mod %p\n",
+                        pr_err("Record mod %p not equal to passed in mod %p\n",
                                rec->arch.mod, mod);
                         return -EINVAL;
                 }
@@ -307,26 +306,25 @@ __ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
          * The load offset is different depending on the ABI. For simplicity
          * just mask it out when doing the compare.
          */
-        if ((op[0] != 0x48000008) || ((op[1] & 0xffff00000) != 0xe8410000)) {
-                printk(KERN_ERR "Unexpected call sequence: %x %x\n",
-                        op[0], op[1]);
+        if ((op[0] != 0x48000008) || ((op[1] & 0xffff0000) != 0xe8410000)) {
+                pr_err("Unexpected call sequence: %x %x\n", op[0], op[1]);
                 return -EINVAL;
         }
 
         /* If we never set up a trampoline to ftrace_caller, then bail */
         if (!rec->arch.mod->arch.tramp) {
-                printk(KERN_ERR "No ftrace trampoline\n");
+                pr_err("No ftrace trampoline\n");
                 return -EINVAL;
         }
 
         /* Ensure branch is within 24 bits */
-        if (create_branch(ip, rec->arch.mod->arch.tramp, BRANCH_SET_LINK)) {
-                printk(KERN_ERR "Branch out of range");
+        if (!create_branch(ip, rec->arch.mod->arch.tramp, BRANCH_SET_LINK)) {
+                pr_err("Branch out of range\n");
                 return -EINVAL;
         }
 
         if (patch_branch(ip, rec->arch.mod->arch.tramp, BRANCH_SET_LINK)) {
-                printk(KERN_ERR "REL24 out of range!\n");
+                pr_err("REL24 out of range!\n");
                 return -EINVAL;
         }
 
@@ -345,13 +343,13 @@ __ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 
         /* It should be pointing to a nop */
         if (op != PPC_INST_NOP) {
-                printk(KERN_ERR "Expected NOP but have %x\n", op);
+                pr_err("Expected NOP but have %x\n", op);
                 return -EINVAL;
         }
 
         /* If we never set up a trampoline to ftrace_caller, then bail */
         if (!rec->arch.mod->arch.tramp) {
-                printk(KERN_ERR "No ftrace trampoline\n");
+                pr_err("No ftrace trampoline\n");
                 return -EINVAL;
         }
 
@@ -359,7 +357,7 @@ __ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
         op = create_branch((unsigned int *)ip,
                            rec->arch.mod->arch.tramp, BRANCH_SET_LINK);
         if (!op) {
-                printk(KERN_ERR "REL24 out of range!\n");
+                pr_err("REL24 out of range!\n");
                 return -EINVAL;
         }
 
@@ -397,7 +395,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
          * already have a module defined.
          */
         if (!rec->arch.mod) {
-                printk(KERN_ERR "No module loaded\n");
+                pr_err("No module loaded\n");
                 return -EINVAL;
         }
 
diff --git a/arch/powerpc/kernel/iomap.c b/arch/powerpc/kernel/iomap.c
index b82227e7e21b..12e48d56f771 100644
--- a/arch/powerpc/kernel/iomap.c
+++ b/arch/powerpc/kernel/iomap.c
@@ -23,7 +23,7 @@ unsigned int ioread16(void __iomem *addr)
 }
 unsigned int ioread16be(void __iomem *addr)
 {
-        return in_be16(addr);
+        return readw_be(addr);
 }
 unsigned int ioread32(void __iomem *addr)
 {
@@ -31,7 +31,7 @@ unsigned int ioread32(void __iomem *addr)
 }
 unsigned int ioread32be(void __iomem *addr)
 {
-        return in_be32(addr);
+        return readl_be(addr);
 }
 EXPORT_SYMBOL(ioread8);
 EXPORT_SYMBOL(ioread16);
@@ -49,7 +49,7 @@ void iowrite16(u16 val, void __iomem *addr)
 }
 void iowrite16be(u16 val, void __iomem *addr)
 {
-        out_be16(addr, val);
+        writew_be(val, addr);
 }
 void iowrite32(u32 val, void __iomem *addr)
 {
@@ -57,7 +57,7 @@ void iowrite32(u32 val, void __iomem *addr)
 }
 void iowrite32be(u32 val, void __iomem *addr)
 {
-        out_be32(addr, val);
+        writel_be(val, addr);
 }
 EXPORT_SYMBOL(iowrite8);
 EXPORT_SYMBOL(iowrite16);
@@ -75,15 +75,15 @@ EXPORT_SYMBOL(iowrite32be);
  */
 void ioread8_rep(void __iomem *addr, void *dst, unsigned long count)
 {
-        _insb((u8 __iomem *) addr, dst, count);
+        readsb(addr, dst, count);
 }
 void ioread16_rep(void __iomem *addr, void *dst, unsigned long count)
 {
-        _insw_ns((u16 __iomem *) addr, dst, count);
+        readsw(addr, dst, count);
 }
 void ioread32_rep(void __iomem *addr, void *dst, unsigned long count)
 {
-        _insl_ns((u32 __iomem *) addr, dst, count);
+        readsl(addr, dst, count);
 }
 EXPORT_SYMBOL(ioread8_rep);
 EXPORT_SYMBOL(ioread16_rep);
@@ -91,15 +91,15 @@ EXPORT_SYMBOL(ioread32_rep);
 
 void iowrite8_rep(void __iomem *addr, const void *src, unsigned long count)
 {
-        _outsb((u8 __iomem *) addr, src, count);
+        writesb(addr, src, count);
 }
 void iowrite16_rep(void __iomem *addr, const void *src, unsigned long count)
 {
-        _outsw_ns((u16 __iomem *) addr, src, count);
+        writesw(addr, src, count);
 }
 void iowrite32_rep(void __iomem *addr, const void *src, unsigned long count)
 {
-        _outsl_ns((u32 __iomem *) addr, src, count);
+        writesl(addr, src, count);
 }
 EXPORT_SYMBOL(iowrite8_rep);
 EXPORT_SYMBOL(iowrite16_rep);
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 90fab64d911d..2f72af82513c 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -32,6 +32,7 @@
 #include <linux/module.h>
 #include <linux/kdebug.h>
 #include <linux/slab.h>
+#include <asm/code-patching.h>
 #include <asm/cacheflush.h>
 #include <asm/sstep.h>
 #include <asm/uaccess.h>
@@ -491,12 +492,10 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
         return ret;
 }
 
-#ifdef CONFIG_PPC64
 unsigned long arch_deref_entry_point(void *entry)
 {
-        return ((func_descr_t *)entry)->entry;
+        return ppc_global_function_entry(entry);
 }
-#endif
 
 int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
 {
@@ -508,8 +507,12 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
         /* setup return addr to the jprobe handler routine */
         regs->nip = arch_deref_entry_point(jp->entry);
 #ifdef CONFIG_PPC64
+#if defined(_CALL_ELF) && _CALL_ELF == 2
+        regs->gpr[12] = (unsigned long)jp->entry;
+#else
         regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc);
 #endif
+#endif
 
         return 1;
 }
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index 077d2ce6c5a7..d807ee626af9 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -315,8 +315,17 @@ static void dedotify_versions(struct modversion_info *vers,
         struct modversion_info *end;
 
         for (end = (void *)vers + size; vers < end; vers++)
-                if (vers->name[0] == '.')
+                if (vers->name[0] == '.') {
                         memmove(vers->name, vers->name+1, strlen(vers->name));
+#ifdef ARCH_RELOCATES_KCRCTAB
+                        /* The TOC symbol has no CRC computed. To avoid CRC
+                         * check failing, we must force it to the expected
+                         * value (see CRC check in module.c).
+                         */
+                        if (!strcmp(vers->name, "TOC."))
+                                vers->crc = -(unsigned long)reloc_start;
+#endif
+                }
 }
 
 /* Undefined symbols which refer to .funcname, hack to funcname (or .TOC.) */
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 613a860a203c..b694b0730971 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -662,13 +662,6 @@ void __init early_init_devtree(void *params)
         of_scan_flat_dt(early_init_dt_scan_fw_dump, NULL);
 #endif
 
-        /* Pre-initialize the cmd_line with the content of boot_commmand_line,
-         * which will be empty except when the content of the variable has
-         * been overriden by a bootloading mechanism. This happens typically
-         * with HAL takeover
-         */
-        strlcpy(cmd_line, boot_command_line, COMMAND_LINE_SIZE);
-
         /* Retrieve various informations from the /chosen node of the
          * device-tree, including the platform type, initrd location and
          * size, TCE reserve, and more ...
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 078145acf7fb..1a85d8f96739 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -1268,201 +1268,6 @@ static u64 __initdata prom_opal_base;
 static u64 __initdata prom_opal_entry;
 #endif
 
-#ifdef __BIG_ENDIAN__
-/* XXX Don't change this structure without updating opal-takeover.S */
-static struct opal_secondary_data {
-        s64                             ack;    /*  0 */
-        u64                             go;     /*  8 */
-        struct opal_takeover_args       args;   /* 16 */
-} opal_secondary_data;
-
-static u64 __initdata prom_opal_align;
-static u64 __initdata prom_opal_size;
-static int __initdata prom_rtas_start_cpu;
-static u64 __initdata prom_rtas_data;
-static u64 __initdata prom_rtas_entry;
-
-extern char opal_secondary_entry;
-
-static void __init prom_query_opal(void)
-{
-        long rc;
-
-        /* We must not query for OPAL presence on a machine that
-         * supports TNK takeover (970 blades), as this uses the same
-         * h-call with different arguments and will crash
-         */
-        if (PHANDLE_VALID(call_prom("finddevice", 1, 1,
-                                    ADDR("/tnk-memory-map")))) {
-                prom_printf("TNK takeover detected, skipping OPAL check\n");
-                return;
-        }
-
-        prom_printf("Querying for OPAL presence... ");
-
-        rc = opal_query_takeover(&prom_opal_size,
-                                 &prom_opal_align);
-        prom_debug("(rc = %ld) ", rc);
-        if (rc != 0) {
-                prom_printf("not there.\n");
-                return;
-        }
-        of_platform = PLATFORM_OPAL;
-        prom_printf(" there !\n");
-        prom_debug("  opal_size  = 0x%lx\n", prom_opal_size);
-        prom_debug("  opal_align = 0x%lx\n", prom_opal_align);
-        if (prom_opal_align < 0x10000)
-                prom_opal_align = 0x10000;
-}
-
-static int __init prom_rtas_call(int token, int nargs, int nret,
-                                 int *outputs, ...)
-{
-        struct rtas_args rtas_args;
-        va_list list;
-        int i;
-
-        rtas_args.token = token;
-        rtas_args.nargs = nargs;
-        rtas_args.nret  = nret;
-        rtas_args.rets  = (rtas_arg_t *)&(rtas_args.args[nargs]);
-        va_start(list, outputs);
-        for (i = 0; i < nargs; ++i)
-                rtas_args.args[i] = va_arg(list, rtas_arg_t);
-        va_end(list);
-
-        for (i = 0; i < nret; ++i)
-                rtas_args.rets[i] = 0;
-
-        opal_enter_rtas(&rtas_args, prom_rtas_data,
-                        prom_rtas_entry);
-
-        if (nret > 1 && outputs != NULL)
-                for (i = 0; i < nret-1; ++i)
-                        outputs[i] = rtas_args.rets[i+1];
-        return (nret > 0)? rtas_args.rets[0]: 0;
-}
-
-static void __init prom_opal_hold_cpus(void)
-{
-        int i, cnt, cpu, rc;
-        long j;
-        phandle node;
-        char type[64];
-        u32 servers[8];
-        void *entry = (unsigned long *)&opal_secondary_entry;
-        struct opal_secondary_data *data = &opal_secondary_data;
-
-        prom_debug("prom_opal_hold_cpus: start...\n");
-        prom_debug("    - entry       = 0x%x\n", entry);
-        prom_debug("    - data        = 0x%x\n", data);
-
-        data->ack = -1;
-        data->go = 0;
-
-        /* look for cpus */
-        for (node = 0; prom_next_node(&node); ) {
-                type[0] = 0;
-                prom_getprop(node, "device_type", type, sizeof(type));
-                if (strcmp(type, "cpu") != 0)
-                        continue;
-
-                /* Skip non-configured cpus. */
-                if (prom_getprop(node, "status", type, sizeof(type)) > 0)
-                        if (strcmp(type, "okay") != 0)
-                                continue;
-
-                cnt = prom_getprop(node, "ibm,ppc-interrupt-server#s", servers,
-                             sizeof(servers));
-                if (cnt == PROM_ERROR)
-                        break;
-                cnt >>= 2;
-                for (i = 0; i < cnt; i++) {
-                        cpu = servers[i];
-                        prom_debug("CPU %d ... ", cpu);
-                        if (cpu == prom.cpu) {
-                                prom_debug("booted !\n");
-                                continue;
-                        }
-                        prom_debug("starting ... ");
-
-                        /* Init the acknowledge var which will be reset by
-                         * the secondary cpu when it awakens from its OF
-                         * spinloop.
-                         */
-                        data->ack = -1;
-                        rc = prom_rtas_call(prom_rtas_start_cpu, 3, 1,
-                                            NULL, cpu, entry, data);
-                        prom_debug("rtas rc=%d ...", rc);
-
-                        for (j = 0; j < 100000000 && data->ack == -1; j++) {
-                                HMT_low();
-                                mb();
-                        }
-                        HMT_medium();
-                        if (data->ack != -1)
-                                prom_debug("done, PIR=0x%x\n", data->ack);
-                        else
-                                prom_debug("timeout !\n");
-                }
-        }
-        prom_debug("prom_opal_hold_cpus: end...\n");
-}
-
-static void __init prom_opal_takeover(void)
-{
-        struct opal_secondary_data *data = &opal_secondary_data;
-        struct opal_takeover_args *args = &data->args;
-        u64 align = prom_opal_align;
-        u64 top_addr, opal_addr;
-
-        args->k_image   = (u64)_stext;
-        args->k_size    = _end - _stext;
-        args->k_entry   = 0;
-        args->k_entry2  = 0x60;
-
-        top_addr = _ALIGN_UP(args->k_size, align);
-
-        if (prom_initrd_start != 0) {
-                args->rd_image = prom_initrd_start;
-                args->rd_size = prom_initrd_end - args->rd_image;
-                args->rd_loc = top_addr;
-                top_addr = _ALIGN_UP(args->rd_loc + args->rd_size, align);
-        }
-
-        /* Pickup an address for the HAL. We want to go really high
-         * up to avoid problem with future kexecs. On the other hand
-         * we don't want to be all over the TCEs on P5IOC2 machines
-         * which are going to be up there too. We assume the machine
-         * has plenty of memory, and we ask for the HAL for now to
-         * be just below the 1G point, or above the initrd
-         */
-        opal_addr = _ALIGN_DOWN(0x40000000 - prom_opal_size, align);
-        if (opal_addr < top_addr)
-                opal_addr = top_addr;
-        args->hal_addr = opal_addr;
-
-        /* Copy the command line to the kernel image */
-        strlcpy(boot_command_line, prom_cmd_line,
-                COMMAND_LINE_SIZE);
-
-        prom_debug("  k_image    = 0x%lx\n", args->k_image);
-        prom_debug("  k_size     = 0x%lx\n", args->k_size);
-        prom_debug("  k_entry    = 0x%lx\n", args->k_entry);
-        prom_debug("  k_entry2   = 0x%lx\n", args->k_entry2);
-        prom_debug("  hal_addr   = 0x%lx\n", args->hal_addr);
-        prom_debug("  rd_image   = 0x%lx\n", args->rd_image);
-        prom_debug("  rd_size    = 0x%lx\n", args->rd_size);
-        prom_debug("  rd_loc     = 0x%lx\n", args->rd_loc);
-        prom_printf("Performing OPAL takeover,this can take a few minutes..\n");
-        prom_close_stdin();
-        mb();
-        data->go = 1;
-        for (;;)
-                opal_do_takeover(args);
-}
-#endif /* __BIG_ENDIAN__ */
-
 /*
  * Allocate room for and instantiate OPAL
  */
@@ -1597,12 +1402,6 @@ static void __init prom_instantiate_rtas(void)
                          &val, sizeof(val)) != PROM_ERROR)
                 rtas_has_query_cpu_stopped = true;
 
-#if defined(CONFIG_PPC_POWERNV) && defined(__BIG_ENDIAN__)
-        /* PowerVN takeover hack */
-        prom_rtas_data = base;
-        prom_rtas_entry = entry;
-        prom_getprop(rtas_node, "start-cpu", &prom_rtas_start_cpu, 4);
-#endif
         prom_debug("rtas base     = 0x%x\n", base);
         prom_debug("rtas entry    = 0x%x\n", entry);
         prom_debug("rtas size     = 0x%x\n", (long)size);
@@ -3027,16 +2826,6 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
                 prom_instantiate_rtas();
 
 #ifdef CONFIG_PPC_POWERNV
-#ifdef __BIG_ENDIAN__
-        /* Detect HAL and try instanciating it & doing takeover */
-        if (of_platform == PLATFORM_PSERIES_LPAR) {
-                prom_query_opal();
-                if (of_platform == PLATFORM_OPAL) {
-                        prom_opal_hold_cpus();
-                        prom_opal_takeover();
-                }
-        } else
-#endif /* __BIG_ENDIAN__ */
         if (of_platform == PLATFORM_OPAL)
                 prom_instantiate_opal();
 #endif /* CONFIG_PPC_POWERNV */
diff --git a/arch/powerpc/kernel/prom_init_check.sh b/arch/powerpc/kernel/prom_init_check.sh
index 77aa1e95e904..fe8e54b9ef7d 100644
--- a/arch/powerpc/kernel/prom_init_check.sh
+++ b/arch/powerpc/kernel/prom_init_check.sh
@@ -21,9 +21,7 @@ _end enter_prom memcpy memset reloc_offset __secondary_hold
 __secondary_hold_acknowledge __secondary_hold_spinloop __start
 strcmp strcpy strlcpy strlen strncmp strstr logo_linux_clut224
 reloc_got2 kernstart_addr memstart_addr linux_banner _stext
-opal_query_takeover opal_do_takeover opal_enter_rtas opal_secondary_entry
-boot_command_line __prom_init_toc_start __prom_init_toc_end
-btext_setup_display TOC."
+__prom_init_toc_start __prom_init_toc_end btext_setup_display TOC."
 
 NM="$1"
 OBJ="$2"
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index e239df3768ac..e5b022c55ccd 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -469,9 +469,17 @@ void __init smp_setup_cpu_maps(void)
                 }
 
                 for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) {
+                        bool avail;
+
                         DBG("    thread %d -> cpu %d (hard id %d)\n",
                             j, cpu, be32_to_cpu(intserv[j]));
-                        set_cpu_present(cpu, of_device_is_available(dn));
+
+                        avail = of_device_is_available(dn);
+                        if (!avail)
+                                avail = !of_property_match_string(dn,
+                                                "enable-method", "spin-table");
+
+                        set_cpu_present(cpu, avail);
                         set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j]));
                         set_cpu_possible(cpu, true);
                         cpu++;
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 4e47db686b5d..1bc5a1755ed4 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -54,7 +54,6 @@
 
 #include "signal.h"
 
-#undef DEBUG_SIG
 
 #ifdef CONFIG_PPC64
 #define sys_rt_sigreturn        compat_sys_rt_sigreturn
@@ -1063,10 +1062,6 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
         return 1;
 
 badframe:
-#ifdef DEBUG_SIG
-        printk("badframe in handle_rt_signal, regs=%p frame=%p newsp=%lx\n",
-               regs, frame, newsp);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(KERN_INFO
                                    "%s[%d]: bad frame in handle_rt_signal32: "
@@ -1484,10 +1479,6 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
         return 1;
 
 badframe:
-#ifdef DEBUG_SIG
-        printk("badframe in handle_signal, regs=%p frame=%p newsp=%lx\n",
-               regs, frame, newsp);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(KERN_INFO
                                    "%s[%d]: bad frame in handle_signal32: "
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index d501dc4dc3e6..97c1e4b683fc 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -38,7 +38,6 @@
 
 #include "signal.h"
 
-#define DEBUG_SIG 0
 
 #define GP_REGS_SIZE    min(sizeof(elf_gregset_t), sizeof(struct pt_regs))
 #define FP_REGS_SIZE    sizeof(elf_fpregset_t)
@@ -700,10 +699,6 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
         return 0;
 
 badframe:
-#if DEBUG_SIG
-        printk("badframe in sys_rt_sigreturn, regs=%p uc=%p &uc->uc_mcontext=%p\n",
-               regs, uc, &uc->uc_mcontext);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(regs->msr & MSR_64BIT ? fmt64 : fmt32,
                                    current->comm, current->pid, "rt_sigreturn",
@@ -809,10 +804,6 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
         return 1;
 
 badframe:
-#if DEBUG_SIG
-        printk("badframe in setup_rt_frame, regs=%p frame=%p newsp=%lx\n",
-               regs, frame, newsp);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(regs->msr & MSR_64BIT ? fmt64 : fmt32,
                                    current->comm, current->pid, "setup_rt_frame",
diff --git a/arch/powerpc/platforms/cell/cbe_thermal.c b/arch/powerpc/platforms/cell/cbe_thermal.c
index 94560db788bf..2c15ff094483 100644
--- a/arch/powerpc/platforms/cell/cbe_thermal.c
+++ b/arch/powerpc/platforms/cell/cbe_thermal.c
@@ -125,7 +125,7 @@ static ssize_t show_throttle(struct cbe_pmd_regs __iomem *pmd_regs, char *buf, i
 static ssize_t store_throttle(struct cbe_pmd_regs __iomem *pmd_regs, const char *buf, size_t size, int pos)
 {
         u64 reg_value;
-        int temp;
+        unsigned int temp;
         u64 new_value;
         int ret;
 
diff --git a/arch/powerpc/platforms/powernv/Makefile b/arch/powerpc/platforms/powernv/Makefile
index d55891f89a2c..4ad227d04c1a 100644
--- a/arch/powerpc/platforms/powernv/Makefile
+++ b/arch/powerpc/platforms/powernv/Makefile
@@ -1,4 +1,4 @@
-obj-y                   += setup.o opal-takeover.o opal-wrappers.o opal.o opal-async.o
+obj-y                   += setup.o opal-wrappers.o opal.o opal-async.o
 obj-y                   += opal-rtc.o opal-nvram.o opal-lpc.o opal-flash.o
 obj-y                   += rng.o opal-elog.o opal-dump.o opal-sysparam.o opal-sensor.o
 obj-y                   += opal-msglog.o
diff --git a/arch/powerpc/platforms/powernv/opal-takeover.S b/arch/powerpc/platforms/powernv/opal-takeover.S
deleted file mode 100644
index 11a3169ee583..000000000000
--- a/arch/powerpc/platforms/powernv/opal-takeover.S
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * PowerNV OPAL takeover assembly code, for use by prom_init.c
- *
- * Copyright 2011 IBM Corp.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <asm/ppc_asm.h>
-#include <asm/hvcall.h>
-#include <asm/asm-offsets.h>
-#include <asm/opal.h>
-
-#define H_HAL_TAKEOVER                  0x5124
-#define H_HAL_TAKEOVER_QUERY_MAGIC      -1
-
-        .text
-_GLOBAL(opal_query_takeover)
-        mfcr    r0
-        stw     r0,8(r1)
-        stdu    r1,-STACKFRAMESIZE(r1)
-        std     r3,STK_PARAM(R3)(r1)
-        std     r4,STK_PARAM(R4)(r1)
-        li      r3,H_HAL_TAKEOVER
-        li      r4,H_HAL_TAKEOVER_QUERY_MAGIC
-        HVSC
-        addi    r1,r1,STACKFRAMESIZE
-        ld      r10,STK_PARAM(R3)(r1)
-        std     r4,0(r10)
-        ld      r10,STK_PARAM(R4)(r1)
-        std     r5,0(r10)
-        lwz     r0,8(r1)
-        mtcrf   0xff,r0
-        blr
-
-_GLOBAL(opal_do_takeover)
-        mfcr    r0
-        stw     r0,8(r1)
-        mflr    r0
-        std     r0,16(r1)
-        bl      __opal_do_takeover
-        ld      r0,16(r1)
-        mtlr    r0
-        lwz     r0,8(r1)
-        mtcrf   0xff,r0
-        blr
-
-__opal_do_takeover:
-        ld      r4,0(r3)
-        ld      r5,0x8(r3)
-        ld      r6,0x10(r3)
-        ld      r7,0x18(r3)
-        ld      r8,0x20(r3)
-        ld      r9,0x28(r3)
-        ld      r10,0x30(r3)
-        ld      r11,0x38(r3)
-        li      r3,H_HAL_TAKEOVER
-        HVSC
-        blr
-
-        .globl opal_secondary_entry
-opal_secondary_entry:
-        mr      r31,r3
-        mfmsr   r11
-        li      r12,(MSR_SF | MSR_ISF)@highest
-        sldi    r12,r12,48
-        or      r11,r11,r12
-        mtmsrd  r11
-        isync
-        mfspr   r4,SPRN_PIR
-        std     r4,0(r3)
-1:      HMT_LOW
-        ld      r4,8(r3)
-        cmpli   cr0,r4,0
-        beq     1b
-        HMT_MEDIUM
-1:      addi    r3,r31,16
-        bl      __opal_do_takeover
-        b       1b
-
-_GLOBAL(opal_enter_rtas)
-        mflr    r0
-        std     r0,16(r1)
-        stdu    r1,-PROM_FRAME_SIZE(r1) /* Save SP and create stack space */
-
-        /* Because PROM is running in 32b mode, it clobbers the high order half
-         * of all registers that it saves.  We therefore save those registers
-         * PROM might touch to the stack.  (r0, r3-r13 are caller saved)
-        */
-        SAVE_GPR(2, r1)
-        SAVE_GPR(13, r1)
-        SAVE_8GPRS(14, r1)
-        SAVE_10GPRS(22, r1)
-        mfcr    r10
-        mfmsr   r11
-        std     r10,_CCR(r1)
-        std     r11,_MSR(r1)
-
-        /* Get the PROM entrypoint */
-        mtlr    r5
-
-        /* Switch MSR to 32 bits mode
-         */
-        li      r12,1
-        rldicr  r12,r12,MSR_SF_LG,(63-MSR_SF_LG)
-        andc    r11,r11,r12
-        li      r12,1
-        rldicr  r12,r12,MSR_ISF_LG,(63-MSR_ISF_LG)
-        andc    r11,r11,r12
-        mtmsrd  r11
-        isync
-
-        /* Enter RTAS here... */
-        blrl
-
-        /* Just make sure that r1 top 32 bits didn't get
-         * corrupt by OF
-         */
-        rldicl  r1,r1,0,32
-
-        /* Restore the MSR (back to 64 bits) */
-        ld      r0,_MSR(r1)
-        MTMSRD(r0)
-        isync
-
-        /* Restore other registers */
-        REST_GPR(2, r1)
-        REST_GPR(13, r1)
-        REST_8GPRS(14, r1)
-        REST_10GPRS(22, r1)
-        ld      r4,_CCR(r1)
-        mtcr    r4
-
-        addi    r1,r1,PROM_FRAME_SIZE
-        ld      r0,16(r1)
-        mtlr    r0
-        blr
diff --git a/arch/powerpc/sysdev/dart_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 62c47bb76517..9e5353ff6d1b 100644
--- a/arch/powerpc/sysdev/dart_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -476,6 +476,11 @@ void __init alloc_dart_table(void)
          */
         dart_tablebase = (unsigned long)
                 __va(memblock_alloc_base(1UL<<24, 1UL<<24, 0x80000000L));
+        /*
+         * The DART space is later unmapped from the kernel linear mapping and
+         * accessing dart_tablebase during kmemleak scanning will fault.
+         */
+        kmemleak_no_scan((void *)dart_tablebase);
 
         printk(KERN_INFO "DART table allocated at: %lx\n", dart_tablebase);
 }
diff --git a/arch/sparc/include/asm/irq_64.h b/arch/sparc/include/asm/irq_64.h
index 375cffcf7dbd..91d219381306 100644
--- a/arch/sparc/include/asm/irq_64.h
+++ b/arch/sparc/include/asm/irq_64.h
@@ -89,7 +89,7 @@ static inline unsigned long get_softint(void)
         return retval;
 }
 
-void arch_trigger_all_cpu_backtrace(void);
+void arch_trigger_all_cpu_backtrace(bool);
 #define arch_trigger_all_cpu_backtrace arch_trigger_all_cpu_backtrace
 
 extern void *hardirq_stack[NR_CPUS];
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index b2988f25e230..027e09986194 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -239,7 +239,7 @@ static void __global_reg_poll(struct global_reg_snapshot *gp)
         }
 }
 
-void arch_trigger_all_cpu_backtrace(void)
+void arch_trigger_all_cpu_backtrace(bool include_self)
 {
         struct thread_info *tp = current_thread_info();
         struct pt_regs *regs = get_irq_regs();
@@ -251,16 +251,22 @@ void arch_trigger_all_cpu_backtrace(void)
 
         spin_lock_irqsave(&global_cpu_snapshot_lock, flags);
 
-        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-
         this_cpu = raw_smp_processor_id();
 
-        __global_reg_self(tp, regs, this_cpu);
+        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
+
+        if (include_self)
+                __global_reg_self(tp, regs, this_cpu);
 
         smp_fetch_global_regs();
 
         for_each_online_cpu(cpu) {
-                struct global_reg_snapshot *gp = &global_cpu_snapshot[cpu].reg;
+                struct global_reg_snapshot *gp;
+
+                if (!include_self && cpu == this_cpu)
+                        continue;
+
+                gp = &global_cpu_snapshot[cpu].reg;
 
                 __global_reg_poll(gp);
 
@@ -292,7 +298,7 @@ void arch_trigger_all_cpu_backtrace(void)
 
 static void sysrq_handle_globreg(int key)
 {
-        arch_trigger_all_cpu_backtrace();
+        arch_trigger_all_cpu_backtrace(true);
 }
 
 static struct sysrq_key_op sparc_globalreg_op = {
diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
index cb6cfcd034cf..a80cbb88ea91 100644
--- a/arch/x86/include/asm/irq.h
+++ b/arch/x86/include/asm/irq.h
@@ -43,7 +43,7 @@ extern int vector_used_by_percpu_irq(unsigned int vector);
 extern void init_ISA_irqs(void);
 
 #ifdef CONFIG_X86_LOCAL_APIC
-void arch_trigger_all_cpu_backtrace(void);
+void arch_trigger_all_cpu_backtrace(bool);
 #define arch_trigger_all_cpu_backtrace arch_trigger_all_cpu_backtrace
 #endif
 
diff --git a/arch/x86/kernel/apic/hw_nmi.c b/arch/x86/kernel/apic/hw_nmi.c
index c3fcb5de5083..6a1e71bde323 100644
--- a/arch/x86/kernel/apic/hw_nmi.c
+++ b/arch/x86/kernel/apic/hw_nmi.c
@@ -33,31 +33,41 @@ static DECLARE_BITMAP(backtrace_mask, NR_CPUS) __read_mostly;
 /* "in progress" flag of arch_trigger_all_cpu_backtrace */
 static unsigned long backtrace_flag;
 
-void arch_trigger_all_cpu_backtrace(void)
+void arch_trigger_all_cpu_backtrace(bool include_self)
 {
         int i;
+        int cpu = get_cpu();
 
-        if (test_and_set_bit(0, &backtrace_flag))
+        if (test_and_set_bit(0, &backtrace_flag)) {
                 /*
                  * If there is already a trigger_all_cpu_backtrace() in progress
                  * (backtrace_flag == 1), don't output double cpu dump infos.
                  */
+                put_cpu();
                 return;
+        }
 
         cpumask_copy(to_cpumask(backtrace_mask), cpu_online_mask);
+        if (!include_self)
+                cpumask_clear_cpu(cpu, to_cpumask(backtrace_mask));
 
-        printk(KERN_INFO "sending NMI to all CPUs:\n");
-        apic->send_IPI_all(NMI_VECTOR);
+        if (!cpumask_empty(to_cpumask(backtrace_mask))) {
+                pr_info("sending NMI to %s CPUs:\n",
+                        (include_self ? "all" : "other"));
+                apic->send_IPI_mask(to_cpumask(backtrace_mask), NMI_VECTOR);
+        }
 
         /* Wait for up to 10 seconds for all CPUs to do the backtrace */
         for (i = 0; i < 10 * 1000; i++) {
                 if (cpumask_empty(to_cpumask(backtrace_mask)))
                         break;
                 mdelay(1);
+                touch_softlockup_watchdog();
         }
 
         clear_bit(0, &backtrace_flag);
         smp_mb__after_atomic();
+        put_cpu();
 }
 
 static int
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index f0da82b8e634..dbaa23e78b36 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -423,9 +423,10 @@ sysenter_past_esp:
         jnz sysenter_audit
 sysenter_do_call:
         cmpl $(NR_syscalls), %eax
-        jae syscall_badsys
+        jae sysenter_badsys
         call *sys_call_table(,%eax,4)
         movl %eax,PT_EAX(%esp)
+sysenter_after_call:
         LOCKDEP_SYS_EXIT
         DISABLE_INTERRUPTS(CLBR_ANY)
         TRACE_IRQS_OFF
@@ -675,7 +676,12 @@ END(syscall_fault)
 
 syscall_badsys:
         movl $-ENOSYS,PT_EAX(%esp)
-        jmp resume_userspace
+        jmp syscall_exit
+END(syscall_badsys)
+
+sysenter_badsys:
+        movl $-ENOSYS,PT_EAX(%esp)
+        jmp sysenter_after_call
 END(syscall_badsys)
         CFI_ENDPROC
 
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index a0da58db43a8..2851d63c1202 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -363,7 +363,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
 
                 /* Set up to return from userspace.  */
                 restorer = current->mm->context.vdso +
-                        selected_vdso32->sym___kernel_sigreturn;
+                        selected_vdso32->sym___kernel_rt_sigreturn;
                 if (ksig->ka.sa.sa_flags & SA_RESTORER)
                         restorer = ksig->ka.sa.sa_restorer;
                 put_user_ex(restorer, &frame->pretcode);
diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
index 3c0809a0631f..61b04fe36e66 100644
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -11,7 +11,6 @@ VDSO32-$(CONFIG_COMPAT)		:= y
 
 # files to link into the vdso
 vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o vdso-fakesections.o
-vobjs-nox32 := vdso-fakesections.o
 
 # files to link into kernel
 obj-y                           += vma.o
@@ -67,7 +66,8 @@ $(obj)/vdso-image-%.c: $(obj)/vdso%.so.dbg $(obj)/vdso2c FORCE
 #
 CFL := $(PROFILING) -mcmodel=small -fPIC -O2 -fasynchronous-unwind-tables -m64 \
        $(filter -g%,$(KBUILD_CFLAGS)) $(call cc-option, -fno-stack-protector) \
-       -fno-omit-frame-pointer -foptimize-sibling-calls
+       -fno-omit-frame-pointer -foptimize-sibling-calls \
+       -DDISABLE_BRANCH_PROFILING
 
 $(vobjs): KBUILD_CFLAGS += $(CFL)
 
@@ -134,7 +134,7 @@ override obj-dirs = $(dir $(obj)) $(obj)/vdso32/
 
 targets += vdso32/vdso32.lds
 targets += vdso32/note.o vdso32/vclock_gettime.o $(vdso32.so-y:%=vdso32/%.o)
-targets += vdso32/vclock_gettime.o
+targets += vdso32/vclock_gettime.o vdso32/vdso-fakesections.o
 
 $(obj)/vdso32.o: $(vdso32-images:%=$(obj)/%)
 
@@ -150,11 +150,13 @@ KBUILD_CFLAGS_32 += -m32 -msoft-float -mregparm=0 -fpic
 KBUILD_CFLAGS_32 += $(call cc-option, -fno-stack-protector)
 KBUILD_CFLAGS_32 += $(call cc-option, -foptimize-sibling-calls)
 KBUILD_CFLAGS_32 += -fno-omit-frame-pointer
+KBUILD_CFLAGS_32 += -DDISABLE_BRANCH_PROFILING
 $(vdso32-images:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
 
 $(vdso32-images:%=$(obj)/%.dbg): $(obj)/vdso32-%.so.dbg: FORCE \
                                  $(obj)/vdso32/vdso32.lds \
                                  $(obj)/vdso32/vclock_gettime.o \
+                                 $(obj)/vdso32/vdso-fakesections.o \
                                  $(obj)/vdso32/note.o \
                                  $(obj)/vdso32/%.o
         $(call if_changed,vdso)
@@ -169,14 +171,24 @@ quiet_cmd_vdso = VDSO    $@
                  sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
 
 VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) \
-        -Wl,-Bsymbolic $(LTO_CFLAGS)
+        $(call cc-ldoption, -Wl$(comma)--build-id) -Wl,-Bsymbolic $(LTO_CFLAGS)
 GCOV_PROFILE := n
 
 #
-# Install the unstripped copies of vdso*.so.
+# Install the unstripped copies of vdso*.so.  If our toolchain supports
+# build-id, install .build-id links as well.
 #
 quiet_cmd_vdso_install = INSTALL $(@:install_%=%)
-      cmd_vdso_install = cp $< $(MODLIB)/vdso/$(@:install_%=%)
+define cmd_vdso_install
+        cp $< "$(MODLIB)/vdso/$(@:install_%=%)"; \
+        if readelf -n $< |grep -q 'Build ID'; then \
+          buildid=`readelf -n $< |grep 'Build ID' |sed -e 's/^.*Build ID: \(.*\)$$/\1/'`; \
+          first=`echo $$buildid | cut -b-2`; \
+          last=`echo $$buildid | cut -b3-`; \
+          mkdir -p "$(MODLIB)/vdso/.build-id/$$first"; \
+          ln -sf "../../$(@:install_%=%)" "$(MODLIB)/vdso/.build-id/$$first/$$last.debug"; \
+        fi
+endef
 
 vdso_img_insttargets := $(vdso_img_sodbg:%.dbg=install_%)
 
diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
index b2e4f493e5b0..9793322751e0 100644
--- a/arch/x86/vdso/vclock_gettime.c
+++ b/arch/x86/vdso/vclock_gettime.c
@@ -11,9 +11,6 @@
  * Check with readelf after changing.
  */
 
-/* Disable profiling for userspace code: */
-#define DISABLE_BRANCH_PROFILING
-
 #include <uapi/linux/time.h>
 #include <asm/vgtod.h>
 #include <asm/hpet.h>
diff --git a/arch/x86/vdso/vdso-fakesections.c b/arch/x86/vdso/vdso-fakesections.c
index cb8a8d72c24b..aa5fbfab20a5 100644
--- a/arch/x86/vdso/vdso-fakesections.c
+++ b/arch/x86/vdso/vdso-fakesections.c
@@ -2,31 +2,20 @@
  * Copyright 2014 Andy Lutomirski
  * Subject to the GNU Public License, v.2
  *
- * Hack to keep broken Go programs working.
- *
- * The Go runtime had a couple of bugs: it would read the section table to try
- * to figure out how many dynamic symbols there were (it shouldn't have looked
- * at the section table at all) and, if there were no SHT_SYNDYM section table
- * entry, it would use an uninitialized value for the number of symbols.  As a
- * workaround, we supply a minimal section table.  vdso2c will adjust the
- * in-memory image so that "vdso_fake_sections" becomes the section table.
- *
- * The bug was introduced by:
- * https://code.google.com/p/go/source/detail?r=56ea40aac72b (2012-08-31)
- * and is being addressed in the Go runtime in this issue:
- * https://code.google.com/p/go/issues/detail?id=8197
+ * String table for loadable section headers.  See vdso2c.h for why
+ * this exists.
  */
 
-#ifndef __x86_64__
-#error This hack is specific to the 64-bit vDSO
-#endif
-
-#include <linux/elf.h>
-
-extern const __visible struct elf64_shdr vdso_fake_sections[];
-const __visible struct elf64_shdr vdso_fake_sections[] = {
-        {
-                .sh_type = SHT_DYNSYM,
-                .sh_entsize = sizeof(Elf64_Sym),
-        }
-};
+const char fake_shstrtab[] __attribute__((section(".fake_shstrtab"))) =
+        ".hash\0"
+        ".dynsym\0"
+        ".dynstr\0"
+        ".gnu.version\0"
+        ".gnu.version_d\0"
+        ".dynamic\0"
+        ".rodata\0"
+        ".fake_shstrtab\0"  /* Yay, self-referential code. */
+        ".note\0"
+        ".eh_frame_hdr\0"
+        ".eh_frame\0"
+        ".text";
diff --git a/arch/x86/vdso/vdso-layout.lds.S b/arch/x86/vdso/vdso-layout.lds.S
index 2ec72f651ebf..9197544eea9a 100644
--- a/arch/x86/vdso/vdso-layout.lds.S
+++ b/arch/x86/vdso/vdso-layout.lds.S
@@ -6,6 +6,16 @@
  * This script controls its layout.
  */
 
+#if defined(BUILD_VDSO64)
+# define SHDR_SIZE 64
+#elif defined(BUILD_VDSO32) || defined(BUILD_VDSOX32)
+# define SHDR_SIZE 40
+#else
+# error unknown VDSO target
+#endif
+
+#define NUM_FAKE_SHDRS 13
+
 SECTIONS
 {
         . = SIZEOF_HEADERS;
@@ -18,36 +28,53 @@ SECTIONS
         .gnu.version_d  : { *(.gnu.version_d) }
         .gnu.version_r  : { *(.gnu.version_r) }
 
+        .dynamic        : { *(.dynamic) }               :text   :dynamic
+
+        .rodata         : {
+                *(.rodata*)
+                *(.data*)
+                *(.sdata*)
+                *(.got.plt) *(.got)
+                *(.gnu.linkonce.d.*)
+                *(.bss*)
+                *(.dynbss*)
+                *(.gnu.linkonce.b.*)
+
+                /*
+                 * Ideally this would live in a C file, but that won't
+                 * work cleanly for x32 until we start building the x32
+                 * C code using an x32 toolchain.
+                 */
+                VDSO_FAKE_SECTION_TABLE_START = .;
+                . = . + NUM_FAKE_SHDRS * SHDR_SIZE;
+                VDSO_FAKE_SECTION_TABLE_END = .;
+        }                                               :text
+
+        .fake_shstrtab  : { *(.fake_shstrtab) }         :text
+
+
         .note           : { *(.note.*) }                :text   :note
 
         .eh_frame_hdr   : { *(.eh_frame_hdr) }          :text   :eh_frame_hdr
         .eh_frame       : { KEEP (*(.eh_frame)) }       :text
 
-        .dynamic        : { *(.dynamic) }               :text   :dynamic
-
-        .rodata         : { *(.rodata*) }               :text
-        .data           : {
-              *(.data*)
-              *(.sdata*)
-              *(.got.plt) *(.got)
-              *(.gnu.linkonce.d.*)
-              *(.bss*)
-              *(.dynbss*)
-              *(.gnu.linkonce.b.*)
-        }
-
-        .altinstructions        : { *(.altinstructions) }
-        .altinstr_replacement   : { *(.altinstr_replacement) }
 
         /*
-         * Align the actual code well away from the non-instruction data.
-         * This is the best thing for the I-cache.
+         * Text is well-separated from actual data: there's plenty of
+         * stuff that isn't used at runtime in between.
          */
-        . = ALIGN(0x100);
 
         .text           : { *(.text*) }                 :text   =0x90909090,
 
         /*
+         * At the end so that eu-elflint stays happy when vdso2c strips
+         * these.  A better implementation would avoid allocating space
+         * for these.
+         */
+        .altinstructions        : { *(.altinstructions) }       :text
+        .altinstr_replacement   : { *(.altinstr_replacement) }  :text
+
+        /*
          * The remainder of the vDSO consists of special pages that are
          * shared between the kernel and userspace.  It needs to be at the
          * end so that it doesn't overlap the mapping of the actual
@@ -75,6 +102,7 @@ SECTIONS
         /DISCARD/ : {
                 *(.discard)
                 *(.discard.*)
+                *(__bug_table)
         }
 }
 
diff --git a/arch/x86/vdso/vdso.lds.S b/arch/x86/vdso/vdso.lds.S
index 75e3404c83b1..6807932643c2 100644
--- a/arch/x86/vdso/vdso.lds.S
+++ b/arch/x86/vdso/vdso.lds.S
@@ -6,6 +6,8 @@
  * the DSO.
  */
 
+#define BUILD_VDSO64
+
 #include "vdso-layout.lds.S"
 
 /*
diff --git a/arch/x86/vdso/vdso2c.c b/arch/x86/vdso/vdso2c.c
index 7a6bf50f9165..238dbe82776e 100644
--- a/arch/x86/vdso/vdso2c.c
+++ b/arch/x86/vdso/vdso2c.c
@@ -23,6 +23,8 @@ enum {
         sym_vvar_page,
         sym_hpet_page,
         sym_end_mapping,
+        sym_VDSO_FAKE_SECTION_TABLE_START,
+        sym_VDSO_FAKE_SECTION_TABLE_END,
 };
 
 const int special_pages[] = {
@@ -30,15 +32,26 @@ const int special_pages[] = {
         sym_hpet_page,
 };
 
-char const * const required_syms[] = {
-        [sym_vvar_page] = "vvar_page",
-        [sym_hpet_page] = "hpet_page",
-        [sym_end_mapping] = "end_mapping",
-        "VDSO32_NOTE_MASK",
-        "VDSO32_SYSENTER_RETURN",
-        "__kernel_vsyscall",
-        "__kernel_sigreturn",
-        "__kernel_rt_sigreturn",
+struct vdso_sym {
+        const char *name;
+        bool export;
+};
+
+struct vdso_sym required_syms[] = {
+        [sym_vvar_page] = {"vvar_page", true},
+        [sym_hpet_page] = {"hpet_page", true},
+        [sym_end_mapping] = {"end_mapping", true},
+        [sym_VDSO_FAKE_SECTION_TABLE_START] = {
+                "VDSO_FAKE_SECTION_TABLE_START", false
+        },
+        [sym_VDSO_FAKE_SECTION_TABLE_END] = {
+                "VDSO_FAKE_SECTION_TABLE_END", false
+        },
+        {"VDSO32_NOTE_MASK", true},
+        {"VDSO32_SYSENTER_RETURN", true},
+        {"__kernel_vsyscall", true},
+        {"__kernel_sigreturn", true},
+        {"__kernel_rt_sigreturn", true},
 };
 
 __attribute__((format(printf, 1, 2))) __attribute__((noreturn))
@@ -83,37 +96,21 @@ extern void bad_put_le(void);
 
 #define NSYMS (sizeof(required_syms) / sizeof(required_syms[0]))
 
-#define BITS 64
-#define GOFUNC go64
-#define Elf_Ehdr Elf64_Ehdr
-#define Elf_Shdr Elf64_Shdr
-#define Elf_Phdr Elf64_Phdr
-#define Elf_Sym Elf64_Sym
-#define Elf_Dyn Elf64_Dyn
+#define BITSFUNC3(name, bits) name##bits
+#define BITSFUNC2(name, bits) BITSFUNC3(name, bits)
+#define BITSFUNC(name) BITSFUNC2(name, ELF_BITS)
+
+#define ELF_BITS_XFORM2(bits, x) Elf##bits##_##x
+#define ELF_BITS_XFORM(bits, x) ELF_BITS_XFORM2(bits, x)
+#define ELF(x) ELF_BITS_XFORM(ELF_BITS, x)
+
+#define ELF_BITS 64
 #include "vdso2c.h"
-#undef BITS
-#undef GOFUNC
-#undef Elf_Ehdr
-#undef Elf_Shdr
-#undef Elf_Phdr
-#undef Elf_Sym
-#undef Elf_Dyn
-
-#define BITS 32
-#define GOFUNC go32
-#define Elf_Ehdr Elf32_Ehdr
-#define Elf_Shdr Elf32_Shdr
-#define Elf_Phdr Elf32_Phdr
-#define Elf_Sym Elf32_Sym
-#define Elf_Dyn Elf32_Dyn
+#undef ELF_BITS
+
+#define ELF_BITS 32
 #include "vdso2c.h"
-#undef BITS
-#undef GOFUNC
-#undef Elf_Ehdr
-#undef Elf_Shdr
-#undef Elf_Phdr
-#undef Elf_Sym
-#undef Elf_Dyn
+#undef ELF_BITS
 
 static void go(void *addr, size_t len, FILE *outfile, const char *name)
 {
diff --git a/arch/x86/vdso/vdso2c.h b/arch/x86/vdso/vdso2c.h
index c6eefaf389b9..df95a2fdff73 100644
--- a/arch/x86/vdso/vdso2c.h
+++ b/arch/x86/vdso/vdso2c.h
@@ -4,23 +4,136 @@
  * are built for 32-bit userspace.
  */
 
-static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
+/*
+ * We're writing a section table for a few reasons:
+ *
+ * The Go runtime had a couple of bugs: it would read the section
+ * table to try to figure out how many dynamic symbols there were (it
+ * shouldn't have looked at the section table at all) and, if there
+ * were no SHT_SYNDYM section table entry, it would use an
+ * uninitialized value for the number of symbols.  An empty DYNSYM
+ * table would work, but I see no reason not to write a valid one (and
+ * keep full performance for old Go programs).  This hack is only
+ * needed on x86_64.
+ *
+ * The bug was introduced on 2012-08-31 by:
+ * https://code.google.com/p/go/source/detail?r=56ea40aac72b
+ * and was fixed on 2014-06-13 by:
+ * https://code.google.com/p/go/source/detail?r=fc1cd5e12595
+ *
+ * Binutils has issues debugging the vDSO: it reads the section table to
+ * find SHT_NOTE; it won't look at PT_NOTE for the in-memory vDSO, which
+ * would break build-id if we removed the section table.  Binutils
+ * also requires that shstrndx != 0.  See:
+ * https://sourceware.org/bugzilla/show_bug.cgi?id=17064
+ *
+ * elfutils might not look for PT_NOTE if there is a section table at
+ * all.  I don't know whether this matters for any practical purpose.
+ *
+ * For simplicity, rather than hacking up a partial section table, we
+ * just write a mostly complete one.  We omit non-dynamic symbols,
+ * though, since they're rather large.
+ *
+ * Once binutils gets fixed, we might be able to drop this for all but
+ * the 64-bit vdso, since build-id only works in kernel RPMs, and
+ * systems that update to new enough kernel RPMs will likely update
+ * binutils in sync.  build-id has never worked for home-built kernel
+ * RPMs without manual symlinking, and I suspect that no one ever does
+ * that.
+ */
+struct BITSFUNC(fake_sections)
+{
+        ELF(Shdr) *table;
+        unsigned long table_offset;
+        int count, max_count;
+
+        int in_shstrndx;
+        unsigned long shstr_offset;
+        const char *shstrtab;
+        size_t shstrtab_len;
+
+        int out_shstrndx;
+};
+
+static unsigned int BITSFUNC(find_shname)(struct BITSFUNC(fake_sections) *out,
+                                          const char *name)
+{
+        const char *outname = out->shstrtab;
+        while (outname - out->shstrtab < out->shstrtab_len) {
+                if (!strcmp(name, outname))
+                        return (outname - out->shstrtab) + out->shstr_offset;
+                outname += strlen(outname) + 1;
+        }
+
+        if (*name)
+                printf("Warning: could not find output name \"%s\"\n", name);
+        return out->shstr_offset + out->shstrtab_len - 1;  /* Use a null. */
+}
+
+static void BITSFUNC(init_sections)(struct BITSFUNC(fake_sections) *out)
+{
+        if (!out->in_shstrndx)
+                fail("didn't find the fake shstrndx\n");
+
+        memset(out->table, 0, out->max_count * sizeof(ELF(Shdr)));
+
+        if (out->max_count < 1)
+                fail("we need at least two fake output sections\n");
+
+        PUT_LE(&out->table[0].sh_type, SHT_NULL);
+        PUT_LE(&out->table[0].sh_name, BITSFUNC(find_shname)(out, ""));
+
+        out->count = 1;
+}
+
+static void BITSFUNC(copy_section)(struct BITSFUNC(fake_sections) *out,
+                                   int in_idx, const ELF(Shdr) *in,
+                                   const char *name)
+{
+        uint64_t flags = GET_LE(&in->sh_flags);
+
+        bool copy = flags & SHF_ALLOC &&
+                strcmp(name, ".altinstructions") &&
+                strcmp(name, ".altinstr_replacement");
+
+        if (!copy)
+                return;
+
+        if (out->count >= out->max_count)
+                fail("too many copied sections (max = %d)\n", out->max_count);
+
+        if (in_idx == out->in_shstrndx)
+                out->out_shstrndx = out->count;
+
+        out->table[out->count] = *in;
+        PUT_LE(&out->table[out->count].sh_name,
+               BITSFUNC(find_shname)(out, name));
+
+        /* elfutils requires that a strtab have the correct type. */
+        if (!strcmp(name, ".fake_shstrtab"))
+                PUT_LE(&out->table[out->count].sh_type, SHT_STRTAB);
+
+        out->count++;
+}
+
+static void BITSFUNC(go)(void *addr, size_t len,
+                         FILE *outfile, const char *name)
 {
         int found_load = 0;
         unsigned long load_size = -1;  /* Work around bogus warning */
         unsigned long data_size;
-        Elf_Ehdr *hdr = (Elf_Ehdr *)addr;
+        ELF(Ehdr) *hdr = (ELF(Ehdr) *)addr;
         int i;
         unsigned long j;
-        Elf_Shdr *symtab_hdr = NULL, *strtab_hdr, *secstrings_hdr,
+        ELF(Shdr) *symtab_hdr = NULL, *strtab_hdr, *secstrings_hdr,
                 *alt_sec = NULL;
-        Elf_Dyn *dyn = 0, *dyn_end = 0;
+        ELF(Dyn) *dyn = 0, *dyn_end = 0;
         const char *secstrings;
         uint64_t syms[NSYMS] = {};
 
-        uint64_t fake_sections_value = 0, fake_sections_size = 0;
+        struct BITSFUNC(fake_sections) fake_sections = {};
 
-        Elf_Phdr *pt = (Elf_Phdr *)(addr + GET_LE(&hdr->e_phoff));
+        ELF(Phdr) *pt = (ELF(Phdr) *)(addr + GET_LE(&hdr->e_phoff));
 
         /* Walk the segment table. */
         for (i = 0; i < GET_LE(&hdr->e_phnum); i++) {
@@ -51,7 +164,7 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
         for (i = 0; dyn + i < dyn_end &&
                      GET_LE(&dyn[i].d_tag) != DT_NULL; i++) {
                 typeof(dyn[i].d_tag) tag = GET_LE(&dyn[i].d_tag);
-                if (tag == DT_REL || tag == DT_RELSZ ||
+                if (tag == DT_REL || tag == DT_RELSZ || tag == DT_RELA ||
                     tag == DT_RELENT || tag == DT_TEXTREL)
                         fail("vdso image contains dynamic relocations\n");
         }
@@ -61,7 +174,7 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
                 GET_LE(&hdr->e_shentsize)*GET_LE(&hdr->e_shstrndx);
         secstrings = addr + GET_LE(&secstrings_hdr->sh_offset);
         for (i = 0; i < GET_LE(&hdr->e_shnum); i++) {
-                Elf_Shdr *sh = addr + GET_LE(&hdr->e_shoff) +
+                ELF(Shdr) *sh = addr + GET_LE(&hdr->e_shoff) +
                         GET_LE(&hdr->e_shentsize) * i;
                 if (GET_LE(&sh->sh_type) == SHT_SYMTAB)
                         symtab_hdr = sh;
@@ -82,29 +195,63 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
              i < GET_LE(&symtab_hdr->sh_size) / GET_LE(&symtab_hdr->sh_entsize);
              i++) {
                 int k;
-                Elf_Sym *sym = addr + GET_LE(&symtab_hdr->sh_offset) +
+                ELF(Sym) *sym = addr + GET_LE(&symtab_hdr->sh_offset) +
                         GET_LE(&symtab_hdr->sh_entsize) * i;
                 const char *name = addr + GET_LE(&strtab_hdr->sh_offset) +
                         GET_LE(&sym->st_name);
 
                 for (k = 0; k < NSYMS; k++) {
-                        if (!strcmp(name, required_syms[k])) {
+                        if (!strcmp(name, required_syms[k].name)) {
                                 if (syms[k]) {
                                         fail("duplicate symbol %s\n",
-                                             required_syms[k]);
+                                             required_syms[k].name);
                                 }
                                 syms[k] = GET_LE(&sym->st_value);
                         }
                 }
 
-                if (!strcmp(name, "vdso_fake_sections")) {
-                        if (fake_sections_value)
-                                fail("duplicate vdso_fake_sections\n");
-                        fake_sections_value = GET_LE(&sym->st_value);
-                        fake_sections_size = GET_LE(&sym->st_size);
+                if (!strcmp(name, "fake_shstrtab")) {
+                        ELF(Shdr) *sh;
+
+                        fake_sections.in_shstrndx = GET_LE(&sym->st_shndx);
+                        fake_sections.shstrtab = addr + GET_LE(&sym->st_value);
+                        fake_sections.shstrtab_len = GET_LE(&sym->st_size);
+                        sh = addr + GET_LE(&hdr->e_shoff) +
+                                GET_LE(&hdr->e_shentsize) *
+                                fake_sections.in_shstrndx;
+                        fake_sections.shstr_offset = GET_LE(&sym->st_value) -
+                                GET_LE(&sh->sh_addr);
                 }
         }
 
+        /* Build the output section table. */
+        if (!syms[sym_VDSO_FAKE_SECTION_TABLE_START] ||
+            !syms[sym_VDSO_FAKE_SECTION_TABLE_END])
+                fail("couldn't find fake section table\n");
+        if ((syms[sym_VDSO_FAKE_SECTION_TABLE_END] -
+             syms[sym_VDSO_FAKE_SECTION_TABLE_START]) % sizeof(ELF(Shdr)))
+                fail("fake section table size isn't a multiple of sizeof(Shdr)\n");
+        fake_sections.table = addr + syms[sym_VDSO_FAKE_SECTION_TABLE_START];
+        fake_sections.table_offset = syms[sym_VDSO_FAKE_SECTION_TABLE_START];
+        fake_sections.max_count = (syms[sym_VDSO_FAKE_SECTION_TABLE_END] -
+                                   syms[sym_VDSO_FAKE_SECTION_TABLE_START]) /
+                sizeof(ELF(Shdr));
+
+        BITSFUNC(init_sections)(&fake_sections);
+        for (i = 0; i < GET_LE(&hdr->e_shnum); i++) {
+                ELF(Shdr) *sh = addr + GET_LE(&hdr->e_shoff) +
+                        GET_LE(&hdr->e_shentsize) * i;
+                BITSFUNC(copy_section)(&fake_sections, i, sh,
+                                       secstrings + GET_LE(&sh->sh_name));
+        }
+        if (!fake_sections.out_shstrndx)
+                fail("didn't generate shstrndx?!?\n");
+
+        PUT_LE(&hdr->e_shoff, fake_sections.table_offset);
+        PUT_LE(&hdr->e_shentsize, sizeof(ELF(Shdr)));
+        PUT_LE(&hdr->e_shnum, fake_sections.count);
+        PUT_LE(&hdr->e_shstrndx, fake_sections.out_shstrndx);
+
         /* Validate mapping addresses. */
         for (i = 0; i < sizeof(special_pages) / sizeof(special_pages[0]); i++) {
                 if (!syms[i])
@@ -112,25 +259,17 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
 
                 if (syms[i] % 4096)
                         fail("%s must be a multiple of 4096\n",
-                             required_syms[i]);
+                             required_syms[i].name);
                 if (syms[i] < data_size)
                         fail("%s must be after the text mapping\n",
-                             required_syms[i]);
+                             required_syms[i].name);
                 if (syms[sym_end_mapping] < syms[i] + 4096)
-                        fail("%s overruns end_mapping\n", required_syms[i]);
+                        fail("%s overruns end_mapping\n",
+                             required_syms[i].name);
         }
         if (syms[sym_end_mapping] % 4096)
                 fail("end_mapping must be a multiple of 4096\n");
 
-        /* Remove sections or use fakes */
-        if (fake_sections_size % sizeof(Elf_Shdr))
-                fail("vdso_fake_sections size is not a multiple of %ld\n",
-                     (long)sizeof(Elf_Shdr));
-        PUT_LE(&hdr->e_shoff, fake_sections_value);
-        PUT_LE(&hdr->e_shentsize, fake_sections_value ? sizeof(Elf_Shdr) : 0);
-        PUT_LE(&hdr->e_shnum, fake_sections_size / sizeof(Elf_Shdr));
-        PUT_LE(&hdr->e_shstrndx, SHN_UNDEF);
-
         if (!name) {
                 fwrite(addr, load_size, 1, outfile);
                 return;
@@ -168,9 +307,9 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
                         (unsigned long)GET_LE(&alt_sec->sh_size));
         }
         for (i = 0; i < NSYMS; i++) {
-                if (syms[i])
+                if (required_syms[i].export && syms[i])
                         fprintf(outfile, "\t.sym_%s = 0x%" PRIx64 ",\n",
-                                required_syms[i], syms[i]);
+                                required_syms[i].name, syms[i]);
         }
         fprintf(outfile, "};\n");
 }
diff --git a/arch/x86/vdso/vdso32/vdso-fakesections.c b/arch/x86/vdso/vdso32/vdso-fakesections.c
new file mode 100644
index 000000000000..541468e25265
--- /dev/null
+++ b/arch/x86/vdso/vdso32/vdso-fakesections.c
@@ -0,0 +1 @@
+#include "../vdso-fakesections.c"
diff --git a/arch/x86/vdso/vdsox32.lds.S b/arch/x86/vdso/vdsox32.lds.S
index 46b991b578a8..697c11ece90c 100644
--- a/arch/x86/vdso/vdsox32.lds.S
+++ b/arch/x86/vdso/vdsox32.lds.S
@@ -6,6 +6,8 @@
  * the DSO.
  */
 
+#define BUILD_VDSOX32
+
 #include "vdso-layout.lds.S"
 
 /*
diff --git a/block/bio.c b/block/bio.c
index 8c2e55e39a1b..0ec61c9e536c 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -746,6 +746,14 @@ static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
 
                         goto done;
                 }
+
+                /*
+                 * If the queue doesn't support SG gaps and adding this
+                 * offset would create a gap, disallow it.
+                 */
+                if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS) &&
+                    bvec_gap_to_prev(prev, offset))
+                        return 0;
         }
 
         if (bio->bi_vcnt >= bio->bi_max_vecs)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 069bc202ffe3..b9f4cc494ece 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -80,7 +80,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q,
         blkg->q = q;
         INIT_LIST_HEAD(&blkg->q_node);
         blkg->blkcg = blkcg;
-        blkg->refcnt = 1;
+        atomic_set(&blkg->refcnt, 1);
 
         /* root blkg uses @q->root_rl, init rl only for !root blkgs */
         if (blkcg != &blkcg_root) {
@@ -399,11 +399,8 @@ void __blkg_release_rcu(struct rcu_head *rcu_head)
 
         /* release the blkcg and parent blkg refs this blkg has been holding */
         css_put(&blkg->blkcg->css);
-        if (blkg->parent) {
-                spin_lock_irq(blkg->q->queue_lock);
+        if (blkg->parent)
                 blkg_put(blkg->parent);
-                spin_unlock_irq(blkg->q->queue_lock);
-        }
 
         blkg_free(blkg);
 }
@@ -1093,7 +1090,7 @@ EXPORT_SYMBOL_GPL(blkcg_deactivate_policy);
  * Register @pol with blkcg core.  Might sleep and @pol may be modified on
  * successful registration.  Returns 0 on success and -errno on failure.
  */
-int __init blkcg_policy_register(struct blkcg_policy *pol)
+int blkcg_policy_register(struct blkcg_policy *pol)
 {
         int i, ret;
 
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index cbb7f943f78a..d3fd7aa3d2a3 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -18,6 +18,7 @@
 #include <linux/seq_file.h>
 #include <linux/radix-tree.h>
 #include <linux/blkdev.h>
+#include <linux/atomic.h>
 
 /* Max limits for throttle policy */
 #define THROTL_IOPS_MAX         UINT_MAX
@@ -104,7 +105,7 @@ struct blkcg_gq {
         struct request_list             rl;
 
         /* reference count */
-        int                             refcnt;
+        atomic_t                        refcnt;
 
         /* is this blkg online? protected by both blkcg and q locks */
         bool                            online;
@@ -145,7 +146,7 @@ void blkcg_drain_queue(struct request_queue *q);
 void blkcg_exit_queue(struct request_queue *q);
 
 /* Blkio controller policy registration */
-int __init blkcg_policy_register(struct blkcg_policy *pol);
+int blkcg_policy_register(struct blkcg_policy *pol);
 void blkcg_policy_unregister(struct blkcg_policy *pol);
 int blkcg_activate_policy(struct request_queue *q,
                           const struct blkcg_policy *pol);
@@ -257,13 +258,12 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen)
  * blkg_get - get a blkg reference
  * @blkg: blkg to get
  *
- * The caller should be holding queue_lock and an existing reference.
+ * The caller should be holding an existing reference.
  */
 static inline void blkg_get(struct blkcg_gq *blkg)
 {
-        lockdep_assert_held(blkg->q->queue_lock);
-        WARN_ON_ONCE(!blkg->refcnt);
-        blkg->refcnt++;
+        WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
+        atomic_inc(&blkg->refcnt);
 }
 
 void __blkg_release_rcu(struct rcu_head *rcu);
@@ -271,14 +271,11 @@ void __blkg_release_rcu(struct rcu_head *rcu);
 /**
  * blkg_put - put a blkg reference
  * @blkg: blkg to put
- *
- * The caller should be holding queue_lock.
  */
 static inline void blkg_put(struct blkcg_gq *blkg)
 {
-        lockdep_assert_held(blkg->q->queue_lock);
-        WARN_ON_ONCE(blkg->refcnt <= 0);
-        if (!--blkg->refcnt)
+        WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
+        if (atomic_dec_and_test(&blkg->refcnt))
                 call_rcu(&blkg->rcu_head, __blkg_release_rcu);
 }
 
@@ -580,7 +577,7 @@ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, void *key) { ret
 static inline int blkcg_init_queue(struct request_queue *q) { return 0; }
 static inline void blkcg_drain_queue(struct request_queue *q) { }
 static inline void blkcg_exit_queue(struct request_queue *q) { }
-static inline int __init blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
+static inline int blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
 static inline void blkcg_policy_unregister(struct blkcg_policy *pol) { }
 static inline int blkcg_activate_policy(struct request_queue *q,
                                         const struct blkcg_policy *pol) { return 0; }
diff --git a/block/blk-merge.c b/block/blk-merge.c
index b3bf0df0f4c2..54535831f1e1 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -568,6 +568,8 @@ int blk_attempt_req_merge(struct request_queue *q, struct request *rq,
 
 bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
 {
+        struct request_queue *q = rq->q;
+
         if (!rq_mergeable(rq) || !bio_mergeable(bio))
                 return false;
 
@@ -591,6 +593,14 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
             !blk_write_same_mergeable(rq->bio, bio))
                 return false;
 
+        if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
+                struct bio_vec *bprev;
+
+                bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
+                if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
+                        return false;
+        }
+
         return true;
 }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 0ef2dc7f01bf..ad69ef657e85 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -878,7 +878,7 @@ void blk_mq_start_hw_queue(struct blk_mq_hw_ctx *hctx)
         clear_bit(BLK_MQ_S_STOPPED, &hctx->state);
 
         preempt_disable();
-        __blk_mq_run_hw_queue(hctx);
+        blk_mq_run_hw_queue(hctx, false);
         preempt_enable();
 }
 EXPORT_SYMBOL(blk_mq_start_hw_queue);
diff --git a/block/elevator.c b/block/elevator.c
index 34bded18910e..24c28b659bb3 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -825,7 +825,7 @@ void elv_unregister_queue(struct request_queue *q)
 }
 EXPORT_SYMBOL(elv_unregister_queue);
 
-int __init elv_register(struct elevator_type *e)
+int elv_register(struct elevator_type *e)
 {
         char *def = "";
 
diff --git a/crypto/Kconfig b/crypto/Kconfig
index ce4012a58781..749b1e05c490 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -540,6 +540,17 @@ config CRYPTO_SHA1_ARM
           SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
           using optimized ARM assembler.
 
+config CRYPTO_SHA1_ARM_NEON
+        tristate "SHA1 digest algorithm (ARM NEON)"
+        depends on ARM && KERNEL_MODE_NEON && !CPU_BIG_ENDIAN
+        select CRYPTO_SHA1_ARM
+        select CRYPTO_SHA1
+        select CRYPTO_HASH
+        help
+          SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
+          using optimized ARM NEON assembly, when NEON instructions are
+          available.
+
 config CRYPTO_SHA1_PPC
         tristate "SHA1 digest algorithm (powerpc)"
         depends on PPC
@@ -589,6 +600,21 @@ config CRYPTO_SHA512_SPARC64
           SHA-512 secure hash standard (DFIPS 180-2) implemented
           using sparc64 crypto instructions, when available.
 
+config CRYPTO_SHA512_ARM_NEON
+        tristate "SHA384 and SHA512 digest algorithm (ARM NEON)"
+        depends on ARM && KERNEL_MODE_NEON && !CPU_BIG_ENDIAN
+        select CRYPTO_SHA512
+        select CRYPTO_HASH
+        help
+          SHA-512 secure hash standard (DFIPS 180-2) implemented
+          using ARM NEON instructions, when available.
+
+          This version of SHA implements a 512 bit hash with 256 bits of
+          security against collision attacks.
+
+          This code also includes SHA-384, a 384 bit hash with 192 bits
+          of security against collision attacks.
+
 config CRYPTO_TGR192
         tristate "Tiger digest algorithms"
         select CRYPTO_HASH
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 83969f8c5727..6467c919c509 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -176,14 +176,24 @@ static int __init cma_activate_area(struct cma *cma)
                 base_pfn = pfn;
                 for (j = pageblock_nr_pages; j; --j, pfn++) {
                         WARN_ON_ONCE(!pfn_valid(pfn));
+                        /*
+                         * alloc_contig_range requires the pfn range
+                         * specified to be in the same zone. Make this
+                         * simple by forcing the entire CMA resv range
+                         * to be in the same zone.
+                         */
                         if (page_zone(pfn_to_page(pfn)) != zone)
-                                return -EINVAL;
+                                goto err;
                 }
                 init_cma_reserved_pageblock(pfn_to_page(base_pfn));
         } while (--i);
 
         mutex_init(&cma->lock);
         return 0;
+
+err:
+        kfree(cma->bitmap);
+        return -EINVAL;
 }
 
 static struct cma cma_areas[MAX_CMA_AREAS];
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index b6c8aaf4931b..5b17ec88ea05 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1337,8 +1337,11 @@ int drbd_submit_peer_request(struct drbd_device *device,
                 return 0;
         }
 
+        /* Discards don't have any payload.
+         * But the scsi layer still expects a bio_vec it can use internally,
+         * see sd_setup_discard_cmnd() and blk_add_request_payload(). */
         if (peer_req->flags & EE_IS_TRIM)
-                nr_pages = 0; /* discards don't have any payload. */
+                nr_pages = 1;
 
         /* In most cases, we will only need one bio.  But in case the lower
          * level restrictions happen to be different at this offset on this
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 677db049f55a..56d46ffb08e1 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3777,7 +3777,7 @@ static void floppy_rb0_cb(struct bio *bio, int err)
         int drive = cbdata->drive;
 
         if (err) {
-                pr_info("floppy: error %d while reading block 0", err);
+                pr_info("floppy: error %d while reading block 0\n", err);
                 set_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
         }
         complete(&cbdata->complete);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index bbeb404b3a07..b2c98c1bc037 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1431,6 +1431,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request)
         return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0;
 }
 
+static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request)
+{
+        struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
+
+        return obj_request->img_offset <
+            round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header));
+}
+
 static void rbd_obj_request_get(struct rbd_obj_request *obj_request)
 {
         dout("%s: obj %p (was %d)\n", __func__, obj_request,
@@ -2748,7 +2756,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request)
          */
         if (!img_request_write_test(img_request) ||
                 !img_request_layered_test(img_request) ||
-                rbd_dev->parent_overlap <= obj_request->img_offset ||
+                !obj_request_overlaps_parent(obj_request) ||
                 ((known = obj_request_known_test(obj_request)) &&
                         obj_request_exists_test(obj_request))) {
 
diff --git a/drivers/clocksource/arm_global_timer.c b/drivers/clocksource/arm_global_timer.c
index 60e5a170c4d2..e6833771a716 100644
--- a/drivers/clocksource/arm_global_timer.c
+++ b/drivers/clocksource/arm_global_timer.c
@@ -250,7 +250,7 @@ static void __init global_timer_of_register(struct device_node *np)
          * fire when the timer value is greater than or equal to. In previous
          * revisions the comparators fired when the timer value was equal to.
          */
-        if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9
+        if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9
             && (read_cpuid_id() & 0xf0000f) < 0x200000) {
                 pr_warn("global-timer: non support for this cpu version.\n");
                 return;
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 8d6420013a04..f71d55f5e6e5 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -153,13 +153,10 @@ static void exynos4_mct_write(unsigned int value, unsigned long offset)
 }
 
 /* Clocksource handling */
-static void exynos4_mct_frc_start(u32 hi, u32 lo)
+static void exynos4_mct_frc_start(void)
 {
         u32 reg;
 
-        exynos4_mct_write(lo, EXYNOS4_MCT_G_CNT_L);
-        exynos4_mct_write(hi, EXYNOS4_MCT_G_CNT_U);
-
         reg = __raw_readl(reg_base + EXYNOS4_MCT_G_TCON);
         reg |= MCT_G_TCON_START;
         exynos4_mct_write(reg, EXYNOS4_MCT_G_TCON);
@@ -181,7 +178,7 @@ static cycle_t exynos4_frc_read(struct clocksource *cs)
 
 static void exynos4_frc_resume(struct clocksource *cs)
 {
-        exynos4_mct_frc_start(0, 0);
+        exynos4_mct_frc_start();
 }
 
 struct clocksource mct_frc = {
@@ -200,7 +197,7 @@ static u64 notrace exynos4_read_sched_clock(void)
 
 static void __init exynos4_clocksource_init(void)
 {
-        exynos4_mct_frc_start(0, 0);
+        exynos4_mct_frc_start();
 
         if (clocksource_register_hz(&mct_frc, clk_rate))
                 panic("%s: can't register clocksource\n", mct_frc.name);
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 4b9dc836dcf9..e992abc5ef26 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -40,7 +40,7 @@ struct pstore_read_data {
 static inline u64 generic_id(unsigned long timestamp,
                              unsigned int part, int count)
 {
-        return (timestamp * 100 + part) * 1000 + count;
+        return ((u64) timestamp * 100 + part) * 1000 + count;
 }
 
 static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index cd36deb619fa..eff1a2f22f09 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -353,10 +353,10 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
                                        int depth, void *data)
 {
         struct param_info *info = data;
-        void *prop, *dest;
-        unsigned long len;
+        const void *prop;
+        void *dest;
         u64 val;
-        int i;
+        int i, len;
 
         if (depth != 1 ||
             (strcmp(uname, "chosen") != 0 && strcmp(uname, "chosen@0") != 0))
diff --git a/drivers/firmware/efi/fdt.c b/drivers/firmware/efi/fdt.c
index 5c6a8e8a9580..82d774161cc9 100644
--- a/drivers/firmware/efi/fdt.c
+++ b/drivers/firmware/efi/fdt.c
@@ -63,7 +63,7 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
          */
         prev = 0;
         for (;;) {
-                const char *type, *name;
+                const char *type;
                 int len;
 
                 node = fdt_next_node(fdt, prev, NULL);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 03711d00aaae..8218078b6133 100644..100755
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -419,8 +419,9 @@ long drm_ioctl(struct file *filp,
                         retcode = -EFAULT;
                         goto err_i1;
                 }
-        } else
+        } else if (cmd & IOC_OUT) {
                 memset(kdata, 0, usize);
+        }
 
         if (ioctl->flags & DRM_UNLOCKED)
                 retcode = func(dev, kdata, file_priv);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dpi.c b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
index 482127f633c5..9e530f205ad2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dpi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
@@ -40,7 +40,7 @@ exynos_dpi_detect(struct drm_connector *connector, bool force)
 {
         struct exynos_dpi *ctx = connector_to_dpi(connector);
 
-        if (!ctx->panel->connector)
+        if (ctx->panel && !ctx->panel->connector)
                 drm_panel_attach(ctx->panel, &ctx->connector);
 
         return connector_status_connected;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index d91f27777537..ab7d182063c3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -765,24 +765,24 @@ static int exynos_drm_init(void)
 
         return 0;
 
-err_unregister_pd:
-        platform_device_unregister(exynos_drm_pdev);
-
 err_remove_vidi:
 #ifdef CONFIG_DRM_EXYNOS_VIDI
         exynos_drm_remove_vidi();
+
+err_unregister_pd:
 #endif
+        platform_device_unregister(exynos_drm_pdev);
 
         return ret;
 }
 
 static void exynos_drm_exit(void)
 {
+        platform_driver_unregister(&exynos_drm_platform_driver);
 #ifdef CONFIG_DRM_EXYNOS_VIDI
         exynos_drm_remove_vidi();
 #endif
         platform_device_unregister(exynos_drm_pdev);
-        platform_driver_unregister(&exynos_drm_platform_driver);
 }
 
 module_init(exynos_drm_init);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index 36535f398848..06cde4506278 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -343,7 +343,7 @@ struct exynos_drm_display * exynos_dpi_probe(struct device *dev);
 int exynos_dpi_remove(struct device *dev);
 #else
 static inline struct exynos_drm_display *
-exynos_dpi_probe(struct device *dev) { return 0; }
+exynos_dpi_probe(struct device *dev) { return NULL; }
 static inline int exynos_dpi_remove(struct device *dev) { return 0; }
 #endif
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index bb45ab2e7384..33161ad38201 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -741,6 +741,8 @@ static void fimd_apply(struct exynos_drm_manager *mgr)
                 win_data = &ctx->win_data[i];
                 if (win_data->enabled)
                         fimd_win_commit(mgr, i);
+                else
+                        fimd_win_disable(mgr, i);
         }
 
         fimd_commit(mgr);
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index c104d0c9b385..aa259b0a873a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2090,6 +2090,11 @@ out:
 
 static void hdmi_dpms(struct exynos_drm_display *display, int mode)
 {
+        struct hdmi_context *hdata = display->ctx;
+        struct drm_encoder *encoder = hdata->encoder;
+        struct drm_crtc *crtc = encoder->crtc;
+        struct drm_crtc_helper_funcs *funcs = NULL;
+
         DRM_DEBUG_KMS("mode %d\n", mode);
 
         switch (mode) {
@@ -2099,6 +2104,20 @@ static void hdmi_dpms(struct exynos_drm_display *display, int mode)
         case DRM_MODE_DPMS_STANDBY:
         case DRM_MODE_DPMS_SUSPEND:
         case DRM_MODE_DPMS_OFF:
+                /*
+                 * The SFRs of VP and Mixer are updated by Vertical Sync of
+                 * Timing generator which is a part of HDMI so the sequence
+                 * to disable TV Subsystem should be as following,
+                 *      VP -> Mixer -> HDMI
+                 *
+                 * Below codes will try to disable Mixer and VP(if used)
+                 * prior to disabling HDMI.
+                 */
+                if (crtc)
+                        funcs = crtc->helper_private;
+                if (funcs && funcs->dpms)
+                        (*funcs->dpms)(crtc, mode);
+
                 hdmi_poweroff(display);
                 break;
         default:
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 4c5aed7e54c8..7529946d0a74 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -377,6 +377,20 @@ static void mixer_run(struct mixer_context *ctx)
         mixer_regs_dump(ctx);
 }
 
+static void mixer_stop(struct mixer_context *ctx)
+{
+        struct mixer_resources *res = &ctx->mixer_res;
+        int timeout = 20;
+
+        mixer_reg_writemask(res, MXR_STATUS, 0, MXR_STATUS_REG_RUN);
+
+        while (!(mixer_reg_read(res, MXR_STATUS) & MXR_STATUS_REG_IDLE) &&
+                        --timeout)
+                usleep_range(10000, 12000);
+
+        mixer_regs_dump(ctx);
+}
+
 static void vp_video_buffer(struct mixer_context *ctx, int win)
 {
         struct mixer_resources *res = &ctx->mixer_res;
@@ -497,13 +511,8 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
 static void mixer_layer_update(struct mixer_context *ctx)
 {
         struct mixer_resources *res = &ctx->mixer_res;
-        u32 val;
-
-        val = mixer_reg_read(res, MXR_CFG);
 
-        /* allow one update per vsync only */
-        if (!(val & MXR_CFG_LAYER_UPDATE_COUNT_MASK))
-                mixer_reg_writemask(res, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
+        mixer_reg_writemask(res, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
 }
 
 static void mixer_graph_buffer(struct mixer_context *ctx, int win)
@@ -1010,6 +1019,8 @@ static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
         }
         mutex_unlock(&mixer_ctx->mixer_mutex);
 
+        drm_vblank_get(mgr->crtc->dev, mixer_ctx->pipe);
+
         atomic_set(&mixer_ctx->wait_vsync_event, 1);
 
         /*
@@ -1020,6 +1031,8 @@ static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
                                 !atomic_read(&mixer_ctx->wait_vsync_event),
                                 HZ/20))
                 DRM_DEBUG_KMS("vblank wait timed out.\n");
+
+        drm_vblank_put(mgr->crtc->dev, mixer_ctx->pipe);
 }
 
 static void mixer_window_suspend(struct exynos_drm_manager *mgr)
@@ -1061,7 +1074,7 @@ static void mixer_poweron(struct exynos_drm_manager *mgr)
                 mutex_unlock(&ctx->mixer_mutex);
                 return;
         }
-        ctx->powered = true;
+
         mutex_unlock(&ctx->mixer_mutex);
 
         pm_runtime_get_sync(ctx->dev);
@@ -1072,6 +1085,12 @@ static void mixer_poweron(struct exynos_drm_manager *mgr)
                 clk_prepare_enable(res->sclk_mixer);
         }
 
+        mutex_lock(&ctx->mixer_mutex);
+        ctx->powered = true;
+        mutex_unlock(&ctx->mixer_mutex);
+
+        mixer_reg_writemask(res, MXR_STATUS, ~0, MXR_STATUS_SOFT_RESET);
+
         mixer_reg_write(res, MXR_INT_EN, ctx->int_en);
         mixer_win_reset(ctx);
 
@@ -1084,14 +1103,21 @@ static void mixer_poweroff(struct exynos_drm_manager *mgr)
         struct mixer_resources *res = &ctx->mixer_res;
 
         mutex_lock(&ctx->mixer_mutex);
-        if (!ctx->powered)
-                goto out;
+        if (!ctx->powered) {
+                mutex_unlock(&ctx->mixer_mutex);
+                return;
+        }
         mutex_unlock(&ctx->mixer_mutex);
 
+        mixer_stop(ctx);
         mixer_window_suspend(mgr);
 
         ctx->int_en = mixer_reg_read(res, MXR_INT_EN);
 
+        mutex_lock(&ctx->mixer_mutex);
+        ctx->powered = false;
+        mutex_unlock(&ctx->mixer_mutex);
+
         clk_disable_unprepare(res->mixer);
         if (ctx->vp_enabled) {
                 clk_disable_unprepare(res->vp);
@@ -1099,12 +1125,6 @@ static void mixer_poweroff(struct exynos_drm_manager *mgr)
         }
 
         pm_runtime_put_sync(ctx->dev);
-
-        mutex_lock(&ctx->mixer_mutex);
-        ctx->powered = false;
-
-out:
-        mutex_unlock(&ctx->mixer_mutex);
 }
 
 static void mixer_dpms(struct exynos_drm_manager *mgr, int mode)
diff --git a/drivers/gpu/drm/exynos/regs-mixer.h b/drivers/gpu/drm/exynos/regs-mixer.h
index 4537026bc385..5f32e1a29411 100644
--- a/drivers/gpu/drm/exynos/regs-mixer.h
+++ b/drivers/gpu/drm/exynos/regs-mixer.h
@@ -78,6 +78,7 @@
 #define MXR_STATUS_BIG_ENDIAN           (1 << 3)
 #define MXR_STATUS_ENDIAN_MASK          (1 << 3)
 #define MXR_STATUS_SYNC_ENABLE          (1 << 2)
+#define MXR_STATUS_REG_IDLE             (1 << 1)
 #define MXR_STATUS_REG_RUN              (1 << 0)
 
 /* bits for MXR_CFG */
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 601caa88c092..b8c689202c40 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -446,7 +446,9 @@ static int i915_gem_object_info(struct seq_file *m, void* data)
 
                 memset(&stats, 0, sizeof(stats));
                 stats.file_priv = file->driver_priv;
+                spin_lock(&file->table_lock);
                 idr_for_each(&file->object_idr, per_file_stats, &stats);
+                spin_unlock(&file->table_lock);
                 /*
                  * Although we have a valid reference on file->pid, that does
                  * not guarantee that the task_struct who called get_pid() is
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 49414d30e8d4..a47fbf60b781 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -977,6 +977,8 @@ struct i915_power_well {
         bool always_on;
         /* power well enable/disable usage count */
         int count;
+        /* cached hw enabled state */
+        bool hw_enabled;
         unsigned long domains;
         unsigned long data;
         const struct i915_power_well_ops *ops;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 3ffe308d5893..a5ddf3bce9c3 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -598,6 +598,7 @@ static int do_switch(struct intel_engine_cs *ring,
         struct intel_context *from = ring->last_context;
         struct i915_hw_ppgtt *ppgtt = ctx_to_ppgtt(to);
         u32 hw_flags = 0;
+        bool uninitialized = false;
         int ret, i;
 
         if (from != NULL && ring == &dev_priv->ring[RCS]) {
@@ -696,19 +697,20 @@ static int do_switch(struct intel_engine_cs *ring,
                 i915_gem_context_unreference(from);
         }
 
+        uninitialized = !to->is_initialized && from == NULL;
+        to->is_initialized = true;
+
 done:
         i915_gem_context_reference(to);
         ring->last_context = to;
         to->last_ring = ring;
 
-        if (ring->id == RCS && !to->is_initialized && from == NULL) {
+        if (uninitialized) {
                 ret = i915_gem_render_state_init(ring);
                 if (ret)
                         DRM_ERROR("init render state: %d\n", ret);
         }
 
-        to->is_initialized = true;
-
         return 0;
 
 unpin_out:
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 1ee98f121a00..827498e081df 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -315,9 +315,6 @@ parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
         const struct bdb_lfp_backlight_data *backlight_data;
         const struct bdb_lfp_backlight_data_entry *entry;
 
-        /* Err to enabling backlight if no backlight block. */
-        dev_priv->vbt.backlight.present = true;
-
         backlight_data = find_section(bdb, BDB_LVDS_BACKLIGHT);
         if (!backlight_data)
                 return;
@@ -1088,6 +1085,9 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
 
         dev_priv->vbt.crt_ddc_pin = GMBUS_PORT_VGADDC;
 
+        /* Default to having backlight */
+        dev_priv->vbt.backlight.present = true;
+
         /* LFP panel data */
         dev_priv->vbt.lvds_dither = 1;
         dev_priv->vbt.lvds_vbt = 0;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index efd3cf50cb0f..5f285fba4e41 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4564,7 +4564,10 @@ static void valleyview_crtc_enable(struct drm_crtc *crtc)
         if (intel_crtc->active)
                 return;
 
-        vlv_prepare_pll(intel_crtc);
+        is_dsi = intel_pipe_has_type(crtc, INTEL_OUTPUT_DSI);
+
+        if (!is_dsi && !IS_CHERRYVIEW(dev))
+                vlv_prepare_pll(intel_crtc);
 
         /* Set up the display plane register */
         dspcntr = DISPPLANE_GAMMA_ENABLE;
@@ -4598,8 +4601,6 @@ static void valleyview_crtc_enable(struct drm_crtc *crtc)
                 if (encoder->pre_pll_enable)
                         encoder->pre_pll_enable(encoder);
 
-        is_dsi = intel_pipe_has_type(crtc, INTEL_OUTPUT_DSI);
-
         if (!is_dsi) {
                 if (IS_CHERRYVIEW(dev))
                         chv_enable_pll(intel_crtc);
@@ -12411,8 +12412,8 @@ intel_display_capture_error_state(struct drm_device *dev)
 
         for_each_pipe(i) {
                 error->pipe[i].power_domain_on =
-                        intel_display_power_enabled_sw(dev_priv,
-                                                       POWER_DOMAIN_PIPE(i));
+                        intel_display_power_enabled_unlocked(dev_priv,
+                                                           POWER_DOMAIN_PIPE(i));
                 if (!error->pipe[i].power_domain_on)
                         continue;
 
@@ -12447,7 +12448,7 @@ intel_display_capture_error_state(struct drm_device *dev)
                 enum transcoder cpu_transcoder = transcoders[i];
 
                 error->transcoder[i].power_domain_on =
-                        intel_display_power_enabled_sw(dev_priv,
+                        intel_display_power_enabled_unlocked(dev_priv,
                                 POWER_DOMAIN_TRANSCODER(cpu_transcoder));
                 if (!error->transcoder[i].power_domain_on)
                         continue;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index bda0ae3d80cc..eaa27ee9e367 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -950,8 +950,8 @@ int intel_power_domains_init(struct drm_i915_private *);
 void intel_power_domains_remove(struct drm_i915_private *);
 bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
                                  enum intel_display_power_domain domain);
-bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
-                                    enum intel_display_power_domain domain);
+bool intel_display_power_enabled_unlocked(struct drm_i915_private *dev_priv,
+                                          enum intel_display_power_domain domain);
 void intel_display_power_get(struct drm_i915_private *dev_priv,
                              enum intel_display_power_domain domain);
 void intel_display_power_put(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 54242e4f6f4c..9ad0c6afc487 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5603,8 +5603,8 @@ static bool hsw_power_well_enabled(struct drm_i915_private *dev_priv,
                      (HSW_PWR_WELL_ENABLE_REQUEST | HSW_PWR_WELL_STATE_ENABLED);
 }
 
-bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
-                                    enum intel_display_power_domain domain)
+bool intel_display_power_enabled_unlocked(struct drm_i915_private *dev_priv,
+                                          enum intel_display_power_domain domain)
 {
         struct i915_power_domains *power_domains;
         struct i915_power_well *power_well;
@@ -5615,16 +5615,19 @@ bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
                 return false;
 
         power_domains = &dev_priv->power_domains;
+
         is_enabled = true;
+
         for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
                 if (power_well->always_on)
                         continue;
 
-                if (!power_well->count) {
+                if (!power_well->hw_enabled) {
                         is_enabled = false;
                         break;
                 }
         }
+
         return is_enabled;
 }
 
@@ -5632,30 +5635,15 @@ bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
                                  enum intel_display_power_domain domain)
 {
         struct i915_power_domains *power_domains;
-        struct i915_power_well *power_well;
-        bool is_enabled;
-        int i;
-
-        if (dev_priv->pm.suspended)
-                return false;
+        bool ret;
 
         power_domains = &dev_priv->power_domains;
 
-        is_enabled = true;
-
         mutex_lock(&power_domains->lock);
-        for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
-                if (power_well->always_on)
-                        continue;
-
-                if (!power_well->ops->is_enabled(dev_priv, power_well)) {
-                        is_enabled = false;
-                        break;
-                }
-        }
+        ret = intel_display_power_enabled_unlocked(dev_priv, domain);
         mutex_unlock(&power_domains->lock);
 
-        return is_enabled;
+        return ret;
 }
 
 /*
@@ -5976,6 +5964,7 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
                 if (!power_well->count++) {
                         DRM_DEBUG_KMS("enabling %s\n", power_well->name);
                         power_well->ops->enable(dev_priv, power_well);
+                        power_well->hw_enabled = true;
                 }
 
                 check_power_well_state(dev_priv, power_well);
@@ -6005,6 +5994,7 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
 
                 if (!--power_well->count && i915.disable_power_well) {
                         DRM_DEBUG_KMS("disabling %s\n", power_well->name);
+                        power_well->hw_enabled = false;
                         power_well->ops->disable(dev_priv, power_well);
                 }
 
@@ -6267,8 +6257,11 @@ static void intel_power_domains_resume(struct drm_i915_private *dev_priv)
         int i;
 
         mutex_lock(&power_domains->lock);
-        for_each_power_well(i, power_well, POWER_DOMAIN_MASK, power_domains)
+        for_each_power_well(i, power_well, POWER_DOMAIN_MASK, power_domains) {
                 power_well->ops->sync_hw(dev_priv, power_well);
+                power_well->hw_enabled = power_well->ops->is_enabled(dev_priv,
+                                                                     power_well);
+        }
         mutex_unlock(&power_domains->lock);
 }
 
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
index ae750f6928c1..7f7aadef8a82 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
@@ -277,6 +277,7 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
         static const char *hpd_reg_names[] = {"hpd-gdsc", "hpd-5v"};
         static const char *pwr_reg_names[] = {"core-vdda", "core-vcc"};
         static const char *hpd_clk_names[] = {"iface_clk", "core_clk", "mdp_core_clk"};
+        static unsigned long hpd_clk_freq[] = {0, 19200000, 0};
         static const char *pwr_clk_names[] = {"extp_clk", "alt_iface_clk"};
 
         config.phy_init      = hdmi_phy_8x74_init;
@@ -286,6 +287,7 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
         config.pwr_reg_names = pwr_reg_names;
         config.pwr_reg_cnt   = ARRAY_SIZE(pwr_reg_names);
         config.hpd_clk_names = hpd_clk_names;
+        config.hpd_freq      = hpd_clk_freq;
         config.hpd_clk_cnt   = ARRAY_SIZE(hpd_clk_names);
         config.pwr_clk_names = pwr_clk_names;
         config.pwr_clk_cnt   = ARRAY_SIZE(pwr_clk_names);
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.h b/drivers/gpu/drm/msm/hdmi/hdmi.h
index 9fafee6a3e43..9d7723c6528a 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.h
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.h
@@ -87,6 +87,7 @@ struct hdmi_platform_config {
 
         /* clks that need to be on for hpd: */
         const char **hpd_clk_names;
+        const long unsigned *hpd_freq;
         int hpd_clk_cnt;
 
         /* clks that need to be on for screen pwr (ie pixel clk): */
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
index e56a6196867c..28f7e3ec6c28 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
@@ -127,6 +127,14 @@ static int hpd_enable(struct hdmi_connector *hdmi_connector)
         }
 
         for (i = 0; i < config->hpd_clk_cnt; i++) {
+                if (config->hpd_freq && config->hpd_freq[i]) {
+                        ret = clk_set_rate(hdmi->hpd_clks[i],
+                                        config->hpd_freq[i]);
+                        if (ret)
+                                dev_warn(dev->dev, "failed to set clk %s (%d)\n",
+                                                config->hpd_clk_names[i], ret);
+                }
+
                 ret = clk_prepare_enable(hdmi->hpd_clks[i]);
                 if (ret) {
                         dev_err(dev->dev, "failed to enable hpd clk: %s (%d)\n",
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 42caf7fcb0b9..71510ee26e96 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -20,6 +20,10 @@
 #include "msm_mmu.h"
 #include "mdp5_kms.h"
 
+static const char *iommu_ports[] = {
+                "mdp_0",
+};
+
 static struct mdp5_platform_config *mdp5_get_config(struct platform_device *dev);
 
 static int mdp5_hw_init(struct msm_kms *kms)
@@ -104,6 +108,12 @@ static void mdp5_preclose(struct msm_kms *kms, struct drm_file *file)
 static void mdp5_destroy(struct msm_kms *kms)
 {
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        struct msm_mmu *mmu = mdp5_kms->mmu;
+
+        if (mmu) {
+                mmu->funcs->detach(mmu, iommu_ports, ARRAY_SIZE(iommu_ports));
+                mmu->funcs->destroy(mmu);
+        }
         kfree(mdp5_kms);
 }
 
@@ -216,10 +226,6 @@ fail:
         return ret;
 }
 
-static const char *iommu_ports[] = {
-                "mdp_0",
-};
-
 static int get_clk(struct platform_device *pdev, struct clk **clkp,
                 const char *name)
 {
@@ -317,17 +323,23 @@ struct msm_kms *mdp5_kms_init(struct drm_device *dev)
                 mmu = msm_iommu_new(dev, config->iommu);
                 if (IS_ERR(mmu)) {
                         ret = PTR_ERR(mmu);
+                        dev_err(dev->dev, "failed to init iommu: %d\n", ret);
                         goto fail;
                 }
+
                 ret = mmu->funcs->attach(mmu, iommu_ports,
                                 ARRAY_SIZE(iommu_ports));
-                if (ret)
+                if (ret) {
+                        dev_err(dev->dev, "failed to attach iommu: %d\n", ret);
+                        mmu->funcs->destroy(mmu);
                         goto fail;
+                }
         } else {
                 dev_info(dev->dev, "no iommu, fallback to phys "
                                 "contig buffers for scanout\n");
                 mmu = NULL;
         }
+        mdp5_kms->mmu = mmu;
 
         mdp5_kms->id = msm_register_mmu(dev, mmu);
         if (mdp5_kms->id < 0) {
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
index c8b1a2522c25..6e981b692d1d 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
@@ -33,6 +33,7 @@ struct mdp5_kms {
 
         /* mapper-id used to request GEM buffer mapped for scanout: */
         int id;
+        struct msm_mmu *mmu;
 
         /* for tracking smp allocation amongst pipes: */
         mdp5_smp_state_t smp_state;
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 0d2562fb681e..9a5d87db5c23 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -159,7 +159,7 @@ static int msm_unload(struct drm_device *dev)
 static int get_mdp_ver(struct platform_device *pdev)
 {
 #ifdef CONFIG_OF
-        const static struct of_device_id match_types[] = { {
+        static const struct of_device_id match_types[] = { {
                 .compatible = "qcom,mdss_mdp",
                 .data   = (void *)5,
         }, {
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index a752ab83b810..5107fc4826bc 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -59,7 +59,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
         struct drm_framebuffer *fb = NULL;
         struct fb_info *fbi = NULL;
         struct drm_mode_fb_cmd2 mode_cmd = {0};
-        dma_addr_t paddr;
+        uint32_t paddr;
         int ret, size;
 
         sizes->surface_bpp = 32;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index bb8026daebc9..690d7e7b6d1e 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -278,6 +278,7 @@ int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
                 uint32_t *iova)
 {
         struct msm_gem_object *msm_obj = to_msm_bo(obj);
+        struct drm_device *dev = obj->dev;
         int ret = 0;
 
         if (!msm_obj->domain[id].iova) {
@@ -285,6 +286,11 @@ int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
                 struct msm_mmu *mmu = priv->mmus[id];
                 struct page **pages = get_pages(obj);
 
+                if (!mmu) {
+                        dev_err(dev->dev, "null MMU pointer\n");
+                        return -EINVAL;
+                }
+
                 if (IS_ERR(pages))
                         return PTR_ERR(pages);
 
diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index 92b745986231..4b2ad9181edf 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -28,7 +28,7 @@ static int msm_fault_handler(struct iommu_domain *iommu, struct device *dev,
                 unsigned long iova, int flags, void *arg)
 {
         DBG("*** fault: iova=%08lx, flags=%d", iova, flags);
-        return 0;
+        return -ENOSYS;
 }
 
 static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
@@ -40,8 +40,10 @@ static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
         for (i = 0; i < cnt; i++) {
                 struct device *msm_iommu_get_ctx(const char *ctx_name);
                 struct device *ctx = msm_iommu_get_ctx(names[i]);
-                if (IS_ERR_OR_NULL(ctx))
+                if (IS_ERR_OR_NULL(ctx)) {
+                        dev_warn(dev->dev, "couldn't get %s context", names[i]);
                         continue;
+                }
                 ret = iommu_attach_device(iommu->domain, ctx);
                 if (ret) {
                         dev_warn(dev->dev, "could not attach iommu to %s", names[i]);
@@ -52,6 +54,20 @@ static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
         return 0;
 }
 
+static void msm_iommu_detach(struct msm_mmu *mmu, const char **names, int cnt)
+{
+        struct msm_iommu *iommu = to_msm_iommu(mmu);
+        int i;
+
+        for (i = 0; i < cnt; i++) {
+                struct device *msm_iommu_get_ctx(const char *ctx_name);
+                struct device *ctx = msm_iommu_get_ctx(names[i]);
+                if (IS_ERR_OR_NULL(ctx))
+                        continue;
+                iommu_detach_device(iommu->domain, ctx);
+        }
+}
+
 static int msm_iommu_map(struct msm_mmu *mmu, uint32_t iova,
                 struct sg_table *sgt, unsigned len, int prot)
 {
@@ -110,7 +126,7 @@ static int msm_iommu_unmap(struct msm_mmu *mmu, uint32_t iova,
 
                 VERB("unmap[%d]: %08x(%x)", i, iova, bytes);
 
-                BUG_ON(!IS_ALIGNED(bytes, PAGE_SIZE));
+                BUG_ON(!PAGE_ALIGNED(bytes));
 
                 da += bytes;
         }
@@ -127,6 +143,7 @@ static void msm_iommu_destroy(struct msm_mmu *mmu)
 
 static const struct msm_mmu_funcs funcs = {
                 .attach = msm_iommu_attach,
+                .detach = msm_iommu_detach,
                 .map = msm_iommu_map,
                 .unmap = msm_iommu_unmap,
                 .destroy = msm_iommu_destroy,
diff --git a/drivers/gpu/drm/msm/msm_mmu.h b/drivers/gpu/drm/msm/msm_mmu.h
index 030324482b4a..21da6d154f71 100644
--- a/drivers/gpu/drm/msm/msm_mmu.h
+++ b/drivers/gpu/drm/msm/msm_mmu.h
@@ -22,6 +22,7 @@
 
 struct msm_mmu_funcs {
         int (*attach)(struct msm_mmu *mmu, const char **names, int cnt);
+        void (*detach)(struct msm_mmu *mmu, const char **names, int cnt);
         int (*map)(struct msm_mmu *mmu, uint32_t iova, struct sg_table *sgt,
                         unsigned len, int prot);
         int (*unmap)(struct msm_mmu *mmu, uint32_t iova, struct sg_table *sgt,
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 08531a128f53..02d3d85829f3 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1052,7 +1052,7 @@ config SENSORS_PC87427
           will be called pc87427.
 
 config SENSORS_NTC_THERMISTOR
-        tristate "NTC thermistor support"
+        tristate "NTC thermistor support from Murata"
         depends on !OF || IIO=n || IIO
         help
           This driver supports NTC thermistors sensor reading and its
@@ -1060,7 +1060,8 @@ config SENSORS_NTC_THERMISTOR
           send notifications about the temperature.
 
           Currently, this driver supports
-          NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, and NCP15WL333.
+          NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, and NCP15WL333
+          from Murata.
 
           This driver can also be built as a module.  If so, the module
           will be called ntc-thermistor.
@@ -1176,6 +1177,7 @@ config SENSORS_DME1737
 config SENSORS_EMC1403
         tristate "SMSC EMC1403/23 thermal sensor"
         depends on I2C
+        select REGMAP_I2C
         help
           If you say yes here you get support for the SMSC EMC1403/23
           temperature monitoring chip.
diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index ba35e4d530b5..2566c43dd1e9 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -538,7 +538,7 @@ static int gpio_fan_probe(struct platform_device *pdev)
 
         /* Make this driver part of hwmon class. */
         fan_data->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev,
-                                                "gpio-fan", fan_data,
+                                                "gpio_fan", fan_data,
                                                 gpio_fan_groups);
         if (IS_ERR(fan_data->hwmon_dev))
                 return PTR_ERR(fan_data->hwmon_dev);
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index e76feb86a1d4..bdfbe9114889 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -163,6 +163,18 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 }
 
 static const struct of_device_id ntc_match[] = {
+        { .compatible = "murata,ncp15wb473",
+                .data = &ntc_thermistor_id[0] },
+        { .compatible = "murata,ncp18wb473",
+                .data = &ntc_thermistor_id[1] },
+        { .compatible = "murata,ncp21wb473",
+                .data = &ntc_thermistor_id[2] },
+        { .compatible = "murata,ncp03wb473",
+                .data = &ntc_thermistor_id[3] },
+        { .compatible = "murata,ncp15wl333",
+                .data = &ntc_thermistor_id[4] },
+
+        /* Usage of vendor name "ntc" is deprecated */
         { .compatible = "ntc,ncp15wb473",
                 .data = &ntc_thermistor_id[0] },
         { .compatible = "ntc,ncp18wb473",
@@ -534,7 +546,7 @@ static struct platform_driver ntc_thermistor_driver = {
 
 module_platform_driver(ntc_thermistor_driver);
 
-MODULE_DESCRIPTION("NTC Thermistor Driver");
+MODULE_DESCRIPTION("NTC Thermistor Driver from Murata");
 MODULE_AUTHOR("MyungJoo Ham <myungjoo.ham@samsung.com>");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:ntc-thermistor");
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index 6ed76ceb9270..32487c19cbfc 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -249,7 +249,7 @@ static ssize_t show_##reg(struct device *dev, struct device_attribute *attr, \
         int nr = to_sensor_dev_attr(attr)->index; \
         struct w83l786ng_data *data = w83l786ng_update_device(dev); \
         return sprintf(buf, "%d\n", \
-                FAN_FROM_REG(data->fan[nr], DIV_FROM_REG(data->fan_div[nr]))); \
+                FAN_FROM_REG(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \
 }
 
 show_fan_reg(fan);
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index d4daa05efe60..499b4366a98d 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -45,7 +45,7 @@ struct pri_queue {
 struct pasid_state {
         struct list_head list;                  /* For global state-list */
         atomic_t count;                         /* Reference count */
-        atomic_t mmu_notifier_count;            /* Counting nested mmu_notifier
+        unsigned mmu_notifier_count;            /* Counting nested mmu_notifier
                                                    calls */
         struct task_struct *task;               /* Task bound to this PASID */
         struct mm_struct *mm;                   /* mm_struct for the faults */
@@ -53,7 +53,8 @@ struct pasid_state {
         struct pri_queue pri[PRI_QUEUE_SIZE];   /* PRI tag states */
         struct device_state *device_state;      /* Link to our device_state */
         int pasid;                              /* PASID index */
-        spinlock_t lock;                        /* Protect pri_queues */
+        spinlock_t lock;                        /* Protect pri_queues and
+                                                   mmu_notifer_count */
         wait_queue_head_t wq;                   /* To wait for count == 0 */
 };
 
@@ -431,15 +432,19 @@ static void mn_invalidate_range_start(struct mmu_notifier *mn,
 {
         struct pasid_state *pasid_state;
         struct device_state *dev_state;
+        unsigned long flags;
 
         pasid_state = mn_to_state(mn);
         dev_state   = pasid_state->device_state;
 
-        if (atomic_add_return(1, &pasid_state->mmu_notifier_count) == 1) {
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        if (pasid_state->mmu_notifier_count == 0) {
                 amd_iommu_domain_set_gcr3(dev_state->domain,
                                           pasid_state->pasid,
                                           __pa(empty_page_table));
         }
+        pasid_state->mmu_notifier_count += 1;
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
 }
 
 static void mn_invalidate_range_end(struct mmu_notifier *mn,
@@ -448,15 +453,19 @@ static void mn_invalidate_range_end(struct mmu_notifier *mn,
 {
         struct pasid_state *pasid_state;
         struct device_state *dev_state;
+        unsigned long flags;
 
         pasid_state = mn_to_state(mn);
         dev_state   = pasid_state->device_state;
 
-        if (atomic_dec_and_test(&pasid_state->mmu_notifier_count)) {
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        pasid_state->mmu_notifier_count -= 1;
+        if (pasid_state->mmu_notifier_count == 0) {
                 amd_iommu_domain_set_gcr3(dev_state->domain,
                                           pasid_state->pasid,
                                           __pa(pasid_state->mm->pgd));
         }
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
 }
 
 static void mn_release(struct mmu_notifier *mn, struct mm_struct *mm)
@@ -650,7 +659,6 @@ int amd_iommu_bind_pasid(struct pci_dev *pdev, int pasid,
                 goto out;
 
         atomic_set(&pasid_state->count, 1);
-        atomic_set(&pasid_state->mmu_notifier_count, 0);
         init_waitqueue_head(&pasid_state->wq);
         spin_lock_init(&pasid_state->lock);
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 6bb32773c3ac..51b6b77dc3e5 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3816,14 +3816,11 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
                                 ((void *)rmrr) + rmrr->header.length,
                                 rmrr->segment, rmrru->devices,
                                 rmrru->devices_cnt);
-                        if (ret > 0)
-                                break;
-                        else if(ret < 0)
+                        if(ret < 0)
                                 return ret;
                 } else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
-                        if (dmar_remove_dev_scope(info, rmrr->segment,
-                                rmrru->devices, rmrru->devices_cnt))
-                                break;
+                        dmar_remove_dev_scope(info, rmrr->segment,
+                                rmrru->devices, rmrru->devices_cnt);
                 }
         }
 
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index d9edcc94c2a8..97465ac5a2d5 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -16,7 +16,7 @@ config ISDN_DRV_HISAX
           also to the configuration option of the driver for your particular
           card, below.
 
-if ISDN_DRV_HISAX!=n
+if ISDN_DRV_HISAX
 
 comment "D-channel protocol features"
 
@@ -348,10 +348,6 @@ config HISAX_ENTERNOW_PCI
           This enables HiSax support for the Formula-n enter:now PCI
           ISDN card.
 
-endif
-
-if ISDN_DRV_HISAX
-
 config HISAX_DEBUG
         bool "HiSax debugging"
         help
@@ -420,11 +416,6 @@ config HISAX_FRITZ_PCIPNP
           (the latter also needs you to select "ISA Plug and Play support"
           from the menu "Plug and Play configuration")
 
-config HISAX_AVM_A1_PCMCIA
-        bool
-        depends on HISAX_AVM_A1_CS
-        default y
-
 endif
 
 endmenu
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index 23b4a3b28dbc..4eab93aa570b 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -1257,7 +1257,8 @@ static unsigned int smu_fpoll(struct file *file, poll_table *wait)
                 if (pp->busy && pp->cmd.status != 1)
                         mask |= POLLIN;
                 spin_unlock_irqrestore(&pp->lock, flags);
-        } if (pp->mode == smu_file_events) {
+        }
+        if (pp->mode == smu_file_events) {
                 /* Not yet implemented */
         }
         return mask;
diff --git a/drivers/memstick/host/rtsx_pci_ms.c b/drivers/memstick/host/rtsx_pci_ms.c
index 2a635b6fdaf7..c880ba685754 100644
--- a/drivers/memstick/host/rtsx_pci_ms.c
+++ b/drivers/memstick/host/rtsx_pci_ms.c
@@ -601,6 +601,7 @@ static int rtsx_pci_ms_drv_remove(struct platform_device *pdev)
         pcr->slots[RTSX_MS_CARD].card_event = NULL;
         msh = host->msh;
         host->eject = true;
+        cancel_work_sync(&host->handle_req);
 
         mutex_lock(&host->host_mutex);
         if (host->req) {
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index ee8204cc31e9..6cc4b6acc22a 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -760,6 +760,7 @@ config MFD_SYSCON
 config MFD_DAVINCI_VOICECODEC
         tristate
         select MFD_CORE
+        select REGMAP_MMIO
 
 config MFD_TI_AM335X_TSCADC
         tristate "TI ADC / Touch Screen chip support"
@@ -1225,7 +1226,7 @@ config MFD_WM8994
           functionaltiy of the device other drivers must be enabled.
 
 config MFD_STW481X
-        bool "Support for ST Microelectronics STw481x"
+        tristate "Support for ST Microelectronics STw481x"
         depends on I2C && ARCH_NOMADIK
         select REGMAP_I2C
         select MFD_CORE
@@ -1248,7 +1249,7 @@ config MCP_SA11X0
 
 # Chip drivers
 config MCP_UCB1200
-        bool "Support for UCB1200 / UCB1300"
+        tristate "Support for UCB1200 / UCB1300"
         depends on MCP_SA11X0
         select MCP
 
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index a8ee4a36a1d8..cf2e6a198c6b 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -591,7 +591,7 @@ static int ab8500_irq_init(struct ab8500 *ab8500, struct device_node *np)
                 num_irqs = AB8500_NR_IRQS;
 
         /* If ->irq_base is zero this will give a linear mapping */
-        ab8500->domain = irq_domain_add_simple(NULL,
+        ab8500->domain = irq_domain_add_simple(ab8500->dev->of_node,
                         num_irqs, 0,
                         &ab8500_irq_ops, ab8500);
 
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a43d0c467274..ee9402324a23 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -54,7 +54,7 @@ config AD525X_DPOT_SPI
 config ATMEL_PWM
         tristate "Atmel AT32/AT91 PWM support"
         depends on HAVE_CLK
-        depends on AVR32 || AT91SAM9263 || AT91SAM9RL || AT91SAM9G45
+        depends on AVR32 || ARCH_AT91SAM9263 || ARCH_AT91SAM9RL || ARCH_AT91SAM9G45
         help
           This option enables device driver support for the PWM channels
           on certain Atmel processors.  Pulse Width Modulation is used for
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 04f35f960cb8..3a451b6cd3d5 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1025,10 +1025,14 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
                                  NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
                                  NETIF_F_HIGHDMA | NETIF_F_LRO)
 
+#define BOND_ENC_FEATURES       (NETIF_F_ALL_CSUM | NETIF_F_SG | NETIF_F_RXCSUM |\
+                                 NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL)
+
 static void bond_compute_features(struct bonding *bond)
 {
         unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
         netdev_features_t vlan_features = BOND_VLAN_FEATURES;
+        netdev_features_t enc_features  = BOND_ENC_FEATURES;
         struct net_device *bond_dev = bond->dev;
         struct list_head *iter;
         struct slave *slave;
@@ -1044,6 +1048,9 @@ static void bond_compute_features(struct bonding *bond)
                 vlan_features = netdev_increment_features(vlan_features,
                         slave->dev->vlan_features, BOND_VLAN_FEATURES);
 
+                enc_features = netdev_increment_features(enc_features,
+                                                         slave->dev->hw_enc_features,
+                                                         BOND_ENC_FEATURES);
                 dst_release_flag &= slave->dev->priv_flags;
                 if (slave->dev->hard_header_len > max_hard_header_len)
                         max_hard_header_len = slave->dev->hard_header_len;
@@ -1054,6 +1061,7 @@ static void bond_compute_features(struct bonding *bond)
 
 done:
         bond_dev->vlan_features = vlan_features;
+        bond_dev->hw_enc_features = enc_features;
         bond_dev->hard_header_len = max_hard_header_len;
         bond_dev->gso_max_segs = gso_max_segs;
         netif_set_gso_max_size(bond_dev, gso_max_size);
@@ -3975,6 +3983,7 @@ void bond_setup(struct net_device *bond_dev)
                                 NETIF_F_HW_VLAN_CTAG_FILTER;
 
         bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
+        bond_dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
         bond_dev->features |= bond_dev->hw_features;
 }
 
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index dcf9196f6316..ea4d4f1a6411 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -52,6 +52,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/workqueue.h>
 #include <linux/can.h>
 #include <linux/can/skb.h>
 
@@ -85,6 +86,7 @@ struct slcan {
         struct tty_struct       *tty;           /* ptr to TTY structure      */
         struct net_device       *dev;           /* easy for intr handling    */
         spinlock_t              lock;
+        struct work_struct      tx_work;        /* Flushes transmit buffer   */
 
         /* These are pointers to the malloc()ed frame buffers. */
         unsigned char           rbuff[SLC_MTU]; /* receiver buffer           */
@@ -309,36 +311,46 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
         sl->dev->stats.tx_bytes += cf->can_dlc;
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slcan_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slcan_transmit(struct work_struct *work)
 {
+        struct slcan *sl = container_of(work, struct slcan, tx_work);
         int actual;
-        struct slcan *sl = (struct slcan *) tty->disc_data;
 
+        spin_lock_bh(&sl->lock);
         /* First make sure we're connected. */
-        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                 return;
+        }
 
-        spin_lock_bh(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                 spin_unlock_bh(&sl->lock);
                 netif_wake_queue(sl->dev);
                 return;
         }
 
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
         spin_unlock_bh(&sl->lock);
 }
 
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slcan_write_wakeup(struct tty_struct *tty)
+{
+        struct slcan *sl = tty->disc_data;
+
+        schedule_work(&sl->tx_work);
+}
+
 /* Send a can_frame to a TTY queue. */
 static netdev_tx_t slc_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -528,6 +540,7 @@ static struct slcan *slc_alloc(dev_t line)
         sl->magic = SLCAN_MAGIC;
         sl->dev = dev;
         spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slcan_transmit);
         slcan_devs[i] = dev;
 
         return sl;
@@ -626,8 +639,12 @@ static void slcan_close(struct tty_struct *tty)
         if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty)
                 return;
 
+        spin_lock_bh(&sl->lock);
         tty->disc_data = NULL;
         sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+
+        flush_work(&sl->tx_work);
 
         /* Flush network side */
         unregister_netdev(sl->dev);
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 28460676b8ca..d81e7167a8b5 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -736,6 +736,7 @@ static int emac_open(struct net_device *dev)
 
         ret = emac_mdio_probe(dev);
         if (ret < 0) {
+                free_irq(dev->irq, dev);
                 netdev_err(dev, "cannot probe MDIO bus\n");
                 return ret;
         }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index df2792d8383d..8afa579e7c40 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -3224,7 +3224,7 @@ static int tg3_nvram_read_using_eeprom(struct tg3 *tp,
         return 0;
 }
 
-#define NVRAM_CMD_TIMEOUT 100
+#define NVRAM_CMD_TIMEOUT 5000
 
 static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
 {
@@ -3232,7 +3232,7 @@ static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
 
         tw32(NVRAM_CMD, nvram_cmd);
         for (i = 0; i < NVRAM_CMD_TIMEOUT; i++) {
-                udelay(10);
+                usleep_range(10, 40);
                 if (tr32(NVRAM_CMD) & NVRAM_CMD_DONE) {
                         udelay(10);
                         break;
@@ -7854,8 +7854,8 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
                 netif_wake_queue(tp->dev);
         }
 
-        segs = skb_gso_segment(skb, tp->dev->features & ~NETIF_F_TSO);
-        if (IS_ERR(segs))
+        segs = skb_gso_segment(skb, tp->dev->features & ~(NETIF_F_TSO | NETIF_F_TSO6));
+        if (IS_ERR(segs) || !segs)
                 goto tg3_tso_bug_end;
 
         do {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 2f8d6b910383..a83271cf17c3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4057,22 +4057,19 @@ int cxgb4_unregister_uld(enum cxgb4_uld type)
 EXPORT_SYMBOL(cxgb4_unregister_uld);
 
 /* Check if netdev on which event is occured belongs to us or not. Return
- * suceess (1) if it belongs otherwise failure (0).
+ * success (true) if it belongs otherwise failure (false).
+ * Called with rcu_read_lock() held.
  */
-static int cxgb4_netdev(struct net_device *netdev)
+static bool cxgb4_netdev(const struct net_device *netdev)
 {
         struct adapter *adap;
         int i;
 
-        spin_lock(&adap_rcu_lock);
         list_for_each_entry_rcu(adap, &adap_rcu_list, rcu_node)
                 for (i = 0; i < MAX_NPORTS; i++)
-                        if (adap->port[i] == netdev) {
-                                spin_unlock(&adap_rcu_lock);
-                                return 1;
-                        }
-        spin_unlock(&adap_rcu_lock);
-        return 0;
+                        if (adap->port[i] == netdev)
+                                return true;
+        return false;
 }
 
 static int clip_add(struct net_device *event_dev, struct inet6_ifaddr *ifa,
@@ -6396,6 +6393,7 @@ static void remove_one(struct pci_dev *pdev)
                         adapter->flags &= ~DEV_ENABLED;
                 }
                 pci_release_regions(pdev);
+                synchronize_rcu();
                 kfree(adapter);
         } else
                 pci_release_regions(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index bba67681aeaa..931478e7bd28 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3962,6 +3962,7 @@ int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
                 p->lport = j;
                 p->rss_size = rss_size;
                 memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN);
+                adap->port[i]->dev_port = j;
 
                 ret = ntohl(c.u.info.lstatus_to_modtype);
                 p->mdio_addr = (ret & FW_PORT_CMD_MDIOCAP) ?
diff --git a/drivers/net/ethernet/dec/tulip/timer.c b/drivers/net/ethernet/dec/tulip/timer.c
index 768379b8aee9..523d9dde50a2 100644
--- a/drivers/net/ethernet/dec/tulip/timer.c
+++ b/drivers/net/ethernet/dec/tulip/timer.c
@@ -158,7 +158,7 @@ void comet_timer(unsigned long data)
 {
         struct net_device *dev = (struct net_device *)data;
         struct tulip_private *tp = netdev_priv(dev);
-        int next_tick = 60*HZ;
+        int next_tick = 2*HZ;
 
         if (tulip_debug > 1)
                 netdev_dbg(dev, "Comet link status %04x partner capability %04x\n",
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 2e7c5553955e..c2f5d2d3b932 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -557,9 +557,7 @@ static inline u16 be_max_qs(struct be_adapter *adapter)
 #define be_pvid_tagging_enabled(adapter)        (adapter->pvid)
 
 /* Is BE in QNQ multi-channel mode */
-#define be_is_qnq_mode(adapter)         (adapter->mc_type == FLEX10 ||  \
-                                         adapter->mc_type == vNIC1 ||   \
-                                         adapter->mc_type == UFP)
+#define be_is_qnq_mode(adapter)         (adapter->function_mode & QNQ_MODE)
 
 #define lancer_chip(adapter)    (adapter->pdev->device == OC_DEVICE_ID3 || \
                                  adapter->pdev->device == OC_DEVICE_ID4)
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 3e0a6b243806..59b3c056f329 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1091,7 +1091,7 @@ struct be_cmd_resp_modify_eq_delay {
  * based on the skew/IPL.
  */
 #define RDMA_ENABLED                            0x4
-#define FLEX10_MODE                             0x400
+#define QNQ_MODE                                0x400
 #define VNIC_MODE                               0x20000
 #define UMC_ENABLED                             0x1000000
 struct be_cmd_req_query_fw_cfg {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 6822b3d76d85..34a26e42f19d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3254,9 +3254,9 @@ err:
 
 static u8 be_convert_mc_type(u32 function_mode)
 {
-        if (function_mode & VNIC_MODE && function_mode & FLEX10_MODE)
+        if (function_mode & VNIC_MODE && function_mode & QNQ_MODE)
                 return vNIC1;
-        else if (function_mode & FLEX10_MODE)
+        else if (function_mode & QNQ_MODE)
                 return FLEX10;
         else if (function_mode & VNIC_MODE)
                 return vNIC2;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 38d9d276ab8b..77037fd377b8 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -320,6 +320,11 @@ static void *swap_buffer(void *bufaddr, int len)
         return bufaddr;
 }
 
+static inline bool is_ipv4_pkt(struct sk_buff *skb)
+{
+        return skb->protocol == htons(ETH_P_IP) && ip_hdr(skb)->version == 4;
+}
+
 static int
 fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
 {
@@ -330,7 +335,8 @@ fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
         if (unlikely(skb_cow_head(skb, 0)))
                 return -1;
 
-        ip_hdr(skb)->check = 0;
+        if (is_ipv4_pkt(skb))
+                ip_hdr(skb)->check = 0;
         *(__sum16 *)(skb->head + skb->csum_start + skb->csum_offset) = 0;
 
         return 0;
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 7f81ae66cc89..e912b6887d40 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4199,6 +4199,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "P5NSLI")
                 },
         },
+        {
+                .ident = "FUJITSU SIEMENS A8NE-FM",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTek Computer INC."),
+                        DMI_MATCH(DMI_BOARD_NAME, "A8NE-FM")
+                },
+        },
         {}
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5f42f6d6e4c6..82ab427290c3 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2439,7 +2439,8 @@ slave_start:
                             (num_vfs_argc > 1 || probe_vfs_argc > 1)) {
                                 mlx4_err(dev,
                                          "Invalid syntax of num_vfs/probe_vfs with IB port - single port VFs syntax is only supported when all ports are configured as ethernet\n");
-                                goto err_close;
+                                err = -EINVAL;
+                                goto err_master_mfunc;
                         }
                         for (i = 0; i < sizeof(nvfs)/sizeof(nvfs[0]); i++) {
                                 unsigned j;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index ff380dac6629..b988d16cd34e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1212,7 +1212,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
         for_each_slave(priv, cpsw_slave_open, priv);
 
         /* Add default VLAN */
-        cpsw_add_default_vlan(priv);
+        if (!priv->data.dual_emac)
+                cpsw_add_default_vlan(priv);
+        else
+                cpsw_ale_add_vlan(priv->ale, priv->data.default_vlan,
+                                  ALE_ALL_PORTS << priv->host_port,
+                                  ALE_ALL_PORTS << priv->host_port, 0, 0);
 
         if (!cpsw_common_res_usage_state(priv)) {
                 /* setup tx dma to fixed prio and zero offset */
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 14389f841d43..4c70360967c2 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2191,7 +2191,6 @@ static void tile_net_setup(struct net_device *dev)
 static void tile_net_dev_init(const char *name, const uint8_t *mac)
 {
         int ret;
-        int i;
         struct net_device *dev;
         struct tile_net_priv *priv;
 
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index c041f63a6d30..4ed38eaecea8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -189,7 +189,7 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
                                    "unable to teardown send buffer's gpadl\n");
                         return ret;
                 }
-                net_device->recv_buf_gpadl_handle = 0;
+                net_device->send_buf_gpadl_handle = 0;
         }
         if (net_device->send_buf) {
                 /* Free up the receive buffer */
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 4517b149ed07..50899416f668 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1137,6 +1137,8 @@ static int at86rf230_probe(struct spi_device *spi)
         dev->flags = IEEE802154_HW_OMIT_CKSUM | IEEE802154_HW_AACK;
 
         irq_type = irq_get_trigger_type(spi->irq);
+        if (!irq_type)
+                irq_type = IRQF_TRIGGER_RISING;
         if (irq_type & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING)) {
                 irq_worker = at86rf230_irqwork;
                 irq_handler = at86rf230_isr;
@@ -1168,7 +1170,8 @@ static int at86rf230_probe(struct spi_device *spi)
         if (rc)
                 goto err_hw_init;
 
-        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler, IRQF_SHARED,
+        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler,
+                              IRQF_SHARED | irq_type,
                               dev_name(&spi->dev), lp);
         if (rc)
                 goto err_hw_init;
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 6c622aedbae1..fdc1b418fa6a 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -16,9 +16,13 @@
 #include <linux/string.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/of_gpio.h>
+#include <linux/gpio/consumer.h>
 
 #define AT803X_INTR_ENABLE                      0x12
 #define AT803X_INTR_STATUS                      0x13
+#define AT803X_SMART_SPEED                      0x14
+#define AT803X_LED_CONTROL                      0x18
 #define AT803X_WOL_ENABLE                       0x01
 #define AT803X_DEVICE_ADDR                      0x03
 #define AT803X_LOC_MAC_ADDR_0_15_OFFSET         0x804C
@@ -35,10 +39,52 @@
 #define AT803X_DEBUG_SYSTEM_MODE_CTRL           0x05
 #define AT803X_DEBUG_RGMII_TX_CLK_DLY           BIT(8)
 
+#define ATH8030_PHY_ID 0x004dd076
+#define ATH8031_PHY_ID 0x004dd074
+#define ATH8035_PHY_ID 0x004dd072
+
 MODULE_DESCRIPTION("Atheros 803x PHY driver");
 MODULE_AUTHOR("Matus Ujhelyi");
 MODULE_LICENSE("GPL");
 
+struct at803x_priv {
+        bool phy_reset:1;
+        struct gpio_desc *gpiod_reset;
+};
+
+struct at803x_context {
+        u16 bmcr;
+        u16 advertise;
+        u16 control1000;
+        u16 int_enable;
+        u16 smart_speed;
+        u16 led_control;
+};
+
+/* save relevant PHY registers to private copy */
+static void at803x_context_save(struct phy_device *phydev,
+                                struct at803x_context *context)
+{
+        context->bmcr = phy_read(phydev, MII_BMCR);
+        context->advertise = phy_read(phydev, MII_ADVERTISE);
+        context->control1000 = phy_read(phydev, MII_CTRL1000);
+        context->int_enable = phy_read(phydev, AT803X_INTR_ENABLE);
+        context->smart_speed = phy_read(phydev, AT803X_SMART_SPEED);
+        context->led_control = phy_read(phydev, AT803X_LED_CONTROL);
+}
+
+/* restore relevant PHY registers from private copy */
+static void at803x_context_restore(struct phy_device *phydev,
+                                   const struct at803x_context *context)
+{
+        phy_write(phydev, MII_BMCR, context->bmcr);
+        phy_write(phydev, MII_ADVERTISE, context->advertise);
+        phy_write(phydev, MII_CTRL1000, context->control1000);
+        phy_write(phydev, AT803X_INTR_ENABLE, context->int_enable);
+        phy_write(phydev, AT803X_SMART_SPEED, context->smart_speed);
+        phy_write(phydev, AT803X_LED_CONTROL, context->led_control);
+}
+
 static int at803x_set_wol(struct phy_device *phydev,
                           struct ethtool_wolinfo *wol)
 {
@@ -142,6 +188,26 @@ static int at803x_resume(struct phy_device *phydev)
         return 0;
 }
 
+static int at803x_probe(struct phy_device *phydev)
+{
+        struct device *dev = &phydev->dev;
+        struct at803x_priv *priv;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->gpiod_reset = devm_gpiod_get(dev, "reset");
+        if (IS_ERR(priv->gpiod_reset))
+                priv->gpiod_reset = NULL;
+        else
+                gpiod_direction_output(priv->gpiod_reset, 1);
+
+        phydev->priv = priv;
+
+        return 0;
+}
+
 static int at803x_config_init(struct phy_device *phydev)
 {
         int ret;
@@ -189,58 +255,99 @@ static int at803x_config_intr(struct phy_device *phydev)
         return err;
 }
 
+static void at803x_link_change_notify(struct phy_device *phydev)
+{
+        struct at803x_priv *priv = phydev->priv;
+
+        /*
+         * Conduct a hardware reset for AT8030 every time a link loss is
+         * signalled. This is necessary to circumvent a hardware bug that
+         * occurs when the cable is unplugged while TX packets are pending
+         * in the FIFO. In such cases, the FIFO enters an error mode it
+         * cannot recover from by software.
+         */
+        if (phydev->drv->phy_id == ATH8030_PHY_ID) {
+                if (phydev->state == PHY_NOLINK) {
+                        if (priv->gpiod_reset && !priv->phy_reset) {
+                                struct at803x_context context;
+
+                                at803x_context_save(phydev, &context);
+
+                                gpiod_set_value(priv->gpiod_reset, 0);
+                                msleep(1);
+                                gpiod_set_value(priv->gpiod_reset, 1);
+                                msleep(1);
+
+                                at803x_context_restore(phydev, &context);
+
+                                dev_dbg(&phydev->dev, "%s(): phy was reset\n",
+                                        __func__);
+                                priv->phy_reset = true;
+                        }
+                } else {
+                        priv->phy_reset = false;
+                }
+        }
+}
+
 static struct phy_driver at803x_driver[] = {
 {
         /* ATHEROS 8035 */
-        .phy_id         = 0x004dd072,
-        .name           = "Atheros 8035 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .driver         = {
+        .phy_id                 = ATH8035_PHY_ID,
+        .name                   = "Atheros 8035 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 }, {
         /* ATHEROS 8030 */
-        .phy_id         = 0x004dd076,
-        .name           = "Atheros 8030 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .driver         = {
+        .phy_id                 = ATH8030_PHY_ID,
+        .name                   = "Atheros 8030 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 }, {
         /* ATHEROS 8031 */
-        .phy_id         = 0x004dd074,
-        .name           = "Atheros 8031 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .ack_interrupt  = &at803x_ack_interrupt,
-        .config_intr    = &at803x_config_intr,
-        .driver         = {
+        .phy_id                 = ATH8031_PHY_ID,
+        .name                   = "Atheros 8031 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .ack_interrupt          = &at803x_ack_interrupt,
+        .config_intr            = &at803x_config_intr,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 } };
@@ -260,9 +367,9 @@ module_init(atheros_init);
 module_exit(atheros_exit);
 
 static struct mdio_device_id __maybe_unused atheros_tbl[] = {
-        { 0x004dd076, 0xffffffef },
-        { 0x004dd074, 0xffffffef },
-        { 0x004dd072, 0xffffffef },
+        { ATH8030_PHY_ID, 0xffffffef },
+        { ATH8031_PHY_ID, 0xffffffef },
+        { ATH8035_PHY_ID, 0xffffffef },
         { }
 };
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 3bc079a67a3d..f7c61812ea4a 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -720,6 +720,9 @@ void phy_state_machine(struct work_struct *work)
 
         mutex_lock(&phydev->lock);
 
+        if (phydev->drv->link_change_notify)
+                phydev->drv->link_change_notify(phydev);
+
         switch (phydev->state) {
         case PHY_DOWN:
         case PHY_STARTING:
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index ad4a94e9ff57..87526443841f 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -83,6 +83,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
 #include "slip.h"
 #ifdef CONFIG_INET
 #include <linux/ip.h>
@@ -416,36 +417,46 @@ static void sl_encaps(struct slip *sl, unsigned char *icp, int len)
 #endif
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slip_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slip_transmit(struct work_struct *work)
 {
+        struct slip *sl = container_of(work, struct slip, tx_work);
         int actual;
-        struct slip *sl = tty->disc_data;
 
+        spin_lock_bh(&sl->lock);
         /* First make sure we're connected. */
-        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                 return;
+        }
 
-        spin_lock_bh(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                 spin_unlock_bh(&sl->lock);
                 sl_unlock(sl);
                 return;
         }
 
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
         spin_unlock_bh(&sl->lock);
 }
 
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slip_write_wakeup(struct tty_struct *tty)
+{
+        struct slip *sl = tty->disc_data;
+
+        schedule_work(&sl->tx_work);
+}
+
 static void sl_tx_timeout(struct net_device *dev)
 {
         struct slip *sl = netdev_priv(dev);
@@ -749,6 +760,7 @@ static struct slip *sl_alloc(dev_t line)
         sl->magic       = SLIP_MAGIC;
         sl->dev         = dev;
         spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slip_transmit);
         sl->mode        = SL_MODE_DEFAULT;
 #ifdef CONFIG_SLIP_SMART
         /* initialize timer_list struct */
@@ -872,8 +884,12 @@ static void slip_close(struct tty_struct *tty)
         if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty)
                 return;
 
+        spin_lock_bh(&sl->lock);
         tty->disc_data = NULL;
         sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+
+        flush_work(&sl->tx_work);
 
         /* VSV = very important to remove timers */
 #ifdef CONFIG_SLIP_SMART
diff --git a/drivers/net/slip/slip.h b/drivers/net/slip/slip.h
index 67673cf1266b..cf32aadf508f 100644
--- a/drivers/net/slip/slip.h
+++ b/drivers/net/slip/slip.h
@@ -53,6 +53,7 @@ struct slip {
   struct tty_struct     *tty;           /* ptr to TTY structure         */
   struct net_device     *dev;           /* easy for intr handling       */
   spinlock_t            lock;
+  struct work_struct    tx_work;        /* Flushes transmit buffer      */
 
 #ifdef SL_INCLUDE_CSLIP
   struct slcompress     *slcomp;        /* for header compression       */
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index f9822bc75425..5d95a13dbe2a 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -84,12 +84,13 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
         ctx = drvstate->ctx;
 
         if (usbnet_dev->status)
-                /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256
-                 * decimal (0x100)"
+                /* The wMaxCommand buffer must be big enough to hold
+                 * any message from the modem. Experience has shown
+                 * that some replies are more than 256 bytes long
                  */
                 subdriver = usb_cdc_wdm_register(ctx->control,
                                                  &usbnet_dev->status->desc,
-                                                 256, /* wMaxCommand */
+                                                 1024, /* wMaxCommand */
                                                  huawei_cdc_ncm_wdm_manage_power);
         if (IS_ERR(subdriver)) {
                 ret = PTR_ERR(subdriver);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 97394345e5dd..b76f7dcde0db 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2589,8 +2589,8 @@ vmxnet3_open(struct net_device *netdev)
         for (i = 0; i < adapter->num_tx_queues; i++)
                 spin_lock_init(&adapter->tx_queue[i].tx_lock);
 
-        err = vmxnet3_create_queues(adapter, VMXNET3_DEF_TX_RING_SIZE,
-                                    VMXNET3_DEF_RX_RING_SIZE,
+        err = vmxnet3_create_queues(adapter, adapter->tx_ring_size,
+                                    adapter->rx_ring_size,
                                     VMXNET3_DEF_RX_RING_SIZE);
         if (err)
                 goto queue_err;
@@ -2968,6 +2968,9 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         adapter->netdev = netdev;
         adapter->pdev = pdev;
 
+        adapter->tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
+        adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
+
         spin_lock_init(&adapter->cmd_lock);
         adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
                                              sizeof(struct vmxnet3_adapter),
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 40c1c7b0d9e0..b725fd9e7803 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -449,8 +449,8 @@ vmxnet3_get_ringparam(struct net_device *netdev,
         param->rx_mini_max_pending = 0;
         param->rx_jumbo_max_pending = 0;
 
-        param->rx_pending = adapter->rx_queue[0].rx_ring[0].size;
-        param->tx_pending = adapter->tx_queue[0].tx_ring.size;
+        param->rx_pending = adapter->rx_ring_size;
+        param->tx_pending = adapter->tx_ring_size;
         param->rx_mini_pending = 0;
         param->rx_jumbo_pending = 0;
 }
@@ -529,9 +529,11 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                          * size */
                         netdev_err(netdev, "failed to apply new sizes, "
                                    "try the default ones\n");
+                        new_rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
+                        new_tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
                         err = vmxnet3_create_queues(adapter,
-                                                    VMXNET3_DEF_TX_RING_SIZE,
-                                                    VMXNET3_DEF_RX_RING_SIZE,
+                                                    new_tx_ring_size,
+                                                    new_rx_ring_size,
                                                     VMXNET3_DEF_RX_RING_SIZE);
                         if (err) {
                                 netdev_err(netdev, "failed to create queues "
@@ -545,6 +547,8 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                         netdev_err(netdev, "failed to re-activate, error %d."
                                    " Closing it\n", err);
         }
+        adapter->tx_ring_size = new_tx_ring_size;
+        adapter->rx_ring_size = new_rx_ring_size;
 
 out:
         clear_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state);
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 190569d02450..29ee77f2c97f 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -349,6 +349,11 @@ struct vmxnet3_adapter {
         u32     link_speed; /* in mbps */
 
         u64     tx_timeout_count;
+
+        /* Ring sizes */
+        u32 tx_ring_size;
+        u32 rx_ring_size;
+
         struct work_struct work;
 
         unsigned long  state;    /* VMXNET3_STATE_BIT_xxx */
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index e3f67b8d3f80..40fd9b7b1426 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -36,7 +36,7 @@ config B43_SSB
 choice
         prompt "Supported bus types"
         depends on B43
-        default B43_BCMA_AND_SSB
+        default B43_BUSES_BCMA_AND_SSB
 
 config B43_BUSES_BCMA_AND_SSB
         bool "BCMA and SSB"
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 32538ac5f7e4..0d6a0bb1f876 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5221,6 +5221,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         /* We don't support 5 GHz on some PHYs yet */
         switch (dev->phy.type) {
         case B43_PHYTYPE_A:
+        case B43_PHYTYPE_G:
         case B43_PHYTYPE_N:
         case B43_PHYTYPE_LP:
         case B43_PHYTYPE_HT:
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 4f38f19b8e3d..6e6ef3fc2247 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
                 break;
         case B43_PHYTYPE_G:
                 status.band = IEEE80211_BAND_2GHZ;
-                /* chanid is the radio channel cookie value as used
-                 * to tune the radio. */
-                status.freq = chanid + 2400;
+                /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
+                 * has been modified to be compatible with N-PHY and others.
+                 */
+                if (dev->fw.rev >= 508)
+                        status.freq = ieee80211_channel_to_frequency(chanid, status.band);
+                else
+                        status.freq = chanid + 2400;
                 break;
         case B43_PHYTYPE_N:
         case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 574d4b597468..2cc9b6fca490 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -50,7 +50,7 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
                 return -1;
         }
         mapping.len = size;
-        memcpy(skb->cb, &mapping, sizeof(mapping));
+        mwifiex_store_mapping(skb, &mapping);
         return 0;
 }
 
@@ -60,7 +60,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,
         struct pcie_service_card *card = adapter->card;
         struct mwifiex_dma_mapping mapping;
 
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
         pci_unmap_single(card->dev, mapping.addr, mapping.len, flags);
 }
 
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index ddae57021397..caadb3737b9e 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,32 +20,55 @@
 #ifndef _MWIFIEX_UTIL_H_
 #define _MWIFIEX_UTIL_H_
 
+struct mwifiex_dma_mapping {
+        dma_addr_t addr;
+        size_t len;
+};
+
+struct mwifiex_cb {
+        struct mwifiex_dma_mapping dma_mapping;
+        union {
+                struct mwifiex_rxinfo rx_info;
+                struct mwifiex_txinfo tx_info;
+        };
+};
+
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_rxinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        BUILD_BUG_ON(sizeof(struct mwifiex_cb) > sizeof(skb->cb));
+        return &cb->rx_info;
 }
 
 static inline struct mwifiex_txinfo *MWIFIEX_SKB_TXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_txinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        return &cb->tx_info;
 }
 
-struct mwifiex_dma_mapping {
-        dma_addr_t addr;
-        size_t len;
-};
+static inline void mwifiex_store_mapping(struct sk_buff *skb,
+                                         struct mwifiex_dma_mapping *mapping)
+{
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        memcpy(&cb->dma_mapping, mapping, sizeof(*mapping));
+}
 
-static inline void MWIFIEX_SKB_PACB(struct sk_buff *skb,
-                                        struct mwifiex_dma_mapping *mapping)
+static inline void mwifiex_get_mapping(struct sk_buff *skb,
+                                       struct mwifiex_dma_mapping *mapping)
 {
-        memcpy(mapping, skb->cb, sizeof(*mapping));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        memcpy(mapping, &cb->dma_mapping, sizeof(*mapping));
 }
 
 static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
 {
         struct mwifiex_dma_mapping mapping;
 
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
 
         return mapping.addr;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2f1cd929c6f6..a511cccc9f01 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
         /*
          * Detect if this device has an hardware controlled radio.
          */
-        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
+        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
                 __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
+                /*
+                 * On this device RFKILL initialized during probe does not work.
+                 */
+                __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
+        }
 
         /*
          * Check if the BBP tuning should be enabled.
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a49c3d73ea2c..e11dab2216c6 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -229,6 +229,27 @@ static enum hrtimer_restart rt2800usb_tx_sta_fifo_timeout(struct hrtimer *timer)
 /*
  * Firmware functions
  */
+static int rt2800usb_autorun_detect(struct rt2x00_dev *rt2x00dev)
+{
+        __le32 reg;
+        u32 fw_mode;
+
+        /* cannot use rt2x00usb_register_read here as it uses different
+         * mode (MULTI_READ vs. DEVICE_MODE) and does not pass the
+         * magic value USB_MODE_AUTORUN (0x11) to the device, thus the
+         * returned value would be invalid.
+         */
+        rt2x00usb_vendor_request(rt2x00dev, USB_DEVICE_MODE,
+                                 USB_VENDOR_REQUEST_IN, 0, USB_MODE_AUTORUN,
+                                 &reg, sizeof(reg), REGISTER_TIMEOUT_FIRMWARE);
+        fw_mode = le32_to_cpu(reg);
+
+        if ((fw_mode & 0x00000003) == 2)
+                return 1;
+
+        return 0;
+}
+
 static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev)
 {
         return FIRMWARE_RT2870;
@@ -257,8 +278,13 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
         /*
          * Write firmware to device.
          */
-        rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
-                                      data + offset, length);
+        if (rt2800usb_autorun_detect(rt2x00dev)) {
+                rt2x00_info(rt2x00dev,
+                            "Firmware loading not required - NIC in AutoRun mode\n");
+        } else {
+                rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                              data + offset, length);
+        }
 
         rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
         rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
@@ -735,11 +761,18 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
 /*
  * Device probe functions.
  */
+static int rt2800usb_efuse_detect(struct rt2x00_dev *rt2x00dev)
+{
+        if (rt2800usb_autorun_detect(rt2x00dev))
+                return 1;
+        return rt2800_efuse_detect(rt2x00dev);
+}
+
 static int rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
-        if (rt2800_efuse_detect(rt2x00dev))
+        if (rt2800usb_efuse_detect(rt2x00dev))
                 retval = rt2800_read_eeprom_efuse(rt2x00dev);
         else
                 retval = rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 010b76505243..d13f25cd70d5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
         REQUIRE_SW_SEQNO,
         REQUIRE_HT_TX_DESC,
         REQUIRE_PS_AUTOWAKE,
+        REQUIRE_DELAYED_RFKILL,
 
         /*
          * Capabilities
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 2bde6729f5e6..4fa43a2eeb73 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
                 return;
 
         /*
-         * Unregister extra components.
+         * Stop rfkill polling.
          */
-        rt2x00rfkill_unregister(rt2x00dev);
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
 
         /*
          * Allow the HW to uninitialize.
@@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
 
         set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
 
+        /*
+         * Start rfkill polling.
+         */
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
+
         return 0;
 }
 
@@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         rt2x00link_register(rt2x00dev);
         rt2x00leds_register(rt2x00dev);
         rt2x00debug_register(rt2x00dev);
-        rt2x00rfkill_register(rt2x00dev);
+
+        /*
+         * Start rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
 
         return 0;
 
@@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
 
         /*
+         * Stop rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
+
+        /*
          * Disable radio.
          */
         rt2x00lib_disable_radio(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 212ac4842c16..004dff9b962d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         crypto.cipher = rt2x00crypto_key_to_cipher(key);
         if (crypto.cipher == CIPHER_NONE)
                 return -EOPNOTSUPP;
+        if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
+                return -EOPNOTSUPP;
 
         crypto.cmd = cmd;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index e7bcf62347d5..831b65f93feb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -93,6 +93,7 @@ enum rt2x00usb_mode_offset {
         USB_MODE_SLEEP = 7,     /* RT73USB */
         USB_MODE_FIRMWARE = 8,  /* RT73USB */
         USB_MODE_WAKEUP = 9,    /* RT73USB */
+        USB_MODE_AUTORUN = 17, /* RT2800USB */
 };
 
 /**
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4dd7c4a1923b..2532ce85d718 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -222,6 +222,7 @@ struct xenvif {
 
         /* Queues */
         struct xenvif_queue *queues;
+        unsigned int num_queues; /* active queues, resource allocated */
 
         /* Miscellaneous private stuff. */
         struct net_device *dev;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 852da34b8961..9e97c7ca0ddd 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -137,32 +137,11 @@ static void xenvif_wake_queue_callback(unsigned long data)
         }
 }
 
-static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
-                               void *accel_priv, select_queue_fallback_t fallback)
-{
-        unsigned int num_queues = dev->real_num_tx_queues;
-        u32 hash;
-        u16 queue_index;
-
-        /* First, check if there is only one queue to optimise the
-         * single-queue or old frontend scenario.
-         */
-        if (num_queues == 1) {
-                queue_index = 0;
-        } else {
-                /* Use skb_get_hash to obtain an L4 hash if available */
-                hash = skb_get_hash(skb);
-                queue_index = hash % num_queues;
-        }
-
-        return queue_index;
-}
-
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         u16 index;
         int min_slots_needed;
 
@@ -225,7 +204,7 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned long rx_bytes = 0;
         unsigned long rx_packets = 0;
         unsigned long tx_bytes = 0;
@@ -256,7 +235,7 @@ out:
 static void xenvif_up(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -272,7 +251,7 @@ static void xenvif_up(struct xenvif *vif)
 static void xenvif_down(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -379,7 +358,7 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                                      struct ethtool_stats *stats, u64 * data)
 {
         struct xenvif *vif = netdev_priv(dev);
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         int i;
         unsigned int queue_index;
         struct xenvif_stats *vif_stats;
@@ -424,7 +403,6 @@ static const struct net_device_ops xenvif_netdev_ops = {
         .ndo_fix_features = xenvif_fix_features,
         .ndo_set_mac_address = eth_mac_addr,
         .ndo_validate_addr   = eth_validate_addr,
-        .ndo_select_queue = xenvif_select_queue,
 };
 
 struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
@@ -438,7 +416,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         snprintf(name, IFNAMSIZ - 1, "vif%u.%u", domid, handle);
         /* Allocate a netdev with the max. supported number of queues.
          * When the guest selects the desired number, it will be updated
-         * via netif_set_real_num_tx_queues().
+         * via netif_set_real_num_*_queues().
          */
         dev = alloc_netdev_mq(sizeof(struct xenvif), name, ether_setup,
                               xenvif_max_queues);
@@ -458,11 +436,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->dev = dev;
         vif->disabled = false;
 
-        /* Start out with no queues. The call below does not require
-         * rtnl_lock() as it happens before register_netdev().
-         */
+        /* Start out with no queues. */
         vif->queues = NULL;
-        netif_set_real_num_tx_queues(dev, 0);
+        vif->num_queues = 0;
 
         dev->netdev_ops = &xenvif_netdev_ops;
         dev->hw_features = NETIF_F_SG |
@@ -677,7 +653,7 @@ static void xenvif_wait_unmap_timeout(struct xenvif_queue *queue,
 void xenvif_disconnect(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         if (netif_carrier_ok(vif->dev))
@@ -724,7 +700,7 @@ void xenvif_deinit_queue(struct xenvif_queue *queue)
 void xenvif_free(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
         /* Here we want to avoid timeout messages if an skb can be legitimately
          * stuck somewhere else. Realistically this could be an another vif's
@@ -748,12 +724,9 @@ void xenvif_free(struct xenvif *vif)
                 xenvif_deinit_queue(queue);
         }
 
-        /* Free the array of queues. The call below does not require
-         * rtnl_lock() because it happens after unregister_netdev().
-         */
-        netif_set_real_num_tx_queues(vif->dev, 0);
         vfree(vif->queues);
         vif->queues = NULL;
+        vif->num_queues = 0;
 
         free_netdev(vif->dev);
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 96c63dc2509e..3d85acd84bad 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -527,9 +527,7 @@ static void connect(struct backend_info *be)
         /* Use the number of queues requested by the frontend */
         be->vif->queues = vzalloc(requested_num_queues *
                                   sizeof(struct xenvif_queue));
-        rtnl_lock();
-        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
-        rtnl_unlock();
+        be->vif->num_queues = requested_num_queues;
 
         for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
                 queue = &be->vif->queues[queue_index];
@@ -546,9 +544,7 @@ static void connect(struct backend_info *be)
                          * earlier queues can be destroyed using the regular
                          * disconnect logic.
                          */
-                        rtnl_lock();
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
+                        be->vif->num_queues = queue_index;
                         goto err;
                 }
 
@@ -561,13 +557,19 @@ static void connect(struct backend_info *be)
                          * and also clean up any previously initialised queues.
                          */
                         xenvif_deinit_queue(queue);
-                        rtnl_lock();
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
+                        be->vif->num_queues = queue_index;
                         goto err;
                 }
         }
 
+        /* Initialisation completed, tell core driver the number of
+         * active queues.
+         */
+        rtnl_lock();
+        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
+        netif_set_real_num_rx_queues(be->vif->dev, requested_num_queues);
+        rtnl_unlock();
+
         xenvif_carrier_on(be->vif);
 
         unregister_hotplug_status_watch(be);
@@ -582,13 +584,11 @@ static void connect(struct backend_info *be)
         return;
 
 err:
-        if (be->vif->dev->real_num_tx_queues > 0)
+        if (be->vif->num_queues > 0)
                 xenvif_disconnect(be->vif); /* Clean up existing queues */
         vfree(be->vif->queues);
         be->vif->queues = NULL;
-        rtnl_lock();
-        netif_set_real_num_tx_queues(be->vif->dev, 0);
-        rtnl_unlock();
+        be->vif->num_queues = 0;
         return;
 }
 
@@ -596,7 +596,7 @@ err:
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue)
 {
         struct xenbus_device *dev = be->dev;
-        unsigned int num_queues = queue->vif->dev->real_num_tx_queues;
+        unsigned int num_queues = queue->vif->num_queues;
         unsigned long tx_ring_ref, rx_ring_ref;
         unsigned int tx_evtchn, rx_evtchn;
         int err;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 5a7872ac3566..2ccb4a02368b 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1287,7 +1287,7 @@ static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
 
         if (likely(netif_carrier_ok(dev) &&
                    RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
-                        napi_schedule(&queue->napi);
+                napi_schedule(&queue->napi);
 
         return IRQ_HANDLED;
 }
@@ -1437,10 +1437,11 @@ static void xennet_end_access(int ref, void *page)
 static void xennet_disconnect_backend(struct netfront_info *info)
 {
         unsigned int i = 0;
-        struct netfront_queue *queue = NULL;
         unsigned int num_queues = info->netdev->real_num_tx_queues;
 
         for (i = 0; i < num_queues; ++i) {
+                struct netfront_queue *queue = &info->queues[i];
+
                 /* Stop old i/f to prevent errors whilst we rebuild the state. */
                 spin_lock_bh(&queue->rx_lock);
                 spin_lock_irq(&queue->tx_lock);
@@ -1698,8 +1699,6 @@ static int xennet_init_queue(struct netfront_queue *queue)
                 goto exit_free_tx;
         }
 
-        netif_napi_add(queue->info->netdev, &queue->napi, xennet_poll, 64);
-
         return 0;
 
  exit_free_tx:
@@ -1790,6 +1789,70 @@ error:
         return err;
 }
 
+static void xennet_destroy_queues(struct netfront_info *info)
+{
+        unsigned int i;
+
+        rtnl_lock();
+
+        for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+
+                if (netif_running(info->netdev))
+                        napi_disable(&queue->napi);
+                netif_napi_del(&queue->napi);
+        }
+
+        rtnl_unlock();
+
+        kfree(info->queues);
+        info->queues = NULL;
+}
+
+static int xennet_create_queues(struct netfront_info *info,
+                                unsigned int num_queues)
+{
+        unsigned int i;
+        int ret;
+
+        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),
+                               GFP_KERNEL);
+        if (!info->queues)
+                return -ENOMEM;
+
+        rtnl_lock();
+
+        for (i = 0; i < num_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+
+                queue->id = i;
+                queue->info = info;
+
+                ret = xennet_init_queue(queue);
+                if (ret < 0) {
+                        dev_warn(&info->netdev->dev, "only created %d queues\n",
+                                 num_queues);
+                        num_queues = i;
+                        break;
+                }
+
+                netif_napi_add(queue->info->netdev, &queue->napi,
+                               xennet_poll, 64);
+                if (netif_running(info->netdev))
+                        napi_enable(&queue->napi);
+        }
+
+        netif_set_real_num_tx_queues(info->netdev, num_queues);
+
+        rtnl_unlock();
+
+        if (num_queues == 0) {
+                dev_err(&info->netdev->dev, "no queues\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
 /* Common code used when first setting up, and when resuming. */
 static int talk_to_netback(struct xenbus_device *dev,
                            struct netfront_info *info)
@@ -1826,42 +1889,20 @@ static int talk_to_netback(struct xenbus_device *dev,
                 goto out;
         }
 
-        /* Allocate array of queues */
-        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue), GFP_KERNEL);
-        if (!info->queues) {
-                err = -ENOMEM;
-                goto out;
-        }
-        rtnl_lock();
-        netif_set_real_num_tx_queues(info->netdev, num_queues);
-        rtnl_unlock();
+        if (info->queues)
+                xennet_destroy_queues(info);
+
+        err = xennet_create_queues(info, num_queues);
+        if (err < 0)
+                goto destroy_ring;
 
         /* Create shared ring, alloc event channel -- for each queue */
         for (i = 0; i < num_queues; ++i) {
                 queue = &info->queues[i];
-                queue->id = i;
-                queue->info = info;
-                err = xennet_init_queue(queue);
-                if (err) {
-                        /* xennet_init_queue() cleans up after itself on failure,
-                         * but we still have to clean up any previously initialised
-                         * queues. If i > 0, set num_queues to i, then goto
-                         * destroy_ring, which calls xennet_disconnect_backend()
-                         * to tidy up.
-                         */
-                        if (i > 0) {
-                                rtnl_lock();
-                                netif_set_real_num_tx_queues(info->netdev, i);
-                                rtnl_unlock();
-                                goto destroy_ring;
-                        } else {
-                                goto out;
-                        }
-                }
                 err = setup_netfront(dev, queue, feature_split_evtchn);
                 if (err) {
-                        /* As for xennet_init_queue(), setup_netfront() will tidy
-                         * up the current queue on error, but we need to clean up
+                        /* setup_netfront() will tidy up the current
+                         * queue on error, but we need to clean up
                          * those already allocated.
                          */
                         if (i > 0) {
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index fb4a59830648..a3bf2122a8d5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -323,11 +323,13 @@ int of_phy_register_fixed_link(struct device_node *np)
         fixed_link_node = of_get_child_by_name(np, "fixed-link");
         if (fixed_link_node) {
                 status.link = 1;
-                status.duplex = of_property_read_bool(np, "full-duplex");
+                status.duplex = of_property_read_bool(fixed_link_node,
+                                                      "full-duplex");
                 if (of_property_read_u32(fixed_link_node, "speed", &status.speed))
                         return -EINVAL;
-                status.pause = of_property_read_bool(np, "pause");
-                status.asym_pause = of_property_read_bool(np, "asym-pause");
+                status.pause = of_property_read_bool(fixed_link_node, "pause");
+                status.asym_pause = of_property_read_bool(fixed_link_node,
+                                                          "asym-pause");
                 of_node_put(fixed_link_node);
                 return fixed_phy_register(PHY_POLL, &status, np);
         }
diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
index 6aea373547f6..ee3de3421f2d 100644
--- a/drivers/ptp/Kconfig
+++ b/drivers/ptp/Kconfig
@@ -74,7 +74,7 @@ config DP83640_PHY
 
 config PTP_1588_CLOCK_PCH
         tristate "Intel PCH EG20T as PTP clock"
-        depends on X86 || COMPILE_TEST
+        depends on X86_32 || COMPILE_TEST
         depends on HAS_IOMEM && NET
         select PTP_1588_CLOCK
         help
diff --git a/drivers/regulator/bcm590xx-regulator.c b/drivers/regulator/bcm590xx-regulator.c
index 57544e254a78..58ece59367ae 100644
--- a/drivers/regulator/bcm590xx-regulator.c
+++ b/drivers/regulator/bcm590xx-regulator.c
@@ -119,6 +119,10 @@ static const unsigned int ldo_c_table[] = {
         2900000, 3000000, 3300000,
 };
 
+static const unsigned int ldo_vbus[] = {
+        5000000,
+};
+
 /* DCDC group CSR: supported voltages in microvolts */
 static const struct regulator_linear_range dcdc_csr_ranges[] = {
         REGULATOR_LINEAR_RANGE(860000, 2, 50, 10000),
@@ -192,6 +196,7 @@ static struct bcm590xx_info bcm590xx_regs[] = {
         BCM590XX_REG_TABLE(gpldo4, ldo_a_table),
         BCM590XX_REG_TABLE(gpldo5, ldo_a_table),
         BCM590XX_REG_TABLE(gpldo6, ldo_a_table),
+        BCM590XX_REG_TABLE(vbus, ldo_vbus),
 };
 
 struct bcm590xx_reg {
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index b982f0ff4e01..93b4ad842901 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -325,6 +325,10 @@ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
         if (rail_enable)
                 palmas_smps_write(pmic->palmas,
                         palmas_regs_info[id].ctrl_addr, reg);
+
+        /* Switch the enable value to ensure this is used for enable */
+        pmic->desc[id].enable_val = pmic->current_reg_mode[id];
+
         return 0;
 }
 
@@ -964,6 +968,14 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                                 return ret;
                         pmic->current_reg_mode[id] = reg &
                                         PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+
+                        pmic->desc[id].enable_reg =
+                                        PALMAS_BASE_TO_REG(PALMAS_SMPS_BASE,
+                                                palmas_regs_info[id].ctrl_addr);
+                        pmic->desc[id].enable_mask =
+                                        PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+                        /* set_mode overrides this value */
+                        pmic->desc[id].enable_val = SMPS_CTRL_MODE_ON;
                 }
 
                 pmic->desc[id].type = REGULATOR_VOLTAGE;
diff --git a/drivers/regulator/tps65218-regulator.c b/drivers/regulator/tps65218-regulator.c
index 69b4b7750410..9effe48c605e 100644
--- a/drivers/regulator/tps65218-regulator.c
+++ b/drivers/regulator/tps65218-regulator.c
@@ -209,7 +209,7 @@ static const struct regulator_desc regulators[] = {
                            1, -1, -1, TPS65218_REG_ENABLE1,
                            TPS65218_ENABLE1_DC6_EN, NULL, NULL, 0, 0),
         TPS65218_REGULATOR("LDO1", TPS65218_LDO_1, tps65218_ldo1_dcdc34_ops, 64,
-                           TPS65218_REG_CONTROL_DCDC4,
+                           TPS65218_REG_CONTROL_LDO1,
                            TPS65218_CONTROL_LDO1_MASK, TPS65218_REG_ENABLE2,
                            TPS65218_ENABLE2_LDO1_EN, NULL, ldo1_dcdc3_ranges,
                            2, 0),
@@ -240,6 +240,7 @@ static int tps65218_regulator_probe(struct platform_device *pdev)
         config.init_data = init_data;
         config.driver_data = tps;
         config.regmap = tps->regmap;
+        config.of_node = pdev->dev.of_node;
 
         rdev = devm_regulator_register(&pdev->dev, &regulators[id], &config);
         if (IS_ERR(rdev)) {
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index a98df7eeb42d..fe792106bdc5 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -118,6 +118,7 @@ static void lpss_ssp_setup(struct driver_data *drv_data)
          */
         orig = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
 
+        /* Test SPI_CS_CONTROL_SW_MODE bit enabling */
         value = orig | SPI_CS_CONTROL_SW_MODE;
         writel(value, drv_data->ioaddr + offset + SPI_CS_CONTROL);
         value = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
@@ -126,10 +127,13 @@ static void lpss_ssp_setup(struct driver_data *drv_data)
                 goto detection_done;
         }
 
-        value &= ~SPI_CS_CONTROL_SW_MODE;
+        orig = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
+
+        /* Test SPI_CS_CONTROL_SW_MODE bit disabling */
+        value = orig & ~SPI_CS_CONTROL_SW_MODE;
         writel(value, drv_data->ioaddr + offset + SPI_CS_CONTROL);
         value = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
-        if (value != orig) {
+        if (value != (orig & ~SPI_CS_CONTROL_SW_MODE)) {
                 offset = 0x800;
                 goto detection_done;
         }
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index fc1de86d3c8a..c08da380cb23 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -424,31 +424,6 @@ static int spi_qup_io_config(struct spi_device *spi, struct spi_transfer *xfer)
         return 0;
 }
 
-static void spi_qup_set_cs(struct spi_device *spi, bool enable)
-{
-        struct spi_qup *controller = spi_master_get_devdata(spi->master);
-
-        u32 iocontol, mask;
-
-        iocontol = readl_relaxed(controller->base + SPI_IO_CONTROL);
-
-        /* Disable auto CS toggle and use manual */
-        iocontol &= ~SPI_IO_C_MX_CS_MODE;
-        iocontol |= SPI_IO_C_FORCE_CS;
-
-        iocontol &= ~SPI_IO_C_CS_SELECT_MASK;
-        iocontol |= SPI_IO_C_CS_SELECT(spi->chip_select);
-
-        mask = SPI_IO_C_CS_N_POLARITY_0 << spi->chip_select;
-
-        if (enable)
-                iocontol |= mask;
-        else
-                iocontol &= ~mask;
-
-        writel_relaxed(iocontol, controller->base + SPI_IO_CONTROL);
-}
-
 static int spi_qup_transfer_one(struct spi_master *master,
                               struct spi_device *spi,
                               struct spi_transfer *xfer)
@@ -571,12 +546,16 @@ static int spi_qup_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
+        /* use num-cs unless not present or out of range */
+        if (of_property_read_u16(dev->of_node, "num-cs",
+                        &master->num_chipselect) ||
+                        (master->num_chipselect > SPI_NUM_CHIPSELECTS))
+                master->num_chipselect = SPI_NUM_CHIPSELECTS;
+
         master->bus_num = pdev->id;
         master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
-        master->num_chipselect = SPI_NUM_CHIPSELECTS;
         master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32);
         master->max_speed_hz = max_freq;
-        master->set_cs = spi_qup_set_cs;
         master->transfer_one = spi_qup_transfer_one;
         master->dev.of_node = pdev->dev.of_node;
         master->auto_runtime_pm = true;
@@ -640,16 +619,19 @@ static int spi_qup_probe(struct platform_device *pdev)
         if (ret)
                 goto error;
 
-        ret = devm_spi_register_master(dev, master);
-        if (ret)
-                goto error;
-
         pm_runtime_set_autosuspend_delay(dev, MSEC_PER_SEC);
         pm_runtime_use_autosuspend(dev);
         pm_runtime_set_active(dev);
         pm_runtime_enable(dev);
+
+        ret = devm_spi_register_master(dev, master);
+        if (ret)
+                goto disable_pm;
+
         return 0;
 
+disable_pm:
+        pm_runtime_disable(&pdev->dev);
 error:
         clk_disable_unprepare(cclk);
         clk_disable_unprepare(iclk);
diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
index 1f56ef651d1a..b83dd733684c 100644
--- a/drivers/spi/spi-sh-sci.c
+++ b/drivers/spi/spi-sh-sci.c
@@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev)
 {
         struct sh_sci_spi *sp = platform_get_drvdata(dev);
 
-        iounmap(sp->membase);
-        setbits(sp, PIN_INIT, 0);
         spi_bitbang_stop(&sp->bitbang);
+        setbits(sp, PIN_INIT, 0);
+        iounmap(sp->membase);
         spi_master_put(sp->bitbang.master);
         return 0;
 }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 5663f4d19d02..1f4c794f5fcc 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1309,7 +1309,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
         if (cmd->data_direction != DMA_TO_DEVICE) {
                 pr_err("Command ITT: 0x%08x received DataOUT for a"
                         " NON-WRITE command.\n", cmd->init_task_tag);
-                return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
+                return iscsit_dump_data_payload(conn, payload_length, 1);
         }
         se_cmd = &cmd->se_cmd;
         iscsit_mod_dataout_timer(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 19b842c3e0b3..ab4915c0d933 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -174,7 +174,6 @@ static int chap_server_compute_md5(
         char *nr_out_ptr,
         unsigned int *nr_out_len)
 {
-        char *endptr;
         unsigned long id;
         unsigned char id_as_uchar;
         unsigned char digest[MD5_SIGNATURE_SIZE];
@@ -320,9 +319,14 @@ static int chap_server_compute_md5(
         }
 
         if (type == HEX)
-                id = simple_strtoul(&identifier[2], &endptr, 0);
+                ret = kstrtoul(&identifier[2], 0, &id);
         else
-                id = simple_strtoul(identifier, &endptr, 0);
+                ret = kstrtoul(identifier, 0, &id);
+
+        if (ret < 0) {
+                pr_err("kstrtoul() failed for CHAP identifier: %d\n", ret);
+                goto out;
+        }
         if (id > 255) {
                 pr_err("chap identifier: %lu greater than 255\n", id);
                 goto out;
@@ -351,6 +355,10 @@ static int chap_server_compute_md5(
                 pr_err("Unable to convert incoming challenge\n");
                 goto out;
         }
+        if (challenge_len > 1024) {
+                pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
+                goto out;
+        }
         /*
          * During mutual authentication, the CHAP_C generated by the
          * initiator must not match the original CHAP_C generated by
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index fecb69535a15..5e71ac609418 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1216,7 +1216,7 @@ old_sess_out:
 static int __iscsi_target_login_thread(struct iscsi_np *np)
 {
         u8 *buffer, zero_tsih = 0;
-        int ret = 0, rc, stop;
+        int ret = 0, rc;
         struct iscsi_conn *conn = NULL;
         struct iscsi_login *login;
         struct iscsi_portal_group *tpg = NULL;
@@ -1230,6 +1230,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                 complete(&np->np_restart_comp);
+        } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
+                spin_unlock_bh(&np->np_thread_lock);
+                goto exit;
         } else {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
         }
@@ -1422,10 +1425,8 @@ old_sess_out:
         }
 
 out:
-        stop = kthread_should_stop();
-        /* Wait for another socket.. */
-        if (!stop)
-                return 1;
+        return 1;
+
 exit:
         iscsi_stop_login_thread_timer(np);
         spin_lock_bh(&np->np_thread_lock);
@@ -1442,7 +1443,7 @@ int iscsi_target_login_thread(void *arg)
 
         allow_signal(SIGINT);
 
-        while (!kthread_should_stop()) {
+        while (1) {
                 ret = __iscsi_target_login_thread(np);
                 /*
                  * We break and exit here unless another sock_accept() call
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 53e157cb8c54..fd90b28f1d94 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -1295,6 +1295,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta
         login->login_failed = 1;
         iscsit_collect_login_stats(conn, status_class, status_detail);
 
+        memset(&login->rsp[0], 0, ISCSI_HDR_LEN);
+
         hdr     = (struct iscsi_login_rsp *)&login->rsp[0];
         hdr->opcode             = ISCSI_OP_LOGIN_RSP;
         hdr->status_class       = status_class;
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 6d2f37578b29..8c64b8776a96 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -239,6 +239,7 @@ static void tcm_loop_submission_work(struct work_struct *work)
         return;
 
 out_done:
+        kmem_cache_free(tcm_loop_cmd_cache, tl_cmd);
         sc->scsi_done(sc);
         return;
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 11d26fe65bfb..98da90167159 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -616,6 +616,7 @@ void core_dev_unexport(
         dev->export_count--;
         spin_unlock(&hba->device_lock);
 
+        lun->lun_sep = NULL;
         lun->lun_se_dev = NULL;
 }
 
diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
index a8aaf6ac2ae2..946562389ca8 100644
--- a/drivers/tc/tc.c
+++ b/drivers/tc/tc.c
@@ -129,7 +129,10 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
 
                 tc_device_get_irq(tdev);
 
-                device_register(&tdev->dev);
+                if (device_register(&tdev->dev)) {
+                        put_device(&tdev->dev);
+                        goto out_err;
+                }
                 list_add_tail(&tdev->node, &tbus->devices);
 
 out_err:
@@ -148,7 +151,10 @@ static int __init tc_init(void)
 
         INIT_LIST_HEAD(&tc_bus.devices);
         dev_set_name(&tc_bus.dev, "tc");
-        device_register(&tc_bus.dev);
+        if (device_register(&tc_bus.dev)) {
+                put_device(&tc_bus.dev);
+                return 0;
+        }
 
         if (tc_bus.info.slot_size) {
                 unsigned int tc_clock = tc_get_speed(&tc_bus) / 100000;
diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
index c41aca4dfc43..72000a6d5af0 100644
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -991,7 +991,7 @@ static const struct of_device_id msm_uartdm_table[] = {
         { }
 };
 
-static int __init msm_serial_probe(struct platform_device *pdev)
+static int msm_serial_probe(struct platform_device *pdev)
 {
         struct msm_port *msm_port;
         struct resource *resource;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 971a760af4a1..8dae2f724a35 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -700,14 +700,6 @@ static void handle_rx_net(struct vhost_work *work)
         handle_rx(net);
 }
 
-static void vhost_net_free(void *addr)
-{
-        if (is_vmalloc_addr(addr))
-                vfree(addr);
-        else
-                kfree(addr);
-}
-
 static int vhost_net_open(struct inode *inode, struct file *f)
 {
         struct vhost_net *n;
@@ -723,7 +715,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
         }
         vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
         if (!vqs) {
-                vhost_net_free(n);
+                kvfree(n);
                 return -ENOMEM;
         }
 
@@ -840,7 +832,7 @@ static int vhost_net_release(struct inode *inode, struct file *f)
          * since jobs can re-queue themselves. */
         vhost_net_flush(n);
         kfree(n->dev.vqs);
-        vhost_net_free(n);
+        kvfree(n);
         return 0;
 }
 
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4f4ffa4c604e..69906cacd04f 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1503,14 +1503,6 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
         return 0;
 }
 
-static void vhost_scsi_free(struct vhost_scsi *vs)
-{
-        if (is_vmalloc_addr(vs))
-                vfree(vs);
-        else
-                kfree(vs);
-}
-
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
         struct vhost_scsi *vs;
@@ -1550,7 +1542,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
         return 0;
 
 err_vqs:
-        vhost_scsi_free(vs);
+        kvfree(vs);
 err_vs:
         return r;
 }
@@ -1569,7 +1561,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
         /* Jobs can re-queue themselves in evt kick handler. Do extra flush. */
         vhost_scsi_flush(vs);
         kfree(vs->dev.vqs);
-        vhost_scsi_free(vs);
+        kvfree(vs);
         return 0;
 }
 
diff --git a/fs/aio.c b/fs/aio.c
index 4f078c054b41..955947ef3e02 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1021,6 +1021,7 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
 
         /* everything turned out well, dispose of the aiocb. */
         kiocb_free(iocb);
+        put_reqs_available(ctx, 1);
 
         /*
          * We have to order our ring_info tail store above and test
@@ -1062,6 +1063,9 @@ static long aio_read_events_ring(struct kioctx *ctx,
         if (head == tail)
                 goto out;
 
+        head %= ctx->nr_events;
+        tail %= ctx->nr_events;
+
         while (ret < nr) {
                 long avail;
                 struct io_event *ev;
@@ -1100,8 +1104,6 @@ static long aio_read_events_ring(struct kioctx *ctx,
         flush_dcache_page(ctx->ring_pages[0]);
 
         pr_debug("%li  h%u t%u\n", ret, head, tail);
-
-        put_reqs_available(ctx, ret);
 out:
         mutex_unlock(&ctx->ring_lock);
 
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 0227b45ef00a..15e9505aa35f 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -290,7 +290,8 @@ int
 cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                  const struct nls_table *cp, int mapChars)
 {
-        int i, j, charlen;
+        int i, charlen;
+        int j = 0;
         char src_char;
         __le16 dst_char;
         wchar_t tmp;
@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
         if (!mapChars)
                 return cifs_strtoUTF16(target, source, PATH_MAX, cp);
 
-        for (i = 0, j = 0; i < srclen; j++) {
+        for (i = 0; i < srclen; j++) {
                 src_char = source[i];
                 charlen = 1;
                 switch (src_char) {
                 case 0:
-                        put_unaligned(0, &target[j]);
                         goto ctoUTF16_out;
                 case ':':
                         dst_char = cpu_to_le16(UNI_COLON);
@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
         }
 
 ctoUTF16_out:
+        put_unaligned(0, &target[j]); /* Null terminate target unicode string */
         return j;
 }
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 2c90d07c0b3a..888398067420 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -725,6 +725,19 @@ out_nls:
         goto out;
 }
 
+static ssize_t
+cifs_loose_read_iter(struct kiocb *iocb, struct iov_iter *iter)
+{
+        ssize_t rc;
+        struct inode *inode = file_inode(iocb->ki_filp);
+
+        rc = cifs_revalidate_mapping(inode);
+        if (rc)
+                return rc;
+
+        return generic_file_read_iter(iocb, iter);
+}
+
 static ssize_t cifs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
 {
         struct inode *inode = file_inode(iocb->ki_filp);
@@ -881,7 +894,7 @@ const struct inode_operations cifs_symlink_inode_ops = {
 const struct file_operations cifs_file_ops = {
         .read = new_sync_read,
         .write = new_sync_write,
-        .read_iter = generic_file_read_iter,
+        .read_iter = cifs_loose_read_iter,
         .write_iter = cifs_file_write_iter,
         .open = cifs_open,
         .release = cifs_close,
@@ -939,7 +952,7 @@ const struct file_operations cifs_file_direct_ops = {
 const struct file_operations cifs_file_nobrl_ops = {
         .read = new_sync_read,
         .write = new_sync_write,
-        .read_iter = generic_file_read_iter,
+        .read_iter = cifs_loose_read_iter,
         .write_iter = cifs_file_write_iter,
         .open = cifs_open,
         .release = cifs_close,
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 264ece71bdb2..68559fd557fb 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -374,7 +374,7 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
         oparms.cifs_sb = cifs_sb;
         oparms.desired_access = GENERIC_WRITE;
         oparms.create_options = create_options;
-        oparms.disposition = FILE_OPEN;
+        oparms.disposition = FILE_CREATE;
         oparms.path = path;
         oparms.fid = &fid;
         oparms.reconnect = false;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index c496f8a74639..9927913c97c2 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -147,6 +147,17 @@ int nfs_sync_mapping(struct address_space *mapping)
         return ret;
 }
 
+static void nfs_set_cache_invalid(struct inode *inode, unsigned long flags)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+
+        if (inode->i_mapping->nrpages == 0)
+                flags &= ~NFS_INO_INVALID_DATA;
+        nfsi->cache_validity |= flags;
+        if (flags & NFS_INO_INVALID_DATA)
+                nfs_fscache_invalidate(inode);
+}
+
 /*
  * Invalidate the local caches
  */
@@ -162,17 +173,16 @@ static void nfs_zap_caches_locked(struct inode *inode)
 
         memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
         if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) {
-                nfs_fscache_invalidate(inode);
-                nfsi->cache_validity |= NFS_INO_INVALID_ATTR
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
                                         | NFS_INO_INVALID_DATA
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
-                                        | NFS_INO_REVAL_PAGECACHE;
+                                        | NFS_INO_REVAL_PAGECACHE);
         } else
-                nfsi->cache_validity |= NFS_INO_INVALID_ATTR
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
-                                        | NFS_INO_REVAL_PAGECACHE;
+                                        | NFS_INO_REVAL_PAGECACHE);
         nfs_zap_label_cache_locked(nfsi);
 }
 
@@ -187,8 +197,7 @@ void nfs_zap_mapping(struct inode *inode, struct address_space *mapping)
 {
         if (mapping->nrpages != 0) {
                 spin_lock(&inode->i_lock);
-                NFS_I(inode)->cache_validity |= NFS_INO_INVALID_DATA;
-                nfs_fscache_invalidate(inode);
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA);
                 spin_unlock(&inode->i_lock);
         }
 }
@@ -209,7 +218,7 @@ EXPORT_SYMBOL_GPL(nfs_zap_acl_cache);
 void nfs_invalidate_atime(struct inode *inode)
 {
         spin_lock(&inode->i_lock);
-        NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATIME;
+        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATIME);
         spin_unlock(&inode->i_lock);
 }
 EXPORT_SYMBOL_GPL(nfs_invalidate_atime);
@@ -369,7 +378,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
                 inode->i_mode = fattr->mode;
                 if ((fattr->valid & NFS_ATTR_FATTR_MODE) == 0
                                 && nfs_server_capable(inode, NFS_CAP_MODE))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 /* Why so? Because we want revalidate for devices/FIFOs, and
                  * that's precisely what we have in nfs_file_inode_operations.
                  */
@@ -415,36 +424,36 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
                 if (fattr->valid & NFS_ATTR_FATTR_ATIME)
                         inode->i_atime = fattr->atime;
                 else if (nfs_server_capable(inode, NFS_CAP_ATIME))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_MTIME)
                         inode->i_mtime = fattr->mtime;
                 else if (nfs_server_capable(inode, NFS_CAP_MTIME))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_CTIME)
                         inode->i_ctime = fattr->ctime;
                 else if (nfs_server_capable(inode, NFS_CAP_CTIME))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_CHANGE)
                         inode->i_version = fattr->change_attr;
                 else if (nfs_server_capable(inode, NFS_CAP_CHANGE_ATTR))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_SIZE)
                         inode->i_size = nfs_size_to_loff_t(fattr->size);
                 else
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                | NFS_INO_REVAL_PAGECACHE;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
+                                | NFS_INO_REVAL_PAGECACHE);
                 if (fattr->valid & NFS_ATTR_FATTR_NLINK)
                         set_nlink(inode, fattr->nlink);
                 else if (nfs_server_capable(inode, NFS_CAP_NLINK))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_OWNER)
                         inode->i_uid = fattr->uid;
                 else if (nfs_server_capable(inode, NFS_CAP_OWNER))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_GROUP)
                         inode->i_gid = fattr->gid;
                 else if (nfs_server_capable(inode, NFS_CAP_OWNER_GROUP))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_BLOCKS_USED)
                         inode->i_blocks = fattr->du.nfs2.blocks;
                 if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) {
@@ -550,6 +559,9 @@ static int nfs_vmtruncate(struct inode * inode, loff_t offset)
 
         spin_lock(&inode->i_lock);
         i_size_write(inode, offset);
+        /* Optimisation */
+        if (offset == 0)
+                NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_DATA;
         spin_unlock(&inode->i_lock);
 
         truncate_pagecache(inode, offset);
@@ -578,7 +590,8 @@ void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
                         inode->i_uid = attr->ia_uid;
                 if ((attr->ia_valid & ATTR_GID) != 0)
                         inode->i_gid = attr->ia_gid;
-                NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_ACCESS
+                                | NFS_INO_INVALID_ACL);
                 spin_unlock(&inode->i_lock);
         }
         if ((attr->ia_valid & ATTR_SIZE) != 0) {
@@ -1101,7 +1114,7 @@ static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr
                         && inode->i_version == fattr->pre_change_attr) {
                 inode->i_version = fattr->change_attr;
                 if (S_ISDIR(inode->i_mode))
-                        nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA);
                 ret |= NFS_INO_INVALID_ATTR;
         }
         /* If we have atomic WCC data, we may update some attributes */
@@ -1117,7 +1130,7 @@ static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr
                         && timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
                 memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
                 if (S_ISDIR(inode->i_mode))
-                        nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA);
                 ret |= NFS_INO_INVALID_ATTR;
         }
         if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
@@ -1128,9 +1141,6 @@ static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr
                 ret |= NFS_INO_INVALID_ATTR;
         }
 
-        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-                nfs_fscache_invalidate(inode);
-
         return ret;
 }
 
@@ -1189,7 +1199,7 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
                 invalid |= NFS_INO_INVALID_ATIME;
 
         if (invalid != 0)
-                nfsi->cache_validity |= invalid;
+                nfs_set_cache_invalid(inode, invalid);
 
         nfsi->read_cache_jiffies = fattr->time_start;
         return 0;
@@ -1402,13 +1412,11 @@ EXPORT_SYMBOL_GPL(nfs_refresh_inode);
 
 static int nfs_post_op_update_inode_locked(struct inode *inode, struct nfs_fattr *fattr)
 {
-        struct nfs_inode *nfsi = NFS_I(inode);
+        unsigned long invalid = NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
 
-        nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
-        if (S_ISDIR(inode->i_mode)) {
-                nfsi->cache_validity |= NFS_INO_INVALID_DATA;
-                nfs_fscache_invalidate(inode);
-        }
+        if (S_ISDIR(inode->i_mode))
+                invalid |= NFS_INO_INVALID_DATA;
+        nfs_set_cache_invalid(inode, invalid);
         if ((fattr->valid & NFS_ATTR_FATTR) == 0)
                 return 0;
         return nfs_refresh_inode_locked(inode, fattr);
@@ -1601,6 +1609,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         if ((nfsi->npages == 0) || new_isize > cur_isize) {
                                 i_size_write(inode, new_isize);
                                 invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+                                invalid &= ~NFS_INO_REVAL_PAGECACHE;
                         }
                         dprintk("NFS: isize change on server for file %s/%ld "
                                         "(%Ld to %Ld)\n",
@@ -1702,10 +1711,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 invalid &= ~NFS_INO_INVALID_DATA;
         if (!NFS_PROTO(inode)->have_delegation(inode, FMODE_READ) ||
                         (save_cache_validity & NFS_INO_REVAL_FORCED))
-                nfsi->cache_validity |= invalid;
-
-        if (invalid & NFS_INO_INVALID_DATA)
-                nfs_fscache_invalidate(inode);
+                nfs_set_cache_invalid(inode, invalid);
 
         return 0;
  out_err:
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index f63cb87cd730..ba2affa51941 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -230,7 +230,7 @@ int nfs_atomic_open(struct inode *, struct dentry *, struct file *,
 extern struct file_system_type nfs4_fs_type;
 
 /* nfs4namespace.c */
-struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *, struct inode *, struct qstr *);
+struct rpc_clnt *nfs4_negotiate_security(struct rpc_clnt *, struct inode *, struct qstr *);
 struct vfsmount *nfs4_submount(struct nfs_server *, struct dentry *,
                                struct nfs_fh *, struct nfs_fattr *);
 int nfs4_replace_transport(struct nfs_server *server,
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 3d5dbf80d46a..3d83cb1fdc70 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -139,16 +139,22 @@ static size_t nfs_parse_server_name(char *string, size_t len,
  * @server: NFS server struct
  * @flavors: List of security tuples returned by SECINFO procedure
  *
- * Return the pseudoflavor of the first security mechanism in
- * "flavors" that is locally supported.  Return RPC_AUTH_UNIX if
- * no matching flavor is found in the array.  The "flavors" array
+ * Return an rpc client that uses the first security mechanism in
+ * "flavors" that is locally supported.  The "flavors" array
  * is searched in the order returned from the server, per RFC 3530
- * recommendation.
+ * recommendation and each flavor is checked for membership in the
+ * sec= mount option list if it exists.
+ *
+ * Return -EPERM if no matching flavor is found in the array.
+ *
+ * Please call rpc_shutdown_client() when you are done with this rpc client.
+ *
  */
-static rpc_authflavor_t nfs_find_best_sec(struct nfs_server *server,
+static struct rpc_clnt *nfs_find_best_sec(struct rpc_clnt *clnt,
+                                          struct nfs_server *server,
                                           struct nfs4_secinfo_flavors *flavors)
 {
-        rpc_authflavor_t pseudoflavor;
+        rpc_authflavor_t pflavor;
         struct nfs4_secinfo4 *secinfo;
         unsigned int i;
 
@@ -159,62 +165,73 @@ static rpc_authflavor_t nfs_find_best_sec(struct nfs_server *server,
                 case RPC_AUTH_NULL:
                 case RPC_AUTH_UNIX:
                 case RPC_AUTH_GSS:
-                        pseudoflavor = rpcauth_get_pseudoflavor(secinfo->flavor,
+                        pflavor = rpcauth_get_pseudoflavor(secinfo->flavor,
                                                         &secinfo->flavor_info);
-                        /* make sure pseudoflavor matches sec= mount opt */
-                        if (pseudoflavor != RPC_AUTH_MAXFLAVOR &&
-                            nfs_auth_info_match(&server->auth_info,
-                                                pseudoflavor))
-                                return pseudoflavor;
-                        break;
+                        /* does the pseudoflavor match a sec= mount opt? */
+                        if (pflavor != RPC_AUTH_MAXFLAVOR &&
+                            nfs_auth_info_match(&server->auth_info, pflavor)) {
+                                struct rpc_clnt *new;
+                                struct rpc_cred *cred;
+
+                                /* Cloning creates an rpc_auth for the flavor */
+                                new = rpc_clone_client_set_auth(clnt, pflavor);
+                                if (IS_ERR(new))
+                                        continue;
+                                /**
+                                * Check that the user actually can use the
+                                * flavor. This is mostly for RPC_AUTH_GSS
+                                * where cr_init obtains a gss context
+                                */
+                                cred = rpcauth_lookupcred(new->cl_auth, 0);
+                                if (IS_ERR(cred)) {
+                                        rpc_shutdown_client(new);
+                                        continue;
+                                }
+                                put_rpccred(cred);
+                                return new;
+                        }
                 }
         }
-
-        /* if there were any sec= options then nothing matched */
-        if (server->auth_info.flavor_len > 0)
-                return -EPERM;
-
-        return RPC_AUTH_UNIX;
+        return ERR_PTR(-EPERM);
 }
 
-static rpc_authflavor_t nfs4_negotiate_security(struct inode *inode, struct qstr *name)
+/**
+ * nfs4_negotiate_security - in response to an NFS4ERR_WRONGSEC on lookup,
+ * return an rpc_clnt that uses the best available security flavor with
+ * respect to the secinfo flavor list and the sec= mount options.
+ *
+ * @clnt: RPC client to clone
+ * @inode: directory inode
+ * @name: lookup name
+ *
+ * Please call rpc_shutdown_client() when you are done with this rpc client.
+ */
+struct rpc_clnt *
+nfs4_negotiate_security(struct rpc_clnt *clnt, struct inode *inode,
+                                        struct qstr *name)
 {
         struct page *page;
         struct nfs4_secinfo_flavors *flavors;
-        rpc_authflavor_t flavor;
+        struct rpc_clnt *new;
         int err;
 
         page = alloc_page(GFP_KERNEL);
         if (!page)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
+
         flavors = page_address(page);
 
         err = nfs4_proc_secinfo(inode, name, flavors);
         if (err < 0) {
-                flavor = err;
+                new = ERR_PTR(err);
                 goto out;
         }
 
-        flavor = nfs_find_best_sec(NFS_SERVER(inode), flavors);
+        new = nfs_find_best_sec(clnt, NFS_SERVER(inode), flavors);
 
 out:
         put_page(page);
-        return flavor;
-}
-
-/*
- * Please call rpc_shutdown_client() when you are done with this client.
- */
-struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *clnt, struct inode *inode,
-                                        struct qstr *name)
-{
-        rpc_authflavor_t flavor;
-
-        flavor = nfs4_negotiate_security(inode, name);
-        if ((int)flavor < 0)
-                return ERR_PTR((int)flavor);
-
-        return rpc_clone_client_set_auth(clnt, flavor);
+        return new;
 }
 
 static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
@@ -397,11 +414,6 @@ struct vfsmount *nfs4_submount(struct nfs_server *server, struct dentry *dentry,
 
         if (client->cl_auth->au_flavor != flavor)
                 flavor = client->cl_auth->au_flavor;
-        else {
-                rpc_authflavor_t new = nfs4_negotiate_security(dir, name);
-                if ((int)new >= 0)
-                        flavor = new;
-        }
         mnt = nfs_do_submount(dentry, fh, fattr, flavor);
 out:
         rpc_shutdown_client(client);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 285ad5334018..4bf3d97cc5a0 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3247,7 +3247,7 @@ static int nfs4_proc_lookup_common(struct rpc_clnt **clnt, struct inode *dir,
                         err = -EPERM;
                         if (client != *clnt)
                                 goto out;
-                        client = nfs4_create_sec_client(client, dir, name);
+                        client = nfs4_negotiate_security(client, dir, name);
                         if (IS_ERR(client))
                                 return PTR_ERR(client);
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 3ee5af4e738e..98ff061ccaf3 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -934,12 +934,14 @@ static bool nfs_write_pageuptodate(struct page *page, struct inode *inode)
 
         if (nfs_have_delegated_attributes(inode))
                 goto out;
-        if (nfsi->cache_validity & (NFS_INO_INVALID_DATA|NFS_INO_REVAL_PAGECACHE))
+        if (nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
                 return false;
         smp_rmb();
         if (test_bit(NFS_INO_INVALIDATING, &nfsi->flags))
                 return false;
 out:
+        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
+                return false;
         return PageUptodate(page) != 0;
 }
 
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index a106b3f2b22a..fae17c640df3 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -331,6 +331,7 @@ struct dlm_lock_resource
         u16 state;
         char lvb[DLM_LVB_LEN];
         unsigned int inflight_locks;
+        unsigned int inflight_assert_workers;
         unsigned long refmap[BITS_TO_LONGS(O2NM_MAX_NODES)];
 };
 
@@ -910,6 +911,9 @@ void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
 void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
                                    struct dlm_lock_resource *res);
 
+void __dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res);
+
 void dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
 void dlm_queue_bast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
 void __dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 3087a21d32f9..82abf0cc9a12 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -581,6 +581,7 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm,
         atomic_set(&res->asts_reserved, 0);
         res->migration_pending = 0;
         res->inflight_locks = 0;
+        res->inflight_assert_workers = 0;
 
         res->dlm = dlm;
 
@@ -683,6 +684,43 @@ void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
         wake_up(&res->wq);
 }
 
+void __dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        assert_spin_locked(&res->spinlock);
+        res->inflight_assert_workers++;
+        mlog(0, "%s:%.*s: inflight assert worker++: now %u\n",
+                        dlm->name, res->lockname.len, res->lockname.name,
+                        res->inflight_assert_workers);
+}
+
+static void dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        spin_lock(&res->spinlock);
+        __dlm_lockres_grab_inflight_worker(dlm, res);
+        spin_unlock(&res->spinlock);
+}
+
+static void __dlm_lockres_drop_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        assert_spin_locked(&res->spinlock);
+        BUG_ON(res->inflight_assert_workers == 0);
+        res->inflight_assert_workers--;
+        mlog(0, "%s:%.*s: inflight assert worker--: now %u\n",
+                        dlm->name, res->lockname.len, res->lockname.name,
+                        res->inflight_assert_workers);
+}
+
+static void dlm_lockres_drop_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        spin_lock(&res->spinlock);
+        __dlm_lockres_drop_inflight_worker(dlm, res);
+        spin_unlock(&res->spinlock);
+}
+
 /*
  * lookup a lock resource by name.
  * may already exist in the hashtable.
@@ -1603,7 +1641,8 @@ send_response:
                         mlog(ML_ERROR, "failed to dispatch assert master work\n");
                         response = DLM_MASTER_RESP_ERROR;
                         dlm_lockres_put(res);
-                }
+                } else
+                        dlm_lockres_grab_inflight_worker(dlm, res);
         } else {
                 if (res)
                         dlm_lockres_put(res);
@@ -2118,6 +2157,8 @@ static void dlm_assert_master_worker(struct dlm_work_item *item, void *data)
         dlm_lockres_release_ast(dlm, res);
 
 put:
+        dlm_lockres_drop_inflight_worker(dlm, res);
+
         dlm_lockres_put(res);
 
         mlog(0, "finished with dlm_assert_master_worker\n");
@@ -3088,11 +3129,15 @@ static int dlm_add_migration_mle(struct dlm_ctxt *dlm,
                         /* remove it so that only one mle will be found */
                         __dlm_unlink_mle(dlm, tmp);
                         __dlm_mle_detach_hb_events(dlm, tmp);
-                        ret = DLM_MIGRATE_RESPONSE_MASTERY_REF;
-                        mlog(0, "%s:%.*s: master=%u, newmaster=%u, "
-                            "telling master to get ref for cleared out mle "
-                            "during migration\n", dlm->name, namelen, name,
-                            master, new_master);
+                        if (tmp->type == DLM_MLE_MASTER) {
+                                ret = DLM_MIGRATE_RESPONSE_MASTERY_REF;
+                                mlog(0, "%s:%.*s: master=%u, newmaster=%u, "
+                                                "telling master to get ref "
+                                                "for cleared out mle during "
+                                                "migration\n", dlm->name,
+                                                namelen, name, master,
+                                                new_master);
+                        }
                 }
                 spin_unlock(&tmp->spinlock);
         }
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 5de019437ea5..45067faf5695 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1708,7 +1708,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
                                 mlog_errno(-ENOMEM);
                                 /* retry!? */
                                 BUG();
-                        }
+                        } else
+                                __dlm_lockres_grab_inflight_worker(dlm, res);
                 } else /* put.. incase we are not the master */
                         dlm_lockres_put(res);
                 spin_unlock(&res->spinlock);
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index 9db869de829d..69aac6f088ad 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -259,12 +259,15 @@ static void dlm_run_purge_list(struct dlm_ctxt *dlm,
                  * refs on it. */
                 unused = __dlm_lockres_unused(lockres);
                 if (!unused ||
-                    (lockres->state & DLM_LOCK_RES_MIGRATING)) {
+                    (lockres->state & DLM_LOCK_RES_MIGRATING) ||
+                    (lockres->inflight_assert_workers != 0)) {
                         mlog(0, "%s: res %.*s is in use or being remastered, "
-                             "used %d, state %d\n", dlm->name,
-                             lockres->lockname.len, lockres->lockname.name,
-                             !unused, lockres->state);
-                        list_move_tail(&dlm->purge_list, &lockres->purge);
+                             "used %d, state %d, assert master workers %u\n",
+                             dlm->name, lockres->lockname.len,
+                             lockres->lockname.name,
+                             !unused, lockres->state,
+                             lockres->inflight_assert_workers);
+                        list_move_tail(&lockres->purge, &dlm->purge_list);
                         spin_unlock(&lockres->spinlock);
                         continue;
                 }
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 5698b52cf5c9..2e3c9dbab68c 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -191,7 +191,9 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                                      DLM_UNLOCK_CLEAR_CONVERT_TYPE);
                 } else if (status == DLM_RECOVERING ||
                            status == DLM_MIGRATING ||
-                           status == DLM_FORWARD) {
+                           status == DLM_FORWARD ||
+                           status == DLM_NOLOCKMGR
+                           ) {
                         /* must clear the actions because this unlock
                          * is about to be retried.  cannot free or do
                          * any list manipulation. */
@@ -200,7 +202,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                              res->lockname.name,
                              status==DLM_RECOVERING?"recovering":
                              (status==DLM_MIGRATING?"migrating":
-                              "forward"));
+                                (status == DLM_FORWARD ? "forward" :
+                                                "nolockmanager")));
                         actions = 0;
                 }
                 if (flags & LKM_CANCEL)
@@ -364,7 +367,10 @@ static enum dlm_status dlm_send_remote_unlock_request(struct dlm_ctxt *dlm,
                          * updated state to the recovery master.  this thread
                          * just needs to finish out the operation and call
                          * the unlockast. */
-                        ret = DLM_NORMAL;
+                        if (dlm_is_node_dead(dlm, owner))
+                                ret = DLM_NORMAL;
+                        else
+                                ret = DLM_NOLOCKMGR;
                 } else {
                         /* something bad.  this will BUG in ocfs2 */
                         ret = dlm_err_to_dlm_status(tmpret);
@@ -638,7 +644,9 @@ retry:
 
         if (status == DLM_RECOVERING ||
             status == DLM_MIGRATING ||
-            status == DLM_FORWARD) {
+            status == DLM_FORWARD ||
+            status == DLM_NOLOCKMGR) {
+
                 /* We want to go away for a tiny bit to allow recovery
                  * / migration to complete on this resource. I don't
                  * know of any wait queue we could sleep on as this
@@ -650,7 +658,7 @@ retry:
                 msleep(50);
 
                 mlog(0, "retrying unlock due to pending recovery/"
-                     "migration/in-progress\n");
+                     "migration/in-progress/reconnect\n");
                 goto retry;
         }
 
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 2060fc398445..8add6f1030d7 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -205,6 +205,21 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode)
         return inode;
 }
 
+static void ocfs2_cleanup_add_entry_failure(struct ocfs2_super *osb,
+                struct dentry *dentry, struct inode *inode)
+{
+        struct ocfs2_dentry_lock *dl = dentry->d_fsdata;
+
+        ocfs2_simple_drop_lockres(osb, &dl->dl_lockres);
+        ocfs2_lock_res_free(&dl->dl_lockres);
+        BUG_ON(dl->dl_count != 1);
+        spin_lock(&dentry_attach_lock);
+        dentry->d_fsdata = NULL;
+        spin_unlock(&dentry_attach_lock);
+        kfree(dl);
+        iput(inode);
+}
+
 static int ocfs2_mknod(struct inode *dir,
                        struct dentry *dentry,
                        umode_t mode,
@@ -231,6 +246,7 @@ static int ocfs2_mknod(struct inode *dir,
         sigset_t oldset;
         int did_block_signals = 0;
         struct posix_acl *default_acl = NULL, *acl = NULL;
+        struct ocfs2_dentry_lock *dl = NULL;
 
         trace_ocfs2_mknod(dir, dentry, dentry->d_name.len, dentry->d_name.name,
                           (unsigned long long)OCFS2_I(dir)->ip_blkno,
@@ -423,6 +439,8 @@ static int ocfs2_mknod(struct inode *dir,
                 goto leave;
         }
 
+        dl = dentry->d_fsdata;
+
         status = ocfs2_add_entry(handle, dentry, inode,
                                  OCFS2_I(inode)->ip_blkno, parent_fe_bh,
                                  &lookup);
@@ -469,6 +487,9 @@ leave:
          * ocfs2_delete_inode will mutex_lock again.
          */
         if ((status < 0) && inode) {
+                if (dl)
+                        ocfs2_cleanup_add_entry_failure(osb, dentry, inode);
+
                 OCFS2_I(inode)->ip_flags |= OCFS2_INODE_SKIP_ORPHAN_DIR;
                 clear_nlink(inode);
                 iput(inode);
@@ -991,6 +1012,65 @@ leave:
         return status;
 }
 
+static int ocfs2_check_if_ancestor(struct ocfs2_super *osb,
+                u64 src_inode_no, u64 dest_inode_no)
+{
+        int ret = 0, i = 0;
+        u64 parent_inode_no = 0;
+        u64 child_inode_no = src_inode_no;
+        struct inode *child_inode;
+
+#define MAX_LOOKUP_TIMES 32
+        while (1) {
+                child_inode = ocfs2_iget(osb, child_inode_no, 0, 0);
+                if (IS_ERR(child_inode)) {
+                        ret = PTR_ERR(child_inode);
+                        break;
+                }
+
+                ret = ocfs2_inode_lock(child_inode, NULL, 0);
+                if (ret < 0) {
+                        iput(child_inode);
+                        if (ret != -ENOENT)
+                                mlog_errno(ret);
+                        break;
+                }
+
+                ret = ocfs2_lookup_ino_from_name(child_inode, "..", 2,
+                                &parent_inode_no);
+                ocfs2_inode_unlock(child_inode, 0);
+                iput(child_inode);
+                if (ret < 0) {
+                        ret = -ENOENT;
+                        break;
+                }
+
+                if (parent_inode_no == dest_inode_no) {
+                        ret = 1;
+                        break;
+                }
+
+                if (parent_inode_no == osb->root_inode->i_ino) {
+                        ret = 0;
+                        break;
+                }
+
+                child_inode_no = parent_inode_no;
+
+                if (++i >= MAX_LOOKUP_TIMES) {
+                        mlog(ML_NOTICE, "max lookup times reached, filesystem "
+                                        "may have nested directories, "
+                                        "src inode: %llu, dest inode: %llu.\n",
+                                        (unsigned long long)src_inode_no,
+                                        (unsigned long long)dest_inode_no);
+                        ret = 0;
+                        break;
+                }
+        }
+
+        return ret;
+}
+
 /*
  * The only place this should be used is rename!
  * if they have the same id, then the 1st one is the only one locked.
@@ -1002,6 +1082,7 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
                              struct inode *inode2)
 {
         int status;
+        int inode1_is_ancestor, inode2_is_ancestor;
         struct ocfs2_inode_info *oi1 = OCFS2_I(inode1);
         struct ocfs2_inode_info *oi2 = OCFS2_I(inode2);
         struct buffer_head **tmpbh;
@@ -1015,9 +1096,26 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
         if (*bh2)
                 *bh2 = NULL;
 
-        /* we always want to lock the one with the lower lockid first. */
+        /* we always want to lock the one with the lower lockid first.
+         * and if they are nested, we lock ancestor first */
         if (oi1->ip_blkno != oi2->ip_blkno) {
-                if (oi1->ip_blkno < oi2->ip_blkno) {
+                inode1_is_ancestor = ocfs2_check_if_ancestor(osb, oi2->ip_blkno,
+                                oi1->ip_blkno);
+                if (inode1_is_ancestor < 0) {
+                        status = inode1_is_ancestor;
+                        goto bail;
+                }
+
+                inode2_is_ancestor = ocfs2_check_if_ancestor(osb, oi1->ip_blkno,
+                                oi2->ip_blkno);
+                if (inode2_is_ancestor < 0) {
+                        status = inode2_is_ancestor;
+                        goto bail;
+                }
+
+                if ((inode1_is_ancestor == 1) ||
+                                (oi1->ip_blkno < oi2->ip_blkno &&
+                                inode2_is_ancestor == 0)) {
                         /* switch id1 and id2 around */
                         tmpbh = bh2;
                         bh2 = bh1;
@@ -1098,6 +1196,7 @@ static int ocfs2_rename(struct inode *old_dir,
         struct ocfs2_dir_lookup_result old_entry_lookup = { NULL, };
         struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
         struct ocfs2_dir_lookup_result target_insert = { NULL, };
+        bool should_add_orphan = false;
 
         /* At some point it might be nice to break this function up a
          * bit. */
@@ -1134,6 +1233,21 @@ static int ocfs2_rename(struct inode *old_dir,
                         goto bail;
                 }
                 rename_lock = 1;
+
+                /* here we cannot guarantee the inodes haven't just been
+                 * changed, so check if they are nested again */
+                status = ocfs2_check_if_ancestor(osb, new_dir->i_ino,
+                                old_inode->i_ino);
+                if (status < 0) {
+                        mlog_errno(status);
+                        goto bail;
+                } else if (status == 1) {
+                        status = -EPERM;
+                        trace_ocfs2_rename_not_permitted(
+                                        (unsigned long long)old_inode->i_ino,
+                                        (unsigned long long)new_dir->i_ino);
+                        goto bail;
+                }
         }
 
         /* if old and new are the same, this'll just do one lock. */
@@ -1304,6 +1418,7 @@ static int ocfs2_rename(struct inode *old_dir,
                                 mlog_errno(status);
                                 goto bail;
                         }
+                        should_add_orphan = true;
                 }
         } else {
                 BUG_ON(new_dentry->d_parent->d_inode != new_dir);
@@ -1348,17 +1463,6 @@ static int ocfs2_rename(struct inode *old_dir,
                         goto bail;
                 }
 
-                if (S_ISDIR(new_inode->i_mode) ||
-                    (ocfs2_read_links_count(newfe) == 1)) {
-                        status = ocfs2_orphan_add(osb, handle, new_inode,
-                                                  newfe_bh, orphan_name,
-                                                  &orphan_insert, orphan_dir);
-                        if (status < 0) {
-                                mlog_errno(status);
-                                goto bail;
-                        }
-                }
-
                 /* change the dirent to point to the correct inode */
                 status = ocfs2_update_entry(new_dir, handle, &target_lookup_res,
                                             old_inode);
@@ -1373,6 +1477,15 @@ static int ocfs2_rename(struct inode *old_dir,
                 else
                         ocfs2_add_links_count(newfe, -1);
                 ocfs2_journal_dirty(handle, newfe_bh);
+                if (should_add_orphan) {
+                        status = ocfs2_orphan_add(osb, handle, new_inode,
+                                        newfe_bh, orphan_name,
+                                        &orphan_insert, orphan_dir);
+                        if (status < 0) {
+                                mlog_errno(status);
+                                goto bail;
+                        }
+                }
         } else {
                 /* if the name was not found in new_dir, add it now */
                 status = ocfs2_add_entry(handle, new_dentry, old_inode,
@@ -1642,6 +1755,7 @@ static int ocfs2_symlink(struct inode *dir,
         struct ocfs2_dir_lookup_result lookup = { NULL, };
         sigset_t oldset;
         int did_block_signals = 0;
+        struct ocfs2_dentry_lock *dl = NULL;
 
         trace_ocfs2_symlink_begin(dir, dentry, symname,
                                   dentry->d_name.len, dentry->d_name.name);
@@ -1830,6 +1944,8 @@ static int ocfs2_symlink(struct inode *dir,
                 goto bail;
         }
 
+        dl = dentry->d_fsdata;
+
         status = ocfs2_add_entry(handle, dentry, inode,
                                  le64_to_cpu(fe->i_blkno), parent_fe_bh,
                                  &lookup);
@@ -1864,6 +1980,9 @@ bail:
         if (xattr_ac)
                 ocfs2_free_alloc_context(xattr_ac);
         if ((status < 0) && inode) {
+                if (dl)
+                        ocfs2_cleanup_add_entry_failure(osb, dentry, inode);
+
                 OCFS2_I(inode)->ip_flags |= OCFS2_INODE_SKIP_ORPHAN_DIR;
                 clear_nlink(inode);
                 iput(inode);
diff --git a/fs/ocfs2/ocfs2_trace.h b/fs/ocfs2/ocfs2_trace.h
index 1b60c62aa9d6..6cb019b7c6a8 100644
--- a/fs/ocfs2/ocfs2_trace.h
+++ b/fs/ocfs2/ocfs2_trace.h
@@ -2292,6 +2292,8 @@ TRACE_EVENT(ocfs2_rename,
                   __entry->new_len, __get_str(new_name))
 );
 
+DEFINE_OCFS2_ULL_ULL_EVENT(ocfs2_rename_not_permitted);
+
 TRACE_EVENT(ocfs2_rename_target_exists,
         TP_PROTO(int new_len, const char *new_name),
         TP_ARGS(new_len, new_name),
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 714e53b9cc66..636aab69ead5 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -4288,9 +4288,16 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir,
                 goto out;
         }
 
+        error = ocfs2_rw_lock(inode, 1);
+        if (error) {
+                mlog_errno(error);
+                goto out;
+        }
+
         error = ocfs2_inode_lock(inode, &old_bh, 1);
         if (error) {
                 mlog_errno(error);
+                ocfs2_rw_unlock(inode, 1);
                 goto out;
         }
 
@@ -4302,6 +4309,7 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir,
         up_write(&OCFS2_I(inode)->ip_xattr_sem);
 
         ocfs2_inode_unlock(inode, 1);
+        ocfs2_rw_unlock(inode, 1);
         brelse(old_bh);
 
         if (error) {
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index c7a89cea5c5d..ddb662b32447 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1925,15 +1925,11 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
 
         ocfs2_shutdown_local_alloc(osb);
 
+        ocfs2_truncate_log_shutdown(osb);
+
         /* This will disable recovery and flush any recovery work. */
         ocfs2_recovery_exit(osb);
 
-        /*
-         * During dismount, when it recovers another node it will call
-         * ocfs2_recover_orphans and queue delayed work osb_truncate_log_wq.
-         */
-        ocfs2_truncate_log_shutdown(osb);
-
         ocfs2_journal_shutdown(osb);
 
         ocfs2_sync_blockdev(sb);
diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index 0572035673f3..a70d45647898 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -237,13 +237,21 @@
 #define INTEL_BDW_GT3D_IDS(info) \
         _INTEL_BDW_D_IDS(3, info)
 
+#define INTEL_BDW_RSVDM_IDS(info) \
+        _INTEL_BDW_M_IDS(4, info)
+
+#define INTEL_BDW_RSVDD_IDS(info) \
+        _INTEL_BDW_D_IDS(4, info)
+
 #define INTEL_BDW_M_IDS(info) \
         INTEL_BDW_GT12M_IDS(info), \
-        INTEL_BDW_GT3M_IDS(info)
+        INTEL_BDW_GT3M_IDS(info), \
+        INTEL_BDW_RSVDM_IDS(info)
 
 #define INTEL_BDW_D_IDS(info) \
         INTEL_BDW_GT12D_IDS(info), \
-        INTEL_BDW_GT3D_IDS(info)
+        INTEL_BDW_GT3D_IDS(info), \
+        INTEL_BDW_RSVDD_IDS(info)
 
 #define INTEL_CHV_IDS(info) \
         INTEL_VGA_DEVICE(0x22b0, info), \
diff --git a/include/dt-bindings/clock/imx6sl-clock.h b/include/dt-bindings/clock/imx6sl-clock.h
index 7cf5c9969336..b91dd462ba85 100644
--- a/include/dt-bindings/clock/imx6sl-clock.h
+++ b/include/dt-bindings/clock/imx6sl-clock.h
@@ -145,6 +145,7 @@
 #define IMX6SL_CLK_USDHC4               132
 #define IMX6SL_CLK_PLL4_AUDIO_DIV       133
 #define IMX6SL_CLK_SPBA                 134
-#define IMX6SL_CLK_END                  135
+#define IMX6SL_CLK_ENET                 135
+#define IMX6SL_CLK_END                  136
 
 #endif /* __DT_BINDINGS_CLOCK_IMX6SL_H */
diff --git a/include/dt-bindings/clock/stih415-clks.h b/include/dt-bindings/clock/stih415-clks.h
index 0d2c7397e028..d80caa68aebd 100644
--- a/include/dt-bindings/clock/stih415-clks.h
+++ b/include/dt-bindings/clock/stih415-clks.h
@@ -10,6 +10,7 @@
 #define CLK_ETH1_PHY            4
 
 /* CLOCKGEN A1 */
+#define CLK_ICN_IF_2            0
 #define CLK_GMAC0_PHY           3
 
 #endif
diff --git a/include/dt-bindings/clock/stih416-clks.h b/include/dt-bindings/clock/stih416-clks.h
index 552c779eb6af..f9bdbd13568d 100644
--- a/include/dt-bindings/clock/stih416-clks.h
+++ b/include/dt-bindings/clock/stih416-clks.h
@@ -10,6 +10,7 @@
 #define CLK_ETH1_PHY            4
 
 /* CLOCKGEN A1 */
+#define CLK_ICN_IF_2            0
 #define CLK_GMAC0_PHY           3
 
 #endif
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 5a645769f020..d2633ee099d9 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -186,6 +186,15 @@ static inline void *bio_data(struct bio *bio)
 #define BIOVEC_SEG_BOUNDARY(q, b1, b2) \
         __BIO_SEG_BOUNDARY(bvec_to_phys((b1)), bvec_to_phys((b2)) + (b2)->bv_len, queue_segment_boundary((q)))
 
+/*
+ * Check if adding a bio_vec after bprv with offset would create a gap in
+ * the SG list. Most drivers don't care about this, but some do.
+ */
+static inline bool bvec_gap_to_prev(struct bio_vec *bprv, unsigned int offset)
+{
+        return offset || ((bprv->bv_offset + bprv->bv_len) & (PAGE_SIZE - 1));
+}
+
 #define bio_io_error(bio) bio_endio((bio), -EIO)
 
 /*
@@ -644,10 +653,6 @@ struct biovec_slab {
 
 #if defined(CONFIG_BLK_DEV_INTEGRITY)
 
-
-
-#define bip_vec_idx(bip, idx)   (&(bip->bip_vec[(idx)]))
-
 #define bip_for_each_vec(bvl, bip, iter)                                \
         for_each_bvec(bvl, (bip)->bip_vec, iter, (bip)->bip_iter)
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 713f8b62b435..8699bcf5f099 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -512,6 +512,7 @@ struct request_queue {
 #define QUEUE_FLAG_DEAD        19       /* queue tear-down finished */
 #define QUEUE_FLAG_INIT_DONE   20       /* queue is initialized */
 #define QUEUE_FLAG_NO_SG_MERGE 21       /* don't attempt to merge SG segments*/
+#define QUEUE_FLAG_SG_GAPS     22       /* queue doesn't support SG gaps */
 
 #define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
                                  (1 << QUEUE_FLAG_STACKABLE)    |       \
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index e2a6bd7fb133..45a91474487d 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -143,7 +143,7 @@ extern void elv_drain_elevator(struct request_queue *);
  * io scheduler registration
  */
 extern void __init load_default_elevator_module(void);
-extern int __init elv_register(struct elevator_type *);
+extern int elv_register(struct elevator_type *);
 extern void elv_unregister(struct elevator_type *);
 
 /*
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index 6a45fb583ff1..447775ee2c4b 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -32,15 +32,24 @@ static inline void touch_nmi_watchdog(void)
 #ifdef arch_trigger_all_cpu_backtrace
 static inline bool trigger_all_cpu_backtrace(void)
 {
-        arch_trigger_all_cpu_backtrace();
+        arch_trigger_all_cpu_backtrace(true);
 
         return true;
 }
+static inline bool trigger_allbutself_cpu_backtrace(void)
+{
+        arch_trigger_all_cpu_backtrace(false);
+        return true;
+}
 #else
 static inline bool trigger_all_cpu_backtrace(void)
 {
         return false;
 }
+static inline bool trigger_allbutself_cpu_backtrace(void)
+{
+        return false;
+}
 #endif
 
 #ifdef CONFIG_LOCKUP_DETECTOR
@@ -48,6 +57,7 @@ int hw_nmi_is_cpu_stuck(struct pt_regs *);
 u64 hw_nmi_get_sample_period(int watchdog_thresh);
 extern int watchdog_user_enabled;
 extern int watchdog_thresh;
+extern int sysctl_softlockup_all_cpu_backtrace;
 struct ctl_table;
 extern int proc_dowatchdog(struct ctl_table *, int ,
                            void __user *, size_t *, loff_t *);
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 3c545b48aeab..8304959ad336 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -360,6 +360,9 @@ static inline void ClearPageCompound(struct page *page)
         ClearPageHead(page);
 }
 #endif
+
+#define PG_head_mask ((1L << PG_head))
+
 #else
 /*
  * Reduce page flag use as much as possible by overlapping
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 864ddafad8cc..68041446c450 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -536,6 +536,15 @@ struct phy_driver {
         /* See set_wol, but for checking whether Wake on LAN is enabled. */
         void (*get_wol)(struct phy_device *dev, struct ethtool_wolinfo *wol);
 
+        /*
+         * Called to inform a PHY device driver when the core is about to
+         * change the link state. This callback is supposed to be used as
+         * fixup hook for drivers that need to take action when the link
+         * state changes. Drivers are by no means allowed to mess with the
+         * PHY device structure in their implementations.
+         */
+        void (*link_change_notify)(struct phy_device *dev);
+
         struct device_driver driver;
 };
 #define to_phy_driver(d) container_of(d, struct phy_driver, driver)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 8e98297f1388..ec538fc287a6 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -305,8 +305,6 @@ struct ucred {
 /* IPX options */
 #define IPX_TYPE        1
 
-extern int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
-                               int offset, int len);
 extern int csum_partial_copy_fromiovecend(unsigned char *kdata, 
                                           struct iovec *iov, 
                                           int offset, 
@@ -315,8 +313,6 @@ extern unsigned long iov_pages(const struct iovec *iov, int offset,
                                unsigned long nr_segs);
 
 extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *address, int mode);
-extern int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
-                             int offset, int len);
 extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
 
diff --git a/include/linux/uio.h b/include/linux/uio.h
index e2231e47cec1..09a7cffc224e 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -94,8 +94,20 @@ static inline size_t iov_iter_count(struct iov_iter *i)
         return i->count;
 }
 
-static inline void iov_iter_truncate(struct iov_iter *i, size_t count)
+/*
+ * Cap the iov_iter by given limit; note that the second argument is
+ * *not* the new size - it's upper limit for such.  Passing it a value
+ * greater than the amount of data in iov_iter is fine - it'll just do
+ * nothing in that case.
+ */
+static inline void iov_iter_truncate(struct iov_iter *i, u64 count)
 {
+        /*
+         * count doesn't have to fit in size_t - comparison extends both
+         * operands to u64 here and any value that would be truncated by
+         * conversion in assignement is by definition greater than all
+         * values of size_t, including old i->count.
+         */
         if (i->count > count)
                 i->count = count;
 }
@@ -111,6 +123,9 @@ static inline void iov_iter_reexpand(struct iov_iter *i, size_t count)
 
 int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
 int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len);
-
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len);
+int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
+                      int offset, int len);
 
 #endif
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 7ee6ce6564ae..713b0b88bd5a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -503,9 +503,9 @@ enum nft_chain_flags {
  *      @net: net namespace that this chain belongs to
  *      @table: table that this chain belongs to
  *      @handle: chain handle
- *      @flags: bitmask of enum nft_chain_flags
  *      @use: number of jump references to this chain
  *      @level: length of longest path to this chain
+ *      @flags: bitmask of enum nft_chain_flags
  *      @name: name of the chain
  */
 struct nft_chain {
@@ -514,9 +514,9 @@ struct nft_chain {
         struct net                      *net;
         struct nft_table                *table;
         u64                             handle;
-        u8                              flags;
-        u16                             use;
+        u32                             use;
         u16                             level;
+        u8                              flags;
         char                            name[NFT_CHAIN_MAXNAMELEN];
 };
 
diff --git a/include/net/sock.h b/include/net/sock.h
index 07b7fcd60d80..173cae485de1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1730,8 +1730,8 @@ sk_dst_get(struct sock *sk)
 
         rcu_read_lock();
         dst = rcu_dereference(sk->sk_dst_cache);
-        if (dst)
-                dst_hold(dst);
+        if (dst && !atomic_inc_not_zero(&dst->__refcnt))
+                dst = NULL;
         rcu_read_unlock();
         return dst;
 }
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 0fd06fef9fac..26b4f2e13275 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -44,6 +44,12 @@
 #undef __field_ext
 #define __field_ext(type, item, filter_type)    type    item;
 
+#undef __field_struct
+#define __field_struct(type, item)      type    item;
+
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)     type    item;
+
 #undef __array
 #define __array(type, item, len)        type    item[len];
 
@@ -122,6 +128,12 @@
 #undef __field_ext
 #define __field_ext(type, item, filter_type)
 
+#undef __field_struct
+#define __field_struct(type, item)
+
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)
+
 #undef __array
 #define __array(type, item, len)
 
@@ -315,9 +327,21 @@ static struct trace_event_functions ftrace_event_type_funcs_##call = {	\
         if (ret)                                                        \
                 return ret;
 
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)                     \
+        ret = trace_define_field(event_call, #type, #item,              \
+                                 offsetof(typeof(field), item),         \
+                                 sizeof(field.item),                    \
+                                 0, filter_type);                       \
+        if (ret)                                                        \
+                return ret;
+
 #undef __field
 #define __field(type, item)     __field_ext(type, item, FILTER_OTHER)
 
+#undef __field_struct
+#define __field_struct(type, item) __field_struct_ext(type, item, FILTER_OTHER)
+
 #undef __array
 #define __array(type, item, len)                                        \
         do {                                                            \
@@ -379,6 +403,12 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call)	\
 #undef __field_ext
 #define __field_ext(type, item, filter_type)
 
+#undef __field_struct
+#define __field_struct(type, item)
+
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)
+
 #undef __array
 #define __array(type, item, len)
 
@@ -550,6 +580,9 @@ static inline notrace int ftrace_get_offsets_##call(			\
 #undef __field
 #define __field(type, item)
 
+#undef __field_struct
+#define __field_struct(type, item)
+
 #undef __array
 #define __array(type, item, len)
 
diff --git a/include/trace/syscall.h b/include/trace/syscall.h
index fed853f3d7aa..9674145e2f6a 100644
--- a/include/trace/syscall.h
+++ b/include/trace/syscall.h
@@ -4,6 +4,7 @@
 #include <linux/tracepoint.h>
 #include <linux/unistd.h>
 #include <linux/ftrace_event.h>
+#include <linux/thread_info.h>
 
 #include <asm/ptrace.h>
 
@@ -32,4 +33,18 @@ struct syscall_metadata {
         struct ftrace_event_call *exit_event;
 };
 
+#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS)
+static inline void syscall_tracepoint_update(struct task_struct *p)
+{
+        if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
+                set_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
+        else
+                clear_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
+}
+#else
+static inline void syscall_tracepoint_update(struct task_struct *p)
+{
+}
+#endif
+
 #endif /* _TRACE_SYSCALL_H */
diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h
index 21eed488783f..1964026b5e09 100644
--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -39,7 +39,7 @@
 struct snd_compressed_buffer {
         __u32 fragment_size;
         __u32 fragments;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_params: compressed stream params
@@ -51,7 +51,7 @@ struct snd_compr_params {
         struct snd_compressed_buffer buffer;
         struct snd_codec codec;
         __u8 no_wake_mode;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_tstamp: timestamp descriptor
@@ -70,7 +70,7 @@ struct snd_compr_tstamp {
         __u32 pcm_frames;
         __u32 pcm_io_frames;
         __u32 sampling_rate;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_avail: avail descriptor
@@ -80,7 +80,7 @@ struct snd_compr_tstamp {
 struct snd_compr_avail {
         __u64 avail;
         struct snd_compr_tstamp tstamp;
-} __attribute__((packed));
+} __attribute__((packed, aligned(4)));
 
 enum snd_compr_direction {
         SND_COMPRESS_PLAYBACK = 0,
@@ -107,7 +107,7 @@ struct snd_compr_caps {
         __u32 max_fragments;
         __u32 codecs[MAX_NUM_CODECS];
         __u32 reserved[11];
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_codec_caps: query capability of codec
@@ -119,7 +119,7 @@ struct snd_compr_codec_caps {
         __u32 codec;
         __u32 num_descriptors;
         struct snd_codec_desc descriptor[MAX_NUM_CODEC_DESCRIPTORS];
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * @SNDRV_COMPRESS_ENCODER_PADDING: no of samples appended by the encoder at the
@@ -140,7 +140,7 @@ enum {
 struct snd_compr_metadata {
          __u32 key;
          __u32 value[8];
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * compress path ioctl definitions
diff --git a/include/uapi/sound/compress_params.h b/include/uapi/sound/compress_params.h
index 165e7059de75..d9bd9ca0d5b0 100644
--- a/include/uapi/sound/compress_params.h
+++ b/include/uapi/sound/compress_params.h
@@ -268,7 +268,7 @@ struct snd_enc_vorbis {
         __u32 max_bit_rate;
         __u32 min_bit_rate;
         __u32 downmix;
-};
+} __attribute__((packed, aligned(4)));
 
 
 /**
@@ -284,7 +284,7 @@ struct snd_enc_real {
         __u32 quant_bits;
         __u32 start_region;
         __u32 num_regions;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_enc_flac
@@ -308,12 +308,12 @@ struct snd_enc_real {
 struct snd_enc_flac {
         __u32 num;
         __u32 gain;
-};
+} __attribute__((packed, aligned(4)));
 
 struct snd_enc_generic {
         __u32 bw;       /* encoder bandwidth */
         __s32 reserved[15];
-};
+} __attribute__((packed, aligned(4)));
 
 union snd_codec_options {
         struct snd_enc_wma wma;
@@ -321,7 +321,7 @@ union snd_codec_options {
         struct snd_enc_real real;
         struct snd_enc_flac flac;
         struct snd_enc_generic generic;
-};
+} __attribute__((packed, aligned(4)));
 
 /** struct snd_codec_desc - description of codec capabilities
  * @max_ch: Maximum number of audio channels
@@ -358,7 +358,7 @@ struct snd_codec_desc {
         __u32 formats;
         __u32 min_buffer;
         __u32 reserved[15];
-};
+} __attribute__((packed, aligned(4)));
 
 /** struct snd_codec
  * @id: Identifies the supported audio encoder/decoder.
@@ -399,6 +399,6 @@ struct snd_codec {
         __u32 align;
         union snd_codec_options options;
         __u32 reserved[3];
-};
+} __attribute__((packed, aligned(4)));
 
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index d2799d1fc952..6a13c46cd87d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1487,7 +1487,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
         total_forks++;
         spin_unlock(&current->sighand->siglock);
+        syscall_tracepoint_update(p);
         write_unlock_irq(&tasklist_lock);
+
         proc_fork_connector(p);
         cgroup_post_fork(p);
         if (clone_flags & CLONE_THREAD)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 6748688813d0..369f41a94124 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1617,6 +1617,7 @@ static int __init crash_save_vmcoreinfo_init(void)
 #ifdef CONFIG_MEMORY_FAILURE
         VMCOREINFO_NUMBER(PG_hwpoison);
 #endif
+        VMCOREINFO_NUMBER(PG_head_mask);
         VMCOREINFO_NUMBER(PAGE_BUDDY_MAPCOUNT_VALUE);
 
         arch_crash_save_vmcoreinfo();
diff --git a/kernel/smp.c b/kernel/smp.c
index 306f8180b0d5..80c33f8de14f 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -29,6 +29,8 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data);
 
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct llist_head, call_single_queue);
 
+static void flush_smp_call_function_queue(bool warn_cpu_offline);
+
 static int
 hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
@@ -51,12 +53,27 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
 #ifdef CONFIG_HOTPLUG_CPU
         case CPU_UP_CANCELED:
         case CPU_UP_CANCELED_FROZEN:
+                /* Fall-through to the CPU_DEAD[_FROZEN] case. */
 
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
                 free_cpumask_var(cfd->cpumask);
                 free_percpu(cfd->csd);
                 break;
+
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                /*
+                 * The IPIs for the smp-call-function callbacks queued by other
+                 * CPUs might arrive late, either due to hardware latencies or
+                 * because this CPU disabled interrupts (inside stop-machine)
+                 * before the IPIs were sent. So flush out any pending callbacks
+                 * explicitly (without waiting for the IPIs to arrive), to
+                 * ensure that the outgoing CPU doesn't go offline with work
+                 * still pending.
+                 */
+                flush_smp_call_function_queue(false);
+                break;
 #endif
         };
 
@@ -177,23 +194,47 @@ static int generic_exec_single(int cpu, struct call_single_data *csd,
         return 0;
 }
 
-/*
- * Invoked by arch to handle an IPI for call function single. Must be
- * called from the arch with interrupts disabled.
+/**
+ * generic_smp_call_function_single_interrupt - Execute SMP IPI callbacks
+ *
+ * Invoked by arch to handle an IPI for call function single.
+ * Must be called with interrupts disabled.
  */
 void generic_smp_call_function_single_interrupt(void)
 {
+        flush_smp_call_function_queue(true);
+}
+
+/**
+ * flush_smp_call_function_queue - Flush pending smp-call-function callbacks
+ *
+ * @warn_cpu_offline: If set to 'true', warn if callbacks were queued on an
+ *                    offline CPU. Skip this check if set to 'false'.
+ *
+ * Flush any pending smp-call-function callbacks queued on this CPU. This is
+ * invoked by the generic IPI handler, as well as by a CPU about to go offline,
+ * to ensure that all pending IPI callbacks are run before it goes completely
+ * offline.
+ *
+ * Loop through the call_single_queue and run all the queued callbacks.
+ * Must be called with interrupts disabled.
+ */
+static void flush_smp_call_function_queue(bool warn_cpu_offline)
+{
+        struct llist_head *head;
         struct llist_node *entry;
         struct call_single_data *csd, *csd_next;
         static bool warned;
 
-        entry = llist_del_all(&__get_cpu_var(call_single_queue));
+        WARN_ON(!irqs_disabled());
+
+        head = &__get_cpu_var(call_single_queue);
+        entry = llist_del_all(head);
         entry = llist_reverse_order(entry);
 
-        /*
-         * Shouldn't receive this interrupt on a cpu that is not yet online.
-         */
-        if (unlikely(!cpu_online(smp_processor_id()) && !warned)) {
+        /* There shouldn't be any pending callbacks on an offline CPU. */
+        if (unlikely(warn_cpu_offline && !cpu_online(smp_processor_id()) &&
+                     !warned && !llist_empty(head))) {
                 warned = true;
                 WARN(1, "IPI on offline CPU %d\n", smp_processor_id());
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 7de6555cfea0..75b22e22a72c 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -136,7 +136,6 @@ static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
 static int maxolduid = 65535;
 static int minolduid;
-static int min_percpu_pagelist_fract = 8;
 
 static int ngroups_max = NGROUPS_MAX;
 static const int cap_last_cap = CAP_LAST_CAP;
@@ -861,6 +860,17 @@ static struct ctl_table kern_table[] = {
                 .extra1         = &zero,
                 .extra2         = &one,
         },
+#ifdef CONFIG_SMP
+        {
+                .procname       = "softlockup_all_cpu_backtrace",
+                .data           = &sysctl_softlockup_all_cpu_backtrace,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+#endif /* CONFIG_SMP */
         {
                 .procname       = "nmi_watchdog",
                 .data           = &watchdog_user_enabled,
@@ -1317,7 +1327,7 @@ static struct ctl_table vm_table[] = {
                 .maxlen         = sizeof(percpu_pagelist_fraction),
                 .mode           = 0644,
                 .proc_handler   = percpu_pagelist_fraction_sysctl_handler,
-                .extra1         = &min_percpu_pagelist_fract,
+                .extra1         = &zero,
         },
 #ifdef CONFIG_MMU
         {
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 33cbd8c203f8..3490407dc7b7 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -492,33 +492,29 @@ static int sys_tracepoint_refcount;
 
 void syscall_regfunc(void)
 {
-        unsigned long flags;
-        struct task_struct *g, *t;
+        struct task_struct *p, *t;
 
         if (!sys_tracepoint_refcount) {
-                read_lock_irqsave(&tasklist_lock, flags);
-                do_each_thread(g, t) {
-                        /* Skip kernel threads. */
-                        if (t->mm)
-                                set_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
-                } while_each_thread(g, t);
-                read_unlock_irqrestore(&tasklist_lock, flags);
+                read_lock(&tasklist_lock);
+                for_each_process_thread(p, t) {
+                        set_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
+                }
+                read_unlock(&tasklist_lock);
         }
         sys_tracepoint_refcount++;
 }
 
 void syscall_unregfunc(void)
 {
-        unsigned long flags;
-        struct task_struct *g, *t;
+        struct task_struct *p, *t;
 
         sys_tracepoint_refcount--;
         if (!sys_tracepoint_refcount) {
-                read_lock_irqsave(&tasklist_lock, flags);
-                do_each_thread(g, t) {
+                read_lock(&tasklist_lock);
+                for_each_process_thread(p, t) {
                         clear_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
-                } while_each_thread(g, t);
-                read_unlock_irqrestore(&tasklist_lock, flags);
+                }
+                read_unlock(&tasklist_lock);
         }
 }
 #endif
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 516203e665fc..c3319bd1b040 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -31,6 +31,12 @@
 
 int watchdog_user_enabled = 1;
 int __read_mostly watchdog_thresh = 10;
+#ifdef CONFIG_SMP
+int __read_mostly sysctl_softlockup_all_cpu_backtrace;
+#else
+#define sysctl_softlockup_all_cpu_backtrace 0
+#endif
+
 static int __read_mostly watchdog_running;
 static u64 __read_mostly sample_period;
 
@@ -47,6 +53,7 @@ static DEFINE_PER_CPU(bool, watchdog_nmi_touch);
 static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
 #endif
+static unsigned long soft_lockup_nmi_warn;
 
 /* boot commands */
 /*
@@ -95,6 +102,15 @@ static int __init nosoftlockup_setup(char *str)
 }
 __setup("nosoftlockup", nosoftlockup_setup);
 /*  */
+#ifdef CONFIG_SMP
+static int __init softlockup_all_cpu_backtrace_setup(char *str)
+{
+        sysctl_softlockup_all_cpu_backtrace =
+                !!simple_strtol(str, NULL, 0);
+        return 1;
+}
+__setup("softlockup_all_cpu_backtrace=", softlockup_all_cpu_backtrace_setup);
+#endif
 
 /*
  * Hard-lockup warnings should be triggered after just a few seconds. Soft-
@@ -271,6 +287,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         unsigned long touch_ts = __this_cpu_read(watchdog_touch_ts);
         struct pt_regs *regs = get_irq_regs();
         int duration;
+        int softlockup_all_cpu_backtrace = sysctl_softlockup_all_cpu_backtrace;
 
         /* kick the hardlockup detector */
         watchdog_interrupt_count();
@@ -317,6 +334,17 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
                 if (__this_cpu_read(soft_watchdog_warn) == true)
                         return HRTIMER_RESTART;
 
+                if (softlockup_all_cpu_backtrace) {
+                        /* Prevent multiple soft-lockup reports if one cpu is already
+                         * engaged in dumping cpu back traces
+                         */
+                        if (test_and_set_bit(0, &soft_lockup_nmi_warn)) {
+                                /* Someone else will report us. Let's give up */
+                                __this_cpu_write(soft_watchdog_warn, true);
+                                return HRTIMER_RESTART;
+                        }
+                }
+
                 printk(KERN_EMERG "BUG: soft lockup - CPU#%d stuck for %us! [%s:%d]\n",
                         smp_processor_id(), duration,
                         current->comm, task_pid_nr(current));
@@ -327,6 +355,17 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
                 else
                         dump_stack();
 
+                if (softlockup_all_cpu_backtrace) {
+                        /* Avoid generating two back traces for current
+                         * given that one is already made above
+                         */
+                        trigger_allbutself_cpu_backtrace();
+
+                        clear_bit(0, &soft_lockup_nmi_warn);
+                        /* Barrier to sync with other cpus */
+                        smp_mb__after_atomic();
+                }
+
                 if (softlockup_panic)
                         panic("softlockup: hung tasks");
                 __this_cpu_write(soft_watchdog_warn, true);
@@ -527,10 +566,8 @@ static void update_timers_all_cpus(void)
         int cpu;
 
         get_online_cpus();
-        preempt_disable();
         for_each_online_cpu(cpu)
                 update_timers(cpu);
-        preempt_enable();
         put_online_cpus();
 }
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 7cfcc1b8e101..7a638aa3545b 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -930,7 +930,7 @@ config LOCKDEP
         bool
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
         select STACKTRACE
-        select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC
+        select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC && !SCORE
         select KALLSYMS
         select KALLSYMS_ALL
 
@@ -1408,7 +1408,7 @@ config FAULT_INJECTION_STACKTRACE_FILTER
         depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
         depends on !X86_64
         select STACKTRACE
-        select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC
+        select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC && !SCORE
         help
           Provide stacktrace filter for fault-injection capabilities
 
diff --git a/lib/iovec.c b/lib/iovec.c
index 454baa88bf27..7a7c2da4cddf 100644
--- a/lib/iovec.c
+++ b/lib/iovec.c
@@ -51,3 +51,58 @@ int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len)
         return 0;
 }
 EXPORT_SYMBOL(memcpy_toiovec);
+
+/*
+ *      Copy kernel to iovec. Returns -EFAULT on error.
+ */
+
+int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
+                      int offset, int len)
+{
+        int copy;
+        for (; len > 0; ++iov) {
+                /* Skip over the finished iovecs */
+                if (unlikely(offset >= iov->iov_len)) {
+                        offset -= iov->iov_len;
+                        continue;
+                }
+                copy = min_t(unsigned int, iov->iov_len - offset, len);
+                if (copy_to_user(iov->iov_base + offset, kdata, copy))
+                        return -EFAULT;
+                offset = 0;
+                kdata += copy;
+                len -= copy;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(memcpy_toiovecend);
+
+/*
+ *      Copy iovec to kernel. Returns -EFAULT on error.
+ */
+
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len)
+{
+        /* Skip over the finished iovecs */
+        while (offset >= iov->iov_len) {
+                offset -= iov->iov_len;
+                iov++;
+        }
+
+        while (len > 0) {
+                u8 __user *base = iov->iov_base + offset;
+                int copy = min_t(unsigned int, len, iov->iov_len - offset);
+
+                offset = 0;
+                if (copy_from_user(kdata, base, copy))
+                        return -EFAULT;
+                len -= copy;
+                kdata += copy;
+                iov++;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(memcpy_fromiovecend);
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index df6839e3ce08..b74da447e81e 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                         len = *ip++;
                         for (; len == 255; length += 255)
                                 len = *ip++;
+                        if (unlikely(length > (size_t)(length + len)))
+                                goto _output_error;
                         length += len;
                 }
 
@@ -106,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                 if (length == ML_MASK) {
                         for (; *ip == 255; length += 255)
                                 ip++;
+                        if (unlikely(length > (size_t)(length + *ip)))
+                                goto _output_error;
                         length += *ip++;
                 }
 
@@ -155,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
 
         /* write overflow error detected */
 _output_error:
-        return (int) (-(((char *)ip) - source));
+        return -1;
 }
 
 static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
index 569985d522d5..8563081e8da3 100644
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -19,11 +19,31 @@
 #include <linux/lzo.h>
 #include "lzodefs.h"
 
-#define HAVE_IP(x)      ((size_t)(ip_end - ip) >= (size_t)(x))
-#define HAVE_OP(x)      ((size_t)(op_end - op) >= (size_t)(x))
-#define NEED_IP(x)      if (!HAVE_IP(x)) goto input_overrun
-#define NEED_OP(x)      if (!HAVE_OP(x)) goto output_overrun
-#define TEST_LB(m_pos)  if ((m_pos) < out) goto lookbehind_overrun
+#define HAVE_IP(t, x)                                   \
+        (((size_t)(ip_end - ip) >= (size_t)(t + x)) &&  \
+         (((t + x) >= t) && ((t + x) >= x)))
+
+#define HAVE_OP(t, x)                                   \
+        (((size_t)(op_end - op) >= (size_t)(t + x)) &&  \
+         (((t + x) >= t) && ((t + x) >= x)))
+
+#define NEED_IP(t, x)                                   \
+        do {                                            \
+                if (!HAVE_IP(t, x))                     \
+                        goto input_overrun;             \
+        } while (0)
+
+#define NEED_OP(t, x)                                   \
+        do {                                            \
+                if (!HAVE_OP(t, x))                     \
+                        goto output_overrun;            \
+        } while (0)
+
+#define TEST_LB(m_pos)                                  \
+        do {                                            \
+                if ((m_pos) < out)                      \
+                        goto lookbehind_overrun;        \
+        } while (0)
 
 int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
                           unsigned char *out, size_t *out_len)
@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
                                         while (unlikely(*ip == 0)) {
                                                 t += 255;
                                                 ip++;
-                                                NEED_IP(1);
+                                                NEED_IP(1, 0);
                                         }
                                         t += 15 + *ip++;
                                 }
                                 t += 3;
 copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-                                if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
+                                if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
                                         const unsigned char *ie = ip + t;
                                         unsigned char *oe = op + t;
                                         do {
@@ -81,8 +101,8 @@ copy_literal_run:
                                 } else
 #endif
                                 {
-                                        NEED_OP(t);
-                                        NEED_IP(t + 3);
+                                        NEED_OP(t, 0);
+                                        NEED_IP(t, 3);
                                         do {
                                                 *op++ = *ip++;
                                         } while (--t > 0);
@@ -95,7 +115,7 @@ copy_literal_run:
                                 m_pos -= t >> 2;
                                 m_pos -= *ip++ << 2;
                                 TEST_LB(m_pos);
-                                NEED_OP(2);
+                                NEED_OP(2, 0);
                                 op[0] = m_pos[0];
                                 op[1] = m_pos[1];
                                 op += 2;
@@ -119,10 +139,10 @@ copy_literal_run:
                                 while (unlikely(*ip == 0)) {
                                         t += 255;
                                         ip++;
-                                        NEED_IP(1);
+                                        NEED_IP(1, 0);
                                 }
                                 t += 31 + *ip++;
-                                NEED_IP(2);
+                                NEED_IP(2, 0);
                         }
                         m_pos = op - 1;
                         next = get_unaligned_le16(ip);
@@ -137,10 +157,10 @@ copy_literal_run:
                                 while (unlikely(*ip == 0)) {
                                         t += 255;
                                         ip++;
-                                        NEED_IP(1);
+                                        NEED_IP(1, 0);
                                 }
                                 t += 7 + *ip++;
-                                NEED_IP(2);
+                                NEED_IP(2, 0);
                         }
                         next = get_unaligned_le16(ip);
                         ip += 2;
@@ -154,7 +174,7 @@ copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
                 if (op - m_pos >= 8) {
                         unsigned char *oe = op + t;
-                        if (likely(HAVE_OP(t + 15))) {
+                        if (likely(HAVE_OP(t, 15))) {
                                 do {
                                         COPY8(op, m_pos);
                                         op += 8;
@@ -164,7 +184,7 @@ copy_literal_run:
                                         m_pos += 8;
                                 } while (op < oe);
                                 op = oe;
-                                if (HAVE_IP(6)) {
+                                if (HAVE_IP(6, 0)) {
                                         state = next;
                                         COPY4(op, ip);
                                         op += next;
@@ -172,7 +192,7 @@ copy_literal_run:
                                         continue;
                                 }
                         } else {
-                                NEED_OP(t);
+                                NEED_OP(t, 0);
                                 do {
                                         *op++ = *m_pos++;
                                 } while (op < oe);
@@ -181,7 +201,7 @@ copy_literal_run:
 #endif
                 {
                         unsigned char *oe = op + t;
-                        NEED_OP(t);
+                        NEED_OP(t, 0);
                         op[0] = m_pos[0];
                         op[1] = m_pos[1];
                         op += 2;
@@ -194,15 +214,15 @@ match_next:
                 state = next;
                 t = next;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-                if (likely(HAVE_IP(6) && HAVE_OP(4))) {
+                if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
                         COPY4(op, ip);
                         op += t;
                         ip += t;
                 } else
 #endif
                 {
-                        NEED_IP(t + 3);
-                        NEED_OP(t);
+                        NEED_IP(t, 3);
+                        NEED_OP(t, 0);
                         while (t > 0) {
                                 *op++ = *ip++;
                                 t--;
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 649d097853a1..4abda074ea45 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -86,6 +86,7 @@ static unsigned int io_tlb_index;
  * We need to save away the original address corresponding to a mapped entry
  * for the sync operations.
  */
+#define INVALID_PHYS_ADDR (~(phys_addr_t)0)
 static phys_addr_t *io_tlb_orig_addr;
 
 /*
@@ -188,12 +189,14 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
         io_tlb_list = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(int)),
                                 PAGE_SIZE);
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
         io_tlb_orig_addr = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)),
                                 PAGE_SIZE);
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         if (verbose)
                 swiotlb_print_info();
@@ -313,10 +316,6 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_list)
                 goto cleanup3;
 
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
-
         io_tlb_orig_addr = (phys_addr_t *)
                 __get_free_pages(GFP_KERNEL,
                                  get_order(io_tlb_nslabs *
@@ -324,7 +323,11 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_orig_addr)
                 goto cleanup4;
 
-        memset(io_tlb_orig_addr, 0, io_tlb_nslabs * sizeof(phys_addr_t));
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         swiotlb_print_info();
 
@@ -556,7 +559,8 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
         /*
          * First, sync the memory before unmapping the entry
          */
-        if (orig_addr && ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
+        if (orig_addr != INVALID_PHYS_ADDR &&
+            ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
                 swiotlb_bounce(orig_addr, tlb_addr, size, DMA_FROM_DEVICE);
 
         /*
@@ -573,8 +577,10 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
                  * Step 1: return the slots to the free list, merging the
                  * slots with superceeding slots
                  */
-                for (i = index + nslots - 1; i >= index; i--)
+                for (i = index + nslots - 1; i >= index; i--) {
                         io_tlb_list[i] = ++count;
+                        io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+                }
                 /*
                  * Step 2: merge the returned slots with the preceding slots,
                  * if available (non zero)
@@ -593,6 +599,8 @@ void swiotlb_tbl_sync_single(struct device *hwdev, phys_addr_t tlb_addr,
         int index = (tlb_addr - io_tlb_start) >> IO_TLB_SHIFT;
         phys_addr_t orig_addr = io_tlb_orig_addr[index];
 
+        if (orig_addr == INVALID_PHYS_ADDR)
+                return;
         orig_addr += (unsigned long)tlb_addr & ((1 << IO_TLB_SHIFT) - 1);
 
         switch (target) {
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index e60837dc785c..33514d88fef9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -941,6 +941,37 @@ unlock:
         spin_unlock(ptl);
 }
 
+/*
+ * Save CONFIG_DEBUG_PAGEALLOC from faulting falsely on tail pages
+ * during copy_user_huge_page()'s copy_page_rep(): in the case when
+ * the source page gets split and a tail freed before copy completes.
+ * Called under pmd_lock of checked pmd, so safe from splitting itself.
+ */
+static void get_user_huge_page(struct page *page)
+{
+        if (IS_ENABLED(CONFIG_DEBUG_PAGEALLOC)) {
+                struct page *endpage = page + HPAGE_PMD_NR;
+
+                atomic_add(HPAGE_PMD_NR, &page->_count);
+                while (++page < endpage)
+                        get_huge_page_tail(page);
+        } else {
+                get_page(page);
+        }
+}
+
+static void put_user_huge_page(struct page *page)
+{
+        if (IS_ENABLED(CONFIG_DEBUG_PAGEALLOC)) {
+                struct page *endpage = page + HPAGE_PMD_NR;
+
+                while (page < endpage)
+                        put_page(page++);
+        } else {
+                put_page(page);
+        }
+}
+
 static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
                                         struct vm_area_struct *vma,
                                         unsigned long address,
@@ -1074,7 +1105,7 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 ret |= VM_FAULT_WRITE;
                 goto out_unlock;
         }
-        get_page(page);
+        get_user_huge_page(page);
         spin_unlock(ptl);
 alloc:
         if (transparent_hugepage_enabled(vma) &&
@@ -1095,7 +1126,7 @@ alloc:
                                 split_huge_page(page);
                                 ret |= VM_FAULT_FALLBACK;
                         }
-                        put_page(page);
+                        put_user_huge_page(page);
                 }
                 count_vm_event(THP_FAULT_FALLBACK);
                 goto out;
@@ -1105,7 +1136,7 @@ alloc:
                 put_page(new_page);
                 if (page) {
                         split_huge_page(page);
-                        put_page(page);
+                        put_user_huge_page(page);
                 } else
                         split_huge_page_pmd(vma, address, pmd);
                 ret |= VM_FAULT_FALLBACK;
@@ -1127,7 +1158,7 @@ alloc:
 
         spin_lock(ptl);
         if (page)
-                put_page(page);
+                put_user_huge_page(page);
         if (unlikely(!pmd_same(*pmd, orig_pmd))) {
                 spin_unlock(ptl);
                 mem_cgroup_uncharge_page(new_page);
@@ -2392,8 +2423,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         pmd = mm_find_pmd(mm, address);
         if (!pmd)
                 goto out;
-        if (pmd_trans_huge(*pmd))
-                goto out;
 
         anon_vma_lock_write(vma->anon_vma);
 
@@ -2492,8 +2521,6 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
         pmd = mm_find_pmd(mm, address);
         if (!pmd)
                 goto out;
-        if (pmd_trans_huge(*pmd))
-                goto out;
 
         memset(khugepaged_node_load, 0, sizeof(khugepaged_node_load));
         pte = pte_offset_map_lock(mm, pmd, address, &ptl);
@@ -2846,12 +2873,22 @@ void split_huge_page_pmd_mm(struct mm_struct *mm, unsigned long address,
 static void split_huge_page_address(struct mm_struct *mm,
                                     unsigned long address)
 {
+        pgd_t *pgd;
+        pud_t *pud;
         pmd_t *pmd;
 
         VM_BUG_ON(!(address & ~HPAGE_PMD_MASK));
 
-        pmd = mm_find_pmd(mm, address);
-        if (!pmd)
+        pgd = pgd_offset(mm, address);
+        if (!pgd_present(*pgd))
+                return;
+
+        pud = pud_offset(pgd, address);
+        if (!pud_present(*pud))
+                return;
+
+        pmd = pmd_offset(pud, address);
+        if (!pmd_present(*pmd))
                 return;
         /*
          * Caller holds the mmap_sem write mode, so a huge pmd cannot
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 226910cb7c9b..2024bbd573d2 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2520,6 +2520,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma,
                 update_mmu_cache(vma, address, ptep);
 }
 
+static int is_hugetlb_entry_migration(pte_t pte)
+{
+        swp_entry_t swp;
+
+        if (huge_pte_none(pte) || pte_present(pte))
+                return 0;
+        swp = pte_to_swp_entry(pte);
+        if (non_swap_entry(swp) && is_migration_entry(swp))
+                return 1;
+        else
+                return 0;
+}
+
+static int is_hugetlb_entry_hwpoisoned(pte_t pte)
+{
+        swp_entry_t swp;
+
+        if (huge_pte_none(pte) || pte_present(pte))
+                return 0;
+        swp = pte_to_swp_entry(pte);
+        if (non_swap_entry(swp) && is_hwpoison_entry(swp))
+                return 1;
+        else
+                return 0;
+}
 
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                             struct vm_area_struct *vma)
@@ -2559,10 +2584,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                 dst_ptl = huge_pte_lock(h, dst, dst_pte);
                 src_ptl = huge_pte_lockptr(h, src, src_pte);
                 spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
-                if (!huge_pte_none(huge_ptep_get(src_pte))) {
+                entry = huge_ptep_get(src_pte);
+                if (huge_pte_none(entry)) { /* skip none entry */
+                        ;
+                } else if (unlikely(is_hugetlb_entry_migration(entry) ||
+                                    is_hugetlb_entry_hwpoisoned(entry))) {
+                        swp_entry_t swp_entry = pte_to_swp_entry(entry);
+
+                        if (is_write_migration_entry(swp_entry) && cow) {
+                                /*
+                                 * COW mappings require pages in both
+                                 * parent and child to be set to read.
+                                 */
+                                make_migration_entry_read(&swp_entry);
+                                entry = swp_entry_to_pte(swp_entry);
+                                set_huge_pte_at(src, addr, src_pte, entry);
+                        }
+                        set_huge_pte_at(dst, addr, dst_pte, entry);
+                } else {
                         if (cow)
                                 huge_ptep_set_wrprotect(src, addr, src_pte);
-                        entry = huge_ptep_get(src_pte);
                         ptepage = pte_page(entry);
                         get_page(ptepage);
                         page_dup_rmap(ptepage);
@@ -2578,32 +2619,6 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
         return ret;
 }
 
-static int is_hugetlb_entry_migration(pte_t pte)
-{
-        swp_entry_t swp;
-
-        if (huge_pte_none(pte) || pte_present(pte))
-                return 0;
-        swp = pte_to_swp_entry(pte);
-        if (non_swap_entry(swp) && is_migration_entry(swp))
-                return 1;
-        else
-                return 0;
-}
-
-static int is_hugetlb_entry_hwpoisoned(pte_t pte)
-{
-        swp_entry_t swp;
-
-        if (huge_pte_none(pte) || pte_present(pte))
-                return 0;
-        swp = pte_to_swp_entry(pte);
-        if (non_swap_entry(swp) && is_hwpoison_entry(swp))
-                return 1;
-        else
-                return 0;
-}
-
 void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
                             unsigned long start, unsigned long end,
                             struct page *ref_page)
diff --git a/mm/ksm.c b/mm/ksm.c
index 68710e80994a..346ddc9e4c0d 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -945,7 +945,6 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
         pmd = mm_find_pmd(mm, addr);
         if (!pmd)
                 goto out;
-        BUG_ON(pmd_trans_huge(*pmd));
 
         mmun_start = addr;
         mmun_end   = addr + PAGE_SIZE;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 284974230459..eb58de19f815 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -656,19 +656,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma,
  * @nodes and @flags,) it's isolated and queued to the pagelist which is
  * passed via @private.)
  */
-static struct vm_area_struct *
+static int
 queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
                 const nodemask_t *nodes, unsigned long flags, void *private)
 {
-        int err;
-        struct vm_area_struct *first, *vma, *prev;
-
+        int err = 0;
+        struct vm_area_struct *vma, *prev;
 
-        first = find_vma(mm, start);
-        if (!first)
-                return ERR_PTR(-EFAULT);
+        vma = find_vma(mm, start);
+        if (!vma)
+                return -EFAULT;
         prev = NULL;
-        for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
+        for (; vma && vma->vm_start < end; vma = vma->vm_next) {
                 unsigned long endvma = vma->vm_end;
 
                 if (endvma > end)
@@ -678,9 +677,9 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
 
                 if (!(flags & MPOL_MF_DISCONTIG_OK)) {
                         if (!vma->vm_next && vma->vm_end < end)
-                                return ERR_PTR(-EFAULT);
+                                return -EFAULT;
                         if (prev && prev->vm_end < vma->vm_start)
-                                return ERR_PTR(-EFAULT);
+                                return -EFAULT;
                 }
 
                 if (flags & MPOL_MF_LAZY) {
@@ -694,15 +693,13 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
 
                         err = queue_pages_pgd_range(vma, start, endvma, nodes,
                                                 flags, private);
-                        if (err) {
-                                first = ERR_PTR(err);
+                        if (err)
                                 break;
-                        }
                 }
 next:
                 prev = vma;
         }
-        return first;
+        return err;
 }
 
 /*
@@ -1156,16 +1153,17 @@ out:
 
 /*
  * Allocate a new page for page migration based on vma policy.
- * Start assuming that page is mapped by vma pointed to by @private.
+ * Start by assuming the page is mapped by the same vma as contains @start.
  * Search forward from there, if not.  N.B., this assumes that the
  * list of pages handed to migrate_pages()--which is how we get here--
  * is in virtual address order.
  */
-static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
+static struct page *new_page(struct page *page, unsigned long start, int **x)
 {
-        struct vm_area_struct *vma = (struct vm_area_struct *)private;
+        struct vm_area_struct *vma;
         unsigned long uninitialized_var(address);
 
+        vma = find_vma(current->mm, start);
         while (vma) {
                 address = page_address_in_vma(page, vma);
                 if (address != -EFAULT)
@@ -1195,7 +1193,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
         return -ENOSYS;
 }
 
-static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
+static struct page *new_page(struct page *page, unsigned long start, int **x)
 {
         return NULL;
 }
@@ -1205,7 +1203,6 @@ static long do_mbind(unsigned long start, unsigned long len,
                      unsigned short mode, unsigned short mode_flags,
                      nodemask_t *nmask, unsigned long flags)
 {
-        struct vm_area_struct *vma;
         struct mm_struct *mm = current->mm;
         struct mempolicy *new;
         unsigned long end;
@@ -1271,11 +1268,9 @@ static long do_mbind(unsigned long start, unsigned long len,
         if (err)
                 goto mpol_out;
 
-        vma = queue_pages_range(mm, start, end, nmask,
+        err = queue_pages_range(mm, start, end, nmask,
                           flags | MPOL_MF_INVERT, &pagelist);
-
-        err = PTR_ERR(vma);     /* maybe ... */
-        if (!IS_ERR(vma))
+        if (!err)
                 err = mbind_range(mm, start, end, new);
 
         if (!err) {
@@ -1283,9 +1278,8 @@ static long do_mbind(unsigned long start, unsigned long len,
 
                 if (!list_empty(&pagelist)) {
                         WARN_ON_ONCE(flags & MPOL_MF_LAZY);
-                        nr_failed = migrate_pages(&pagelist, new_vma_page,
-                                        NULL, (unsigned long)vma,
-                                        MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
+                        nr_failed = migrate_pages(&pagelist, new_page, NULL,
+                                start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
                         if (nr_failed)
                                 putback_movable_pages(&pagelist);
                 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 63f0cd559999..9e0beaa91845 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -120,8 +120,6 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
                 pmd = mm_find_pmd(mm, addr);
                 if (!pmd)
                         goto out;
-                if (pmd_trans_huge(*pmd))
-                        goto out;
 
                 ptep = pte_offset_map(pmd, addr);
 
diff --git a/mm/nommu.c b/mm/nommu.c
index b78e3a8f5ee7..4a852f6c5709 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -786,7 +786,7 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
         for (i = 0; i < VMACACHE_SIZE; i++) {
                 /* if the vma is cached, invalidate the entire cache */
                 if (curr->vmacache[i] == vma) {
-                        vmacache_invalidate(curr->mm);
+                        vmacache_invalidate(mm);
                         break;
                 }
         }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 4f59fa29eda8..20d17f8266fe 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -69,6 +69,7 @@
 
 /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */
 static DEFINE_MUTEX(pcp_batch_high_lock);
+#define MIN_PERCPU_PAGELIST_FRACTION    (8)
 
 #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
 DEFINE_PER_CPU(int, numa_node);
@@ -4145,7 +4146,7 @@ static void __meminit zone_init_free_lists(struct zone *zone)
         memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY)
 #endif
 
-static int __meminit zone_batchsize(struct zone *zone)
+static int zone_batchsize(struct zone *zone)
 {
 #ifdef CONFIG_MMU
         int batch;
@@ -4261,8 +4262,8 @@ static void pageset_set_high(struct per_cpu_pageset *p,
         pageset_update(&p->pcp, high, batch);
 }
 
-static void __meminit pageset_set_high_and_batch(struct zone *zone,
-                struct per_cpu_pageset *pcp)
+static void pageset_set_high_and_batch(struct zone *zone,
+                                       struct per_cpu_pageset *pcp)
 {
         if (percpu_pagelist_fraction)
                 pageset_set_high(pcp,
@@ -5881,23 +5882,38 @@ int percpu_pagelist_fraction_sysctl_handler(struct ctl_table *table, int write,
         void __user *buffer, size_t *length, loff_t *ppos)
 {
         struct zone *zone;
-        unsigned int cpu;
+        int old_percpu_pagelist_fraction;
         int ret;
 
+        mutex_lock(&pcp_batch_high_lock);
+        old_percpu_pagelist_fraction = percpu_pagelist_fraction;
+
         ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
-        if (!write || (ret < 0))
-                return ret;
+        if (!write || ret < 0)
+                goto out;
+
+        /* Sanity checking to avoid pcp imbalance */
+        if (percpu_pagelist_fraction &&
+            percpu_pagelist_fraction < MIN_PERCPU_PAGELIST_FRACTION) {
+                percpu_pagelist_fraction = old_percpu_pagelist_fraction;
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /* No change? */
+        if (percpu_pagelist_fraction == old_percpu_pagelist_fraction)
+                goto out;
 
-        mutex_lock(&pcp_batch_high_lock);
         for_each_populated_zone(zone) {
-                unsigned long  high;
-                high = zone->managed_pages / percpu_pagelist_fraction;
+                unsigned int cpu;
+
                 for_each_possible_cpu(cpu)
-                        pageset_set_high(per_cpu_ptr(zone->pageset, cpu),
-                                         high);
+                        pageset_set_high_and_batch(zone,
+                                        per_cpu_ptr(zone->pageset, cpu));
         }
+out:
         mutex_unlock(&pcp_batch_high_lock);
-        return 0;
+        return ret;
 }
 
 int hashdist = HASHDIST_DEFAULT;
diff --git a/mm/rmap.c b/mm/rmap.c
index bf05fc872ae8..b7e94ebbd09e 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -569,6 +569,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd = NULL;
+        pmd_t pmde;
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -579,7 +580,13 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
                 goto out;
 
         pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd))
+        /*
+         * Some THP functions use the sequence pmdp_clear_flush(), set_pmd_at()
+         * without holding anon_vma lock for write.  So when looking for a
+         * genuine pmde (in which to find pte), test present and !THP together.
+         */
+        pmde = ACCESS_ONCE(*pmd);
+        if (!pmd_present(pmde) || pmd_trans_huge(pmde))
                 pmd = NULL;
 out:
         return pmd;
@@ -615,9 +622,6 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
         if (!pmd)
                 return NULL;
 
-        if (pmd_trans_huge(*pmd))
-                return NULL;
-
         pte = pte_offset_map(pmd, address);
         /* Make a quick check before getting the lock */
         if (!sync && !pte_present(*pte)) {
diff --git a/mm/shmem.c b/mm/shmem.c
index f484c276e994..8f419cff9e34 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -80,11 +80,12 @@ static struct vfsmount *shm_mnt;
 #define SHORT_SYMLINK_LEN 128
 
 /*
- * shmem_fallocate and shmem_writepage communicate via inode->i_private
- * (with i_mutex making sure that it has only one user at a time):
- * we would prefer not to enlarge the shmem inode just for that.
+ * shmem_fallocate communicates with shmem_fault or shmem_writepage via
+ * inode->i_private (with i_mutex making sure that it has only one user at
+ * a time): we would prefer not to enlarge the shmem inode just for that.
  */
 struct shmem_falloc {
+        int     mode;           /* FALLOC_FL mode currently operating */
         pgoff_t start;          /* start of range currently being fallocated */
         pgoff_t next;           /* the next page offset to be fallocated */
         pgoff_t nr_falloced;    /* how many new pages have been fallocated */
@@ -759,6 +760,7 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
                         spin_lock(&inode->i_lock);
                         shmem_falloc = inode->i_private;
                         if (shmem_falloc &&
+                            !shmem_falloc->mode &&
                             index >= shmem_falloc->start &&
                             index < shmem_falloc->next)
                                 shmem_falloc->nr_unswapped++;
@@ -1233,6 +1235,44 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         int error;
         int ret = VM_FAULT_LOCKED;
 
+        /*
+         * Trinity finds that probing a hole which tmpfs is punching can
+         * prevent the hole-punch from ever completing: which in turn
+         * locks writers out with its hold on i_mutex.  So refrain from
+         * faulting pages into the hole while it's being punched, and
+         * wait on i_mutex to be released if vmf->flags permits.
+         */
+        if (unlikely(inode->i_private)) {
+                struct shmem_falloc *shmem_falloc;
+
+                spin_lock(&inode->i_lock);
+                shmem_falloc = inode->i_private;
+                if (!shmem_falloc ||
+                    shmem_falloc->mode != FALLOC_FL_PUNCH_HOLE ||
+                    vmf->pgoff < shmem_falloc->start ||
+                    vmf->pgoff >= shmem_falloc->next)
+                        shmem_falloc = NULL;
+                spin_unlock(&inode->i_lock);
+                /*
+                 * i_lock has protected us from taking shmem_falloc seriously
+                 * once return from shmem_fallocate() went back up that stack.
+                 * i_lock does not serialize with i_mutex at all, but it does
+                 * not matter if sometimes we wait unnecessarily, or sometimes
+                 * miss out on waiting: we just need to make those cases rare.
+                 */
+                if (shmem_falloc) {
+                        if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
+                           !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
+                                up_read(&vma->vm_mm->mmap_sem);
+                                mutex_lock(&inode->i_mutex);
+                                mutex_unlock(&inode->i_mutex);
+                                return VM_FAULT_RETRY;
+                        }
+                        /* cond_resched? Leave that to GUP or return to user */
+                        return VM_FAULT_NOPAGE;
+                }
+        }
+
         error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret);
         if (error)
                 return ((error == -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS);
@@ -1724,20 +1764,31 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
         pgoff_t start, index, end;
         int error;
 
+        if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+                return -EOPNOTSUPP;
+
         mutex_lock(&inode->i_mutex);
 
+        shmem_falloc.mode = mode & ~FALLOC_FL_KEEP_SIZE;
+
         if (mode & FALLOC_FL_PUNCH_HOLE) {
                 struct address_space *mapping = file->f_mapping;
                 loff_t unmap_start = round_up(offset, PAGE_SIZE);
                 loff_t unmap_end = round_down(offset + len, PAGE_SIZE) - 1;
 
+                shmem_falloc.start = unmap_start >> PAGE_SHIFT;
+                shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT;
+                spin_lock(&inode->i_lock);
+                inode->i_private = &shmem_falloc;
+                spin_unlock(&inode->i_lock);
+
                 if ((u64)unmap_end > (u64)unmap_start)
                         unmap_mapping_range(mapping, unmap_start,
                                             1 + unmap_end - unmap_start, 0);
                 shmem_truncate_range(inode, offset, offset + len - 1);
                 /* No need to unmap again: hole-punching leaves COWed pages */
                 error = 0;
-                goto out;
+                goto undone;
         }
 
         /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
diff --git a/mm/slab.c b/mm/slab.c
index 9ca3b87edabc..3070b929a1bf 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -386,6 +386,39 @@ static void **dbg_userword(struct kmem_cache *cachep, void *objp)
 
 #endif
 
+#define OBJECT_FREE (0)
+#define OBJECT_ACTIVE (1)
+
+#ifdef CONFIG_DEBUG_SLAB_LEAK
+
+static void set_obj_status(struct page *page, int idx, int val)
+{
+        int freelist_size;
+        char *status;
+        struct kmem_cache *cachep = page->slab_cache;
+
+        freelist_size = cachep->num * sizeof(freelist_idx_t);
+        status = (char *)page->freelist + freelist_size;
+        status[idx] = val;
+}
+
+static inline unsigned int get_obj_status(struct page *page, int idx)
+{
+        int freelist_size;
+        char *status;
+        struct kmem_cache *cachep = page->slab_cache;
+
+        freelist_size = cachep->num * sizeof(freelist_idx_t);
+        status = (char *)page->freelist + freelist_size;
+
+        return status[idx];
+}
+
+#else
+static inline void set_obj_status(struct page *page, int idx, int val) {}
+
+#endif
+
 /*
  * Do not go above this order unless 0 objects fit into the slab or
  * overridden on the command line.
@@ -576,12 +609,30 @@ static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
         return cachep->array[smp_processor_id()];
 }
 
+static size_t calculate_freelist_size(int nr_objs, size_t align)
+{
+        size_t freelist_size;
+
+        freelist_size = nr_objs * sizeof(freelist_idx_t);
+        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+                freelist_size += nr_objs * sizeof(char);
+
+        if (align)
+                freelist_size = ALIGN(freelist_size, align);
+
+        return freelist_size;
+}
+
 static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
                                 size_t idx_size, size_t align)
 {
         int nr_objs;
+        size_t remained_size;
         size_t freelist_size;
+        int extra_space = 0;
 
+        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+                extra_space = sizeof(char);
         /*
          * Ignore padding for the initial guess. The padding
          * is at most @align-1 bytes, and @buffer_size is at
@@ -590,14 +641,15 @@ static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
          * into the memory allocation when taking the padding
          * into account.
          */
-        nr_objs = slab_size / (buffer_size + idx_size);
+        nr_objs = slab_size / (buffer_size + idx_size + extra_space);
 
         /*
          * This calculated number will be either the right
          * amount, or one greater than what we want.
          */
-        freelist_size = slab_size - nr_objs * buffer_size;
-        if (freelist_size < ALIGN(nr_objs * idx_size, align))
+        remained_size = slab_size - nr_objs * buffer_size;
+        freelist_size = calculate_freelist_size(nr_objs, align);
+        if (remained_size < freelist_size)
                 nr_objs--;
 
         return nr_objs;
@@ -635,7 +687,7 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
         } else {
                 nr_objs = calculate_nr_objs(slab_size, buffer_size,
                                         sizeof(freelist_idx_t), align);
-                mgmt_size = ALIGN(nr_objs * sizeof(freelist_idx_t), align);
+                mgmt_size = calculate_freelist_size(nr_objs, align);
         }
         *num = nr_objs;
         *left_over = slab_size - nr_objs*buffer_size - mgmt_size;
@@ -2041,13 +2093,16 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
                         break;
 
                 if (flags & CFLGS_OFF_SLAB) {
+                        size_t freelist_size_per_obj = sizeof(freelist_idx_t);
                         /*
                          * Max number of objs-per-slab for caches which
                          * use off-slab slabs. Needed to avoid a possible
                          * looping condition in cache_grow().
                          */
+                        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+                                freelist_size_per_obj += sizeof(char);
                         offslab_limit = size;
-                        offslab_limit /= sizeof(freelist_idx_t);
+                        offslab_limit /= freelist_size_per_obj;
 
                         if (num > offslab_limit)
                                 break;
@@ -2294,8 +2349,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
         if (!cachep->num)
                 return -E2BIG;
 
-        freelist_size =
-                ALIGN(cachep->num * sizeof(freelist_idx_t), cachep->align);
+        freelist_size = calculate_freelist_size(cachep->num, cachep->align);
 
         /*
          * If the slab has been placed off-slab, and we have enough space then
@@ -2308,7 +2362,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
 
         if (flags & CFLGS_OFF_SLAB) {
                 /* really off slab. No need for manual alignment */
-                freelist_size = cachep->num * sizeof(freelist_idx_t);
+                freelist_size = calculate_freelist_size(cachep->num, 0);
 
 #ifdef CONFIG_PAGE_POISONING
                 /* If we're going to use the generic kernel_map_pages()
@@ -2612,6 +2666,7 @@ static void cache_init_objs(struct kmem_cache *cachep,
                 if (cachep->ctor)
                         cachep->ctor(objp);
 #endif
+                set_obj_status(page, i, OBJECT_FREE);
                 set_free_obj(page, i, i);
         }
 }
@@ -2820,6 +2875,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
         BUG_ON(objnr >= cachep->num);
         BUG_ON(objp != index_to_obj(cachep, page, objnr));
 
+        set_obj_status(page, objnr, OBJECT_FREE);
         if (cachep->flags & SLAB_POISON) {
 #ifdef CONFIG_DEBUG_PAGEALLOC
                 if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) {
@@ -2953,6 +3009,8 @@ static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep,
 static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                                 gfp_t flags, void *objp, unsigned long caller)
 {
+        struct page *page;
+
         if (!objp)
                 return objp;
         if (cachep->flags & SLAB_POISON) {
@@ -2983,6 +3041,9 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                 *dbg_redzone1(cachep, objp) = RED_ACTIVE;
                 *dbg_redzone2(cachep, objp) = RED_ACTIVE;
         }
+
+        page = virt_to_head_page(objp);
+        set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE);
         objp += obj_offset(cachep);
         if (cachep->ctor && cachep->flags & SLAB_POISON)
                 cachep->ctor(objp);
@@ -4219,21 +4280,12 @@ static void handle_slab(unsigned long *n, struct kmem_cache *c,
                                                 struct page *page)
 {
         void *p;
-        int i, j;
+        int i;
 
         if (n[0] == n[1])
                 return;
         for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) {
-                bool active = true;
-
-                for (j = page->active; j < c->num; j++) {
-                        /* Skip freed item */
-                        if (get_free_obj(page, j) == i) {
-                                active = false;
-                                break;
-                        }
-                }
-                if (!active)
+                if (get_obj_status(page, i) != OBJECT_ACTIVE)
                         continue;
 
                 if (!add_caller(n, (unsigned long)*dbg_userword(c, p)))
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 9012b1c922b6..75d427763992 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -114,8 +114,11 @@ EXPORT_SYMBOL(vlan_dev_vlan_proto);
 
 static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
 {
-        if (skb_cow(skb, skb_headroom(skb)) < 0)
+        if (skb_cow(skb, skb_headroom(skb)) < 0) {
+                kfree_skb(skb);
                 return NULL;
+        }
+
         memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
         skb->mac_header += VLAN_HLEN;
         return skb;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 8671bc79a35b..ca01d1861854 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -610,11 +610,6 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
         if (hci_update_random_address(req, false, &own_addr_type))
                 return;
 
-        /* Save the address type used for this connnection attempt so we able
-         * to retrieve this information if we need it.
-         */
-        conn->src_type = own_addr_type;
-
         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
         bacpy(&cp.peer_addr, &conn->dst);
@@ -894,7 +889,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
                 /* If we're already encrypted set the REAUTH_PEND flag,
                  * otherwise set the ENCRYPT_PEND.
                  */
-                if (conn->key_type != 0xff)
+                if (conn->link_mode & HCI_LM_ENCRYPT)
                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
                 else
                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 21e5913d12e0..640c54ec1bd2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 
+        hci_dev_lock(hdev);
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        hci_dev_unlock(hdev);
+
         hci_conn_check_pending(hdev);
 }
 
@@ -3537,7 +3541,11 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                         cp.authentication = conn->auth_type;
 
                         /* Request MITM protection if our IO caps allow it
-                         * except for the no-bonding case
+                         * except for the no-bonding case.
+                         * conn->auth_type is not updated here since
+                         * that might cause the user confirmation to be
+                         * rejected in case the remote doesn't have the
+                         * IO capabilities for MITM.
                          */
                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
                             cp.authentication != HCI_AT_NO_BONDING)
@@ -3628,8 +3636,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
 
                 /* If we're not the initiators request authorization to
                  * proceed from user space (mgmt_user_confirm with
-                 * confirm_hint set to 1). */
-                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
+                 * confirm_hint set to 1). The exception is if neither
+                 * side had MITM in which case we do auto-accept.
+                 */
+                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
+                    (loc_mitm || rem_mitm)) {
                         BT_DBG("Confirming auto-accept as acceptor");
                         confirm_hint = 1;
                         goto confirm;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 6eabbe05fe54..323f23cd2c37 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1663,7 +1663,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         kfree_skb(conn->rx_skb);
 
         skb_queue_purge(&conn->pending_rx);
-        flush_work(&conn->pending_rx_work);
+
+        /* We can not call flush_work(&conn->pending_rx_work) here since we
+         * might block if we are running on a worker from the same workqueue
+         * pending_rx_work is waiting on.
+         */
+        if (work_pending(&conn->pending_rx_work))
+                cancel_work_sync(&conn->pending_rx_work);
 
         l2cap_unregister_all_users(conn);
 
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ade3fb4c23bc..e1378693cc90 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -787,11 +787,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 
                 /*change security for LE channels */
                 if (chan->scid == L2CAP_CID_ATT) {
-                        if (!conn->hcon->out) {
-                                err = -EINVAL;
-                                break;
-                        }
-
                         if (smp_conn_security(conn->hcon, sec.level))
                                 break;
                         sk->sk_state = BT_CONFIG;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0fce54412ffd..af8e0a6243b7 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1047,6 +1047,43 @@ static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
         }
 }
 
+static void hci_stop_discovery(struct hci_request *req)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_remote_name_req_cancel cp;
+        struct inquiry_entry *e;
+
+        switch (hdev->discovery.state) {
+        case DISCOVERY_FINDING:
+                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+                        hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
+                } else {
+                        cancel_delayed_work(&hdev->le_scan_disable);
+                        hci_req_add_le_scan_disable(req);
+                }
+
+                break;
+
+        case DISCOVERY_RESOLVING:
+                e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
+                                                     NAME_PENDING);
+                if (!e)
+                        return;
+
+                bacpy(&cp.bdaddr, &e->data.bdaddr);
+                hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
+                            &cp);
+
+                break;
+
+        default:
+                /* Passive scanning */
+                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                        hci_req_add_le_scan_disable(req);
+                break;
+        }
+}
+
 static int clean_up_hci_state(struct hci_dev *hdev)
 {
         struct hci_request req;
@@ -1063,9 +1100,7 @@ static int clean_up_hci_state(struct hci_dev *hdev)
         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
                 disable_advertising(&req);
 
-        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
-                hci_req_add_le_scan_disable(&req);
-        }
+        hci_stop_discovery(&req);
 
         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
                 struct hci_cp_disconnect dc;
@@ -2996,8 +3031,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
         }
 
         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
-                /* Continue with pairing via SMP */
+                /* Continue with pairing via SMP. The hdev lock must be
+                 * released as SMP may try to recquire it for crypto
+                 * purposes.
+                 */
+                hci_dev_unlock(hdev);
                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
+                hci_dev_lock(hdev);
 
                 if (!err)
                         err = cmd_complete(sk, hdev->id, mgmt_op,
@@ -3574,8 +3614,6 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 {
         struct mgmt_cp_stop_discovery *mgmt_cp = data;
         struct pending_cmd *cmd;
-        struct hci_cp_remote_name_req_cancel cp;
-        struct inquiry_entry *e;
         struct hci_request req;
         int err;
 
@@ -3605,52 +3643,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 
         hci_req_init(&req, hdev);
 
-        switch (hdev->discovery.state) {
-        case DISCOVERY_FINDING:
-                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
-                        hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
-                } else {
-                        cancel_delayed_work(&hdev->le_scan_disable);
-
-                        hci_req_add_le_scan_disable(&req);
-                }
-
-                break;
+        hci_stop_discovery(&req);
 
-        case DISCOVERY_RESOLVING:
-                e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
-                                                     NAME_PENDING);
-                if (!e) {
-                        mgmt_pending_remove(cmd);
-                        err = cmd_complete(sk, hdev->id,
-                                           MGMT_OP_STOP_DISCOVERY, 0,
-                                           &mgmt_cp->type,
-                                           sizeof(mgmt_cp->type));
-                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-                        goto unlock;
-                }
-
-                bacpy(&cp.bdaddr, &e->data.bdaddr);
-                hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
-                            &cp);
-
-                break;
-
-        default:
-                BT_DBG("unknown discovery state %u", hdev->discovery.state);
-
-                mgmt_pending_remove(cmd);
-                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
-                                   MGMT_STATUS_FAILED, &mgmt_cp->type,
-                                   sizeof(mgmt_cp->type));
+        err = hci_req_run(&req, stop_discovery_complete);
+        if (!err) {
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
                 goto unlock;
         }
 
-        err = hci_req_run(&req, stop_discovery_complete);
-        if (err < 0)
-                mgmt_pending_remove(cmd);
-        else
-                hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
+        mgmt_pending_remove(cmd);
+
+        /* If no HCI commands were sent we're done */
+        if (err == -ENODATA) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
+                                   &mgmt_cp->type, sizeof(mgmt_cp->type));
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        }
 
 unlock:
         hci_dev_unlock(hdev);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 3d1cc164557d..f2829a7932e2 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -544,7 +544,7 @@ static u8 smp_random(struct smp_chan *smp)
                 hci_le_start_enc(hcon, ediv, rand, stk);
                 hcon->enc_key_size = smp->enc_key_size;
         } else {
-                u8 stk[16];
+                u8 stk[16], auth;
                 __le64 rand = 0;
                 __le16 ediv = 0;
 
@@ -556,8 +556,13 @@ static u8 smp_random(struct smp_chan *smp)
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
 
+                if (hcon->pending_sec_level == BT_SECURITY_HIGH)
+                        auth = 1;
+                else
+                        auth = 0;
+
                 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
-                            HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
+                            HCI_SMP_STK_SLAVE, auth, stk, smp->enc_key_size,
                             ediv, rand);
         }
 
diff --git a/net/core/dst.c b/net/core/dst.c
index 80d6286c8b62..a028409ee438 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -269,6 +269,15 @@ again:
 }
 EXPORT_SYMBOL(dst_destroy);
 
+static void dst_destroy_rcu(struct rcu_head *head)
+{
+        struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
+
+        dst = dst_destroy(dst);
+        if (dst)
+                __dst_free(dst);
+}
+
 void dst_release(struct dst_entry *dst)
 {
         if (dst) {
@@ -276,11 +285,8 @@ void dst_release(struct dst_entry *dst)
 
                 newrefcnt = atomic_dec_return(&dst->__refcnt);
                 WARN_ON(newrefcnt < 0);
-                if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) {
-                        dst = dst_destroy(dst);
-                        if (dst)
-                                __dst_free(dst);
-                }
+                if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
+                        call_rcu(&dst->rcu_head, dst_destroy_rcu);
         }
 }
 EXPORT_SYMBOL(dst_release);
diff --git a/net/core/filter.c b/net/core/filter.c
index 735fad897496..1dbf6462f766 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -840,11 +840,11 @@ int sk_convert_filter(struct sock_filter *prog, int len,
         BUILD_BUG_ON(BPF_MEMWORDS * sizeof(u32) > MAX_BPF_STACK);
         BUILD_BUG_ON(BPF_REG_FP + 1 != MAX_BPF_REG);
 
-        if (len <= 0 || len >= BPF_MAXINSNS)
+        if (len <= 0 || len > BPF_MAXINSNS)
                 return -EINVAL;
 
         if (new_prog) {
-                addrs = kzalloc(len * sizeof(*addrs), GFP_KERNEL);
+                addrs = kcalloc(len, sizeof(*addrs), GFP_KERNEL);
                 if (!addrs)
                         return -ENOMEM;
         }
@@ -1101,7 +1101,7 @@ static int check_load_and_stores(struct sock_filter *filter, int flen)
 
         BUILD_BUG_ON(BPF_MEMWORDS > 16);
 
-        masks = kmalloc(flen * sizeof(*masks), GFP_KERNEL);
+        masks = kmalloc_array(flen, sizeof(*masks), GFP_KERNEL);
         if (!masks)
                 return -ENOMEM;
 
@@ -1382,7 +1382,7 @@ static struct sk_filter *__sk_migrate_realloc(struct sk_filter *fp,
         fp_new = sock_kmalloc(sk, len, GFP_KERNEL);
         if (fp_new) {
                 *fp_new = *fp;
-                /* As we're kepping orig_prog in fp_new along,
+                /* As we're keeping orig_prog in fp_new along,
                  * we need to make sure we're not evicting it
                  * from the old fp.
                  */
@@ -1524,8 +1524,8 @@ static struct sk_filter *__sk_prepare_filter(struct sk_filter *fp,
 
 /**
  *      sk_unattached_filter_create - create an unattached filter
- *      @fprog: the filter program
  *      @pfp: the unattached filter that is created
+ *      @fprog: the filter program
  *
  * Create a filter independent of any socket. We first run some
  * sanity checks on it to make sure it does not explode on us later.
diff --git a/net/core/iovec.c b/net/core/iovec.c
index b61869429f4c..827dd6beb49c 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -75,61 +75,6 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
 }
 
 /*
- *      Copy kernel to iovec. Returns -EFAULT on error.
- */
-
-int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
-                      int offset, int len)
-{
-        int copy;
-        for (; len > 0; ++iov) {
-                /* Skip over the finished iovecs */
-                if (unlikely(offset >= iov->iov_len)) {
-                        offset -= iov->iov_len;
-                        continue;
-                }
-                copy = min_t(unsigned int, iov->iov_len - offset, len);
-                if (copy_to_user(iov->iov_base + offset, kdata, copy))
-                        return -EFAULT;
-                offset = 0;
-                kdata += copy;
-                len -= copy;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(memcpy_toiovecend);
-
-/*
- *      Copy iovec to kernel. Returns -EFAULT on error.
- */
-
-int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
-                        int offset, int len)
-{
-        /* Skip over the finished iovecs */
-        while (offset >= iov->iov_len) {
-                offset -= iov->iov_len;
-                iov++;
-        }
-
-        while (len > 0) {
-                u8 __user *base = iov->iov_base + offset;
-                int copy = min_t(unsigned int, len, iov->iov_len - offset);
-
-                offset = 0;
-                if (copy_from_user(kdata, base, copy))
-                        return -EFAULT;
-                len -= copy;
-                kdata += copy;
-                iov++;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(memcpy_fromiovecend);
-
-/*
  *      And now for the all-in-one: copy and checksum from a user iovec
  *      directly to a datagram
  *      Calls to csum_partial but the last must be in 32 bit chunks
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9cd5344fad73..c1a33033cbe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2993,7 +2993,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
                                                             skb_put(nskb, len),
                                                             len, 0);
                         SKB_GSO_CB(nskb)->csum_start =
-                            skb_headroom(nskb) + offset;
+                            skb_headroom(nskb) + doffset;
                         continue;
                 }
 
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 097b3e7c1e8f..54b6731dab55 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -73,12 +73,7 @@ static void __tunnel_dst_set(struct ip_tunnel_dst *idst,
 {
         struct dst_entry *old_dst;
 
-        if (dst) {
-                if (dst->flags & DST_NOCACHE)
-                        dst = NULL;
-                else
-                        dst_clone(dst);
-        }
+        dst_clone(dst);
         old_dst = xchg((__force struct dst_entry **)&idst->dst, dst);
         dst_release(old_dst);
 }
@@ -108,13 +103,14 @@ static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
 
         rcu_read_lock();
         dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
+        if (dst && !atomic_inc_not_zero(&dst->__refcnt))
+                dst = NULL;
         if (dst) {
                 if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
-                        rcu_read_unlock();
                         tunnel_dst_reset(t);
-                        return NULL;
+                        dst_release(dst);
+                        dst = NULL;
                 }
-                dst_hold(dst);
         }
         rcu_read_unlock();
         return (struct rtable *)dst;
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 62e48cf84e60..9771563ab564 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -131,7 +131,7 @@ static bool tcp_fastopen_create_child(struct sock *sk,
                                       struct dst_entry *dst,
                                       struct request_sock *req)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_sock *tp;
         struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
         struct sock *child;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 40661fc1e233..b5c23756965a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1162,7 +1162,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                         unsigned int new_len = (pkt_len / mss) * mss;
                         if (!in_sack && new_len < pkt_len) {
                                 new_len += mss;
-                                if (new_len > skb->len)
+                                if (new_len >= skb->len)
                                         return 0;
                         }
                         pkt_len = new_len;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c42e83d2751c..581a6584ed0c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3778,6 +3778,7 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
         cancel_delayed_work_sync(&ipvs->defense_work);
         cancel_work_sync(&ipvs->defense_work.work);
         unregister_net_sysctl_table(ipvs->sysctl_hdr);
+        ip_vs_stop_estimator(net, &ipvs->tot_stats);
 }
 
 #else
@@ -3840,7 +3841,6 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
         struct netns_ipvs *ipvs = net_ipvs(net);
 
         ip_vs_trash_cleanup(net);
-        ip_vs_stop_estimator(net, &ipvs->tot_stats);
         ip_vs_control_net_cleanup_sysctl(net);
         remove_proc_entry("ip_vs_stats_percpu", net->proc_net);
         remove_proc_entry("ip_vs_stats", net->proc_net);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 58579634427d..300ed1eec729 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -597,6 +597,9 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct)
 #ifdef CONFIG_NF_CONNTRACK_MARK
                + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
 #endif
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+               + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE */
+#endif
                + ctnetlink_proto_size(ct)
                + ctnetlink_label_size(ct)
                ;
@@ -1150,7 +1153,7 @@ static int ctnetlink_done_list(struct netlink_callback *cb)
 static int
 ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)
 {
-        struct nf_conn *ct, *last = NULL;
+        struct nf_conn *ct, *last;
         struct nf_conntrack_tuple_hash *h;
         struct hlist_nulls_node *n;
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
@@ -1163,8 +1166,7 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
         if (cb->args[2])
                 return 0;
 
-        if (cb->args[0] == nr_cpu_ids)
-                return 0;
+        last = (struct nf_conn *)cb->args[1];
 
         for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
                 struct ct_pcpu *pcpu;
@@ -1174,7 +1176,6 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
 
                 pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
                 spin_lock_bh(&pcpu->lock);
-                last = (struct nf_conn *)cb->args[1];
                 list = dying ? &pcpu->dying : &pcpu->unconfirmed;
 restart:
                 hlist_nulls_for_each_entry(h, n, list, hnnode) {
@@ -1193,7 +1194,9 @@ restart:
                                                   ct);
                         rcu_read_unlock();
                         if (res < 0) {
-                                nf_conntrack_get(&ct->ct_general);
+                                if (!atomic_inc_not_zero(&ct->ct_general.use))
+                                        continue;
+                                cb->args[0] = cpu;
                                 cb->args[1] = (unsigned long)ct;
                                 spin_unlock_bh(&pcpu->lock);
                                 goto out;
@@ -1202,10 +1205,10 @@ restart:
                 if (cb->args[1]) {
                         cb->args[1] = 0;
                         goto restart;
-                } else
-                        cb->args[2] = 1;
+                }
                 spin_unlock_bh(&pcpu->lock);
         }
+        cb->args[2] = 1;
 out:
         if (last)
                 nf_ct_put(last);
@@ -2040,6 +2043,9 @@ ctnetlink_nfqueue_build_size(const struct nf_conn *ct)
 #ifdef CONFIG_NF_CONNTRACK_MARK
                + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
 #endif
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+               + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE */
+#endif
                + ctnetlink_proto_size(ct)
                ;
 }
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 09096a670c45..a49907b1dabc 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -525,6 +525,39 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data)
         return i->status & IPS_NAT_MASK ? 1 : 0;
 }
 
+static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
+{
+        struct nf_conn_nat *nat = nfct_nat(ct);
+
+        if (nf_nat_proto_remove(ct, data))
+                return 1;
+
+        if (!nat || !nat->ct)
+                return 0;
+
+        /* This netns is being destroyed, and conntrack has nat null binding.
+         * Remove it from bysource hash, as the table will be freed soon.
+         *
+         * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
+         * will delete entry from already-freed table.
+         */
+        if (!del_timer(&ct->timeout))
+                return 1;
+
+        spin_lock_bh(&nf_nat_lock);
+        hlist_del_rcu(&nat->bysource);
+        ct->status &= ~IPS_NAT_DONE_MASK;
+        nat->ct = NULL;
+        spin_unlock_bh(&nf_nat_lock);
+
+        add_timer(&ct->timeout);
+
+        /* don't delete conntrack.  Although that would make things a lot
+         * simpler, we'd end up flushing all conntracks on nat rmmod.
+         */
+        return 0;
+}
+
 static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
 {
         struct nf_nat_proto_clean clean = {
@@ -795,7 +828,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
 {
         struct nf_nat_proto_clean clean = {};
 
-        nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0);
+        nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0);
         synchronize_rcu();
         nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
 }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 624e083125b9..ab4566cfcbe4 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1730,6 +1730,9 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
                         return -EINVAL;
                 handle = nf_tables_alloc_handle(table);
+
+                if (chain->use == UINT_MAX)
+                        return -EOVERFLOW;
         }
 
         if (nla[NFTA_RULE_POSITION]) {
@@ -1789,14 +1792,15 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
                 if (nft_rule_is_active_next(net, old_rule)) {
-                        trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE,
+                        trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
                                                    old_rule);
                         if (trans == NULL) {
                                 err = -ENOMEM;
                                 goto err2;
                         }
                         nft_rule_disactivate_next(net, old_rule);
-                        list_add_tail(&rule->list, &old_rule->list);
+                        chain->use--;
+                        list_add_tail_rcu(&rule->list, &old_rule->list);
                 } else {
                         err = -ENOENT;
                         goto err2;
@@ -1826,6 +1830,7 @@ err3:
                 list_del_rcu(&nft_trans_rule(trans)->list);
                 nft_rule_clear(net, nft_trans_rule(trans));
                 nft_trans_destroy(trans);
+                chain->use++;
         }
 err2:
         nf_tables_rule_destroy(&ctx, rule);
@@ -2845,7 +2850,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
                 goto nla_put_failure;
 
         nfmsg = nlmsg_data(nlh);
-        nfmsg->nfgen_family = NFPROTO_UNSPEC;
+        nfmsg->nfgen_family = ctx.afi->family;
         nfmsg->version      = NFNETLINK_V0;
         nfmsg->res_id       = 0;
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 8a779be832fb..1840989092ed 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -195,6 +195,15 @@ static void
 nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_target *target = expr->ops->data;
+        void *info = nft_expr_priv(expr);
+        struct xt_tgdtor_param par;
+
+        par.net = ctx->net;
+        par.target = target;
+        par.targinfo = info;
+        par.family = ctx->afi->family;
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
 
         module_put(target->me);
 }
@@ -382,6 +391,15 @@ static void
 nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_match *match = expr->ops->data;
+        void *info = nft_expr_priv(expr);
+        struct xt_mtdtor_param par;
+
+        par.net = ctx->net;
+        par.match = match;
+        par.matchinfo = info;
+        par.family = ctx->afi->family;
+        if (par.match->destroy != NULL)
+                par.match->destroy(&par);
 
         module_put(match->me);
 }
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index a0195d28bcfc..79ff58cd36dc 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -175,12 +175,14 @@ static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
         if (nla_put_be32(skb,
                          NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max)))
                 goto nla_put_failure;
-        if (nla_put_be32(skb,
-                         NFTA_NAT_REG_PROTO_MIN, htonl(priv->sreg_proto_min)))
-                goto nla_put_failure;
-        if (nla_put_be32(skb,
-                         NFTA_NAT_REG_PROTO_MAX, htonl(priv->sreg_proto_max)))
-                goto nla_put_failure;
+        if (priv->sreg_proto_min) {
+                if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MIN,
+                                 htonl(priv->sreg_proto_min)))
+                        goto nla_put_failure;
+                if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX,
+                                 htonl(priv->sreg_proto_max)))
+                        goto nla_put_failure;
+        }
         return 0;
 
 nla_put_failure:
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index dcb19592761e..12c7e01c2677 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -321,41 +321,40 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
                                 loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
-        char tmp[8];
         struct ctl_table tbl;
-        int ret;
-        int changed = 0;
+        bool changed = false;
         char *none = "none";
+        char tmp[8];
+        int ret;
 
         memset(&tbl, 0, sizeof(struct ctl_table));
 
         if (write) {
                 tbl.data = tmp;
-                tbl.maxlen = 8;
+                tbl.maxlen = sizeof(tmp);
         } else {
                 tbl.data = net->sctp.sctp_hmac_alg ? : none;
                 tbl.maxlen = strlen(tbl.data);
         }
-                ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 
-        if (write) {
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
+        if (write && ret == 0) {
 #ifdef CONFIG_CRYPTO_MD5
                 if (!strncmp(tmp, "md5", 3)) {
                         net->sctp.sctp_hmac_alg = "md5";
-                        changed = 1;
+                        changed = true;
                 }
 #endif
 #ifdef CONFIG_CRYPTO_SHA1
                 if (!strncmp(tmp, "sha1", 4)) {
                         net->sctp.sctp_hmac_alg = "sha1";
-                        changed = 1;
+                        changed = true;
                 }
 #endif
                 if (!strncmp(tmp, "none", 4)) {
                         net->sctp.sctp_hmac_alg = NULL;
-                        changed = 1;
+                        changed = true;
                 }
-
                 if (!changed)
                         ret = -EINVAL;
         }
@@ -368,11 +367,10 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
                                 loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
-        int new_value;
-        struct ctl_table tbl;
         unsigned int min = *(unsigned int *) ctl->extra1;
         unsigned int max = *(unsigned int *) ctl->extra2;
-        int ret;
+        struct ctl_table tbl;
+        int ret, new_value;
 
         memset(&tbl, 0, sizeof(struct ctl_table));
         tbl.maxlen = sizeof(unsigned int);
@@ -381,12 +379,15 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
                 tbl.data = &new_value;
         else
                 tbl.data = &net->sctp.rto_min;
+
         ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
-        if (write) {
-                if (ret || new_value > max || new_value < min)
+        if (write && ret == 0) {
+                if (new_value > max || new_value < min)
                         return -EINVAL;
+
                 net->sctp.rto_min = new_value;
         }
+
         return ret;
 }
 
@@ -395,11 +396,10 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
                                 loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
-        int new_value;
-        struct ctl_table tbl;
         unsigned int min = *(unsigned int *) ctl->extra1;
         unsigned int max = *(unsigned int *) ctl->extra2;
-        int ret;
+        struct ctl_table tbl;
+        int ret, new_value;
 
         memset(&tbl, 0, sizeof(struct ctl_table));
         tbl.maxlen = sizeof(unsigned int);
@@ -408,12 +408,15 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
                 tbl.data = &new_value;
         else
                 tbl.data = &net->sctp.rto_max;
+
         ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
-        if (write) {
-                if (ret || new_value > max || new_value < min)
+        if (write && ret == 0) {
+                if (new_value > max || new_value < min)
                         return -EINVAL;
+
                 net->sctp.rto_max = new_value;
         }
+
         return ret;
 }
 
@@ -444,8 +447,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
                 tbl.data = &net->sctp.auth_enable;
 
         ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
-
-        if (write) {
+        if (write && ret == 0) {
                 struct sock *sk = net->sctp.ctl_sock;
 
                 net->sctp.auth_enable = new_value;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 247e973544bf..f77366717420 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -592,6 +592,7 @@ rpcauth_lookupcred(struct rpc_auth *auth, int flags)
         put_group_info(acred.group_info);
         return ret;
 }
+EXPORT_SYMBOL_GPL(rpcauth_lookupcred);
 
 void
 rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred,
diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h
index 6af373236d73..4b0113f73ee9 100644
--- a/samples/trace_events/trace-events-sample.h
+++ b/samples/trace_events/trace-events-sample.h
@@ -56,7 +56,8 @@
  * struct:  This defines the way the data will be stored in the ring buffer.
  *    There are currently two types of elements. __field and __array.
  *    a __field is broken up into (type, name). Where type can be any
- *    type but an array.
+ *    primitive type (integer, long or pointer). __field_struct() can
+ *    be any static complex data value (struct, union, but not an array).
  *    For an array. there are three fields. (type, name, size). The
  *    type of elements in the array, the name of the field and the size
  *    of the array.
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 010b18ef4ea0..182be0f12407 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3476,12 +3476,17 @@ sub process {
                         }
                 }
 
-# unnecessary return in a void function? (a single leading tab, then return;)
-                if ($sline =~ /^\+\treturn\s*;\s*$/ &&
-                    $prevline =~ /^\+/) {
+# unnecessary return in a void function
+# at end-of-function, with the previous line a single leading tab, then return;
+# and the line before that not a goto label target like "out:"
+                if ($sline =~ /^[ \+]}\s*$/ &&
+                    $prevline =~ /^\+\treturn\s*;\s*$/ &&
+                    $linenr >= 3 &&
+                    $lines[$linenr - 3] =~ /^[ +]/ &&
+                    $lines[$linenr - 3] !~ /^[ +]\s*$Ident\s*:/) {
                         WARN("RETURN_VOID",
-                             "void function return statements are not generally useful\n" . $herecurr);
-                }
+                             "void function return statements are not generally useful\n" . $hereprev);
+               }
 
 # if statements using unnecessary parentheses - ie: if ((foo == bar))
                 if ($^V && $^V ge 5.10.0 &&
diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
index 9d1421e63ff8..49b582a225b0 100644
--- a/scripts/recordmcount.h
+++ b/scripts/recordmcount.h
@@ -163,11 +163,11 @@ static int mcount_adjust = 0;
 
 static int MIPS_is_fake_mcount(Elf_Rel const *rp)
 {
-        static Elf_Addr old_r_offset;
+        static Elf_Addr old_r_offset = ~(Elf_Addr)0;
         Elf_Addr current_r_offset = _w(rp->r_offset);
         int is_fake;
 
-        is_fake = old_r_offset &&
+        is_fake = (old_r_offset != ~(Elf_Addr)0) &&
                 (current_r_offset - old_r_offset == MIPS_FAKEMCOUNT_OFFSET);
         old_r_offset = current_r_offset;
 
diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
index b684c6e4f301..dabe41975a9d 100644
--- a/sound/pci/hda/hda_auto_parser.c
+++ b/sound/pci/hda/hda_auto_parser.c
@@ -898,6 +898,7 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
                         if (!strcmp(codec->modelname, models->name)) {
                                 codec->fixup_id = models->id;
                                 codec->fixup_name = models->name;
+                                codec->fixup_list = fixlist;
                                 codec->fixup_forced = 1;
                                 return;
                         }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 23fd6b9aecca..25753db97071 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -288,6 +288,24 @@ static char *driver_short_names[] = {
         [AZX_DRIVER_GENERIC] = "HD-Audio Generic",
 };
 
+
+/* Intel HSW/BDW display HDA controller Extended Mode registers.
+ * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
+ * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
+ * The values will be lost when the display power well is disabled.
+ */
+#define ICH6_REG_EM4                    0x100c
+#define ICH6_REG_EM5                    0x1010
+
+struct hda_intel {
+        struct azx chip;
+
+        /* HSW/BDW display HDA controller to restore BCLK from CDCLK */
+        unsigned int bclk_m;
+        unsigned int bclk_n;
+};
+
+
 #ifdef CONFIG_X86
 static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool on)
 {
@@ -580,6 +598,22 @@ static int param_set_xint(const char *val, const struct kernel_param *kp)
 #define azx_del_card_list(chip) /* NOP */
 #endif /* CONFIG_PM */
 
+static void haswell_save_bclk(struct azx *chip)
+{
+        struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+
+        hda->bclk_m = azx_readw(chip, EM4);
+        hda->bclk_n = azx_readw(chip, EM5);
+}
+
+static void haswell_restore_bclk(struct azx *chip)
+{
+        struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+
+        azx_writew(chip, EM4, hda->bclk_m);
+        azx_writew(chip, EM5, hda->bclk_n);
+}
+
 #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO)
 /*
  * power management
@@ -606,6 +640,13 @@ static int azx_suspend(struct device *dev)
                 free_irq(chip->irq, chip);
                 chip->irq = -1;
         }
+
+        /* Save BCLK M/N values before they become invalid in D3.
+         * Will test if display power well can be released now.
+         */
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+                haswell_save_bclk(chip);
+
         if (chip->msi)
                 pci_disable_msi(chip->pci);
         pci_disable_device(pci);
@@ -625,8 +666,10 @@ static int azx_resume(struct device *dev)
         if (chip->disabled)
                 return 0;
 
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
                 hda_display_power(true);
+                haswell_restore_bclk(chip);
+        }
         pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
         if (pci_enable_device(pci) < 0) {
@@ -670,8 +713,10 @@ static int azx_runtime_suspend(struct device *dev)
         azx_stop_chip(chip);
         azx_enter_link_reset(chip);
         azx_clear_irq_pending(chip);
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+                haswell_save_bclk(chip);
                 hda_display_power(false);
+        }
         return 0;
 }
 
@@ -689,8 +734,10 @@ static int azx_runtime_resume(struct device *dev)
         if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
                 return 0;
 
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
                 hda_display_power(true);
+                haswell_restore_bclk(chip);
+        }
 
         /* Read STATESTS before controller reset */
         status = azx_readw(chip, STATESTS);
@@ -883,6 +930,8 @@ static int register_vga_switcheroo(struct azx *chip)
 static int azx_free(struct azx *chip)
 {
         struct pci_dev *pci = chip->pci;
+        struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+
         int i;
 
         if ((chip->driver_caps & AZX_DCAPS_PM_RUNTIME)
@@ -930,7 +979,7 @@ static int azx_free(struct azx *chip)
                 hda_display_power(false);
                 hda_i915_exit();
         }
-        kfree(chip);
+        kfree(hda);
 
         return 0;
 }
@@ -1174,6 +1223,7 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
         static struct snd_device_ops ops = {
                 .dev_free = azx_dev_free,
         };
+        struct hda_intel *hda;
         struct azx *chip;
         int err;
 
@@ -1183,13 +1233,14 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
         if (err < 0)
                 return err;
 
-        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
-        if (!chip) {
-                dev_err(card->dev, "Cannot allocate chip\n");
+        hda = kzalloc(sizeof(*hda), GFP_KERNEL);
+        if (!hda) {
+                dev_err(card->dev, "Cannot allocate hda\n");
                 pci_disable_device(pci);
                 return -ENOMEM;
         }
 
+        chip = &hda->chip;
         spin_lock_init(&chip->reg_lock);
         mutex_init(&chip->open_mutex);
         chip->card = card;
diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
index ebd1fa6f015c..4e2d4863daa1 100644
--- a/sound/pci/hda/hda_local.h
+++ b/sound/pci/hda/hda_local.h
@@ -417,6 +417,27 @@ struct snd_hda_pin_quirk {
         int value;                      /* quirk value */
 };
 
+#ifdef CONFIG_SND_DEBUG_VERBOSE
+
+#define SND_HDA_PIN_QUIRK(_codec, _subvendor, _name, _value, _pins...) \
+        { .codec = _codec,\
+          .subvendor = _subvendor,\
+          .name = _name,\
+          .value = _value,\
+          .pins = (const struct hda_pintbl[]) { _pins } \
+        }
+#else
+
+#define SND_HDA_PIN_QUIRK(_codec, _subvendor, _name, _value, _pins...) \
+        { .codec = _codec,\
+          .subvendor = _subvendor,\
+          .value = _value,\
+          .pins = (const struct hda_pintbl[]) { _pins } \
+        }
+
+#endif
+
+
 /* fixup types */
 enum {
         HDA_FIXUP_INVALID,
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 3e4417b0ddbe..4fe876b65fda 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2204,7 +2204,7 @@ static int generic_hdmi_resume(struct hda_codec *codec)
         struct hdmi_spec *spec = codec->spec;
         int pin_idx;
 
-        generic_hdmi_init(codec);
+        codec->patch_ops.init(codec);
         snd_hda_codec_resume_amp(codec);
         snd_hda_codec_resume_cache(codec);
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index af76995fa966..1c654effcd1a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4962,228 +4962,129 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
 };
 
 static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60140},
-                        {0x14, 0x90170110},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211020},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170120},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211030},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170120},
-                        {0x17, 0x90170140},
-                        {0x18, 0x40000000},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41163b05},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x0321102f},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170130},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211040},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170140},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211050},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60170},
-                        {0x14, 0x90170120},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211030},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60170},
-                        {0x14, 0x90170130},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211040},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0283,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60130},
-                        {0x14, 0x90170110},
-                        {0x17, 0x40020008},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40e00001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x0321101f},
-                },
-                .value = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0283,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170120},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211030},
-                },
-                .value = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0292,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60140},
-                        {0x13, 0x411111f0},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0221401f},
-                        {0x16, 0x411111f0},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                },
-                .value = ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0293,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x40000000},
-                        {0x13, 0x90a60140},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0221401f},
-                        {0x16, 0x21014020},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x21a19030},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                },
-                .value = ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60140},
+                {0x14, 0x90170110},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170120},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170120},
+                {0x17, 0x90170140},
+                {0x18, 0x40000000},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41163b05},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0321102f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170130},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170140},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211050}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60170},
+                {0x14, 0x90170120},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60170},
+                {0x14, 0x90170130},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0283, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x17, 0x40020008},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40e00001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0321101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0283, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170120},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
+                {0x12, 0x90a60140},
+                {0x13, 0x411111f0},
+                {0x14, 0x90170110},
+                {0x15, 0x0221401f},
+                {0x16, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x40000000},
+                {0x13, 0x90a60140},
+                {0x14, 0x90170110},
+                {0x15, 0x0221401f},
+                {0x16, 0x21014020},
+                {0x18, 0x411111f0},
+                {0x19, 0x21a19030},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0}),
         {}
 };
 
@@ -6039,90 +5940,66 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
 };
 
 static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x99a30130},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x99a30140},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x99a30150},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x411111f0},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x99a30130},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x99a30140},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x99a30150},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x411111f0},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell XPS 15", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40d6832d},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
         {}
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 7f40a150899c..3744ea4e843d 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -122,6 +122,12 @@ enum {
 };
 
 enum {
+        STAC_92HD95_HP_LED,
+        STAC_92HD95_HP_BASS,
+        STAC_92HD95_MODELS
+};
+
+enum {
         STAC_925x_REF,
         STAC_M1,
         STAC_M1_2,
@@ -4128,6 +4134,48 @@ static const struct snd_pci_quirk stac9205_fixup_tbl[] = {
         {} /* terminator */
 };
 
+static void stac92hd95_fixup_hp_led(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        struct sigmatel_spec *spec = codec->spec;
+
+        if (action != HDA_FIXUP_ACT_PRE_PROBE)
+                return;
+
+        if (find_mute_led_cfg(codec, spec->default_polarity))
+                codec_dbg(codec, "mute LED gpio %d polarity %d\n",
+                                spec->gpio_led,
+                                spec->gpio_led_polarity);
+}
+
+static const struct hda_fixup stac92hd95_fixups[] = {
+        [STAC_92HD95_HP_LED] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = stac92hd95_fixup_hp_led,
+        },
+        [STAC_92HD95_HP_BASS] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        {0x1a, 0x795, 0x00}, /* HPF to 100Hz */
+                        {}
+                },
+                .chained = true,
+                .chain_id = STAC_92HD95_HP_LED,
+        },
+};
+
+static const struct snd_pci_quirk stac92hd95_fixup_tbl[] = {
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1911, "HP Spectre 13", STAC_92HD95_HP_BASS),
+        {} /* terminator */
+};
+
+static const struct hda_model_fixup stac92hd95_models[] = {
+        { .id = STAC_92HD95_HP_LED, .name = "hp-led" },
+        { .id = STAC_92HD95_HP_BASS, .name = "hp-bass" },
+        {}
+};
+
+
 static int stac_parse_auto_config(struct hda_codec *codec)
 {
         struct sigmatel_spec *spec = codec->spec;
@@ -4580,10 +4628,16 @@ static int patch_stac92hd95(struct hda_codec *codec)
         spec->gen.beep_nid = 0x19; /* digital beep */
         spec->pwr_nids = stac92hd95_pwr_nids;
         spec->num_pwrs = ARRAY_SIZE(stac92hd95_pwr_nids);
-        spec->default_polarity = -1; /* no default cfg */
+        spec->default_polarity = 0;
 
         codec->patch_ops = stac_patch_ops;
 
+        snd_hda_pick_fixup(codec, stac92hd95_models, stac92hd95_fixup_tbl,
+                           stac92hd95_fixups);
+        snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
+
+        stac_setup_gpio(codec);
+
         err = stac_parse_auto_config(codec);
         if (err < 0) {
                 stac_free(codec);
@@ -4592,6 +4646,8 @@ static int patch_stac92hd95(struct hda_codec *codec)
 
         codec->proc_widget_hook = stac92hd_proc_hook;
 
+        snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PROBE);
+
         return 0;
 }
 
diff --git a/sound/usb/card.c b/sound/usb/card.c
index c3b5b7dca1c3..a09e5f3519e3 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -307,6 +307,11 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
 
 static int snd_usb_audio_free(struct snd_usb_audio *chip)
 {
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &chip->ep_list)
+                snd_usb_endpoint_free(p);
+
         mutex_destroy(&chip->mutex);
         kfree(chip);
         return 0;
@@ -585,7 +590,7 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
                                      struct snd_usb_audio *chip)
 {
         struct snd_card *card;
-        struct list_head *p, *n;
+        struct list_head *p;
 
         if (chip == (void *)-1L)
                 return;
@@ -598,14 +603,16 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
         mutex_lock(&register_mutex);
         chip->num_interfaces--;
         if (chip->num_interfaces <= 0) {
+                struct snd_usb_endpoint *ep;
+
                 snd_card_disconnect(card);
                 /* release the pcm resources */
                 list_for_each(p, &chip->pcm_list) {
                         snd_usb_stream_disconnect(p);
                 }
                 /* release the endpoint resources */
-                list_for_each_safe(p, n, &chip->ep_list) {
-                        snd_usb_endpoint_free(p);
+                list_for_each_entry(ep, &chip->ep_list, list) {
+                        snd_usb_endpoint_release(ep);
                 }
                 /* release the midi resources */
                 list_for_each(p, &chip->midi_list) {
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 289f582c9130..114e3e7ff511 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -987,19 +987,30 @@ void snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep)
 }
 
 /**
+ * snd_usb_endpoint_release: Tear down an snd_usb_endpoint
+ *
+ * @ep: the endpoint to release
+ *
+ * This function does not care for the endpoint's use count but will tear
+ * down all the streaming URBs immediately.
+ */
+void snd_usb_endpoint_release(struct snd_usb_endpoint *ep)
+{
+        release_urbs(ep, 1);
+}
+
+/**
  * snd_usb_endpoint_free: Free the resources of an snd_usb_endpoint
  *
  * @ep: the list header of the endpoint to free
  *
- * This function does not care for the endpoint's use count but will tear
- * down all the streaming URBs immediately and free all resources.
+ * This free all resources of the given ep.
  */
 void snd_usb_endpoint_free(struct list_head *head)
 {
         struct snd_usb_endpoint *ep;
 
         ep = list_entry(head, struct snd_usb_endpoint, list);
-        release_urbs(ep, 1);
         kfree(ep);
 }
 
diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
index 1c7e8ee48abc..e61ee5c356a3 100644
--- a/sound/usb/endpoint.h
+++ b/sound/usb/endpoint.h
@@ -23,6 +23,7 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
 int  snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep);
+void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_free(struct list_head *head);
 
 int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index 51267f4184a6..2cede239a074 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -2,7 +2,7 @@ PROGS := tm-resched-dscr
 
 all: $(PROGS)
 
-$(PROGS):
+$(PROGS): ../harness.c
 
 run_tests: all
         @-for PROG in $(PROGS); do \
diff --git a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
index ee98e3886af2..42d4c8caad81 100644
--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
@@ -28,6 +28,8 @@
 #include <assert.h>
 #include <asm/tm.h>
 
+#include "utils.h"
+
 #define TBEGIN          ".long 0x7C00051D ;"
 #define TEND            ".long 0x7C00055D ;"
 #define TCHECK          ".long 0x7C00059C ;"
@@ -36,7 +38,8 @@
 #define SPRN_TEXASR     0x82
 #define SPRN_DSCR       0x03
 
-int main(void) {
+int test_body(void)
+{
         uint64_t rv, dscr1 = 1, dscr2, texasr;
 
         printf("Check DSCR TM context switch: ");
@@ -81,10 +84,15 @@ int main(void) {
                 }
                 if (dscr2 != dscr1) {
                         printf(" FAIL\n");
-                        exit(EXIT_FAILURE);
+                        return 1;
                 } else {
                         printf(" OK\n");
-                        exit(EXIT_SUCCESS);
+                        return 0;
                 }
         }
 }
+
+int main(void)
+{
+        return test_harness(test_body, "tm_resched_dscr");
+}