838 files changed, 11206 insertions, 5354 deletions

diff --git a/Documentation/devicetree/bindings/arm/exynos/power_domain.txt b/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
index f4445e5a2bbb..1e097037349c 100644
--- a/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
+++ b/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
@@ -22,6 +22,8 @@ Optional Properties:
         - pclkN, clkN: Pairs of parent of input clock and input clock to the
                 devices in this power domain. Maximum of 4 pairs (N = 0 to 3)
                 are supported currently.
+- power-domains: phandle pointing to the parent power domain, for more details
+                 see Documentation/devicetree/bindings/power/power_domain.txt
 
 Node of a device using power domains must have a power-domains property
 defined with a phandle to respective power domain.
diff --git a/Documentation/devicetree/bindings/arm/sti.txt b/Documentation/devicetree/bindings/arm/sti.txt
index d70ec358736c..8d27f6b084c7 100644
--- a/Documentation/devicetree/bindings/arm/sti.txt
+++ b/Documentation/devicetree/bindings/arm/sti.txt
@@ -13,6 +13,10 @@ Boards with the ST STiH407 SoC shall have the following properties:
 Required root node property:
 compatible = "st,stih407";
 
+Boards with the ST STiH410 SoC shall have the following properties:
+Required root node property:
+compatible = "st,stih410";
+
 Boards with the ST STiH418 SoC shall have the following properties:
 Required root node property:
 compatible = "st,stih418";
diff --git a/Documentation/devicetree/bindings/net/dsa/dsa.txt b/Documentation/devicetree/bindings/net/dsa/dsa.txt
index e124847443f8..f0b4cd72411d 100644
--- a/Documentation/devicetree/bindings/net/dsa/dsa.txt
+++ b/Documentation/devicetree/bindings/net/dsa/dsa.txt
@@ -19,7 +19,9 @@ the parent DSA node. The maximum number of allowed child nodes is 4
 (DSA_MAX_SWITCHES).
 Each of these switch child nodes should have the following required properties:
 
-- reg                   : Describes the switch address on the MII bus
+- reg                   : Contains two fields. The first one describes the
+                          address on the MII bus. The second is the switch
+                          number that must be unique in cascaded configurations
 - #address-cells        : Must be 1
 - #size-cells           : Must be 0
 
diff --git a/Documentation/devicetree/bindings/power/power_domain.txt b/Documentation/devicetree/bindings/power/power_domain.txt
index 98c16672ab5f..0f8ed3710c66 100644
--- a/Documentation/devicetree/bindings/power/power_domain.txt
+++ b/Documentation/devicetree/bindings/power/power_domain.txt
@@ -19,6 +19,16 @@ Required properties:
    providing multiple PM domains (e.g. power controllers), but can be any value
    as specified by device tree binding documentation of particular provider.
 
+Optional properties:
+ - power-domains : A phandle and PM domain specifier as defined by bindings of
+                   the power controller specified by phandle.
+   Some power domains might be powered from another power domain (or have
+   other hardware specific dependencies). For representing such dependency
+   a standard PM domain consumer binding is used. When provided, all domains
+   created by the given provider should be subdomains of the domain
+   specified by this binding. More details about power domain specifier are
+   available in the next section.
+
 Example:
 
         power: power-controller@12340000 {
@@ -30,6 +40,25 @@ Example:
 The node above defines a power controller that is a PM domain provider and
 expects one cell as its phandle argument.
 
+Example 2:
+
+        parent: power-controller@12340000 {
+                compatible = "foo,power-controller";
+                reg = <0x12340000 0x1000>;
+                #power-domain-cells = <1>;
+        };
+
+        child: power-controller@12340000 {
+                compatible = "foo,power-controller";
+                reg = <0x12341000 0x1000>;
+                power-domains = <&parent 0>;
+                #power-domain-cells = <1>;
+        };
+
+The nodes above define two power controllers: 'parent' and 'child'.
+Domains created by the 'child' power controller are subdomains of '0' power
+domain provided by the 'parent' power controller.
+
 ==PM domain consumers==
 
 Required properties:
diff --git a/Documentation/devicetree/bindings/serial/of-serial.txt b/Documentation/devicetree/bindings/serial/8250.txt
index 91d5ab0e60fc..91d5ab0e60fc 100644
--- a/Documentation/devicetree/bindings/serial/of-serial.txt
+++ b/Documentation/devicetree/bindings/serial/8250.txt
diff --git a/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt b/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt
new file mode 100644
index 000000000000..ebcbb62c0a76
--- /dev/null
+++ b/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt
@@ -0,0 +1,19 @@
+ETRAX FS UART
+
+Required properties:
+- compatible : "axis,etraxfs-uart"
+- reg: offset and length of the register set for the device.
+- interrupts: device interrupt
+
+Optional properties:
+- {dtr,dsr,ri,cd}-gpios: specify a GPIO for DTR/DSR/RI/CD
+  line respectively.
+
+Example:
+
+serial@b00260000 {
+        compatible = "axis,etraxfs-uart";
+        reg = <0xb0026000 0x1000>;
+        interrupts = <68>;
+        status = "disabled";
+};
diff --git a/Documentation/devicetree/bindings/submitting-patches.txt b/Documentation/devicetree/bindings/submitting-patches.txt
index 56742bc70218..7d44eae7ab0b 100644
--- a/Documentation/devicetree/bindings/submitting-patches.txt
+++ b/Documentation/devicetree/bindings/submitting-patches.txt
@@ -12,6 +12,9 @@ I. For patch submitters
 
        devicetree@vger.kernel.org
 
+     and Cc: the DT maintainers. Use scripts/get_maintainer.pl to identify
+     all of the DT maintainers.
+
   3) The Documentation/ portion of the patch should come in the series before
      the code implementing the binding.
 
diff --git a/Documentation/devicetree/bindings/thermal/rcar-thermal.txt b/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
index 43404b197933..332e625f6ed0 100644
--- a/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
@@ -4,7 +4,7 @@ Required properties:
 - compatible            : "renesas,thermal-<soctype>", "renesas,rcar-thermal"
                           as fallback.
                           Examples with soctypes are:
-                            - "renesas,thermal-r8a73a4" (R-Mobile AP6)
+                            - "renesas,thermal-r8a73a4" (R-Mobile APE6)
                             - "renesas,thermal-r8a7779" (R-Car H1)
                             - "renesas,thermal-r8a7790" (R-Car H2)
                             - "renesas,thermal-r8a7791" (R-Car M2-W)
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 389ca1347a77..fae26d014aaf 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -20,6 +20,7 @@ amlogic	Amlogic, Inc.
 ams     AMS AG
 amstaos AMS-Taos Inc.
 apm     Applied Micro Circuits Corporation (APM)
+arasan  Arasan Chip Systems
 arm     ARM Ltd.
 armadeus        ARMadeus Systems SARL
 asahi-kasei     Asahi Kasei Corp.
@@ -27,6 +28,7 @@ atmel	Atmel Corporation
 auo     AU Optronics Corporation
 avago   Avago Technologies
 avic    Shanghai AVIC Optoelectronics Co., Ltd.
+axis    Axis Communications AB
 bosch   Bosch Sensortec GmbH
 brcm    Broadcom Corporation
 buffalo Buffalo, Inc.
diff --git a/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt b/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
index f90e294d7631..a4d869744f59 100644
--- a/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
+++ b/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
@@ -26,6 +26,11 @@ Optional properties:
 - atmel,disable : Should be present if you want to disable the watchdog.
 - atmel,idle-halt : Should be present if you want to stop the watchdog when
         entering idle state.
+        CAUTION: This property should be used with care, it actually makes the
+        watchdog not counting when the CPU is in idle state, therefore the
+        watchdog reset time depends on mean CPU usage and will not reset at all
+        if the CPU stop working while it is in idle state, which is probably
+        not what you want.
 - atmel,dbg-halt : Should be present if you want to stop the watchdog when
         entering debug state.
 
diff --git a/Documentation/input/alps.txt b/Documentation/input/alps.txt
index a63e5e013a8c..92ae734c00c3 100644
--- a/Documentation/input/alps.txt
+++ b/Documentation/input/alps.txt
@@ -114,6 +114,9 @@ ALPS Absolute Mode - Protocol Version 2
  byte 4:  0   y6   y5   y4   y3   y2   y1   y0
  byte 5:  0   z6   z5   z4   z3   z2   z1   z0
 
+Protocol Version 2 DualPoint devices send standard PS/2 mouse packets for
+the DualPoint Stick.
+
 Dualpoint device -- interleaved packet format
 ---------------------------------------------
 
@@ -127,6 +130,11 @@ Dualpoint device -- interleaved packet format
  byte 7:    0   y6   y5   y4   y3   y2   y1   y0
  byte 8:    0   z6   z5   z4   z3   z2   z1   z0
 
+Devices which use the interleaving format normally send standard PS/2 mouse
+packets for the DualPoint Stick + ALPS Absolute Mode packets for the
+touchpad, switching to the interleaved packet format when both the stick and
+the touchpad are used at the same time.
+
 ALPS Absolute Mode - Protocol Version 3
 ---------------------------------------
 
diff --git a/Documentation/input/event-codes.txt b/Documentation/input/event-codes.txt
index c587a966413e..96705616f582 100644
--- a/Documentation/input/event-codes.txt
+++ b/Documentation/input/event-codes.txt
@@ -294,6 +294,12 @@ accordingly. This property does not affect kernel behavior.
 The kernel does not provide button emulation for such devices but treats
 them as any other INPUT_PROP_BUTTONPAD device.
 
+INPUT_PROP_ACCELEROMETER
+-------------------------
+Directional axes on this device (absolute and/or relative x, y, z) represent
+accelerometer data. All other axes retain their meaning. A device must not mix
+regular directional axes and accelerometer axes on the same event node.
+
 Guidelines:
 ==========
 The guidelines below ensure proper single-touch and multi-finger functionality.
diff --git a/Documentation/input/multi-touch-protocol.txt b/Documentation/input/multi-touch-protocol.txt
index 7b4f59c09ee2..b85d000faeb4 100644
--- a/Documentation/input/multi-touch-protocol.txt
+++ b/Documentation/input/multi-touch-protocol.txt
@@ -312,9 +312,12 @@ ABS_MT_TOOL_TYPE
 
 The type of approaching tool. A lot of kernel drivers cannot distinguish
 between different tool types, such as a finger or a pen. In such cases, the
-event should be omitted. The protocol currently supports MT_TOOL_FINGER and
-MT_TOOL_PEN [2]. For type B devices, this event is handled by input core;
-drivers should instead use input_mt_report_slot_state().
+event should be omitted. The protocol currently supports MT_TOOL_FINGER,
+MT_TOOL_PEN, and MT_TOOL_PALM [2]. For type B devices, this event is handled
+by input core; drivers should instead use input_mt_report_slot_state().
+A contact's ABS_MT_TOOL_TYPE may change over time while still touching the
+device, because the firmware may not be able to determine which tool is being
+used when it first appears.
 
 ABS_MT_BLOB_ID
 
diff --git a/Documentation/rtc.txt b/Documentation/rtc.txt
index 596b60c08b74..8446f1ea1410 100644
--- a/Documentation/rtc.txt
+++ b/Documentation/rtc.txt
@@ -204,266 +204,4 @@ Some common examples:
 
     *   RTC_PIE_ON, RTC_PIE_OFF: These are also emulated by the generic code.
 
-If all else fails, check out the rtc-test.c driver!
-
-
--------------------- 8< ---------------- 8< -----------------------------
-
-/*
- *      Real Time Clock Driver Test/Example Program
- *
- *      Compile with:
- *                   gcc -s -Wall -Wstrict-prototypes rtctest.c -o rtctest
- *
- *      Copyright (C) 1996, Paul Gortmaker.
- *
- *      Released under the GNU General Public License, version 2,
- *      included herein by reference.
- *
- */
-
-#include <stdio.h>
-#include <linux/rtc.h>
-#include <sys/ioctl.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <errno.h>
-
-
-/*
- * This expects the new RTC class driver framework, working with
- * clocks that will often not be clones of what the PC-AT had.
- * Use the command line to specify another RTC if you need one.
- */
-static const char default_rtc[] = "/dev/rtc0";
-
-
-int main(int argc, char **argv)
-{
-        int i, fd, retval, irqcount = 0;
-        unsigned long tmp, data;
-        struct rtc_time rtc_tm;
-        const char *rtc = default_rtc;
-
-        switch (argc) {
-        case 2:
-                rtc = argv[1];
-                /* FALLTHROUGH */
-        case 1:
-                break;
-        default:
-                fprintf(stderr, "usage:  rtctest [rtcdev]\n");
-                return 1;
-        }
-
-        fd = open(rtc, O_RDONLY);
-
-        if (fd ==  -1) {
-                perror(rtc);
-                exit(errno);
-        }
-
-        fprintf(stderr, "\n\t\t\tRTC Driver Test Example.\n\n");
-
-        /* Turn on update interrupts (one per second) */
-        retval = ioctl(fd, RTC_UIE_ON, 0);
-        if (retval == -1) {
-                if (errno == ENOTTY) {
-                        fprintf(stderr,
-                                "\n...Update IRQs not supported.\n");
-                        goto test_READ;
-                }
-                perror("RTC_UIE_ON ioctl");
-                exit(errno);
-        }
-
-        fprintf(stderr, "Counting 5 update (1/sec) interrupts from reading %s:",
-                        rtc);
-        fflush(stderr);
-        for (i=1; i<6; i++) {
-                /* This read will block */
-                retval = read(fd, &data, sizeof(unsigned long));
-                if (retval == -1) {
-                        perror("read");
-                        exit(errno);
-                }
-                fprintf(stderr, " %d",i);
-                fflush(stderr);
-                irqcount++;
-        }
-
-        fprintf(stderr, "\nAgain, from using select(2) on /dev/rtc:");
-        fflush(stderr);
-        for (i=1; i<6; i++) {
-                struct timeval tv = {5, 0};     /* 5 second timeout on select */
-                fd_set readfds;
-
-                FD_ZERO(&readfds);
-                FD_SET(fd, &readfds);
-                /* The select will wait until an RTC interrupt happens. */
-                retval = select(fd+1, &readfds, NULL, NULL, &tv);
-                if (retval == -1) {
-                        perror("select");
-                        exit(errno);
-                }
-                /* This read won't block unlike the select-less case above. */
-                retval = read(fd, &data, sizeof(unsigned long));
-                if (retval == -1) {
-                        perror("read");
-                        exit(errno);
-                }
-                fprintf(stderr, " %d",i);
-                fflush(stderr);
-                irqcount++;
-        }
-
-        /* Turn off update interrupts */
-        retval = ioctl(fd, RTC_UIE_OFF, 0);
-        if (retval == -1) {
-                perror("RTC_UIE_OFF ioctl");
-                exit(errno);
-        }
-
-test_READ:
-        /* Read the RTC time/date */
-        retval = ioctl(fd, RTC_RD_TIME, &rtc_tm);
-        if (retval == -1) {
-                perror("RTC_RD_TIME ioctl");
-                exit(errno);
-        }
-
-        fprintf(stderr, "\n\nCurrent RTC date/time is %d-%d-%d, %02d:%02d:%02d.\n",
-                rtc_tm.tm_mday, rtc_tm.tm_mon + 1, rtc_tm.tm_year + 1900,
-                rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
-
-        /* Set the alarm to 5 sec in the future, and check for rollover */
-        rtc_tm.tm_sec += 5;
-        if (rtc_tm.tm_sec >= 60) {
-                rtc_tm.tm_sec %= 60;
-                rtc_tm.tm_min++;
-        }
-        if (rtc_tm.tm_min == 60) {
-                rtc_tm.tm_min = 0;
-                rtc_tm.tm_hour++;
-        }
-        if (rtc_tm.tm_hour == 24)
-                rtc_tm.tm_hour = 0;
-
-        retval = ioctl(fd, RTC_ALM_SET, &rtc_tm);
-        if (retval == -1) {
-                if (errno == ENOTTY) {
-                        fprintf(stderr,
-                                "\n...Alarm IRQs not supported.\n");
-                        goto test_PIE;
-                }
-                perror("RTC_ALM_SET ioctl");
-                exit(errno);
-        }
-
-        /* Read the current alarm settings */
-        retval = ioctl(fd, RTC_ALM_READ, &rtc_tm);
-        if (retval == -1) {
-                perror("RTC_ALM_READ ioctl");
-                exit(errno);
-        }
-
-        fprintf(stderr, "Alarm time now set to %02d:%02d:%02d.\n",
-                rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
-
-        /* Enable alarm interrupts */
-        retval = ioctl(fd, RTC_AIE_ON, 0);
-        if (retval == -1) {
-                perror("RTC_AIE_ON ioctl");
-                exit(errno);
-        }
-
-        fprintf(stderr, "Waiting 5 seconds for alarm...");
-        fflush(stderr);
-        /* This blocks until the alarm ring causes an interrupt */
-        retval = read(fd, &data, sizeof(unsigned long));
-        if (retval == -1) {
-                perror("read");
-                exit(errno);
-        }
-        irqcount++;
-        fprintf(stderr, " okay. Alarm rang.\n");
-
-        /* Disable alarm interrupts */
-        retval = ioctl(fd, RTC_AIE_OFF, 0);
-        if (retval == -1) {
-                perror("RTC_AIE_OFF ioctl");
-                exit(errno);
-        }
-
-test_PIE:
-        /* Read periodic IRQ rate */
-        retval = ioctl(fd, RTC_IRQP_READ, &tmp);
-        if (retval == -1) {
-                /* not all RTCs support periodic IRQs */
-                if (errno == ENOTTY) {
-                        fprintf(stderr, "\nNo periodic IRQ support\n");
-                        goto done;
-                }
-                perror("RTC_IRQP_READ ioctl");
-                exit(errno);
-        }
-        fprintf(stderr, "\nPeriodic IRQ rate is %ldHz.\n", tmp);
-
-        fprintf(stderr, "Counting 20 interrupts at:");
-        fflush(stderr);
-
-        /* The frequencies 128Hz, 256Hz, ... 8192Hz are only allowed for root. */
-        for (tmp=2; tmp<=64; tmp*=2) {
-
-                retval = ioctl(fd, RTC_IRQP_SET, tmp);
-                if (retval == -1) {
-                        /* not all RTCs can change their periodic IRQ rate */
-                        if (errno == ENOTTY) {
-                                fprintf(stderr,
-                                        "\n...Periodic IRQ rate is fixed\n");
-                                goto done;
-                        }
-                        perror("RTC_IRQP_SET ioctl");
-                        exit(errno);
-                }
-
-                fprintf(stderr, "\n%ldHz:\t", tmp);
-                fflush(stderr);
-
-                /* Enable periodic interrupts */
-                retval = ioctl(fd, RTC_PIE_ON, 0);
-                if (retval == -1) {
-                        perror("RTC_PIE_ON ioctl");
-                        exit(errno);
-                }
-
-                for (i=1; i<21; i++) {
-                        /* This blocks */
-                        retval = read(fd, &data, sizeof(unsigned long));
-                        if (retval == -1) {
-                                perror("read");
-                                exit(errno);
-                        }
-                        fprintf(stderr, " %d",i);
-                        fflush(stderr);
-                        irqcount++;
-                }
-
-                /* Disable periodic interrupts */
-                retval = ioctl(fd, RTC_PIE_OFF, 0);
-                if (retval == -1) {
-                        perror("RTC_PIE_OFF ioctl");
-                        exit(errno);
-                }
-        }
-
-done:
-        fprintf(stderr, "\n\n\t\t\t *** Test complete ***\n");
-
-        close(fd);
-
-        return 0;
-}
+If all else fails, check out the tools/testing/selftests/timers/rtctest.c test!
diff --git a/MAINTAINERS b/MAINTAINERS
index 15e4015c5a2f..b84686826b23 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -637,8 +637,7 @@ F:      drivers/gpu/drm/radeon/radeon_kfd.h
 F:      include/uapi/linux/kfd_ioctl.h
 
 AMD MICROCODE UPDATE SUPPORT
-M:      Andreas Herrmann <herrmann.der.user@googlemail.com>
-L:      amd64-microcode@amd64.org
+M:      Borislav Petkov <bp@alien8.de>
 S:      Maintained
 F:      arch/x86/kernel/cpu/microcode/amd*
 
@@ -1030,6 +1029,16 @@ F:	arch/arm/mach-mxs/
 F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
 
+ARM/FREESCALE VYBRID ARM ARCHITECTURE
+M:      Shawn Guo <shawn.guo@linaro.org>
+M:      Sascha Hauer <kernel@pengutronix.de>
+R:      Stefan Agner <stefan@agner.ch>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
+F:      arch/arm/mach-imx/*vf610*
+F:      arch/arm/boot/dts/vf*
+
 ARM/GLOMATION GESBC9312SX MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1176,7 +1185,7 @@ M:	Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-mvebu/
-F:      drivers/rtc/armada38x-rtc
+F:      drivers/rtc/rtc-armada38x.c
 
 ARM/Marvell Berlin SoC support
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
@@ -1188,6 +1197,7 @@ ARM/Marvell Dove/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+M:      Gregory Clement <gregory.clement@free-electrons.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-dove/
@@ -1351,6 +1361,7 @@ F:	drivers/i2c/busses/i2c-rk3x.c
 F:      drivers/*/*rockchip*
 F:      drivers/*/*/*rockchip*
 F:      sound/soc/rockchip/
+N:      rockchip
 
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
@@ -1664,8 +1675,8 @@ F:	drivers/misc/eeprom/at24.c
 F:      include/linux/platform_data/at24.h
 
 ATA OVER ETHERNET (AOE) DRIVER
-M:      "Ed L. Cashin" <ecashin@coraid.com>
-W:      http://support.coraid.com/support/linux
+M:      "Ed L. Cashin" <ed.cashin@acm.org>
+W:      http://www.openaoe.org/
 S:      Supported
 F:      Documentation/aoe/
 F:      drivers/block/aoe/
@@ -1730,7 +1741,7 @@ S:	Maintained
 F:      drivers/net/ethernet/atheros/
 
 ATM
-M:      Chas Williams <chas@cmf.nrl.navy.mil>
+M:      Chas Williams <3chas3@gmail.com>
 L:      linux-atm-general@lists.sourceforge.net (moderated for non-subscribers)
 L:      netdev@vger.kernel.org
 W:      http://linux-atm.sourceforge.net
@@ -2107,7 +2118,6 @@ F:	drivers/net/ethernet/broadcom/bnx2x/
 
 BROADCOM BCM281XX/BCM11XXX/BCM216XX ARM ARCHITECTURE
 M:      Christian Daudt <bcm@fixthebug.org>
-M:      Matt Porter <mporter@linaro.org>
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      bcm-kernel-feedback-list@broadcom.com
 T:      git git://github.com/broadcom/mach-bcm
@@ -3242,6 +3252,13 @@ S:	Maintained
 F:      Documentation/hwmon/dme1737
 F:      drivers/hwmon/dme1737.c
 
+DMI/SMBIOS SUPPORT
+M:      Jean Delvare <jdelvare@suse.de>
+S:      Maintained
+F:      drivers/firmware/dmi-id.c
+F:      drivers/firmware/dmi_scan.c
+F:      include/linux/dmi.h
+
 DOCKING STATION DRIVER
 M:      Shaohua Li <shaohua.li@intel.com>
 L:      linux-acpi@vger.kernel.org
@@ -5077,7 +5094,7 @@ S:	Supported
 F:      drivers/platform/x86/intel_menlow.c
 
 INTEL IA32 MICROCODE UPDATE SUPPORT
-M:      Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
+M:      Borislav Petkov <bp@alien8.de>
 S:      Maintained
 F:      arch/x86/kernel/cpu/microcode/core*
 F:      arch/x86/kernel/cpu/microcode/intel*
@@ -5118,22 +5135,21 @@ M:	Deepak Saxena <dsaxena@plexity.net>
 S:      Maintained
 F:      drivers/char/hw_random/ixp4xx-rng.c
 
-INTEL ETHERNET DRIVERS (e100/e1000/e1000e/fm10k/igb/igbvf/ixgb/ixgbe/ixgbevf/i40e/i40evf)
+INTEL ETHERNET DRIVERS
 M:      Jeff Kirsher <jeffrey.t.kirsher@intel.com>
-M:      Jesse Brandeburg <jesse.brandeburg@intel.com>
-M:      Bruce Allan <bruce.w.allan@intel.com>
-M:      Carolyn Wyborny <carolyn.wyborny@intel.com>
-M:      Don Skidmore <donald.c.skidmore@intel.com>
-M:      Greg Rose <gregory.v.rose@intel.com>
-M:      Matthew Vick <matthew.vick@intel.com>
-M:      John Ronciak <john.ronciak@intel.com>
-M:      Mitch Williams <mitch.a.williams@intel.com>
-M:      Linux NICS <linux.nics@intel.com>
-L:      e1000-devel@lists.sourceforge.net
+R:      Jesse Brandeburg <jesse.brandeburg@intel.com>
+R:      Shannon Nelson <shannon.nelson@intel.com>
+R:      Carolyn Wyborny <carolyn.wyborny@intel.com>
+R:      Don Skidmore <donald.c.skidmore@intel.com>
+R:      Matthew Vick <matthew.vick@intel.com>
+R:      John Ronciak <john.ronciak@intel.com>
+R:      Mitch Williams <mitch.a.williams@intel.com>
+L:      intel-wired-lan@lists.osuosl.org
 W:      http://www.intel.com/support/feedback.htm
 W:      http://e1000.sourceforge.net/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-next.git
+Q:      http://patchwork.ozlabs.org/project/intel-wired-lan/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue.git
 S:      Supported
 F:      Documentation/networking/e100.txt
 F:      Documentation/networking/e1000.txt
@@ -8545,6 +8561,7 @@ F:	include/uapi/linux/timex.h
 F:      kernel/time/clocksource.c
 F:      kernel/time/time*.c
 F:      kernel/time/ntp.c
+F:      tools/testing/selftests/timers/
 
 SC1200 WDT DRIVER
 M:      Zwane Mwaikambo <zwanem@gmail.com>
@@ -10199,6 +10216,13 @@ S:	Maintained
 F:      Documentation/usb/ohci.txt
 F:      drivers/usb/host/ohci*
 
+USB OTG FSM (Finite State Machine)
+M:      Peter Chen <Peter.Chen@freescale.com>
+T:      git git://github.com/hzpeterchen/linux-usb.git
+L:      linux-usb@vger.kernel.org
+S:      Maintained
+F:      drivers/usb/common/usb-otg-fsm.c
+
 USB OVER IP DRIVER
 M:      Valentina Manea <valentina.manea.m@gmail.com>
 M:      Shuah Khan <shuah.kh@samsung.com>
diff --git a/Makefile b/Makefile
index 1100ff3c77e3..fbd43bfe4445 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION =
 NAME = Hurr durr I'ma sheep
 
 # *DOCUMENTATION*
diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index 114234e83caa..edda76fae83f 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -67,7 +67,7 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
                sigset_t *set)
 {
         int err;
-        err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs,
+        err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs,
                              sizeof(sf->uc.uc_mcontext.regs.scratch));
         err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
 
@@ -83,7 +83,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
         if (!err)
                 set_current_blocked(&set);
 
-        err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs),
+        err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch),
                                 sizeof(sf->uc.uc_mcontext.regs.scratch));
 
         return err;
@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn)
         /* Don't restart from sigreturn */
         syscall_wont_restart(regs);
 
+        /*
+         * Ensure that sigreturn always returns to user mode (in case the
+         * regs saved on user stack got fudged between save and sigreturn)
+         * Otherwise it is easy to panic the kernel with a custom
+         * signal handler and/or restorer which clobberes the status32/ret
+         * to return to a bogus location in kernel mode.
+         */
+        regs->status32 |= STATUS_U_MASK;
+
         return regs->r0;
 
 badframe:
@@ -229,8 +238,11 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
 
         /*
          * handler returns using sigreturn stub provided already by userpsace
+         * If not, nuke the process right away
          */
-        BUG_ON(!(ksig->ka.sa.sa_flags & SA_RESTORER));
+        if(!(ksig->ka.sa.sa_flags & SA_RESTORER))
+                return 1;
+
         regs->blink = (unsigned long)ksig->ka.sa.sa_restorer;
 
         /* User Stack for signal handler will be above the frame just carved */
@@ -296,12 +308,12 @@ static void
 handle_signal(struct ksignal *ksig, struct pt_regs *regs)
 {
         sigset_t *oldset = sigmask_to_save();
-        int ret;
+        int failed;
 
         /* Set up the stack frame */
-        ret = setup_rt_frame(ksig, oldset, regs);
+        failed = setup_rt_frame(ksig, oldset, regs);
 
-        signal_setup_done(ret, ksig, 0);
+        signal_setup_done(failed, ksig, 0);
 }
 
 void do_signal(struct pt_regs *regs)
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9f1f09a2bc9b..cf4c0c99aa25 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -619,6 +619,7 @@ config ARCH_PXA
         select GENERIC_CLOCKEVENTS
         select GPIO_PXA
         select HAVE_IDE
+        select IRQ_DOMAIN
         select MULTI_IRQ_HANDLER
         select PLAT_PXA
         select SPARSE_IRQ
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 7f99cd652203..eb7bb511f853 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -150,6 +150,7 @@ machine-$(CONFIG_ARCH_BERLIN)		+= berlin
 machine-$(CONFIG_ARCH_CLPS711X)         += clps711x
 machine-$(CONFIG_ARCH_CNS3XXX)          += cns3xxx
 machine-$(CONFIG_ARCH_DAVINCI)          += davinci
+machine-$(CONFIG_ARCH_DIGICOLOR)        += digicolor
 machine-$(CONFIG_ARCH_DOVE)             += dove
 machine-$(CONFIG_ARCH_EBSA110)          += ebsa110
 machine-$(CONFIG_ARCH_EFM32)            += efm32
diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
index 2c6248d9a9ef..c3255e0c90aa 100644
--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
@@ -301,3 +301,11 @@
         cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
         cd-inverted;
 };
+
+&aes {
+        status = "okay";
+};
+
+&sham {
+        status = "okay";
+};
diff --git a/arch/arm/boot/dts/am335x-bone.dts b/arch/arm/boot/dts/am335x-bone.dts
index 83d40f7655e5..6b8493720424 100644
--- a/arch/arm/boot/dts/am335x-bone.dts
+++ b/arch/arm/boot/dts/am335x-bone.dts
@@ -24,11 +24,3 @@
 &mmc1 {
         vmmc-supply = <&ldo3_reg>;
 };
-
-&sham {
-        status = "okay";
-};
-
-&aes {
-        status = "okay";
-};
diff --git a/arch/arm/boot/dts/am335x-lxm.dts b/arch/arm/boot/dts/am335x-lxm.dts
index 7266a00aab2e..5c5667a3624d 100644
--- a/arch/arm/boot/dts/am335x-lxm.dts
+++ b/arch/arm/boot/dts/am335x-lxm.dts
@@ -328,6 +328,10 @@
         dual_emac_res_vlan = <3>;
 };
 
+&phy_sel {
+        rmii-clock-ext;
+};
+
 &mac {
         pinctrl-names = "default", "sleep";
         pinctrl-0 = <&cpsw_default>;
diff --git a/arch/arm/boot/dts/am33xx-clocks.dtsi b/arch/arm/boot/dts/am33xx-clocks.dtsi
index 712edce7d6fb..071b56aa0c7e 100644
--- a/arch/arm/boot/dts/am33xx-clocks.dtsi
+++ b/arch/arm/boot/dts/am33xx-clocks.dtsi
@@ -99,7 +99,7 @@
         ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <0>;
                 reg = <0x0664>;
         };
@@ -107,7 +107,7 @@
         ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <1>;
                 reg = <0x0664>;
         };
@@ -115,7 +115,7 @@
         ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <2>;
                 reg = <0x0664>;
         };
diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
index c7dc9dab93a4..cfb49686ab6a 100644
--- a/arch/arm/boot/dts/am43xx-clocks.dtsi
+++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
@@ -107,7 +107,7 @@
         ehrpwm0_tbclk: ehrpwm0_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <0>;
                 reg = <0x0664>;
         };
@@ -115,7 +115,7 @@
         ehrpwm1_tbclk: ehrpwm1_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <1>;
                 reg = <0x0664>;
         };
@@ -123,7 +123,7 @@
         ehrpwm2_tbclk: ehrpwm2_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <2>;
                 reg = <0x0664>;
         };
@@ -131,7 +131,7 @@
         ehrpwm3_tbclk: ehrpwm3_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <4>;
                 reg = <0x0664>;
         };
@@ -139,7 +139,7 @@
         ehrpwm4_tbclk: ehrpwm4_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <5>;
                 reg = <0x0664>;
         };
@@ -147,7 +147,7 @@
         ehrpwm5_tbclk: ehrpwm5_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <6>;
                 reg = <0x0664>;
         };
diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
index fff0ee69aab4..e7f0a4ae271c 100644
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -494,12 +494,12 @@
 
                                         pinctrl_usart3_rts: usart3_rts-0 {
                                                 atmel,pins =
-                                                        <AT91_PIOB 8 AT91_PERIPH_B AT91_PINCTRL_NONE>;  /* PC8 periph B */
+                                                        <AT91_PIOC 8 AT91_PERIPH_B AT91_PINCTRL_NONE>;
                                         };
 
                                         pinctrl_usart3_cts: usart3_cts-0 {
                                                 atmel,pins =
-                                                        <AT91_PIOB 10 AT91_PERIPH_B AT91_PINCTRL_NONE>; /* PC10 periph B */
+                                                        <AT91_PIOC 10 AT91_PERIPH_B AT91_PINCTRL_NONE>;
                                         };
                                 };
 
@@ -853,7 +853,7 @@
                         };
 
                         usb1: gadget@fffa4000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9260-udc";
                                 reg = <0xfffa4000 0x4000>;
                                 interrupts = <10 IRQ_TYPE_LEVEL_HIGH 2>;
                                 clocks = <&udc_clk>, <&udpck>;
@@ -976,7 +976,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9261.dtsi b/arch/arm/boot/dts/at91sam9261.dtsi
index e247b0b5fdab..d55fdf2487ef 100644
--- a/arch/arm/boot/dts/at91sam9261.dtsi
+++ b/arch/arm/boot/dts/at91sam9261.dtsi
@@ -124,11 +124,12 @@
                         };
 
                         usb1: gadget@fffa4000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9261-udc";
                                 reg = <0xfffa4000 0x4000>;
                                 interrupts = <10 IRQ_TYPE_LEVEL_HIGH 2>;
-                                clocks = <&usb>, <&udc_clk>, <&udpck>;
-                                clock-names = "usb_clk", "udc_clk", "udpck";
+                                clocks = <&udc_clk>, <&udpck>;
+                                clock-names = "pclk", "hclk";
+                                atmel,matrix = <&matrix>;
                                 status = "disabled";
                         };
 
@@ -262,7 +263,7 @@
                         };
 
                         matrix: matrix@ffffee00 {
-                                compatible = "atmel,at91sam9260-bus-matrix";
+                                compatible = "atmel,at91sam9260-bus-matrix", "syscon";
                                 reg = <0xffffee00 0x200>;
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index 1f67bb4c144e..fce301c4e9d6 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -69,7 +69,7 @@
 
         sram1: sram@00500000 {
                 compatible = "mmio-sram";
-                reg = <0x00300000 0x4000>;
+                reg = <0x00500000 0x4000>;
         };
 
         ahb {
@@ -856,7 +856,7 @@
                         };
 
                         usb1: gadget@fff78000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9263-udc";
                                 reg = <0xfff78000 0x4000>;
                                 interrupts = <24 IRQ_TYPE_LEVEL_HIGH 2>;
                                 clocks = <&udc_clk>, <&udpck>;
@@ -905,7 +905,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
index ee80aa9c0759..488af63d5174 100644
--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -1116,7 +1116,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
@@ -1301,7 +1300,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00800000 0x100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "hclk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index c2666a7cb5b1..0c53a375ba99 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -894,7 +894,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 818dabdd8c0e..d221179d0f1a 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -1066,7 +1066,7 @@
                                 reg = <0x00500000 0x80000
                                        0xf803c000 0x400>;
                                 interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
-                                clocks = <&usb>, <&udphs_clk>;
+                                clocks = <&utmi>, <&udphs_clk>;
                                 clock-names = "hclk", "pclk";
                                 status = "disabled";
 
@@ -1130,7 +1130,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
@@ -1186,7 +1185,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00700000 0x100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/dm8168-evm.dts b/arch/arm/boot/dts/dm8168-evm.dts
index d3a29c1b8417..afe678f6d2e9 100644
--- a/arch/arm/boot/dts/dm8168-evm.dts
+++ b/arch/arm/boot/dts/dm8168-evm.dts
@@ -36,6 +36,20 @@
                 >;
         };
 
+        mmc_pins: pinmux_mmc_pins {
+                pinctrl-single,pins = <
+                        DM816X_IOPAD(0x0a70, MUX_MODE0)                 /* SD_POW */
+                        DM816X_IOPAD(0x0a74, MUX_MODE0)                 /* SD_CLK */
+                        DM816X_IOPAD(0x0a78, MUX_MODE0)                 /* SD_CMD */
+                        DM816X_IOPAD(0x0a7C, MUX_MODE0)                 /* SD_DAT0 */
+                        DM816X_IOPAD(0x0a80, MUX_MODE0)                 /* SD_DAT1 */
+                        DM816X_IOPAD(0x0a84, MUX_MODE0)                 /* SD_DAT2 */
+                        DM816X_IOPAD(0x0a88, MUX_MODE0)                 /* SD_DAT2 */
+                        DM816X_IOPAD(0x0a8c, MUX_MODE2)                 /* GP1[7] */
+                        DM816X_IOPAD(0x0a90, MUX_MODE2)                 /* GP1[8] */
+                >;
+        };
+
         usb0_pins: pinmux_usb0_pins {
                 pinctrl-single,pins = <
                         DM816X_IOPAD(0x0d00, MUX_MODE0)                 /* USB0_DRVVBUS */
@@ -137,7 +151,12 @@
 };
 
 &mmc1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc_pins>;
         vmmc-supply = <&vmmcsd_fixed>;
+        bus-width = <4>;
+        cd-gpios = <&gpio2 7 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
 };
 
 /* At least dm8168-evm rev c won't support multipoint, later may */
diff --git a/arch/arm/boot/dts/dm816x.dtsi b/arch/arm/boot/dts/dm816x.dtsi
index 3c97b5f2addc..f35715bc6992 100644
--- a/arch/arm/boot/dts/dm816x.dtsi
+++ b/arch/arm/boot/dts/dm816x.dtsi
@@ -150,17 +150,27 @@
                 };
 
                 gpio1: gpio@48032000 {
-                        compatible = "ti,omap3-gpio";
+                        compatible = "ti,omap4-gpio";
                         ti,hwmods = "gpio1";
+                        ti,gpio-always-on;
                         reg = <0x48032000 0x1000>;
-                        interrupts = <97>;
+                        interrupts = <96>;
+                        gpio-controller;
+                        #gpio-cells = <2>;
+                        interrupt-controller;
+                        #interrupt-cells = <2>;
                 };
 
                 gpio2: gpio@4804c000 {
-                        compatible = "ti,omap3-gpio";
+                        compatible = "ti,omap4-gpio";
                         ti,hwmods = "gpio2";
+                        ti,gpio-always-on;
                         reg = <0x4804c000 0x1000>;
-                        interrupts = <99>;
+                        interrupts = <98>;
+                        gpio-controller;
+                        #gpio-cells = <2>;
+                        interrupt-controller;
+                        #interrupt-cells = <2>;
                 };
 
                 gpmc: gpmc@50000000 {
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 3290a96ba586..7563d7ce01bb 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -263,17 +263,15 @@
 
         dcan1_pins_default: dcan1_pins_default {
                 pinctrl-single,pins = <
-                        0x3d0   (PIN_OUTPUT | MUX_MODE0) /* dcan1_tx */
-                        0x3d4   (MUX_MODE15)            /* dcan1_rx.off */
-                        0x418   (PULL_DIS | MUX_MODE1) /* wakeup0.dcan1_rx */
+                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
+                        0x418   (PULL_UP | MUX_MODE1) /* wakeup0.dcan1_rx */
                 >;
         };
 
         dcan1_pins_sleep: dcan1_pins_sleep {
                 pinctrl-single,pins = <
-                        0x3d0   (MUX_MODE15)    /* dcan1_tx.off */
-                        0x3d4   (MUX_MODE15)    /* dcan1_rx.off */
-                        0x418   (MUX_MODE15)    /* wakeup0.off */
+                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
+                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
                 >;
         };
 };
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 127608d79033..c4659a979c41 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -1111,7 +1111,6 @@
                                               "wkupclk", "refclk",
                                               "div-clk", "phy-div";
                                 #phy-cells = <0>;
-                                ti,hwmods = "pcie1-phy";
                         };
 
                         pcie2_phy: pciephy@4a095000 {
@@ -1130,7 +1129,6 @@
                                               "wkupclk", "refclk",
                                               "div-clk", "phy-div";
                                 #phy-cells = <0>;
-                                ti,hwmods = "pcie2-phy";
                                 status = "disabled";
                         };
                 };
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index e0264d0bf7b9..40ed539ce474 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -119,17 +119,15 @@
 
         dcan1_pins_default: dcan1_pins_default {
                 pinctrl-single,pins = <
-                        0x3d0   (PIN_OUTPUT | MUX_MODE0) /* dcan1_tx */
-                        0x3d4   (MUX_MODE15)            /* dcan1_rx.off */
-                        0x418   (PULL_DIS | MUX_MODE1) /* wakeup0.dcan1_rx */
+                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
+                        0x418   (PULL_UP | MUX_MODE1)   /* wakeup0.dcan1_rx */
                 >;
         };
 
         dcan1_pins_sleep: dcan1_pins_sleep {
                 pinctrl-single,pins = <
-                        0x3d0   (MUX_MODE15)    /* dcan1_tx.off */
-                        0x3d4   (MUX_MODE15)    /* dcan1_rx.off */
-                        0x418   (MUX_MODE15)    /* wakeup0.off */
+                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
+                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
                 >;
         };
 
diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
index 4bdcbd61ce47..99b09a44e269 100644
--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
@@ -243,10 +243,18 @@
                 ti,invert-autoidle-bit;
         };
 
+        dpll_core_byp_mux: dpll_core_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x012c>;
+        };
+
         dpll_core_ck: dpll_core_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-core-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
                 reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
         };
 
@@ -309,10 +317,18 @@
                 clock-div = <1>;
         };
 
+        dpll_dsp_byp_mux: dpll_dsp_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x0240>;
+        };
+
         dpll_dsp_ck: dpll_dsp_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
                 reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
         };
 
@@ -335,10 +351,18 @@
                 clock-div = <1>;
         };
 
+        dpll_iva_byp_mux: dpll_iva_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x01ac>;
+        };
+
         dpll_iva_ck: dpll_iva_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
                 reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
         };
 
@@ -361,10 +385,18 @@
                 clock-div = <1>;
         };
 
+        dpll_gpu_byp_mux: dpll_gpu_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x02e4>;
+        };
+
         dpll_gpu_ck: dpll_gpu_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
                 reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
         };
 
@@ -398,10 +430,18 @@
                 clock-div = <1>;
         };
 
+        dpll_ddr_byp_mux: dpll_ddr_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x021c>;
+        };
+
         dpll_ddr_ck: dpll_ddr_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
                 reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
         };
 
@@ -416,10 +456,18 @@
                 ti,invert-autoidle-bit;
         };
 
+        dpll_gmac_byp_mux: dpll_gmac_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x02b4>;
+        };
+
         dpll_gmac_ck: dpll_gmac_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
                 reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
         };
 
@@ -482,10 +530,18 @@
                 clock-div = <1>;
         };
 
+        dpll_eve_byp_mux: dpll_eve_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x0290>;
+        };
+
         dpll_eve_ck: dpll_eve_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
                 reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
         };
 
@@ -1249,10 +1305,18 @@
                 clock-div = <1>;
         };
 
+        dpll_per_byp_mux: dpll_per_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x014c>;
+        };
+
         dpll_per_ck: dpll_per_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
                 reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
         };
 
@@ -1275,10 +1339,18 @@
                 clock-div = <1>;
         };
 
+        dpll_usb_byp_mux: dpll_usb_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x018c>;
+        };
+
         dpll_usb_ck: dpll_usb_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-j-type-clock";
-                clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
                 reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
         };
 
diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
index 277b48b0b6f9..ac6b0ae42caf 100644
--- a/arch/arm/boot/dts/exynos3250.dtsi
+++ b/arch/arm/boot/dts/exynos3250.dtsi
@@ -18,6 +18,7 @@
  */
 
 #include "skeleton.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 #include <dt-bindings/clock/exynos3250.h>
 
 / {
@@ -193,6 +194,7 @@
                         interrupts = <0 216 0>;
                         clocks = <&cmu CLK_TMU_APBIF>;
                         clock-names = "tmu_apbif";
+                        #include "exynos4412-tmu-sensor-conf.dtsi"
                         status = "disabled";
                 };
 
diff --git a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
new file mode 100644
index 000000000000..735cb2f10817
--- /dev/null
+++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
@@ -0,0 +1,52 @@
+/*
+ * Device tree sources for Exynos4 thermal zone
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <dt-bindings/thermal/thermal.h>
+
+/ {
+thermal-zones {
+        cpu_thermal: cpu-thermal {
+                thermal-sensors = <&tmu 0>;
+                polling-delay-passive = <0>;
+                polling-delay = <0>;
+                trips {
+                        cpu_alert0: cpu-alert-0 {
+                                temperature = <70000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_alert1: cpu-alert-1 {
+                                temperature = <95000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_alert2: cpu-alert-2 {
+                                temperature = <110000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_crit0: cpu-crit-0 {
+                                temperature = <120000>; /* millicelsius */
+                                hysteresis = <0>; /* millicelsius */
+                                type = "critical";
+                        };
+                };
+                cooling-maps {
+                        map0 {
+                                trip = <&cpu_alert0>;
+                        };
+                        map1 {
+                                trip = <&cpu_alert1>;
+                        };
+                };
+        };
+};
+};
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index 76173cacd450..77ea547768f4 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -38,6 +38,7 @@
                 i2c5 = &i2c_5;
                 i2c6 = &i2c_6;
                 i2c7 = &i2c_7;
+                i2c8 = &i2c_8;
                 csis0 = &csis_0;
                 csis1 = &csis_1;
                 fimc0 = &fimc_0;
@@ -104,6 +105,7 @@
                 compatible = "samsung,exynos4210-pd";
                 reg = <0x10023C20 0x20>;
                 #power-domain-cells = <0>;
+                power-domains = <&pd_lcd0>;
         };
 
         pd_cam: cam-power-domain@10023C00 {
@@ -554,6 +556,22 @@
                 status = "disabled";
         };
 
+        i2c_8: i2c@138E0000 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                compatible = "samsung,s3c2440-hdmiphy-i2c";
+                reg = <0x138E0000 0x100>;
+                interrupts = <0 93 0>;
+                clocks = <&clock CLK_I2C_HDMI>;
+                clock-names = "i2c";
+                status = "disabled";
+
+                hdmi_i2c_phy: hdmiphy@38 {
+                        compatible = "exynos4210-hdmiphy";
+                        reg = <0x38>;
+                };
+        };
+
         spi_0: spi@13920000 {
                 compatible = "samsung,exynos4210-spi";
                 reg = <0x13920000 0x100>;
@@ -663,6 +681,33 @@
                 status = "disabled";
         };
 
+        tmu: tmu@100C0000 {
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+
+        hdmi: hdmi@12D00000 {
+                compatible = "samsung,exynos4210-hdmi";
+                reg = <0x12D00000 0x70000>;
+                interrupts = <0 92 0>;
+                clock-names = "hdmi", "sclk_hdmi", "sclk_pixel", "sclk_hdmiphy",
+                        "mout_hdmi";
+                clocks = <&clock CLK_HDMI>, <&clock CLK_SCLK_HDMI>,
+                        <&clock CLK_SCLK_PIXEL>, <&clock CLK_SCLK_HDMIPHY>,
+                        <&clock CLK_MOUT_HDMI>;
+                phy = <&hdmi_i2c_phy>;
+                power-domains = <&pd_tv>;
+                samsung,syscon-phandle = <&pmu_system_controller>;
+                status = "disabled";
+        };
+
+        mixer: mixer@12C10000 {
+                compatible = "samsung,exynos4210-mixer";
+                interrupts = <0 91 0>;
+                reg = <0x12C10000 0x2100>, <0x12c00000 0x300>;
+                power-domains = <&pd_tv>;
+                status = "disabled";
+        };
+
         ppmu_dmc0: ppmu_dmc0@106a0000 {
                 compatible = "samsung,exynos-ppmu";
                 reg = <0x106a0000 0x2000>;
diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts
index 3d6652a4b6cb..32c5fd8f6269 100644
--- a/arch/arm/boot/dts/exynos4210-trats.dts
+++ b/arch/arm/boot/dts/exynos4210-trats.dts
@@ -426,6 +426,25 @@
                 status = "okay";
         };
 
+        tmu@100C0000 {
+                status = "okay";
+        };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 2 2>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 4 4>;
+                               };
+                       };
+                };
+        };
+
         camera {
                 pinctrl-names = "default";
                 pinctrl-0 = <>;
diff --git a/arch/arm/boot/dts/exynos4210-universal_c210.dts b/arch/arm/boot/dts/exynos4210-universal_c210.dts
index b57e6b82ea20..d4f2b11319dd 100644
--- a/arch/arm/boot/dts/exynos4210-universal_c210.dts
+++ b/arch/arm/boot/dts/exynos4210-universal_c210.dts
@@ -505,6 +505,63 @@
                         assigned-clock-rates = <0>, <160000000>;
                 };
         };
+
+        hdmi_en: voltage-regulator-hdmi-5v {
+                compatible = "regulator-fixed";
+                regulator-name = "HDMI_5V";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                gpio = <&gpe0 1 0>;
+                enable-active-high;
+        };
+
+        hdmi_ddc: i2c-ddc {
+                compatible = "i2c-gpio";
+                gpios = <&gpe4 2 0 &gpe4 3 0>;
+                i2c-gpio,delay-us = <100>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                pinctrl-0 = <&i2c_ddc_bus>;
+                pinctrl-names = "default";
+                status = "okay";
+        };
+
+        mixer@12C10000 {
+                status = "okay";
+        };
+
+        hdmi@12D00000 {
+                hpd-gpio = <&gpx3 7 0>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&hdmi_hpd>;
+                hdmi-en-supply = <&hdmi_en>;
+                vdd-supply = <&ldo3_reg>;
+                vdd_osc-supply = <&ldo4_reg>;
+                vdd_pll-supply = <&ldo3_reg>;
+                ddc = <&hdmi_ddc>;
+                status = "okay";
+        };
+
+        i2c@138E0000 {
+                status = "okay";
+        };
+};
+
+&pinctrl_1 {
+        hdmi_hpd: hdmi-hpd {
+                samsung,pins = "gpx3-7";
+                samsung,pin-pud = <0>;
+        };
+};
+
+&pinctrl_0 {
+        i2c_ddc_bus: i2c-ddc-bus {
+                samsung,pins = "gpe4-2", "gpe4-3";
+                samsung,pin-function = <2>;
+                samsung,pin-pud = <3>;
+                samsung,pin-drv = <0>;
+        };
 };
 
 &mdma1 {
diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi
index 67c832c9dcf1..be89f83f70e7 100644
--- a/arch/arm/boot/dts/exynos4210.dtsi
+++ b/arch/arm/boot/dts/exynos4210.dtsi
@@ -21,6 +21,7 @@
 
 #include "exynos4.dtsi"
 #include "exynos4210-pinctrl.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 
 / {
         compatible = "samsung,exynos4210", "samsung,exynos4";
@@ -35,10 +36,13 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@900 {
+                cpu0: cpu@900 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0x900>;
+                        cooling-min-level = <4>;
+                        cooling-max-level = <2>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
 
                 cpu@901 {
@@ -153,16 +157,38 @@
                 reg = <0x03860000 0x1000>;
         };
 
-        tmu@100C0000 {
+        tmu: tmu@100C0000 {
                 compatible = "samsung,exynos4210-tmu";
                 interrupt-parent = <&combiner>;
                 reg = <0x100C0000 0x100>;
                 interrupts = <2 4>;
                 clocks = <&clock CLK_TMU_APBIF>;
                 clock-names = "tmu_apbif";
+                samsung,tmu_gain = <15>;
+                samsung,tmu_reference_voltage = <7>;
                 status = "disabled";
         };
 
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        polling-delay-passive = <0>;
+                        polling-delay = <0>;
+                        thermal-sensors = <&tmu 0>;
+
+                        trips {
+                              cpu_alert0: cpu-alert-0 {
+                                      temperature = <85000>; /* millicelsius */
+                              };
+                              cpu_alert1: cpu-alert-1 {
+                                      temperature = <100000>; /* millicelsius */
+                              };
+                              cpu_alert2: cpu-alert-2 {
+                                      temperature = <110000>; /* millicelsius */
+                              };
+                        };
+                };
+        };
+
         g2d@12800000 {
                 compatible = "samsung,s5pv210-g2d";
                 reg = <0x12800000 0x1000>;
@@ -203,6 +229,14 @@
                 };
         };
 
+        mixer: mixer@12C10000 {
+                clock-names = "mixer", "hdmi", "sclk_hdmi", "vp", "mout_mixer",
+                        "sclk_mixer";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                        <&clock CLK_SCLK_HDMI>, <&clock CLK_VP>,
+                        <&clock CLK_MOUT_MIXER>, <&clock CLK_SCLK_MIXER>;
+        };
+
         ppmu_lcd1: ppmu_lcd1@12240000 {
                 compatible = "samsung,exynos-ppmu";
                 reg = <0x12240000 0x2000>;
diff --git a/arch/arm/boot/dts/exynos4212.dtsi b/arch/arm/boot/dts/exynos4212.dtsi
index dd0a43ec56da..5be03288f1ee 100644
--- a/arch/arm/boot/dts/exynos4212.dtsi
+++ b/arch/arm/boot/dts/exynos4212.dtsi
@@ -26,10 +26,13 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@A00 {
+                cpu0: cpu@A00 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0xA00>;
+                        cooling-min-level = <13>;
+                        cooling-max-level = <7>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
 
                 cpu@A01 {
diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
index de80b5bba204..adb4f6a97a1d 100644
--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
@@ -249,6 +249,20 @@
                                         regulator-always-on;
                                 };
 
+                                ldo8_reg: ldo@8 {
+                                        regulator-compatible = "LDO8";
+                                        regulator-name = "VDD10_HDMI_1.0V";
+                                        regulator-min-microvolt = <1000000>;
+                                        regulator-max-microvolt = <1000000>;
+                                };
+
+                                ldo10_reg: ldo@10 {
+                                        regulator-compatible = "LDO10";
+                                        regulator-name = "VDDQ_MIPIHSI_1.8V";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <1800000>;
+                                };
+
                                 ldo11_reg: LDO11 {
                                         regulator-name = "VDD18_ABB1_1.8V";
                                         regulator-min-microvolt = <1800000>;
@@ -411,6 +425,51 @@
         ehci: ehci@12580000 {
                 status = "okay";
         };
+
+        tmu@100C0000 {
+                vtmu-supply = <&ldo10_reg>;
+                status = "okay";
+        };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 7 7>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 13 13>;
+                               };
+                       };
+                };
+        };
+
+        mixer: mixer@12C10000 {
+                status = "okay";
+        };
+
+        hdmi@12D00000 {
+                hpd-gpio = <&gpx3 7 0>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&hdmi_hpd>;
+                vdd-supply = <&ldo8_reg>;
+                vdd_osc-supply = <&ldo10_reg>;
+                vdd_pll-supply = <&ldo8_reg>;
+                ddc = <&hdmi_ddc>;
+                status = "okay";
+        };
+
+        hdmi_ddc: i2c@13880000 {
+                status = "okay";
+                pinctrl-names = "default";
+                pinctrl-0 = <&i2c2_bus>;
+        };
+
+        i2c@138E0000 {
+                status = "okay";
+        };
 };
 
 &pinctrl_1 {
@@ -425,4 +484,9 @@
                 samsung,pin-pud = <0>;
                 samsung,pin-drv = <0>;
         };
+
+        hdmi_hpd: hdmi-hpd {
+                samsung,pins = "gpx3-7";
+                samsung,pin-pud = <1>;
+        };
 };
diff --git a/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi b/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi
new file mode 100644
index 000000000000..e3f7934d19d0
--- /dev/null
+++ b/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi
@@ -0,0 +1,24 @@
+/*
+ * Device tree sources for Exynos4412 TMU sensor configuration
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <dt-bindings/thermal/thermal_exynos.h>
+
+#thermal-sensor-cells = <0>;
+samsung,tmu_gain = <8>;
+samsung,tmu_reference_voltage = <16>;
+samsung,tmu_noise_cancel_mode = <4>;
+samsung,tmu_efuse_value = <55>;
+samsung,tmu_min_efuse_value = <40>;
+samsung,tmu_max_efuse_value = <100>;
+samsung,tmu_first_point_trim = <25>;
+samsung,tmu_second_point_trim = <85>;
+samsung,tmu_default_temp_offset = <50>;
+samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts
index 21f748083586..173ffa479ad3 100644
--- a/arch/arm/boot/dts/exynos4412-trats2.dts
+++ b/arch/arm/boot/dts/exynos4412-trats2.dts
@@ -927,6 +927,21 @@
                 pulldown-ohm = <100000>; /* 100K */
                 io-channels = <&adc 2>;  /* Battery temperature */
         };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 7 7>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 13 13>;
+                               };
+                       };
+                };
+        };
 };
 
 &pmu_system_controller {
diff --git a/arch/arm/boot/dts/exynos4412.dtsi b/arch/arm/boot/dts/exynos4412.dtsi
index 0f6ec93bb1d8..68ad43b391ae 100644
--- a/arch/arm/boot/dts/exynos4412.dtsi
+++ b/arch/arm/boot/dts/exynos4412.dtsi
@@ -26,10 +26,13 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@A00 {
+                cpu0: cpu@A00 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0xA00>;
+                        cooling-min-level = <13>;
+                        cooling-max-level = <7>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
 
                 cpu@A01 {
diff --git a/arch/arm/boot/dts/exynos4x12.dtsi b/arch/arm/boot/dts/exynos4x12.dtsi
index f5e0ae780d6c..6a6abe14fd9b 100644
--- a/arch/arm/boot/dts/exynos4x12.dtsi
+++ b/arch/arm/boot/dts/exynos4x12.dtsi
@@ -19,6 +19,7 @@
 
 #include "exynos4.dtsi"
 #include "exynos4x12-pinctrl.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 
 / {
         aliases {
@@ -297,4 +298,15 @@
                 clock-names = "tmu_apbif";
                 status = "disabled";
         };
+
+        hdmi: hdmi@12D00000 {
+                compatible = "samsung,exynos4212-hdmi";
+        };
+
+        mixer: mixer@12C10000 {
+                compatible = "samsung,exynos4212-mixer";
+                clock-names = "mixer", "hdmi", "sclk_hdmi", "vp";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                         <&clock CLK_SCLK_HDMI>, <&clock CLK_VP>;
+        };
 };
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 9bb1b0b738f5..adbde1adad95 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -20,7 +20,7 @@
 #include <dt-bindings/clock/exynos5250.h>
 #include "exynos5.dtsi"
 #include "exynos5250-pinctrl.dtsi"
-
+#include "exynos4-cpu-thermal.dtsi"
 #include <dt-bindings/clock/exynos-audss-clk.h>
 
 / {
@@ -58,11 +58,14 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@0 {
+                cpu0: cpu@0 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a15";
                         reg = <0>;
                         clock-frequency = <1700000000>;
+                        cooling-min-level = <15>;
+                        cooling-max-level = <9>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
                 cpu@1 {
                         device_type = "cpu";
@@ -102,6 +105,12 @@
                 #power-domain-cells = <0>;
         };
 
+        pd_disp1: disp1-power-domain@100440A0 {
+                compatible = "samsung,exynos4210-pd";
+                reg = <0x100440A0 0x20>;
+                #power-domain-cells = <0>;
+        };
+
         clock: clock-controller@10010000 {
                 compatible = "samsung,exynos5250-clock";
                 reg = <0x10010000 0x30000>;
@@ -235,12 +244,32 @@
                 status = "disabled";
         };
 
-        tmu@10060000 {
+        tmu: tmu@10060000 {
                 compatible = "samsung,exynos5250-tmu";
                 reg = <0x10060000 0x100>;
                 interrupts = <0 65 0>;
                 clocks = <&clock CLK_TMU>;
                 clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        polling-delay-passive = <0>;
+                        polling-delay = <0>;
+                        thermal-sensors = <&tmu 0>;
+
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 9 9>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 15 15>;
+                               };
+                       };
+                };
         };
 
         serial@12C00000 {
@@ -719,6 +748,7 @@
         hdmi: hdmi {
                 compatible = "samsung,exynos4212-hdmi";
                 reg = <0x14530000 0x70000>;
+                power-domains = <&pd_disp1>;
                 interrupts = <0 95 0>;
                 clocks = <&clock CLK_HDMI>, <&clock CLK_SCLK_HDMI>,
                          <&clock CLK_SCLK_PIXEL>, <&clock CLK_SCLK_HDMIPHY>,
@@ -731,9 +761,11 @@
         mixer {
                 compatible = "samsung,exynos5250-mixer";
                 reg = <0x14450000 0x10000>;
+                power-domains = <&pd_disp1>;
                 interrupts = <0 94 0>;
-                clocks = <&clock CLK_MIXER>, <&clock CLK_SCLK_HDMI>;
-                clock-names = "mixer", "sclk_hdmi";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                         <&clock CLK_SCLK_HDMI>;
+                clock-names = "mixer", "hdmi", "sclk_hdmi";
         };
 
         dp_phy: video-phy@10040720 {
@@ -743,6 +775,7 @@
         };
 
         dp: dp-controller@145B0000 {
+                power-domains = <&pd_disp1>;
                 clocks = <&clock CLK_DP>;
                 clock-names = "dp";
                 phys = <&dp_phy>;
@@ -750,6 +783,7 @@
         };
 
         fimd: fimd@14400000 {
+                power-domains = <&pd_disp1>;
                 clocks = <&clock CLK_SCLK_FIMD1>, <&clock CLK_FIMD1>;
                 clock-names = "sclk_fimd", "fimd";
         };
diff --git a/arch/arm/boot/dts/exynos5420-trip-points.dtsi b/arch/arm/boot/dts/exynos5420-trip-points.dtsi
new file mode 100644
index 000000000000..5d31fc140823
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5420-trip-points.dtsi
@@ -0,0 +1,35 @@
+/*
+ * Device tree sources for default Exynos5420 thermal zone definition
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+polling-delay-passive = <0>;
+polling-delay = <0>;
+trips {
+        cpu-alert-0 {
+                temperature = <85000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-alert-1 {
+                temperature = <103000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-alert-2 {
+                temperature = <110000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-crit-0 {
+                temperature = <1200000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "critical";
+        };
+};
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
index 9dc2e9773b30..c0e98cf3514f 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -740,8 +740,9 @@
                 compatible = "samsung,exynos5420-mixer";
                 reg = <0x14450000 0x10000>;
                 interrupts = <0 94 0>;
-                clocks = <&clock CLK_MIXER>, <&clock CLK_SCLK_HDMI>;
-                clock-names = "mixer", "sclk_hdmi";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                         <&clock CLK_SCLK_HDMI>;
+                clock-names = "mixer", "hdmi", "sclk_hdmi";
                 power-domains = <&disp_pd>;
         };
 
@@ -782,6 +783,7 @@
                 interrupts = <0 65 0>;
                 clocks = <&clock CLK_TMU>;
                 clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_cpu1: tmu@10064000 {
@@ -790,6 +792,7 @@
                 interrupts = <0 183 0>;
                 clocks = <&clock CLK_TMU>;
                 clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_cpu2: tmu@10068000 {
@@ -798,6 +801,7 @@
                 interrupts = <0 184 0>;
                 clocks = <&clock CLK_TMU>, <&clock CLK_TMU>;
                 clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_cpu3: tmu@1006c000 {
@@ -806,6 +810,7 @@
                 interrupts = <0 185 0>;
                 clocks = <&clock CLK_TMU>, <&clock CLK_TMU_GPU>;
                 clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_gpu: tmu@100a0000 {
@@ -814,6 +819,30 @@
                 interrupts = <0 215 0>;
                 clocks = <&clock CLK_TMU_GPU>, <&clock CLK_TMU>;
                 clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+
+        thermal-zones {
+                cpu0_thermal: cpu0-thermal {
+                        thermal-sensors = <&tmu_cpu0>;
+                        #include "exynos5420-trip-points.dtsi"
+                };
+                cpu1_thermal: cpu1-thermal {
+                       thermal-sensors = <&tmu_cpu1>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                cpu2_thermal: cpu2-thermal {
+                       thermal-sensors = <&tmu_cpu2>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                cpu3_thermal: cpu3-thermal {
+                       thermal-sensors = <&tmu_cpu3>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                gpu_thermal: gpu-thermal {
+                       thermal-sensors = <&tmu_gpu>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
         };
 
         watchdog: watchdog@101D0000 {
diff --git a/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi b/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi
new file mode 100644
index 000000000000..7b2fba0ae92b
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi
@@ -0,0 +1,24 @@
+/*
+ * Device tree sources for Exynos5440 TMU sensor configuration
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <dt-bindings/thermal/thermal_exynos.h>
+
+#thermal-sensor-cells = <0>;
+samsung,tmu_gain = <5>;
+samsung,tmu_reference_voltage = <16>;
+samsung,tmu_noise_cancel_mode = <4>;
+samsung,tmu_efuse_value = <0x5d2d>;
+samsung,tmu_min_efuse_value = <16>;
+samsung,tmu_max_efuse_value = <76>;
+samsung,tmu_first_point_trim = <25>;
+samsung,tmu_second_point_trim = <70>;
+samsung,tmu_default_temp_offset = <25>;
+samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
diff --git a/arch/arm/boot/dts/exynos5440-trip-points.dtsi b/arch/arm/boot/dts/exynos5440-trip-points.dtsi
new file mode 100644
index 000000000000..48adfa8f4300
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5440-trip-points.dtsi
@@ -0,0 +1,25 @@
+/*
+ * Device tree sources for default Exynos5440 thermal zone definition
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+polling-delay-passive = <0>;
+polling-delay = <0>;
+trips {
+        cpu-alert-0 {
+                temperature = <100000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "active";
+        };
+        cpu-crit-0 {
+                temperature = <1050000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "critical";
+        };
+};
diff --git a/arch/arm/boot/dts/exynos5440.dtsi b/arch/arm/boot/dts/exynos5440.dtsi
index 8f3373cd7b87..59d9416b3b03 100644
--- a/arch/arm/boot/dts/exynos5440.dtsi
+++ b/arch/arm/boot/dts/exynos5440.dtsi
@@ -219,6 +219,7 @@
                 interrupts = <0 58 0>;
                 clocks = <&clock CLK_B_125>;
                 clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
         };
 
         tmuctrl_1: tmuctrl@16011C {
@@ -227,6 +228,7 @@
                 interrupts = <0 58 0>;
                 clocks = <&clock CLK_B_125>;
                 clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
         };
 
         tmuctrl_2: tmuctrl@160120 {
@@ -235,6 +237,22 @@
                 interrupts = <0 58 0>;
                 clocks = <&clock CLK_B_125>;
                 clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
+        };
+
+        thermal-zones {
+                cpu0_thermal: cpu0-thermal {
+                        thermal-sensors = <&tmuctrl_0>;
+                        #include "exynos5440-trip-points.dtsi"
+                };
+                cpu1_thermal: cpu1-thermal {
+                       thermal-sensors = <&tmuctrl_1>;
+                       #include "exynos5440-trip-points.dtsi"
+                };
+                cpu2_thermal: cpu2-thermal {
+                       thermal-sensors = <&tmuctrl_2>;
+                       #include "exynos5440-trip-points.dtsi"
+                };
         };
 
         sata@210000 {
diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
index f1cd2147421d..a626e6dd8022 100644
--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
@@ -35,6 +35,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio3 22 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_usb_h1_vbus: regulator@1 {
@@ -45,6 +46,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio1 29 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_audio: regulator@2 {
diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
index fda4932faefd..945887d3fdb3 100644
--- a/arch/arm/boot/dts/imx6sl-evk.dts
+++ b/arch/arm/boot/dts/imx6sl-evk.dts
@@ -52,6 +52,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio4 0 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_usb_otg2_vbus: regulator@1 {
@@ -62,6 +63,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio4 2 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_aud3v: regulator@2 {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index f4f78c40b564..3fdc84fddb70 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -92,6 +92,8 @@
                         ti,hwmods = "aes";
                         reg = <0x480c5000 0x50>;
                         interrupts = <0>;
+                        dmas = <&sdma 65 &sdma 66>;
+                        dma-names = "tx", "rx";
                 };
 
                 prm: prm@48306000 {
@@ -550,6 +552,8 @@
                         ti,hwmods = "sham";
                         reg = <0x480c3000 0x64>;
                         interrupts = <49>;
+                        dmas = <&sdma 69>;
+                        dma-names = "rx";
                 };
 
                 smartreflex_core: smartreflex@480cb000 {
diff --git a/arch/arm/boot/dts/omap5-core-thermal.dtsi b/arch/arm/boot/dts/omap5-core-thermal.dtsi
index 19212ac6eef0..de8a3d456cf7 100644
--- a/arch/arm/boot/dts/omap5-core-thermal.dtsi
+++ b/arch/arm/boot/dts/omap5-core-thermal.dtsi
@@ -13,7 +13,7 @@
 
 core_thermal: core_thermal {
         polling-delay-passive = <250>; /* milliseconds */
-        polling-delay = <1000>; /* milliseconds */
+        polling-delay = <500>; /* milliseconds */
 
                         /* sensor       ID */
         thermal-sensors = <&bandgap     2>;
diff --git a/arch/arm/boot/dts/omap5-gpu-thermal.dtsi b/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
index 1b87aca88b77..bc3090f2e84b 100644
--- a/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
+++ b/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
@@ -13,7 +13,7 @@
 
 gpu_thermal: gpu_thermal {
         polling-delay-passive = <250>; /* milliseconds */
-        polling-delay = <1000>; /* milliseconds */
+        polling-delay = <500>; /* milliseconds */
 
                         /* sensor       ID */
         thermal-sensors = <&bandgap     1>;
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index ddff674bd05e..4a485b63a141 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -1079,4 +1079,8 @@
         };
 };
 
+&cpu_thermal {
+        polling-delay = <500>; /* milliseconds */
+};
+
 /include/ "omap54xx-clocks.dtsi"
diff --git a/arch/arm/boot/dts/omap54xx-clocks.dtsi b/arch/arm/boot/dts/omap54xx-clocks.dtsi
index 58c27466f012..83b425fb3ac2 100644
--- a/arch/arm/boot/dts/omap54xx-clocks.dtsi
+++ b/arch/arm/boot/dts/omap54xx-clocks.dtsi
@@ -167,10 +167,18 @@
                 ti,index-starts-at-one;
         };
 
+        dpll_core_byp_mux: dpll_core_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x012c>;
+        };
+
         dpll_core_ck: dpll_core_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-core-clock";
-                clocks = <&sys_clkin>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin>, <&dpll_core_byp_mux>;
                 reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
         };
 
@@ -294,10 +302,18 @@
                 clock-div = <1>;
         };
 
+        dpll_iva_byp_mux: dpll_iva_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&iva_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x01ac>;
+        };
+
         dpll_iva_ck: dpll_iva_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin>, <&iva_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_iva_byp_mux>;
                 reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
         };
 
@@ -599,10 +615,19 @@
         };
 };
 &cm_core_clocks {
+
+        dpll_per_byp_mux: dpll_per_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&per_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x014c>;
+        };
+
         dpll_per_ck: dpll_per_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin>, <&per_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_per_byp_mux>;
                 reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
         };
 
@@ -714,10 +739,18 @@
                 ti,index-starts-at-one;
         };
 
+        dpll_usb_byp_mux: dpll_usb_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&usb_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x018c>;
+        };
+
         dpll_usb_ck: dpll_usb_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-j-type-clock";
-                clocks = <&sys_clkin>, <&usb_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_usb_byp_mux>;
                 reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
         };
 
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index d771f687a13b..eccc78d3220b 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -411,6 +411,7 @@
                         "mac_clk_rx", "mac_clk_tx",
                         "clk_mac_ref", "clk_mac_refout",
                         "aclk_mac", "pclk_mac";
+                status = "disabled";
         };
 
         usb_host0_ehci: usb@ff500000 {
diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
index 261311bdf65b..367af53c1b84 100644
--- a/arch/arm/boot/dts/sama5d3.dtsi
+++ b/arch/arm/boot/dts/sama5d3.dtsi
@@ -1248,7 +1248,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
@@ -1416,7 +1415,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00700000 0x100000>;
                         interrupts = <32 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
index d986b41b9654..4303874889c6 100644
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -66,6 +66,7 @@
                 gpio4 = &pioE;
                 tcb0 = &tcb0;
                 tcb1 = &tcb1;
+                i2c0 = &i2c0;
                 i2c2 = &i2c2;
         };
         cpus {
@@ -259,7 +260,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00600000 0x100000>;
                         interrupts = <46 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "uhpck";
                         status = "disabled";
                 };
@@ -461,8 +462,8 @@
 
                                         lcdck: lcdck {
                                                 #clock-cells = <0>;
-                                                reg = <4>;
-                                                clocks = <&smd>;
+                                                reg = <3>;
+                                                clocks = <&mck>;
                                         };
 
                                         smdck: smdck {
@@ -770,7 +771,7 @@
                                                 reg = <50>;
                                         };
 
-                                        lcd_clk: lcd_clk {
+                                        lcdc_clk: lcdc_clk {
                                                 #clock-cells = <0>;
                                                 reg = <51>;
                                         };
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 252c3d1bda50..d9176e606173 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -660,7 +660,7 @@
                         #address-cells = <1>;
                         #size-cells = <0>;
                         reg = <0xfff01000 0x1000>;
-                        interrupts = <0 156 4>;
+                        interrupts = <0 155 4>;
                         num-cs = <4>;
                         clocks = <&spi_m_clk>;
                         status = "disabled";
@@ -713,6 +713,9 @@
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&l4_sp_clk>;
+                        dmas = <&pdma 28>,
+                               <&pdma 29>;
+                        dma-names = "tx", "rx";
                 };
 
                 uart1: serial1@ffc03000 {
@@ -722,6 +725,9 @@
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&l4_sp_clk>;
+                        dmas = <&pdma 30>,
+                               <&pdma 31>;
+                        dma-names = "tx", "rx";
                 };
 
                 rst: rstmgr@ffd05000 {
diff --git a/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts b/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts
index ab7891c43231..75742f8f96f3 100644
--- a/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts
+++ b/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts
@@ -56,6 +56,22 @@
         model = "Olimex A10-OLinuXino-LIME";
         compatible = "olimex,a10-olinuxino-lime", "allwinner,sun4i-a10";
 
+        cpus {
+                cpu0: cpu@0 {
+                        /*
+                         * The A10-Lime is known to be unstable
+                         * when running at 1008 MHz
+                         */
+                        operating-points = <
+                                /* kHz    uV */
+                                912000  1350000
+                                864000  1300000
+                                624000  1250000
+                                >;
+                        cooling-max-level = <2>;
+                };
+        };
+
         soc@01c00000 {
                 emac: ethernet@01c0b000 {
                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 5c2925831f20..eebb7853e00b 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -75,7 +75,6 @@
                         clock-latency = <244144>; /* 8 32k periods */
                         operating-points = <
                                 /* kHz    uV */
-                                1056000 1500000
                                 1008000 1400000
                                 912000  1350000
                                 864000  1300000
@@ -83,7 +82,7 @@
                                 >;
                         #cooling-cells = <2>;
                         cooling-min-level = <0>;
-                        cooling-max-level = <4>;
+                        cooling-max-level = <3>;
                 };
         };
 
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index f8818f1edbbe..883cb4873688 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -47,7 +47,6 @@
                         clock-latency = <244144>; /* 8 32k periods */
                         operating-points = <
                                 /* kHz    uV */
-                                1104000 1500000
                                 1008000 1400000
                                 912000  1350000
                                 864000  1300000
@@ -57,7 +56,7 @@
                                 >;
                         #cooling-cells = <2>;
                         cooling-min-level = <0>;
-                        cooling-max-level = <6>;
+                        cooling-max-level = <5>;
                 };
         };
 
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 3a8530b79f1c..fdd181792b4b 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -105,7 +105,6 @@
                         clock-latency = <244144>; /* 8 32k periods */
                         operating-points = <
                                 /* kHz    uV */
-                                1008000 1450000
                                 960000  1400000
                                 912000  1400000
                                 864000  1300000
@@ -116,7 +115,7 @@
                                 >;
                         #cooling-cells = <2>;
                         cooling-min-level = <0>;
-                        cooling-max-level = <7>;
+                        cooling-max-level = <6>;
                 };
 
                 cpu@1 {
diff --git a/arch/arm/configs/at91_dt_defconfig b/arch/arm/configs/at91_dt_defconfig
index f2670f638e97..811e72bbe642 100644
--- a/arch/arm/configs/at91_dt_defconfig
+++ b/arch/arm/configs/at91_dt_defconfig
@@ -70,6 +70,7 @@ CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_NETDEVICES=y
+CONFIG_ARM_AT91_ETHER=y
 CONFIG_MACB=y
 # CONFIG_NET_VENDOR_BROADCOM is not set
 CONFIG_DM9000=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index b7e6b6fba5e0..06075b6d2463 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -99,7 +99,7 @@ CONFIG_PCI_RCAR_GEN2=y
 CONFIG_PCI_RCAR_GEN2_PCIE=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=8
+CONFIG_NR_CPUS=16
 CONFIG_HIGHPTE=y
 CONFIG_CMA=y
 CONFIG_ARM_APPENDED_DTB=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index a097cffa1231..8e108599e1af 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -377,6 +377,7 @@ CONFIG_PWM_TWL=m
 CONFIG_PWM_TWL_LED=m
 CONFIG_OMAP_USB2=m
 CONFIG_TI_PIPE3=y
+CONFIG_TWL4030_USB=m
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
diff --git a/arch/arm/configs/sama5_defconfig b/arch/arm/configs/sama5_defconfig
index 41d856effe6c..510c747c65b4 100644
--- a/arch/arm/configs/sama5_defconfig
+++ b/arch/arm/configs/sama5_defconfig
@@ -3,8 +3,6 @@
 CONFIG_SYSVIPC=y
 CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EMBEDDED=y
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index 38840a812924..8f6a5702b696 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -4,6 +4,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_PERF_EVENTS=y
 CONFIG_ARCH_SUNXI=y
 CONFIG_SMP=y
+CONFIG_NR_CPUS=8
 CONFIG_AEABI=y
 CONFIG_HIGHMEM=y
 CONFIG_HIGHPTE=y
diff --git a/arch/arm/configs/vexpress_defconfig b/arch/arm/configs/vexpress_defconfig
index f489fdaa19b8..37fe607a4ede 100644
--- a/arch/arm/configs/vexpress_defconfig
+++ b/arch/arm/configs/vexpress_defconfig
@@ -118,8 +118,8 @@ CONFIG_HID_ZEROPLUS=y
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=y
-CONFIG_USB_ISP1760_HCD=y
 CONFIG_USB_STORAGE=y
+CONFIG_USB_ISP1760=y
 CONFIG_MMC=y
 CONFIG_MMC_ARMMMCI=y
 CONFIG_NEW_LEDS=y
diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
index 71e5fc7cfb18..1d1800f71c5b 100644
--- a/arch/arm/crypto/aesbs-core.S_shipped
+++ b/arch/arm/crypto/aesbs-core.S_shipped
@@ -58,14 +58,18 @@
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
+
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -74,8 +78,6 @@
 .code   32
 #endif
 
-.fpu    neon
-
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
         vld1.8  {q8}, [r0]                      @ initial tweak
         adr     r2, .Lxts_magic
 
+#ifndef XTS_CHAIN_TWEAK
         tst     r9, #0xf                        @ if not multiple of 16
         it      ne                              @ Thumb2 thing, sanity check in ARM
         subne   r9, #0x10                       @ subtract another 16 bytes
+#endif
         subs    r9, #0x80
 
         blo     .Lxts_dec_short
diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
index be068db960ee..a4d3856e7d24 100644
--- a/arch/arm/crypto/bsaes-armv7.pl
+++ b/arch/arm/crypto/bsaes-armv7.pl
@@ -701,14 +701,18 @@ $code.=<<___;
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
+
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -717,8 +721,6 @@ $code.=<<___;
 .code   32
 #endif
 
-.fpu    neon
-
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
         vld1.8  {@XMM[8]}, [r0]                 @ initial tweak
         adr     $magic, .Lxts_magic
 
+#ifndef XTS_CHAIN_TWEAK
         tst     $len, #0xf                      @ if not multiple of 16
         it      ne                              @ Thumb2 thing, sanity check in ARM
         subne   $len, #0x10                     @ subtract another 16 bytes
+#endif
         subs    $len, #0x80
 
         blo     .Lxts_dec_short
diff --git a/arch/arm/include/debug/at91.S b/arch/arm/include/debug/at91.S
index 80a6501b4d50..c3c45e628e33 100644
--- a/arch/arm/include/debug/at91.S
+++ b/arch/arm/include/debug/at91.S
@@ -18,8 +18,11 @@
 #define AT91_DBGU 0xfc00c000 /* SAMA5D4_BASE_USART3 */
 #endif
 
-/* Keep in sync with mach-at91/include/mach/hardware.h */
+#ifdef CONFIG_MMU
 #define AT91_IO_P2V(x) ((x) - 0x01000000)
+#else
+#define AT91_IO_P2V(x) (x)
+#endif
 
 #define AT91_DBGU_SR            (0x14)  /* Status Register */
 #define AT91_DBGU_THR           (0x1c)  /* Transmitter Holding Register */
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index e55408e96559..1d60bebea4b8 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -246,12 +246,9 @@ static int __get_cpu_architecture(void)
                 if (cpu_arch)
                         cpu_arch += CPU_ARCH_ARMv3;
         } else if ((read_cpuid_id() & 0x000f0000) == 0x000f0000) {
-                unsigned int mmfr0;
-
                 /* Revised CPUID format. Read the Memory Model Feature
                  * Register 0 and check for VMSAv7 or PMSAv7 */
-                asm("mrc        p15, 0, %0, c0, c1, 4"
-                    : "=r" (mmfr0));
+                unsigned int mmfr0 = read_cpuid_ext(CPUID_EXT_MMFR0);
                 if ((mmfr0 & 0x0000000f) >= 0x00000003 ||
                     (mmfr0 & 0x000000f0) >= 0x00000030)
                         cpu_arch = CPU_ARCH_ARMv7;
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 5e34fb143309..aa4116e9452f 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -270,37 +270,35 @@ static void __init at91_pm_sram_init(void)
         phys_addr_t sram_pbase;
         unsigned long sram_base;
         struct device_node *node;
-        struct platform_device *pdev;
+        struct platform_device *pdev = NULL;
 
-        node = of_find_compatible_node(NULL, NULL, "mmio-sram");
-        if (!node) {
-                pr_warn("%s: failed to find sram node!\n", __func__);
-                return;
+        for_each_compatible_node(node, NULL, "mmio-sram") {
+                pdev = of_find_device_by_node(node);
+                if (pdev) {
+                        of_node_put(node);
+                        break;
+                }
         }
 
-        pdev = of_find_device_by_node(node);
         if (!pdev) {
                 pr_warn("%s: failed to find sram device!\n", __func__);
-                goto put_node;
+                return;
         }
 
         sram_pool = dev_get_gen_pool(&pdev->dev);
         if (!sram_pool) {
                 pr_warn("%s: sram pool unavailable!\n", __func__);
-                goto put_node;
+                return;
         }
 
         sram_base = gen_pool_alloc(sram_pool, at91_slow_clock_sz);
         if (!sram_base) {
                 pr_warn("%s: unable to alloc ocram!\n", __func__);
-                goto put_node;
+                return;
         }
 
         sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base);
         slow_clock = __arm_ioremap_exec(sram_pbase, at91_slow_clock_sz, false);
-
-put_node:
-        of_node_put(node);
 }
 #endif
 
diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
index d2c89963af2d..86c0aa819d25 100644
--- a/arch/arm/mach-at91/pm.h
+++ b/arch/arm/mach-at91/pm.h
@@ -44,7 +44,7 @@ static inline void at91rm9200_standby(void)
                 "    mcr    p15, 0, %0, c7, c0, 4\n\t"
                 "    str    %5, [%1, %2]"
                 :
-                : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
+                : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
                   "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
                   "r" (lpr));
 }
diff --git a/arch/arm/mach-at91/pm_slowclock.S b/arch/arm/mach-at91/pm_slowclock.S
index 556151e85ec4..931f0e302c03 100644
--- a/arch/arm/mach-at91/pm_slowclock.S
+++ b/arch/arm/mach-at91/pm_slowclock.S
@@ -25,11 +25,6 @@
  */
 #undef SLOWDOWN_MASTER_CLOCK
 
-#define MCKRDY_TIMEOUT          1000
-#define MOSCRDY_TIMEOUT         1000
-#define PLLALOCK_TIMEOUT        1000
-#define PLLBLOCK_TIMEOUT        1000
-
 pmc     .req    r0
 sdramc  .req    r1
 ramc1   .req    r2
@@ -41,60 +36,42 @@ tmp2	.req	r5
  * Wait until master clock is ready (after switching master clock source)
  */
         .macro wait_mckrdy
-        mov     tmp2, #MCKRDY_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_MCKRDY
         beq     1b
-2:
         .endm
 
 /*
  * Wait until master oscillator has stabilized.
  */
         .macro wait_moscrdy
-        mov     tmp2, #MOSCRDY_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_MOSCS
         beq     1b
-2:
         .endm
 
 /*
  * Wait until PLLA has locked.
  */
         .macro wait_pllalock
-        mov     tmp2, #PLLALOCK_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_LOCKA
         beq     1b
-2:
         .endm
 
 /*
  * Wait until PLLB has locked.
  */
         .macro wait_pllblock
-        mov     tmp2, #PLLBLOCK_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_LOCKB
         beq     1b
-2:
         .endm
 
         .text
 
+        .arm
+
 /* void at91_slow_clock(void __iomem *pmc, void __iomem *sdramc,
  *                      void __iomem *ramc1, int memctrl)
  */
@@ -134,6 +111,16 @@ ddr_sr_enable:
         cmp     memctrl, #AT91_MEMCTRL_DDRSDR
         bne     sdr_sr_enable
 
+        /* LPDDR1 --> force DDR2 mode during self-refresh */
+        ldr     tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+        str     tmp1, .saved_sam9_mdr
+        bic     tmp1, tmp1, #~AT91_DDRSDRC_MD
+        cmp     tmp1, #AT91_DDRSDRC_MD_LOW_POWER_DDR
+        ldreq   tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+        biceq   tmp1, tmp1, #AT91_DDRSDRC_MD
+        orreq   tmp1, tmp1, #AT91_DDRSDRC_MD_DDR2
+        streq   tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+
         /* prepare for DDRAM self-refresh mode */
         ldr     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
         str     tmp1, .saved_sam9_lpr
@@ -142,14 +129,26 @@ ddr_sr_enable:
 
         /* figure out if we use the second ram controller */
         cmp     ramc1, #0
-        ldrne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
-        strne   tmp2, .saved_sam9_lpr1
-        bicne   tmp2, #AT91_DDRSDRC_LPCB
-        orrne   tmp2, #AT91_DDRSDRC_LPCB_SELF_REFRESH
+        beq     ddr_no_2nd_ctrl
+
+        ldr     tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+        str     tmp2, .saved_sam9_mdr1
+        bic     tmp2, tmp2, #~AT91_DDRSDRC_MD
+        cmp     tmp2, #AT91_DDRSDRC_MD_LOW_POWER_DDR
+        ldreq   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+        biceq   tmp2, tmp2, #AT91_DDRSDRC_MD
+        orreq   tmp2, tmp2, #AT91_DDRSDRC_MD_DDR2
+        streq   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+
+        ldr     tmp2, [ramc1, #AT91_DDRSDRC_LPR]
+        str     tmp2, .saved_sam9_lpr1
+        bic     tmp2, #AT91_DDRSDRC_LPCB
+        orr     tmp2, #AT91_DDRSDRC_LPCB_SELF_REFRESH
 
         /* Enable DDRAM self-refresh mode */
+        str     tmp2, [ramc1, #AT91_DDRSDRC_LPR]
+ddr_no_2nd_ctrl:
         str     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
-        strne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
 
         b       sdr_sr_done
 
@@ -208,6 +207,7 @@ sdr_sr_done:
         /* Turn off the main oscillator */
         ldr     tmp1, [pmc, #AT91_CKGR_MOR]
         bic     tmp1, tmp1, #AT91_PMC_MOSCEN
+        orr     tmp1, tmp1, #AT91_PMC_KEY
         str     tmp1, [pmc, #AT91_CKGR_MOR]
 
         /* Wait for interrupt */
@@ -216,6 +216,7 @@ sdr_sr_done:
         /* Turn on the main oscillator */
         ldr     tmp1, [pmc, #AT91_CKGR_MOR]
         orr     tmp1, tmp1, #AT91_PMC_MOSCEN
+        orr     tmp1, tmp1, #AT91_PMC_KEY
         str     tmp1, [pmc, #AT91_CKGR_MOR]
 
         wait_moscrdy
@@ -280,12 +281,17 @@ sdr_sr_done:
          */
         cmp     memctrl, #AT91_MEMCTRL_DDRSDR
         bne     sdr_en_restore
+        /* Restore MDR in case of LPDDR1 */
+        ldr     tmp1, .saved_sam9_mdr
+        str     tmp1, [sdramc, #AT91_DDRSDRC_MDR]
         /* Restore LPR on AT91 with DDRAM */
         ldr     tmp1, .saved_sam9_lpr
         str     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
 
         /* if we use the second ram controller */
         cmp     ramc1, #0
+        ldrne   tmp2, .saved_sam9_mdr1
+        strne   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
         ldrne   tmp2, .saved_sam9_lpr1
         strne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
 
@@ -319,5 +325,11 @@ ram_restored:
 .saved_sam9_lpr1:
         .word 0
 
+.saved_sam9_mdr:
+        .word 0
+
+.saved_sam9_mdr1:
+        .word 0
+
 ENTRY(at91_slow_clock_sz)
         .word .-at91_slow_clock
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index 3f32c47a6d74..d2e9f12d12f1 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -126,8 +126,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
  */
 void exynos_cpu_power_down(int cpu)
 {
-        if (cpu == 0 && (of_machine_is_compatible("samsung,exynos5420") ||
-                of_machine_is_compatible("samsung,exynos5800"))) {
+        if (cpu == 0 && (soc_is_exynos5420() || soc_is_exynos5800())) {
                 /*
                  * Bypass power down for CPU0 during suspend. Check for
                  * the SYS_PWR_REG value to decide if we are suspending
diff --git a/arch/arm/mach-exynos/pm_domains.c b/arch/arm/mach-exynos/pm_domains.c
index 20f267121b3e..37266a826437 100644
--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -161,6 +161,34 @@ no_clk:
                 of_genpd_add_provider_simple(np, &pd->pd);
         }
 
+        /* Assign the child power domains to their parents */
+        for_each_compatible_node(np, NULL, "samsung,exynos4210-pd") {
+                struct generic_pm_domain *child_domain, *parent_domain;
+                struct of_phandle_args args;
+
+                args.np = np;
+                args.args_count = 0;
+                child_domain = of_genpd_get_from_provider(&args);
+                if (!child_domain)
+                        continue;
+
+                if (of_parse_phandle_with_args(np, "power-domains",
+                                         "#power-domain-cells", 0, &args) != 0)
+                        continue;
+
+                parent_domain = of_genpd_get_from_provider(&args);
+                if (!parent_domain)
+                        continue;
+
+                if (pm_genpd_add_subdomain(parent_domain, child_domain))
+                        pr_warn("%s failed to add subdomain: %s\n",
+                                parent_domain->name, child_domain->name);
+                else
+                        pr_info("%s has as child subdomain: %s.\n",
+                                parent_domain->name, child_domain->name);
+                of_node_put(np);
+        }
+
         return 0;
 }
 arch_initcall(exynos4_pm_init_power_domain);
diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
index 52e2b1a2fddb..318d127df147 100644
--- a/arch/arm/mach-exynos/suspend.c
+++ b/arch/arm/mach-exynos/suspend.c
@@ -87,8 +87,8 @@ static unsigned int exynos_pmu_spare3;
 static u32 exynos_irqwake_intmask = 0xffffffff;
 
 static const struct exynos_wkup_irq exynos3250_wkup_irq[] = {
-        { 73, BIT(1) }, /* RTC alarm */
-        { 74, BIT(2) }, /* RTC tick */
+        { 105, BIT(1) }, /* RTC alarm */
+        { 106, BIT(2) }, /* RTC tick */
         { /* sentinel */ },
 };
 
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 4ad6e473cf83..9de3412af406 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -211,8 +211,9 @@ static void __init imx6q_1588_init(void)
          * set bit IOMUXC_GPR1[21].  Or the PTP clock must be from pad
          * (external OSC), and we need to clear the bit.
          */
-        clksel = ptp_clk == enet_ref ? IMX6Q_GPR1_ENET_CLK_SEL_ANATOP :
-                                       IMX6Q_GPR1_ENET_CLK_SEL_PAD;
+        clksel = clk_is_match(ptp_clk, enet_ref) ?
+                                IMX6Q_GPR1_ENET_CLK_SEL_ANATOP :
+                                IMX6Q_GPR1_ENET_CLK_SEL_PAD;
         gpr = syscon_regmap_lookup_by_compatible("fsl,imx6q-iomuxc-gpr");
         if (!IS_ERR(gpr))
                 regmap_update_bits(gpr, IOMUXC_GPR1,
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 2a2f4d56e4c8..25f1beea453e 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -720,6 +720,8 @@ static const char * __init omap_get_family(void)
                 return kasprintf(GFP_KERNEL, "OMAP4");
         else if (soc_is_omap54xx())
                 return kasprintf(GFP_KERNEL, "OMAP5");
+        else if (soc_is_am33xx() || soc_is_am335x())
+                return kasprintf(GFP_KERNEL, "AM33xx");
         else if (soc_is_am43xx())
                 return kasprintf(GFP_KERNEL, "AM43xx");
         else if (soc_is_dra7xx())
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 92afb723dcfc..355b08936871 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1692,16 +1692,15 @@ static int _deassert_hardreset(struct omap_hwmod *oh, const char *name)
         if (ret == -EBUSY)
                 pr_warn("omap_hwmod: %s: failed to hardreset\n", oh->name);
 
-        if (!ret) {
+        if (oh->clkdm) {
                 /*
                  * Set the clockdomain to HW_AUTO, assuming that the
                  * previous state was HW_AUTO.
                  */
-                if (oh->clkdm && hwsup)
+                if (hwsup)
                         clkdm_allow_idle(oh->clkdm);
-        } else {
-                if (oh->clkdm)
-                        clkdm_hwmod_disable(oh->clkdm, oh);
+
+                clkdm_hwmod_disable(oh->clkdm, oh);
         }
 
         return ret;
@@ -2698,6 +2697,7 @@ static int __init _register(struct omap_hwmod *oh)
         INIT_LIST_HEAD(&oh->master_ports);
         INIT_LIST_HEAD(&oh->slave_ports);
         spin_lock_init(&oh->_lock);
+        lockdep_set_class(&oh->_lock, &oh->hwmod_key);
 
         oh->_state = _HWMOD_STATE_REGISTERED;
 
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 9d4bec6ee742..9611c91d9b82 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -674,6 +674,7 @@ struct omap_hwmod {
         u32                             _sysc_cache;
         void __iomem                    *_mpu_rt_va;
         spinlock_t                      _lock;
+        struct lock_class_key           hwmod_key; /* unique lock class */
         struct list_head                node;
         struct omap_hwmod_ocp_if        *_mpu_port;
         unsigned int                    (*xlate_irq)(unsigned int);
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index e8692e7675b8..16fe7a1b7a35 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1466,55 +1466,18 @@ static struct omap_hwmod dra7xx_ocp2scp3_hwmod = {
  *
  */
 
-static struct omap_hwmod_class dra7xx_pcie_hwmod_class = {
+static struct omap_hwmod_class dra7xx_pciess_hwmod_class = {
         .name   = "pcie",
 };
 
 /* pcie1 */
-static struct omap_hwmod dra7xx_pcie1_hwmod = {
+static struct omap_hwmod dra7xx_pciess1_hwmod = {
         .name           = "pcie1",
-        .class          = &dra7xx_pcie_hwmod_class,
+        .class          = &dra7xx_pciess_hwmod_class,
         .clkdm_name     = "pcie_clkdm",
         .main_clk       = "l4_root_clk_div",
         .prcm = {
                 .omap4 = {
-                        .clkctrl_offs   = DRA7XX_CM_PCIE_CLKSTCTRL_OFFSET,
-                        .modulemode     = MODULEMODE_SWCTRL,
-                },
-        },
-};
-
-/* pcie2 */
-static struct omap_hwmod dra7xx_pcie2_hwmod = {
-        .name           = "pcie2",
-        .class          = &dra7xx_pcie_hwmod_class,
-        .clkdm_name     = "pcie_clkdm",
-        .main_clk       = "l4_root_clk_div",
-        .prcm = {
-                .omap4 = {
-                        .clkctrl_offs = DRA7XX_CM_PCIE_CLKSTCTRL_OFFSET,
-                        .modulemode   = MODULEMODE_SWCTRL,
-                },
-        },
-};
-
-/*
- * 'PCIE PHY' class
- *
- */
-
-static struct omap_hwmod_class dra7xx_pcie_phy_hwmod_class = {
-        .name   = "pcie-phy",
-};
-
-/* pcie1 phy */
-static struct omap_hwmod dra7xx_pcie1_phy_hwmod = {
-        .name           = "pcie1-phy",
-        .class          = &dra7xx_pcie_phy_hwmod_class,
-        .clkdm_name     = "l3init_clkdm",
-        .main_clk       = "l4_root_clk_div",
-        .prcm = {
-                .omap4 = {
                         .clkctrl_offs = DRA7XX_CM_L3INIT_PCIESS1_CLKCTRL_OFFSET,
                         .context_offs = DRA7XX_RM_L3INIT_PCIESS1_CONTEXT_OFFSET,
                         .modulemode   = MODULEMODE_SWCTRL,
@@ -1522,11 +1485,11 @@ static struct omap_hwmod dra7xx_pcie1_phy_hwmod = {
         },
 };
 
-/* pcie2 phy */
-static struct omap_hwmod dra7xx_pcie2_phy_hwmod = {
-        .name           = "pcie2-phy",
-        .class          = &dra7xx_pcie_phy_hwmod_class,
-        .clkdm_name     = "l3init_clkdm",
+/* pcie2 */
+static struct omap_hwmod dra7xx_pciess2_hwmod = {
+        .name           = "pcie2",
+        .class          = &dra7xx_pciess_hwmod_class,
+        .clkdm_name     = "pcie_clkdm",
         .main_clk       = "l4_root_clk_div",
         .prcm = {
                 .omap4 = {
@@ -2877,50 +2840,34 @@ static struct omap_hwmod_ocp_if dra7xx_l4_cfg__ocp2scp3 = {
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l3_main_1 -> pcie1 */
-static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pcie1 = {
+/* l3_main_1 -> pciess1 */
+static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pciess1 = {
         .master         = &dra7xx_l3_main_1_hwmod,
-        .slave          = &dra7xx_pcie1_hwmod,
+        .slave          = &dra7xx_pciess1_hwmod,
         .clk            = "l3_iclk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l4_cfg -> pcie1 */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie1 = {
+/* l4_cfg -> pciess1 */
+static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pciess1 = {
         .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie1_hwmod,
+        .slave          = &dra7xx_pciess1_hwmod,
         .clk            = "l4_root_clk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l3_main_1 -> pcie2 */
-static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pcie2 = {
+/* l3_main_1 -> pciess2 */
+static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pciess2 = {
         .master         = &dra7xx_l3_main_1_hwmod,
-        .slave          = &dra7xx_pcie2_hwmod,
+        .slave          = &dra7xx_pciess2_hwmod,
         .clk            = "l3_iclk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l4_cfg -> pcie2 */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie2 = {
-        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie2_hwmod,
-        .clk            = "l4_root_clk_div",
-        .user           = OCP_USER_MPU | OCP_USER_SDMA,
-};
-
-/* l4_cfg -> pcie1 phy */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie1_phy = {
-        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie1_phy_hwmod,
-        .clk            = "l4_root_clk_div",
-        .user           = OCP_USER_MPU | OCP_USER_SDMA,
-};
-
-/* l4_cfg -> pcie2 phy */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie2_phy = {
+/* l4_cfg -> pciess2 */
+static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pciess2 = {
         .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie2_phy_hwmod,
+        .slave          = &dra7xx_pciess2_hwmod,
         .clk            = "l4_root_clk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
@@ -3327,12 +3274,10 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = {
         &dra7xx_l4_cfg__mpu,
         &dra7xx_l4_cfg__ocp2scp1,
         &dra7xx_l4_cfg__ocp2scp3,
-        &dra7xx_l3_main_1__pcie1,
-        &dra7xx_l4_cfg__pcie1,
-        &dra7xx_l3_main_1__pcie2,
-        &dra7xx_l4_cfg__pcie2,
-        &dra7xx_l4_cfg__pcie1_phy,
-        &dra7xx_l4_cfg__pcie2_phy,
+        &dra7xx_l3_main_1__pciess1,
+        &dra7xx_l4_cfg__pciess1,
+        &dra7xx_l3_main_1__pciess2,
+        &dra7xx_l4_cfg__pciess2,
         &dra7xx_l3_main_1__qspi,
         &dra7xx_l4_per3__rtcss,
         &dra7xx_l4_cfg__sata,
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 190fa43e7479..e642b079e9f3 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -173,6 +173,7 @@ static void __init omap3_igep0030_rev_g_legacy_init(void)
 
 static void __init omap3_evm_legacy_init(void)
 {
+        hsmmc2_internal_input_clk();
         legacy_init_wl12xx(WL12XX_REFCLOCK_38, 0, 149);
 }
 
diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c
index a08a617a6c11..d6d6bc39e05c 100644
--- a/arch/arm/mach-omap2/prm44xx.c
+++ b/arch/arm/mach-omap2/prm44xx.c
@@ -252,10 +252,10 @@ static void omap44xx_prm_save_and_clear_irqen(u32 *saved_mask)
 {
         saved_mask[0] =
                 omap4_prm_read_inst_reg(OMAP4430_PRM_OCP_SOCKET_INST,
-                                        OMAP4_PRM_IRQSTATUS_MPU_OFFSET);
+                                        OMAP4_PRM_IRQENABLE_MPU_OFFSET);
         saved_mask[1] =
                 omap4_prm_read_inst_reg(OMAP4430_PRM_OCP_SOCKET_INST,
-                                        OMAP4_PRM_IRQSTATUS_MPU_2_OFFSET);
+                                        OMAP4_PRM_IRQENABLE_MPU_2_OFFSET);
 
         omap4_prm_write_inst_reg(0, OMAP4430_PRM_OCP_SOCKET_INST,
                                  OMAP4_PRM_IRQENABLE_MPU_OFFSET);
diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c
index 0eecd83c624e..89a7c06570d3 100644
--- a/arch/arm/mach-pxa/irq.c
+++ b/arch/arm/mach-pxa/irq.c
@@ -11,6 +11,7 @@
  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.
  */
+#include <linux/bitops.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/interrupt.h>
@@ -40,7 +41,6 @@
 #define ICHP_VAL_IRQ            (1 << 31)
 #define ICHP_IRQ(i)             (((i) >> 16) & 0x7fff)
 #define IPR_VALID               (1 << 31)
-#define IRQ_BIT(n)              (((n) - PXA_IRQ(0)) & 0x1f)
 
 #define MAX_INTERNAL_IRQS       128
 
@@ -51,6 +51,7 @@
 static void __iomem *pxa_irq_base;
 static int pxa_internal_irq_nr;
 static bool cpu_has_ipr;
+static struct irq_domain *pxa_irq_domain;
 
 static inline void __iomem *irq_base(int i)
 {
@@ -66,18 +67,20 @@ static inline void __iomem *irq_base(int i)
 void pxa_mask_irq(struct irq_data *d)
 {
         void __iomem *base = irq_data_get_irq_chip_data(d);
+        irq_hw_number_t irq = irqd_to_hwirq(d);
         uint32_t icmr = __raw_readl(base + ICMR);
 
-        icmr &= ~(1 << IRQ_BIT(d->irq));
+        icmr &= ~BIT(irq & 0x1f);
         __raw_writel(icmr, base + ICMR);
 }
 
 void pxa_unmask_irq(struct irq_data *d)
 {
         void __iomem *base = irq_data_get_irq_chip_data(d);
+        irq_hw_number_t irq = irqd_to_hwirq(d);
         uint32_t icmr = __raw_readl(base + ICMR);
 
-        icmr |= 1 << IRQ_BIT(d->irq);
+        icmr |= BIT(irq & 0x1f);
         __raw_writel(icmr, base + ICMR);
 }
 
@@ -118,40 +121,63 @@ asmlinkage void __exception_irq_entry ichp_handle_irq(struct pt_regs *regs)
         } while (1);
 }
 
-void __init pxa_init_irq(int irq_nr, int (*fn)(struct irq_data *, unsigned int))
+static int pxa_irq_map(struct irq_domain *h, unsigned int virq,
+                       irq_hw_number_t hw)
 {
-        int irq, i, n;
+        void __iomem *base = irq_base(hw / 32);
 
-        BUG_ON(irq_nr > MAX_INTERNAL_IRQS);
+        /* initialize interrupt priority */
+        if (cpu_has_ipr)
+                __raw_writel(hw | IPR_VALID, pxa_irq_base + IPR(hw));
+
+        irq_set_chip_and_handler(virq, &pxa_internal_irq_chip,
+                                 handle_level_irq);
+        irq_set_chip_data(virq, base);
+        set_irq_flags(virq, IRQF_VALID);
+
+        return 0;
+}
+
+static struct irq_domain_ops pxa_irq_ops = {
+        .map    = pxa_irq_map,
+        .xlate  = irq_domain_xlate_onecell,
+};
+
+static __init void
+pxa_init_irq_common(struct device_node *node, int irq_nr,
+                    int (*fn)(struct irq_data *, unsigned int))
+{
+        int n;
 
         pxa_internal_irq_nr = irq_nr;
-        cpu_has_ipr = !cpu_is_pxa25x();
-        pxa_irq_base = io_p2v(0x40d00000);
+        pxa_irq_domain = irq_domain_add_legacy(node, irq_nr,
+                                               PXA_IRQ(0), 0,
+                                               &pxa_irq_ops, NULL);
+        if (!pxa_irq_domain)
+                panic("Unable to add PXA IRQ domain\n");
+        irq_set_default_host(pxa_irq_domain);
 
         for (n = 0; n < irq_nr; n += 32) {
                 void __iomem *base = irq_base(n >> 5);
 
                 __raw_writel(0, base + ICMR);   /* disable all IRQs */
                 __raw_writel(0, base + ICLR);   /* all IRQs are IRQ, not FIQ */
-                for (i = n; (i < (n + 32)) && (i < irq_nr); i++) {
-                        /* initialize interrupt priority */
-                        if (cpu_has_ipr)
-                                __raw_writel(i | IPR_VALID, pxa_irq_base + IPR(i));
-
-                        irq = PXA_IRQ(i);
-                        irq_set_chip_and_handler(irq, &pxa_internal_irq_chip,
-                                                 handle_level_irq);
-                        irq_set_chip_data(irq, base);
-                        set_irq_flags(irq, IRQF_VALID);
-                }
         }
-
         /* only unmasked interrupts kick us out of idle */
         __raw_writel(1, irq_base(0) + ICCR);
 
         pxa_internal_irq_chip.irq_set_wake = fn;
 }
 
+void __init pxa_init_irq(int irq_nr, int (*fn)(struct irq_data *, unsigned int))
+{
+        BUG_ON(irq_nr > MAX_INTERNAL_IRQS);
+
+        pxa_irq_base = io_p2v(0x40d00000);
+        cpu_has_ipr = !cpu_is_pxa25x();
+        pxa_init_irq_common(NULL, irq_nr, fn);
+}
+
 #ifdef CONFIG_PM
 static unsigned long saved_icmr[MAX_INTERNAL_IRQS/32];
 static unsigned long saved_ipr[MAX_INTERNAL_IRQS];
@@ -203,30 +229,6 @@ struct syscore_ops pxa_irq_syscore_ops = {
 };
 
 #ifdef CONFIG_OF
-static struct irq_domain *pxa_irq_domain;
-
-static int pxa_irq_map(struct irq_domain *h, unsigned int virq,
-                       irq_hw_number_t hw)
-{
-        void __iomem *base = irq_base(hw / 32);
-
-        /* initialize interrupt priority */
-        if (cpu_has_ipr)
-                __raw_writel(hw | IPR_VALID, pxa_irq_base + IPR(hw));
-
-        irq_set_chip_and_handler(hw, &pxa_internal_irq_chip,
-                                 handle_level_irq);
-        irq_set_chip_data(hw, base);
-        set_irq_flags(hw, IRQF_VALID);
-
-        return 0;
-}
-
-static struct irq_domain_ops pxa_irq_ops = {
-        .map    = pxa_irq_map,
-        .xlate  = irq_domain_xlate_onecell,
-};
-
 static const struct of_device_id intc_ids[] __initconst = {
         { .compatible = "marvell,pxa-intc", },
         {}
@@ -236,7 +238,7 @@ void __init pxa_dt_irq_init(int (*fn)(struct irq_data *, unsigned int))
 {
         struct device_node *node;
         struct resource res;
-        int n, ret;
+        int ret;
 
         node = of_find_matching_node(NULL, intc_ids);
         if (!node) {
@@ -267,23 +269,6 @@ void __init pxa_dt_irq_init(int (*fn)(struct irq_data *, unsigned int))
                 return;
         }
 
-        pxa_irq_domain = irq_domain_add_legacy(node, pxa_internal_irq_nr, 0, 0,
-                                               &pxa_irq_ops, NULL);
-        if (!pxa_irq_domain)
-                panic("Unable to add PXA IRQ domain\n");
-
-        irq_set_default_host(pxa_irq_domain);
-
-        for (n = 0; n < pxa_internal_irq_nr; n += 32) {
-                void __iomem *base = irq_base(n >> 5);
-
-                __raw_writel(0, base + ICMR);   /* disable all IRQs */
-                __raw_writel(0, base + ICLR);   /* all IRQs are IRQ, not FIQ */
-        }
-
-        /* only unmasked interrupts kick us out of idle */
-        __raw_writel(1, irq_base(0) + ICCR);
-
-        pxa_internal_irq_chip.irq_set_wake = fn;
+        pxa_init_irq_common(node, pxa_internal_irq_nr, fn);
 }
 #endif /* CONFIG_OF */
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index 205f9bf3821e..ac2ae5c71ab4 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -412,7 +412,7 @@ static struct fixed_voltage_config can_regulator_pdata = {
 };
 
 static struct platform_device can_regulator_device = {
-        .name   = "reg-fixed-volage",
+        .name   = "reg-fixed-voltage",
         .id     = 0,
         .dev    = {
                 .platform_data  = &can_regulator_pdata,
diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h
index 483cb467bf65..a0f3b1cd497c 100644
--- a/arch/arm/mach-socfpga/core.h
+++ b/arch/arm/mach-socfpga/core.h
@@ -45,6 +45,6 @@ extern char secondary_trampoline, secondary_trampoline_end;
 
 extern unsigned long socfpga_cpu1start_addr;
 
-#define SOCFPGA_SCU_VIRT_BASE   0xfffec000
+#define SOCFPGA_SCU_VIRT_BASE   0xfee00000
 
 #endif
diff --git a/arch/arm/mach-socfpga/socfpga.c b/arch/arm/mach-socfpga/socfpga.c
index 383d61e138af..f5e597c207b9 100644
--- a/arch/arm/mach-socfpga/socfpga.c
+++ b/arch/arm/mach-socfpga/socfpga.c
@@ -23,6 +23,7 @@
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
+#include <asm/cacheflush.h>
 
 #include "core.h"
 
@@ -73,6 +74,10 @@ void __init socfpga_sysmgr_init(void)
                         (u32 *) &socfpga_cpu1start_addr))
                 pr_err("SMP: Need cpu1-start-addr in device tree.\n");
 
+        /* Ensure that socfpga_cpu1start_addr is visible to other CPUs */
+        smp_wmb();
+        sync_cache_w(&socfpga_cpu1start_addr);
+
         sys_manager_base_addr = of_iomap(np, 0);
 
         np = of_find_compatible_node(NULL, NULL, "altr,rst-mgr");
diff --git a/arch/arm/mach-sti/board-dt.c b/arch/arm/mach-sti/board-dt.c
index b067390cef4e..b373acade338 100644
--- a/arch/arm/mach-sti/board-dt.c
+++ b/arch/arm/mach-sti/board-dt.c
@@ -18,6 +18,7 @@ static const char *stih41x_dt_match[] __initdata = {
         "st,stih415",
         "st,stih416",
         "st,stih407",
+        "st,stih410",
         "st,stih418",
         NULL
 };
diff --git a/arch/arm/mach-sunxi/Kconfig b/arch/arm/mach-sunxi/Kconfig
index a77604fbaf25..81502b90dd91 100644
--- a/arch/arm/mach-sunxi/Kconfig
+++ b/arch/arm/mach-sunxi/Kconfig
@@ -1,10 +1,12 @@
 menuconfig ARCH_SUNXI
         bool "Allwinner SoCs" if ARCH_MULTI_V7
         select ARCH_REQUIRE_GPIOLIB
+        select ARCH_HAS_RESET_CONTROLLER
         select CLKSRC_MMIO
         select GENERIC_IRQ_CHIP
         select PINCTRL
         select SUN4I_TIMER
+        select RESET_CONTROLLER
 
 if ARCH_SUNXI
 
@@ -20,10 +22,8 @@ config MACH_SUN5I
 config MACH_SUN6I
         bool "Allwinner A31 (sun6i) SoCs support"
         default ARCH_SUNXI
-        select ARCH_HAS_RESET_CONTROLLER
         select ARM_GIC
         select MFD_SUN6I_PRCM
-        select RESET_CONTROLLER
         select SUN5I_HSTIMER
 
 config MACH_SUN7I
@@ -37,16 +37,12 @@ config MACH_SUN7I
 config MACH_SUN8I
         bool "Allwinner A23 (sun8i) SoCs support"
         default ARCH_SUNXI
-        select ARCH_HAS_RESET_CONTROLLER
         select ARM_GIC
         select MFD_SUN6I_PRCM
-        select RESET_CONTROLLER
 
 config MACH_SUN9I
         bool "Allwinner (sun9i) SoCs support"
         default ARCH_SUNXI
-        select ARCH_HAS_RESET_CONTROLLER
         select ARM_GIC
-        select RESET_CONTROLLER
 
 endif
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index c6c7696b8db9..8f15f70622a6 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -1131,23 +1131,22 @@ static void __init l2c310_of_parse(const struct device_node *np,
         }
 
         ret = l2x0_cache_size_of_parse(np, aux_val, aux_mask, &assoc, SZ_512K);
-        if (ret)
-                return;
-
-        switch (assoc) {
-        case 16:
-                *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                *aux_val |= L310_AUX_CTRL_ASSOCIATIVITY_16;
-                *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                break;
-        case 8:
-                *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                break;
-        default:
-                pr_err("L2C-310 OF cache associativity %d invalid, only 8 or 16 permitted\n",
-                       assoc);
-                break;
+        if (!ret) {
+                switch (assoc) {
+                case 16:
+                        *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        *aux_val |= L310_AUX_CTRL_ASSOCIATIVITY_16;
+                        *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        break;
+                case 8:
+                        *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        break;
+                default:
+                        pr_err("L2C-310 OF cache associativity %d invalid, only 8 or 16 permitted\n",
+                               assoc);
+                        break;
+                }
         }
 
         prefetch = l2x0_saved_regs.prefetch_ctrl;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 170a116d1b29..c27447653903 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -171,7 +171,7 @@ static int __dma_supported(struct device *dev, u64 mask, bool warn)
          */
         if (sizeof(mask) != sizeof(dma_addr_t) &&
             mask > (dma_addr_t)~0 &&
-            dma_to_pfn(dev, ~0) < max_pfn) {
+            dma_to_pfn(dev, ~0) < max_pfn - 1) {
                 if (warn) {
                         dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
                                  mask);
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index a982dc3190df..6333d9c17875 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -552,6 +552,7 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 
         pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
                 inf->name, fsr, addr);
+        show_pte(current->mm, addr);
 
         info.si_signo = inf->sig;
         info.si_errno = 0;
diff --git a/arch/arm/mm/pageattr.c b/arch/arm/mm/pageattr.c
index 004e35cdcfff..cf30daff8932 100644
--- a/arch/arm/mm/pageattr.c
+++ b/arch/arm/mm/pageattr.c
@@ -49,7 +49,10 @@ static int change_memory_common(unsigned long addr, int numpages,
                 WARN_ON_ONCE(1);
         }
 
-        if (!is_module_address(start) || !is_module_address(end - 1))
+        if (start < MODULES_VADDR || start >= MODULES_END)
+                return -EINVAL;
+
+        if (end < MODULES_VADDR || start >= MODULES_END)
                 return -EINVAL;
 
         data.set_mask = set_mask;
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index db10169a08de..8ca94d379bc3 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -799,6 +799,7 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
         struct device *dev = &pdev->dev;
         const struct of_device_id *match;
         const struct dmtimer_platform_data *pdata;
+        int ret;
 
         match = of_match_device(of_match_ptr(omap_timer_match), dev);
         pdata = match ? match->data : dev->platform_data;
@@ -860,7 +861,12 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
         }
 
         if (!timer->reserved) {
-                pm_runtime_get_sync(dev);
+                ret = pm_runtime_get_sync(dev);
+                if (ret < 0) {
+                        dev_err(dev, "%s: pm_runtime_get_sync failed!\n",
+                                __func__);
+                        goto err_get_sync;
+                }
                 __omap_dm_timer_init_regs(timer);
                 pm_runtime_put(dev);
         }
@@ -873,6 +879,11 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
         dev_dbg(dev, "Device Probed.\n");
 
         return 0;
+
+err_get_sync:
+        pm_runtime_put_noidle(dev);
+        pm_runtime_disable(dev);
+        return ret;
 }
 
 /**
@@ -899,6 +910,8 @@ static int omap_dm_timer_remove(struct platform_device *pdev)
                 }
         spin_unlock_irqrestore(&dm_timer_lock, flags);
 
+        pm_runtime_disable(&pdev->dev);
+
         return ret;
 }
 
diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
index ea2b5666a16f..c9b89efe0f56 100644
--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
@@ -8,7 +8,7 @@
  */
 
         /* SoC fixed clocks */
-        soc_uartclk: refclk72738khz {
+        soc_uartclk: refclk7273800hz {
                 compatible = "fixed-clock";
                 #clock-cells = <0>;
                 clock-frequency = <7273800>;
diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
index cb9593079f29..d8c25b7b18fb 100644
--- a/arch/arm64/include/asm/cmpxchg.h
+++ b/arch/arm64/include/asm/cmpxchg.h
@@ -246,14 +246,30 @@ static inline unsigned long __cmpxchg_mb(volatile void *ptr, unsigned long old,
         __ret; \
 })
 
-#define this_cpu_cmpxchg_1(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
-#define this_cpu_cmpxchg_2(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
-#define this_cpu_cmpxchg_4(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
-#define this_cpu_cmpxchg_8(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
-
-#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2) \
-        cmpxchg_double_local(raw_cpu_ptr(&(ptr1)), raw_cpu_ptr(&(ptr2)), \
-                                o1, o2, n1, n2)
+#define _protect_cmpxchg_local(pcp, o, n)                       \
+({                                                              \
+        typeof(*raw_cpu_ptr(&(pcp))) __ret;                     \
+        preempt_disable();                                      \
+        __ret = cmpxchg_local(raw_cpu_ptr(&(pcp)), o, n);       \
+        preempt_enable();                                       \
+        __ret;                                                  \
+})
+
+#define this_cpu_cmpxchg_1(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+#define this_cpu_cmpxchg_2(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+#define this_cpu_cmpxchg_4(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+#define this_cpu_cmpxchg_8(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+
+#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2)           \
+({                                                                      \
+        int __ret;                                                      \
+        preempt_disable();                                              \
+        __ret = cmpxchg_double_local(   raw_cpu_ptr(&(ptr1)),           \
+                                        raw_cpu_ptr(&(ptr2)),           \
+                                        o1, o2, n1, n2);                \
+        preempt_enable();                                               \
+        __ret;                                                          \
+})
 
 #define cmpxchg64(ptr,o,n)              cmpxchg((ptr),(o),(n))
 #define cmpxchg64_local(ptr,o,n)        cmpxchg_local((ptr),(o),(n))
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index a9eee33dfa62..101a42bde728 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
         unsigned int cpu = smp_processor_id();
 
+        /*
+         * init_mm.pgd does not contain any user mappings and it is always
+         * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
+         */
+        if (next == &init_mm) {
+                cpu_set_reserved_ttbr0();
+                return;
+        }
+
         if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
                 check_and_switch_context(next, tsk);
 }
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
index 09da25bc596f..4fde8c1df97f 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -204,25 +204,47 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
         return ret;
 }
 
+#define _percpu_read(pcp)                                               \
+({                                                                      \
+        typeof(pcp) __retval;                                           \
+        preempt_disable();                                              \
+        __retval = (typeof(pcp))__percpu_read(raw_cpu_ptr(&(pcp)),      \
+                                              sizeof(pcp));             \
+        preempt_enable();                                               \
+        __retval;                                                       \
+})
+
+#define _percpu_write(pcp, val)                                         \
+do {                                                                    \
+        preempt_disable();                                              \
+        __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val),       \
+                                sizeof(pcp));                           \
+        preempt_enable();                                               \
+} while(0)                                                              \
+
+#define _pcp_protect(operation, pcp, val)                       \
+({                                                              \
+        typeof(pcp) __retval;                                   \
+        preempt_disable();                                      \
+        __retval = (typeof(pcp))operation(raw_cpu_ptr(&(pcp)),  \
+                                          (val), sizeof(pcp));  \
+        preempt_enable();                                       \
+        __retval;                                               \
+})
+
 #define _percpu_add(pcp, val) \
-        __percpu_add(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
+        _pcp_protect(__percpu_add, pcp, val)
 
-#define _percpu_add_return(pcp, val) (typeof(pcp)) (_percpu_add(pcp, val))
+#define _percpu_add_return(pcp, val) _percpu_add(pcp, val)
 
 #define _percpu_and(pcp, val) \
-        __percpu_and(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
+        _pcp_protect(__percpu_and, pcp, val)
 
 #define _percpu_or(pcp, val) \
-        __percpu_or(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
-
-#define _percpu_read(pcp) (typeof(pcp)) \
-        (__percpu_read(raw_cpu_ptr(&(pcp)), sizeof(pcp)))
-
-#define _percpu_write(pcp, val) \
-        __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp))
+        _pcp_protect(__percpu_or, pcp, val)
 
 #define _percpu_xchg(pcp, val) (typeof(pcp)) \
-        (__percpu_xchg(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp)))
+        _pcp_protect(__percpu_xchg, pcp, (unsigned long)(val))
 
 #define this_cpu_add_1(pcp, val) _percpu_add(pcp, val)
 #define this_cpu_add_2(pcp, val) _percpu_add(pcp, val)
diff --git a/arch/arm64/include/asm/proc-fns.h b/arch/arm64/include/asm/proc-fns.h
index 9a8fd84f8fb2..941c375616e2 100644
--- a/arch/arm64/include/asm/proc-fns.h
+++ b/arch/arm64/include/asm/proc-fns.h
@@ -39,7 +39,11 @@ extern u64 cpu_do_resume(phys_addr_t ptr, u64 idmap_ttbr);
 
 #include <asm/memory.h>
 
-#define cpu_switch_mm(pgd,mm) cpu_do_switch_mm(virt_to_phys(pgd),mm)
+#define cpu_switch_mm(pgd,mm)                           \
+do {                                                    \
+        BUG_ON(pgd == swapper_pg_dir);                  \
+        cpu_do_switch_mm(virt_to_phys(pgd),mm);         \
+} while (0)
 
 #define cpu_get_pgd()                                   \
 ({                                                      \
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index c028fe37456f..53d9c354219f 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -48,6 +48,7 @@ static inline void tlb_flush(struct mmu_gather *tlb)
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
                                   unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
         pgtable_page_dtor(pte);
         tlb_remove_entry(tlb, pte);
 }
@@ -56,6 +57,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
                                   unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
         tlb_remove_entry(tlb, virt_to_page(pmdp));
 }
 #endif
@@ -64,6 +66,7 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
 static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
                                   unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
         tlb_remove_entry(tlb, virt_to_page(pudp));
 }
 #endif
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index 4abe9b945f77..c3bb05b98616 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -144,6 +144,19 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end
 }
 
 /*
+ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
+ * table levels (pgd/pud/pmd).
+ */
+static inline void __flush_tlb_pgtable(struct mm_struct *mm,
+                                       unsigned long uaddr)
+{
+        unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
+
+        dsb(ishst);
+        asm("tlbi       vae1is, %0" : : "r" (addr));
+        dsb(ish);
+}
+/*
  * On AArch64, the cache coherency is handled via the set_pte_at() function.
  */
 static inline void update_mmu_cache(struct vm_area_struct *vma,
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index b42c7b480e1e..ab21e0d58278 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -337,7 +337,11 @@ core_initcall(arm64_dmi_init);
 
 static void efi_set_pgd(struct mm_struct *mm)
 {
-        cpu_switch_mm(mm->pgd, mm);
+        if (mm == &init_mm)
+                cpu_set_reserved_ttbr0();
+        else
+                cpu_switch_mm(mm->pgd, mm);
+
         flush_tlb_all();
         if (icache_is_aivivt())
                 __flush_icache_all();
@@ -354,3 +358,12 @@ void efi_virtmap_unload(void)
         efi_set_pgd(current->active_mm);
         preempt_enable();
 }
+
+/*
+ * UpdateCapsule() depends on the system being shutdown via
+ * ResetSystem().
+ */
+bool efi_poweroff_required(void)
+{
+        return efi_enabled(EFI_RUNTIME_SERVICES);
+}
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 8ce88e08c030..07f930540f4a 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -585,8 +585,8 @@ ENDPROC(set_cpu_boot_mode_flag)
  * zeroing of .bss would clobber it.
  */
         .pushsection    .data..cacheline_aligned
-ENTRY(__boot_cpu_mode)
         .align  L1_CACHE_SHIFT
+ENTRY(__boot_cpu_mode)
         .long   BOOT_CPU_MODE_EL2
         .long   0
         .popsection
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index fde9923af859..c6b1f3b96f45 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -21,6 +21,7 @@
 #include <stdarg.h>
 
 #include <linux/compat.h>
+#include <linux/efi.h>
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
@@ -150,6 +151,13 @@ void machine_restart(char *cmd)
         local_irq_disable();
         smp_send_stop();
 
+        /*
+         * UpdateCapsule() depends on the system being reset via
+         * ResetSystem().
+         */
+        if (efi_enabled(EFI_RUNTIME_SERVICES))
+                efi_reboot(reboot_mode, NULL);
+
         /* Now call the architecture specific reboot code. */
         if (arm_pm_restart)
                 arm_pm_restart(reboot_mode, cmd);
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 58e0c2bdde04..ef7d112f5ce0 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -51,7 +51,7 @@ static int __init early_coherent_pool(char *p)
 }
 early_param("coherent_pool", early_coherent_pool);
 
-static void *__alloc_from_pool(size_t size, struct page **ret_page)
+static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
 {
         unsigned long val;
         void *ptr = NULL;
@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
 
                 *ret_page = phys_to_page(phys);
                 ptr = (void *)val;
+                if (flags & __GFP_ZERO)
+                        memset(ptr, 0, size);
         }
 
         return ptr;
@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
                 flags |= GFP_DMA;
         if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
                 struct page *page;
+                void *addr;
 
                 size = PAGE_ALIGN(size);
                 page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
                         return NULL;
 
                 *dma_handle = phys_to_dma(dev, page_to_phys(page));
-                return page_address(page);
+                addr = page_address(page);
+                if (flags & __GFP_ZERO)
+                        memset(addr, 0, size);
+                return addr;
         } else {
                 return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
         }
@@ -146,7 +152,7 @@ static void *__dma_alloc(struct device *dev, size_t size,
 
         if (!coherent && !(flags & __GFP_WAIT)) {
                 struct page *page = NULL;
-                void *addr = __alloc_from_pool(size, &page);
+                void *addr = __alloc_from_pool(size, &page, flags);
 
                 if (addr)
                         *dma_handle = phys_to_dma(dev, page_to_phys(page));
diff --git a/arch/c6x/include/asm/pgtable.h b/arch/c6x/include/asm/pgtable.h
index 78d4483ba40c..ec4db6df5e0d 100644
--- a/arch/c6x/include/asm/pgtable.h
+++ b/arch/c6x/include/asm/pgtable.h
@@ -67,6 +67,11 @@ extern unsigned long empty_zero_page;
  */
 #define pgtable_cache_init()   do { } while (0)
 
+/*
+ * c6x is !MMU, so define the simpliest implementation
+ */
+#define pgprot_writecombine pgprot_noncached
+
 #include <asm-generic/pgtable.h>
 
 #endif /* _ASM_C6X_PGTABLE_H */
diff --git a/arch/metag/include/asm/io.h b/arch/metag/include/asm/io.h
index 9359e5048442..d5779b0ec573 100644
--- a/arch/metag/include/asm/io.h
+++ b/arch/metag/include/asm/io.h
@@ -2,6 +2,7 @@
 #define _ASM_METAG_IO_H
 
 #include <linux/types.h>
+#include <asm/pgtable-bits.h>
 
 #define IO_SPACE_LIMIT  0
 
diff --git a/arch/metag/include/asm/pgtable-bits.h b/arch/metag/include/asm/pgtable-bits.h
new file mode 100644
index 000000000000..25ba6729f496
--- /dev/null
+++ b/arch/metag/include/asm/pgtable-bits.h
@@ -0,0 +1,104 @@
+/*
+ * Meta page table definitions.
+ */
+
+#ifndef _METAG_PGTABLE_BITS_H
+#define _METAG_PGTABLE_BITS_H
+
+#include <asm/metag_mem.h>
+
+/*
+ * Definitions for MMU descriptors
+ *
+ * These are the hardware bits in the MMCU pte entries.
+ * Derived from the Meta toolkit headers.
+ */
+#define _PAGE_PRESENT           MMCU_ENTRY_VAL_BIT
+#define _PAGE_WRITE             MMCU_ENTRY_WR_BIT
+#define _PAGE_PRIV              MMCU_ENTRY_PRIV_BIT
+/* Write combine bit - this can cause writes to occur out of order */
+#define _PAGE_WR_COMBINE        MMCU_ENTRY_WRC_BIT
+/* Sys coherent bit - this bit is never used by Linux */
+#define _PAGE_SYS_COHERENT      MMCU_ENTRY_SYS_BIT
+#define _PAGE_ALWAYS_ZERO_1     0x020
+#define _PAGE_CACHE_CTRL0       0x040
+#define _PAGE_CACHE_CTRL1       0x080
+#define _PAGE_ALWAYS_ZERO_2     0x100
+#define _PAGE_ALWAYS_ZERO_3     0x200
+#define _PAGE_ALWAYS_ZERO_4     0x400
+#define _PAGE_ALWAYS_ZERO_5     0x800
+
+/* These are software bits that we stuff into the gaps in the hardware
+ * pte entries that are not used.  Note, these DO get stored in the actual
+ * hardware, but the hardware just does not use them.
+ */
+#define _PAGE_ACCESSED          _PAGE_ALWAYS_ZERO_1
+#define _PAGE_DIRTY             _PAGE_ALWAYS_ZERO_2
+
+/* Pages owned, and protected by, the kernel. */
+#define _PAGE_KERNEL            _PAGE_PRIV
+
+/* No cacheing of this page */
+#define _PAGE_CACHE_WIN0        (MMCU_CWIN_UNCACHED << MMCU_ENTRY_CWIN_S)
+/* burst cacheing - good for data streaming */
+#define _PAGE_CACHE_WIN1        (MMCU_CWIN_BURST << MMCU_ENTRY_CWIN_S)
+/* One cache way per thread */
+#define _PAGE_CACHE_WIN2        (MMCU_CWIN_C1SET << MMCU_ENTRY_CWIN_S)
+/* Full on cacheing */
+#define _PAGE_CACHE_WIN3        (MMCU_CWIN_CACHED << MMCU_ENTRY_CWIN_S)
+
+#define _PAGE_CACHEABLE         (_PAGE_CACHE_WIN3 | _PAGE_WR_COMBINE)
+
+/* which bits are used for cache control ... */
+#define _PAGE_CACHE_MASK        (_PAGE_CACHE_CTRL0 | _PAGE_CACHE_CTRL1 | \
+                                 _PAGE_WR_COMBINE)
+
+/* This is a mask of the bits that pte_modify is allowed to change. */
+#define _PAGE_CHG_MASK          (PAGE_MASK)
+
+#define _PAGE_SZ_SHIFT          1
+#define _PAGE_SZ_4K             (0x0)
+#define _PAGE_SZ_8K             (0x1 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_16K            (0x2 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_32K            (0x3 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_64K            (0x4 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_128K           (0x5 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_256K           (0x6 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_512K           (0x7 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_1M             (0x8 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_2M             (0x9 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_4M             (0xa << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_MASK           (0xf << _PAGE_SZ_SHIFT)
+
+#if defined(CONFIG_PAGE_SIZE_4K)
+#define _PAGE_SZ                (_PAGE_SZ_4K)
+#elif defined(CONFIG_PAGE_SIZE_8K)
+#define _PAGE_SZ                (_PAGE_SZ_8K)
+#elif defined(CONFIG_PAGE_SIZE_16K)
+#define _PAGE_SZ                (_PAGE_SZ_16K)
+#endif
+#define _PAGE_TABLE             (_PAGE_SZ | _PAGE_PRESENT)
+
+#if defined(CONFIG_HUGETLB_PAGE_SIZE_8K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_8K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_16K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_16K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_32K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_32K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_64K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_64K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_128K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_128K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_256K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_256K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_512K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_512K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_1M)
+# define _PAGE_SZHUGE           (_PAGE_SZ_1M)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_2M)
+# define _PAGE_SZHUGE           (_PAGE_SZ_2M)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_4M)
+# define _PAGE_SZHUGE           (_PAGE_SZ_4M)
+#endif
+
+#endif /* _METAG_PGTABLE_BITS_H */
diff --git a/arch/metag/include/asm/pgtable.h b/arch/metag/include/asm/pgtable.h
index d0604c0a8702..ffa3a3a2ecad 100644
--- a/arch/metag/include/asm/pgtable.h
+++ b/arch/metag/include/asm/pgtable.h
@@ -5,6 +5,7 @@
 #ifndef _METAG_PGTABLE_H
 #define _METAG_PGTABLE_H
 
+#include <asm/pgtable-bits.h>
 #include <asm-generic/pgtable-nopmd.h>
 
 /* Invalid regions on Meta: 0x00000000-0x001FFFFF and 0xFFFF0000-0xFFFFFFFF */
@@ -21,100 +22,6 @@
 #endif
 
 /*
- * Definitions for MMU descriptors
- *
- * These are the hardware bits in the MMCU pte entries.
- * Derived from the Meta toolkit headers.
- */
-#define _PAGE_PRESENT           MMCU_ENTRY_VAL_BIT
-#define _PAGE_WRITE             MMCU_ENTRY_WR_BIT
-#define _PAGE_PRIV              MMCU_ENTRY_PRIV_BIT
-/* Write combine bit - this can cause writes to occur out of order */
-#define _PAGE_WR_COMBINE        MMCU_ENTRY_WRC_BIT
-/* Sys coherent bit - this bit is never used by Linux */
-#define _PAGE_SYS_COHERENT      MMCU_ENTRY_SYS_BIT
-#define _PAGE_ALWAYS_ZERO_1     0x020
-#define _PAGE_CACHE_CTRL0       0x040
-#define _PAGE_CACHE_CTRL1       0x080
-#define _PAGE_ALWAYS_ZERO_2     0x100
-#define _PAGE_ALWAYS_ZERO_3     0x200
-#define _PAGE_ALWAYS_ZERO_4     0x400
-#define _PAGE_ALWAYS_ZERO_5     0x800
-
-/* These are software bits that we stuff into the gaps in the hardware
- * pte entries that are not used.  Note, these DO get stored in the actual
- * hardware, but the hardware just does not use them.
- */
-#define _PAGE_ACCESSED          _PAGE_ALWAYS_ZERO_1
-#define _PAGE_DIRTY             _PAGE_ALWAYS_ZERO_2
-
-/* Pages owned, and protected by, the kernel. */
-#define _PAGE_KERNEL            _PAGE_PRIV
-
-/* No cacheing of this page */
-#define _PAGE_CACHE_WIN0        (MMCU_CWIN_UNCACHED << MMCU_ENTRY_CWIN_S)
-/* burst cacheing - good for data streaming */
-#define _PAGE_CACHE_WIN1        (MMCU_CWIN_BURST << MMCU_ENTRY_CWIN_S)
-/* One cache way per thread */
-#define _PAGE_CACHE_WIN2        (MMCU_CWIN_C1SET << MMCU_ENTRY_CWIN_S)
-/* Full on cacheing */
-#define _PAGE_CACHE_WIN3        (MMCU_CWIN_CACHED << MMCU_ENTRY_CWIN_S)
-
-#define _PAGE_CACHEABLE         (_PAGE_CACHE_WIN3 | _PAGE_WR_COMBINE)
-
-/* which bits are used for cache control ... */
-#define _PAGE_CACHE_MASK        (_PAGE_CACHE_CTRL0 | _PAGE_CACHE_CTRL1 | \
-                                 _PAGE_WR_COMBINE)
-
-/* This is a mask of the bits that pte_modify is allowed to change. */
-#define _PAGE_CHG_MASK          (PAGE_MASK)
-
-#define _PAGE_SZ_SHIFT          1
-#define _PAGE_SZ_4K             (0x0)
-#define _PAGE_SZ_8K             (0x1 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_16K            (0x2 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_32K            (0x3 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_64K            (0x4 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_128K           (0x5 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_256K           (0x6 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_512K           (0x7 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_1M             (0x8 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_2M             (0x9 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_4M             (0xa << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_MASK           (0xf << _PAGE_SZ_SHIFT)
-
-#if defined(CONFIG_PAGE_SIZE_4K)
-#define _PAGE_SZ                (_PAGE_SZ_4K)
-#elif defined(CONFIG_PAGE_SIZE_8K)
-#define _PAGE_SZ                (_PAGE_SZ_8K)
-#elif defined(CONFIG_PAGE_SIZE_16K)
-#define _PAGE_SZ                (_PAGE_SZ_16K)
-#endif
-#define _PAGE_TABLE             (_PAGE_SZ | _PAGE_PRESENT)
-
-#if defined(CONFIG_HUGETLB_PAGE_SIZE_8K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_8K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_16K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_16K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_32K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_32K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_64K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_64K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_128K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_128K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_256K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_256K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_512K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_512K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_1M)
-# define _PAGE_SZHUGE           (_PAGE_SZ_1M)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_2M)
-# define _PAGE_SZHUGE           (_PAGE_SZ_2M)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_4M)
-# define _PAGE_SZHUGE           (_PAGE_SZ_4M)
-#endif
-
-/*
  * The Linux memory management assumes a three-level page table setup. On
  * Meta, we use that, but "fold" the mid level into the top-level page
  * table.
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index 0536bc021cc6..ef548510b951 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -348,8 +348,9 @@ C_ENTRY(_user_exception):
  * The LP register should point to the location where the called function
  * should return.  [note that MAKE_SYS_CALL uses label 1] */
         /* See if the system call number is valid */
+        blti    r12, 5f
         addi    r11, r12, -__NR_syscalls;
-        bgei    r11,5f;
+        bgei    r11, 5f;
         /* Figure out which function to use for this system call.  */
         /* Note Microblaze barrel shift is optional, so don't rely on it */
         add     r12, r12, r12;                  /* convert num -> ptr */
@@ -375,7 +376,7 @@ C_ENTRY(_user_exception):
 
         /* The syscall number is invalid, return an error.  */
 5:
-        rtsd    r15, 8;         /* looks like a normal subroutine return */
+        braid   ret_from_trap
         addi    r3, r0, -ENOSYS;
 
 /* Entry point used to return from a syscall/trap */
@@ -411,7 +412,7 @@ C_ENTRY(ret_from_trap):
         bri     1b
 
         /* Maybe handle a signal */
-5:      
+5:
         andi    r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
         beqi    r11, 4f;                /* Signals to handle, handle them */
 
diff --git a/arch/nios2/include/asm/ptrace.h b/arch/nios2/include/asm/ptrace.h
index 20fb1cf2dab6..642462144872 100644
--- a/arch/nios2/include/asm/ptrace.h
+++ b/arch/nios2/include/asm/ptrace.h
@@ -15,7 +15,54 @@
 
 #include <uapi/asm/ptrace.h>
 
+/* This struct defines the way the registers are stored on the
+   stack during a system call.  */
+
 #ifndef __ASSEMBLY__
+struct pt_regs {
+        unsigned long  r8;      /* r8-r15 Caller-saved GP registers */
+        unsigned long  r9;
+        unsigned long  r10;
+        unsigned long  r11;
+        unsigned long  r12;
+        unsigned long  r13;
+        unsigned long  r14;
+        unsigned long  r15;
+        unsigned long  r1;      /* Assembler temporary */
+        unsigned long  r2;      /* Retval LS 32bits */
+        unsigned long  r3;      /* Retval MS 32bits */
+        unsigned long  r4;      /* r4-r7 Register arguments */
+        unsigned long  r5;
+        unsigned long  r6;
+        unsigned long  r7;
+        unsigned long  orig_r2; /* Copy of r2 ?? */
+        unsigned long  ra;      /* Return address */
+        unsigned long  fp;      /* Frame pointer */
+        unsigned long  sp;      /* Stack pointer */
+        unsigned long  gp;      /* Global pointer */
+        unsigned long  estatus;
+        unsigned long  ea;      /* Exception return address (pc) */
+        unsigned long  orig_r7;
+};
+
+/*
+ * This is the extended stack used by signal handlers and the context
+ * switcher: it's pushed after the normal "struct pt_regs".
+ */
+struct switch_stack {
+        unsigned long  r16;     /* r16-r23 Callee-saved GP registers */
+        unsigned long  r17;
+        unsigned long  r18;
+        unsigned long  r19;
+        unsigned long  r20;
+        unsigned long  r21;
+        unsigned long  r22;
+        unsigned long  r23;
+        unsigned long  fp;
+        unsigned long  gp;
+        unsigned long  ra;
+};
+
 #define user_mode(regs) (((regs)->estatus & ESTATUS_EU))
 
 #define instruction_pointer(regs)       ((regs)->ra)
diff --git a/arch/nios2/include/asm/thread_info.h b/arch/nios2/include/asm/thread_info.h
index 1f266575beb5..a16e55cbd8ad 100644
--- a/arch/nios2/include/asm/thread_info.h
+++ b/arch/nios2/include/asm/thread_info.h
@@ -47,7 +47,6 @@ struct thread_info {
                                                   0-0x7FFFFFFF for user-thead
                                                   0-0xFFFFFFFF for kernel-thread
                                                 */
-        struct restart_block    restart_block;
         struct pt_regs          *regs;
 };
 
@@ -64,9 +63,6 @@ struct thread_info {
         .cpu            = 0,                    \
         .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
-        .restart_block  = {                     \
-                .fn = do_no_restart_syscall,    \
-        },                                      \
 }
 
 #define init_thread_info        (init_thread_union.thread_info)
diff --git a/arch/nios2/include/asm/ucontext.h b/arch/nios2/include/asm/ucontext.h
deleted file mode 100644
index 2c87614b0f6e..000000000000
--- a/arch/nios2/include/asm/ucontext.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) 2010 Tobias Klauser <tklauser@distanz.ch>
- * Copyright (C) 2004 Microtronix Datacom Ltd
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#ifndef _ASM_NIOS2_UCONTEXT_H
-#define _ASM_NIOS2_UCONTEXT_H
-
-typedef int greg_t;
-#define NGREG 32
-typedef greg_t gregset_t[NGREG];
-
-struct mcontext {
-        int version;
-        gregset_t gregs;
-};
-
-#define MCONTEXT_VERSION 2
-
-struct ucontext {
-        unsigned long     uc_flags;
-        struct ucontext  *uc_link;
-        stack_t           uc_stack;
-        struct mcontext   uc_mcontext;
-        sigset_t          uc_sigmask;   /* mask last for extensibility */
-};
-
-#endif
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index 4f07ca3f8d10..e0bb972a50d7 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -1,4 +1,5 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 header-y += elf.h
-header-y += ucontext.h
+
+generic-y += ucontext.h
diff --git a/arch/nios2/include/uapi/asm/elf.h b/arch/nios2/include/uapi/asm/elf.h
index a5b91ae5cf56..6f06d3b2949e 100644
--- a/arch/nios2/include/uapi/asm/elf.h
+++ b/arch/nios2/include/uapi/asm/elf.h
@@ -50,9 +50,7 @@
 
 typedef unsigned long elf_greg_t;
 
-#define ELF_NGREG       \
-        ((sizeof(struct pt_regs) + sizeof(struct switch_stack)) /       \
-                sizeof(elf_greg_t))
+#define ELF_NGREG               49
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 
 typedef unsigned long elf_fpregset_t;
diff --git a/arch/nios2/include/uapi/asm/ptrace.h b/arch/nios2/include/uapi/asm/ptrace.h
index e83a7c9d1c36..eff00e67c0a2 100644
--- a/arch/nios2/include/uapi/asm/ptrace.h
+++ b/arch/nios2/include/uapi/asm/ptrace.h
@@ -60,60 +60,21 @@
 #define PTR_IPENDING    37
 #define PTR_CPUID       38
 #define PTR_CTL6        39
-#define PTR_CTL7        40
+#define PTR_EXCEPTION   40
 #define PTR_PTEADDR     41
 #define PTR_TLBACC      42
 #define PTR_TLBMISC     43
+#define PTR_ECCINJ      44
+#define PTR_BADADDR     45
+#define PTR_CONFIG      46
+#define PTR_MPUBASE     47
+#define PTR_MPUACC      48
 
-#define NUM_PTRACE_REG (PTR_TLBMISC + 1)
+#define NUM_PTRACE_REG (PTR_MPUACC + 1)
 
-/* this struct defines the way the registers are stored on the
-   stack during a system call.
-
-   There is a fake_regs in setup.c that has to match pt_regs.*/
-
-struct pt_regs {
-        unsigned long  r8;              /* r8-r15 Caller-saved GP registers */
-        unsigned long  r9;
-        unsigned long  r10;
-        unsigned long  r11;
-        unsigned long  r12;
-        unsigned long  r13;
-        unsigned long  r14;
-        unsigned long  r15;
-        unsigned long  r1;              /* Assembler temporary */
-        unsigned long  r2;              /* Retval LS 32bits */
-        unsigned long  r3;              /* Retval MS 32bits */
-        unsigned long  r4;              /* r4-r7 Register arguments */
-        unsigned long  r5;
-        unsigned long  r6;
-        unsigned long  r7;
-        unsigned long  orig_r2;         /* Copy of r2 ?? */
-        unsigned long  ra;              /* Return address */
-        unsigned long  fp;              /* Frame pointer */
-        unsigned long  sp;              /* Stack pointer */
-        unsigned long  gp;              /* Global pointer */
-        unsigned long  estatus;
-        unsigned long  ea;              /* Exception return address (pc) */
-        unsigned long  orig_r7;
-};
-
-/*
- * This is the extended stack used by signal handlers and the context
- * switcher: it's pushed after the normal "struct pt_regs".
- */
-struct switch_stack {
-        unsigned long  r16;             /* r16-r23 Callee-saved GP registers */
-        unsigned long  r17;
-        unsigned long  r18;
-        unsigned long  r19;
-        unsigned long  r20;
-        unsigned long  r21;
-        unsigned long  r22;
-        unsigned long  r23;
-        unsigned long  fp;
-        unsigned long  gp;
-        unsigned long  ra;
+/* User structures for general purpose registers.  */
+struct user_pt_regs {
+        __u32           regs[49];
 };
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/nios2/include/uapi/asm/sigcontext.h b/arch/nios2/include/uapi/asm/sigcontext.h
index 7b8bb41867d4..b67944a50927 100644
--- a/arch/nios2/include/uapi/asm/sigcontext.h
+++ b/arch/nios2/include/uapi/asm/sigcontext.h
@@ -15,14 +15,16 @@
  * details.
  */
 
-#ifndef _ASM_NIOS2_SIGCONTEXT_H
-#define _ASM_NIOS2_SIGCONTEXT_H
+#ifndef _UAPI__ASM_SIGCONTEXT_H
+#define _UAPI__ASM_SIGCONTEXT_H
 
-#include <asm/ptrace.h>
+#include <linux/types.h>
+
+#define MCONTEXT_VERSION 2
 
 struct sigcontext {
-        struct pt_regs regs;
-        unsigned long  sc_mask; /* old sigmask */
+        int version;
+        unsigned long gregs[32];
 };
 
 #endif
diff --git a/arch/nios2/kernel/entry.S b/arch/nios2/kernel/entry.S
index 7729bd3f2e79..27b006c52e12 100644
--- a/arch/nios2/kernel/entry.S
+++ b/arch/nios2/kernel/entry.S
@@ -161,7 +161,7 @@ ENTRY(inthandler)
  ***********************************************************************
  */
 ENTRY(handle_trap)
-        ldw     r24, -4(ea)     /* instruction that caused the exception */
+        ldwio   r24, -4(ea)     /* instruction that caused the exception */
         srli    r24, r24, 4
         andi    r24, r24, 0x7c
         movia   r9,trap_table
diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c
index 2d0ea25be171..20662b0f6c9e 100644
--- a/arch/nios2/kernel/signal.c
+++ b/arch/nios2/kernel/signal.c
@@ -39,11 +39,11 @@ static inline int rt_restore_ucontext(struct pt_regs *regs,
                                         struct ucontext *uc, int *pr2)
 {
         int temp;
-        greg_t *gregs = uc->uc_mcontext.gregs;
+        unsigned long *gregs = uc->uc_mcontext.gregs;
         int err;
 
         /* Always make any pending restarted system calls return -EINTR */
-        current_thread_info()->restart_block.fn = do_no_restart_syscall;
+        current->restart_block.fn = do_no_restart_syscall;
 
         err = __get_user(temp, &uc->uc_mcontext.version);
         if (temp != MCONTEXT_VERSION)
@@ -127,7 +127,7 @@ badframe:
 static inline int rt_setup_ucontext(struct ucontext *uc, struct pt_regs *regs)
 {
         struct switch_stack *sw = (struct switch_stack *)regs - 1;
-        greg_t *gregs = uc->uc_mcontext.gregs;
+        unsigned long *gregs = uc->uc_mcontext.gregs;
         int err = 0;
 
         err |= __put_user(MCONTEXT_VERSION, &uc->uc_mcontext.version);
diff --git a/arch/nios2/mm/cacheflush.c b/arch/nios2/mm/cacheflush.c
index 2ae482b42669..796642932e2e 100644
--- a/arch/nios2/mm/cacheflush.c
+++ b/arch/nios2/mm/cacheflush.c
@@ -23,9 +23,6 @@ static void __flush_dcache(unsigned long start, unsigned long end)
         end += (cpuinfo.dcache_line_size - 1);
         end &= ~(cpuinfo.dcache_line_size - 1);
 
-        if (end > start + cpuinfo.dcache_size)
-                end = start + cpuinfo.dcache_size;
-
         for (addr = start; addr < end; addr += cpuinfo.dcache_line_size) {
                 __asm__ __volatile__ ("   flushda 0(%0)\n"
                                         : /* Outputs */
diff --git a/arch/nios2/mm/fault.c b/arch/nios2/mm/fault.c
index 0d231adfe576..0c9b6afe69e9 100644
--- a/arch/nios2/mm/fault.c
+++ b/arch/nios2/mm/fault.c
@@ -126,7 +126,6 @@ good_area:
                 break;
         }
 
-survive:
         /*
          * If for any reason at all we couldn't handle the fault,
          * make sure we exit gracefully rather than endlessly redo
@@ -220,11 +219,6 @@ no_context:
  */
 out_of_memory:
         up_read(&mm->mmap_sem);
-        if (is_global_init(tsk)) {
-                yield();
-                down_read(&mm->mmap_sem);
-                goto survive;
-        }
         if (!user_mode(regs))
                 goto no_context;
         pagefault_out_of_memory();
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
index f213f5b4c423..d17437238a2c 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -26,7 +26,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 
         if (likely(pgd != NULL)) {
                 memset(pgd, 0, PAGE_SIZE<<PGD_ALLOC_ORDER);
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
                 actual_pgd += PTRS_PER_PGD;
                 /* Populate first pmd with allocated memory.  We mark it
                  * with PxD_FLAG_ATTACHED as a signal to the system that this
@@ -45,7 +45,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         pgd -= PTRS_PER_PGD;
 #endif
         free_pages((unsigned long)pgd, PGD_ALLOC_ORDER);
@@ -72,12 +72,15 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
 
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
-#ifdef CONFIG_64BIT
         if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
-                /* This is the permanent pmd attached to the pgd;
-                 * cannot free it */
+                /*
+                 * This is the permanent pmd attached to the pgd;
+                 * cannot free it.
+                 * Increment the counter to compensate for the decrement
+                 * done by generic mm code.
+                 */
+                mm_inc_nr_pmds(mm);
                 return;
-#endif
         free_pages((unsigned long)pmd, PMD_ORDER);
 }
 
@@ -99,7 +102,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 static inline void
 pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd, pte_t *pte)
 {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         /* preserve the gateway marker if this is the beginning of
          * the permanent pmd */
         if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 5a8997d63899..8eefb12d1d33 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -55,8 +55,8 @@
 #define ENTRY_COMP(_name_) .word sys_##_name_
 #endif
 
-        ENTRY_SAME(restart_syscall)     /* 0 */
-        ENTRY_SAME(exit)
+90:     ENTRY_SAME(restart_syscall)     /* 0 */
+91:     ENTRY_SAME(exit)
         ENTRY_SAME(fork_wrapper)
         ENTRY_SAME(read)
         ENTRY_SAME(write)
@@ -439,7 +439,10 @@
         ENTRY_SAME(bpf)
         ENTRY_COMP(execveat)
 
-        /* Nothing yet */
+
+.ifne (. - 90b) - (__NR_Linux_syscalls * (91b - 90b))
+.error "size of syscall table does not fit value of __NR_Linux_syscalls"
+.endif
 
 #undef ENTRY_SAME
 #undef ENTRY_DIFF
diff --git a/arch/powerpc/include/asm/cputhreads.h b/arch/powerpc/include/asm/cputhreads.h
index 2bf8e9307be9..4c8ad592ae33 100644
--- a/arch/powerpc/include/asm/cputhreads.h
+++ b/arch/powerpc/include/asm/cputhreads.h
@@ -55,7 +55,7 @@ static inline cpumask_t cpu_thread_mask_to_cores(const struct cpumask *threads)
 
 static inline int cpu_nr_cores(void)
 {
-        return NR_CPUS >> threads_shift;
+        return nr_cpu_ids >> threads_shift;
 }
 
 static inline cpumask_t cpu_online_cores_map(void)
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index 03cd858a401c..4cbe23af400a 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -153,6 +153,7 @@
 #define PPC_INST_MFSPR_PVR_MASK         0xfc1fffff
 #define PPC_INST_MFTMR                  0x7c0002dc
 #define PPC_INST_MSGSND                 0x7c00019c
+#define PPC_INST_MSGCLR                 0x7c0001dc
 #define PPC_INST_MSGSNDP                0x7c00011c
 #define PPC_INST_MTTMR                  0x7c0003dc
 #define PPC_INST_NOP                    0x60000000
@@ -309,6 +310,8 @@
                                         ___PPC_RB(b) | __PPC_EH(eh))
 #define PPC_MSGSND(b)           stringify_in_c(.long PPC_INST_MSGSND | \
                                         ___PPC_RB(b))
+#define PPC_MSGCLR(b)           stringify_in_c(.long PPC_INST_MSGCLR | \
+                                        ___PPC_RB(b))
 #define PPC_MSGSNDP(b)          stringify_in_c(.long PPC_INST_MSGSNDP | \
                                         ___PPC_RB(b))
 #define PPC_POPCNTB(a, s)       stringify_in_c(.long PPC_INST_POPCNTB | \
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 1c874fb533bb..af56b5c6c81a 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -608,13 +608,16 @@
 #define   SRR1_ISI_N_OR_G       0x10000000 /* ISI: Access is no-exec or G */
 #define   SRR1_ISI_PROT         0x08000000 /* ISI: Other protection fault */
 #define   SRR1_WAKEMASK         0x00380000 /* reason for wakeup */
+#define   SRR1_WAKEMASK_P8      0x003c0000 /* reason for wakeup on POWER8 */
 #define   SRR1_WAKESYSERR       0x00300000 /* System error */
 #define   SRR1_WAKEEE           0x00200000 /* External interrupt */
 #define   SRR1_WAKEMT           0x00280000 /* mtctrl */
 #define   SRR1_WAKEHMI          0x00280000 /* Hypervisor maintenance */
 #define   SRR1_WAKEDEC          0x00180000 /* Decrementer interrupt */
+#define   SRR1_WAKEDBELL        0x00140000 /* Privileged doorbell on P8 */
 #define   SRR1_WAKETHERM        0x00100000 /* Thermal management interrupt */
 #define   SRR1_WAKERESET        0x00100000 /* System reset */
+#define   SRR1_WAKEHDBELL       0x000c0000 /* Hypervisor doorbell on P8 */
 #define   SRR1_WAKESTATE        0x00030000 /* Powersave exit mask [46:47] */
 #define   SRR1_WS_DEEPEST       0x00030000 /* Some resources not maintained,
                                           * may not be recoverable */
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index f337666768a7..f83046878336 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -437,6 +437,26 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .machine_check_early    = __machine_check_early_realmode_p8,
                 .platform               = "power8",
         },
+        {       /* Power8NVL */
+                .pvr_mask               = 0xffff0000,
+                .pvr_value              = 0x004c0000,
+                .cpu_name               = "POWER8NVL (raw)",
+                .cpu_features           = CPU_FTRS_POWER8,
+                .cpu_user_features      = COMMON_USER_POWER8,
+                .cpu_user_features2     = COMMON_USER2_POWER8,
+                .mmu_features           = MMU_FTRS_POWER8,
+                .icache_bsize           = 128,
+                .dcache_bsize           = 128,
+                .num_pmcs               = 6,
+                .pmc_type               = PPC_PMC_IBM,
+                .oprofile_cpu_type      = "ppc64/power8",
+                .oprofile_type          = PPC_OPROFILE_INVALID,
+                .cpu_setup              = __setup_cpu_power8,
+                .cpu_restore            = __restore_cpu_power8,
+                .flush_tlb              = __flush_tlb_power8,
+                .machine_check_early    = __machine_check_early_realmode_p8,
+                .platform               = "power8",
+        },
         {       /* Power8 DD1: Does not support doorbell IPIs */
                 .pvr_mask               = 0xffffff00,
                 .pvr_value              = 0x004d0100,
diff --git a/arch/powerpc/kernel/dbell.c b/arch/powerpc/kernel/dbell.c
index f4217819cc31..2128f3a96c32 100644
--- a/arch/powerpc/kernel/dbell.c
+++ b/arch/powerpc/kernel/dbell.c
@@ -17,6 +17,7 @@
 
 #include <asm/dbell.h>
 #include <asm/irq_regs.h>
+#include <asm/kvm_ppc.h>
 
 #ifdef CONFIG_SMP
 void doorbell_setup_this_cpu(void)
@@ -41,6 +42,7 @@ void doorbell_exception(struct pt_regs *regs)
 
         may_hard_irq_enable();
 
+        kvmppc_set_host_ipi(smp_processor_id(), 0);
         __this_cpu_inc(irq_stat.doorbell_irqs);
 
         smp_ipi_demux();
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index c2df8150bd7a..9519e6bdc6d7 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1408,7 +1408,7 @@ machine_check_handle_early:
         bne     9f                      /* continue in V mode if we are. */
 
 5:
-#ifdef CONFIG_KVM_BOOK3S_64_HV
+#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
         /*
          * We are coming from kernel context. Check if we are coming from
          * guest. if yes, then we can continue. We will fall through
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index de4018a1bc4b..de747563d29d 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -636,7 +636,7 @@ static int kvmppc_get_yield_count(struct kvm_vcpu *vcpu)
         spin_lock(&vcpu->arch.vpa_update_lock);
         lppaca = (struct lppaca *)vcpu->arch.vpa.pinned_addr;
         if (lppaca)
-                yield_count = lppaca->yield_count;
+                yield_count = be32_to_cpu(lppaca->yield_count);
         spin_unlock(&vcpu->arch.vpa_update_lock);
         return yield_count;
 }
@@ -942,20 +942,20 @@ static int kvm_arch_vcpu_ioctl_set_sregs_hv(struct kvm_vcpu *vcpu,
 static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
                 bool preserve_top32)
 {
+        struct kvm *kvm = vcpu->kvm;
         struct kvmppc_vcore *vc = vcpu->arch.vcore;
         u64 mask;
 
+        mutex_lock(&kvm->lock);
         spin_lock(&vc->lock);
         /*
          * If ILE (interrupt little-endian) has changed, update the
          * MSR_LE bit in the intr_msr for each vcpu in this vcore.
          */
         if ((new_lpcr & LPCR_ILE) != (vc->lpcr & LPCR_ILE)) {
-                struct kvm *kvm = vcpu->kvm;
                 struct kvm_vcpu *vcpu;
                 int i;
 
-                mutex_lock(&kvm->lock);
                 kvm_for_each_vcpu(i, vcpu, kvm) {
                         if (vcpu->arch.vcore != vc)
                                 continue;
@@ -964,7 +964,6 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
                         else
                                 vcpu->arch.intr_msr &= ~MSR_LE;
                 }
-                mutex_unlock(&kvm->lock);
         }
 
         /*
@@ -981,6 +980,7 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
                 mask &= 0xFFFFFFFF;
         vc->lpcr = (vc->lpcr & ~mask) | (new_lpcr & mask);
         spin_unlock(&vc->lock);
+        mutex_unlock(&kvm->lock);
 }
 
 static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index bb94e6f20c81..6cbf1630cb70 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1005,6 +1005,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
         /* Save HEIR (HV emulation assist reg) in emul_inst
            if this is an HEI (HV emulation interrupt, e40) */
         li      r3,KVM_INST_FETCH_FAILED
+        stw     r3,VCPU_LAST_INST(r9)
         cmpwi   r12,BOOK3S_INTERRUPT_H_EMUL_ASSIST
         bne     11f
         mfspr   r3,SPRN_HEIR
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index fc34025ef822..38a45088f633 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -33,6 +33,8 @@
 #include <asm/runlatch.h>
 #include <asm/code-patching.h>
 #include <asm/dbell.h>
+#include <asm/kvm_ppc.h>
+#include <asm/ppc-opcode.h>
 
 #include "powernv.h"
 
@@ -149,7 +151,7 @@ static int pnv_smp_cpu_disable(void)
 static void pnv_smp_cpu_kill_self(void)
 {
         unsigned int cpu;
-        unsigned long srr1;
+        unsigned long srr1, wmask;
         u32 idle_states;
 
         /* Standard hot unplug procedure */
@@ -161,6 +163,10 @@ static void pnv_smp_cpu_kill_self(void)
         generic_set_cpu_dead(cpu);
         smp_wmb();
 
+        wmask = SRR1_WAKEMASK;
+        if (cpu_has_feature(CPU_FTR_ARCH_207S))
+                wmask = SRR1_WAKEMASK_P8;
+
         idle_states = pnv_get_supported_cpuidle_states();
         /* We don't want to take decrementer interrupts while we are offline,
          * so clear LPCR:PECE1. We keep PECE2 enabled.
@@ -191,10 +197,14 @@ static void pnv_smp_cpu_kill_self(void)
                  * having finished executing in a KVM guest, then srr1
                  * contains 0.
                  */
-                if ((srr1 & SRR1_WAKEMASK) == SRR1_WAKEEE) {
+                if ((srr1 & wmask) == SRR1_WAKEEE) {
                         icp_native_flush_interrupt();
                         local_paca->irq_happened &= PACA_IRQ_HARD_DIS;
                         smp_mb();
+                } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
+                        unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
+                        asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
+                        kvmppc_set_host_ipi(cpu, 0);
                 }
 
                 if (cpu_core_split_required())
diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
index 90cf3dcbd9f2..8f35d525cede 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
@@ -25,10 +25,10 @@
 static struct kobject *mobility_kobj;
 
 struct update_props_workarea {
-        u32 phandle;
-        u32 state;
-        u64 reserved;
-        u32 nprops;
+        __be32 phandle;
+        __be32 state;
+        __be64 reserved;
+        __be32 nprops;
 } __packed;
 
 #define NODE_ACTION_MASK        0xff000000
@@ -54,11 +54,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
         return rc;
 }
 
-static int delete_dt_node(u32 phandle)
+static int delete_dt_node(__be32 phandle)
 {
         struct device_node *dn;
 
-        dn = of_find_node_by_phandle(phandle);
+        dn = of_find_node_by_phandle(be32_to_cpu(phandle));
         if (!dn)
                 return -ENOENT;
 
@@ -127,7 +127,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
         return 0;
 }
 
-static int update_dt_node(u32 phandle, s32 scope)
+static int update_dt_node(__be32 phandle, s32 scope)
 {
         struct update_props_workarea *upwa;
         struct device_node *dn;
@@ -136,6 +136,7 @@ static int update_dt_node(u32 phandle, s32 scope)
         char *prop_data;
         char *rtas_buf;
         int update_properties_token;
+        u32 nprops;
         u32 vd;
 
         update_properties_token = rtas_token("ibm,update-properties");
@@ -146,7 +147,7 @@ static int update_dt_node(u32 phandle, s32 scope)
         if (!rtas_buf)
                 return -ENOMEM;
 
-        dn = of_find_node_by_phandle(phandle);
+        dn = of_find_node_by_phandle(be32_to_cpu(phandle));
         if (!dn) {
                 kfree(rtas_buf);
                 return -ENOENT;
@@ -162,6 +163,7 @@ static int update_dt_node(u32 phandle, s32 scope)
                         break;
 
                 prop_data = rtas_buf + sizeof(*upwa);
+                nprops = be32_to_cpu(upwa->nprops);
 
                 /* On the first call to ibm,update-properties for a node the
                  * the first property value descriptor contains an empty
@@ -170,17 +172,17 @@ static int update_dt_node(u32 phandle, s32 scope)
                  */
                 if (*prop_data == 0) {
                         prop_data++;
-                        vd = *(u32 *)prop_data;
+                        vd = be32_to_cpu(*(__be32 *)prop_data);
                         prop_data += vd + sizeof(vd);
-                        upwa->nprops--;
+                        nprops--;
                 }
 
-                for (i = 0; i < upwa->nprops; i++) {
+                for (i = 0; i < nprops; i++) {
                         char *prop_name;
 
                         prop_name = prop_data;
                         prop_data += strlen(prop_name) + 1;
-                        vd = *(u32 *)prop_data;
+                        vd = be32_to_cpu(*(__be32 *)prop_data);
                         prop_data += sizeof(vd);
 
                         switch (vd) {
@@ -212,13 +214,13 @@ static int update_dt_node(u32 phandle, s32 scope)
         return 0;
 }
 
-static int add_dt_node(u32 parent_phandle, u32 drc_index)
+static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
 {
         struct device_node *dn;
         struct device_node *parent_dn;
         int rc;
 
-        parent_dn = of_find_node_by_phandle(parent_phandle);
+        parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
         if (!parent_dn)
                 return -ENOENT;
 
@@ -237,7 +239,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
 int pseries_devicetree_update(s32 scope)
 {
         char *rtas_buf;
-        u32 *data;
+        __be32 *data;
         int update_nodes_token;
         int rc;
 
@@ -254,17 +256,17 @@ int pseries_devicetree_update(s32 scope)
                 if (rc && rc != 1)
                         break;
 
-                data = (u32 *)rtas_buf + 4;
-                while (*data & NODE_ACTION_MASK) {
+                data = (__be32 *)rtas_buf + 4;
+                while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
                         int i;
-                        u32 action = *data & NODE_ACTION_MASK;
-                        int node_count = *data & NODE_COUNT_MASK;
+                        u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
+                        u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
 
                         data++;
 
                         for (i = 0; i < node_count; i++) {
-                                u32 phandle = *data++;
-                                u32 drc_index;
+                                __be32 phandle = *data++;
+                                __be32 drc_index;
 
                                 switch (action) {
                                 case DELETE_DT_NODE:
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index c9df40b5c0ac..c9c875d9ed31 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -211,7 +211,7 @@ do {								\
 
 extern unsigned long mmap_rnd_mask;
 
-#define STACK_RND_MASK  (mmap_rnd_mask)
+#define STACK_RND_MASK  (test_thread_flag(TIF_31BIT) ? 0x7ff : mmap_rnd_mask)
 
 #define ARCH_DLINFO                                                         \
 do {                                                                        \
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index 82c19899574f..6c79f1b44fe7 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -57,6 +57,44 @@
 
 unsigned long ftrace_plt;
 
+static inline void ftrace_generate_orig_insn(struct ftrace_insn *insn)
+{
+#ifdef CC_USING_HOTPATCH
+        /* brcl 0,0 */
+        insn->opc = 0xc004;
+        insn->disp = 0;
+#else
+        /* stg r14,8(r15) */
+        insn->opc = 0xe3e0;
+        insn->disp = 0xf0080024;
+#endif
+}
+
+static inline int is_kprobe_on_ftrace(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_KPROBES
+        if (insn->opc == BREAKPOINT_INSTRUCTION)
+                return 1;
+#endif
+        return 0;
+}
+
+static inline void ftrace_generate_kprobe_nop_insn(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_KPROBES
+        insn->opc = BREAKPOINT_INSTRUCTION;
+        insn->disp = KPROBE_ON_FTRACE_NOP;
+#endif
+}
+
+static inline void ftrace_generate_kprobe_call_insn(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_KPROBES
+        insn->opc = BREAKPOINT_INSTRUCTION;
+        insn->disp = KPROBE_ON_FTRACE_CALL;
+#endif
+}
+
 int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
                        unsigned long addr)
 {
@@ -72,16 +110,9 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
                 return -EFAULT;
         if (addr == MCOUNT_ADDR) {
                 /* Initial code replacement */
-#ifdef CC_USING_HOTPATCH
-                /* We expect to see brcl 0,0 */
-                ftrace_generate_nop_insn(&orig);
-#else
-                /* We expect to see stg r14,8(r15) */
-                orig.opc = 0xe3e0;
-                orig.disp = 0xf0080024;
-#endif
+                ftrace_generate_orig_insn(&orig);
                 ftrace_generate_nop_insn(&new);
-        } else if (old.opc == BREAKPOINT_INSTRUCTION) {
+        } else if (is_kprobe_on_ftrace(&old)) {
                 /*
                  * If we find a breakpoint instruction, a kprobe has been
                  * placed at the beginning of the function. We write the
@@ -89,9 +120,8 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
                  * bytes of the original instruction so that the kprobes
                  * handler can execute a nop, if it reaches this breakpoint.
                  */
-                new.opc = orig.opc = BREAKPOINT_INSTRUCTION;
-                orig.disp = KPROBE_ON_FTRACE_CALL;
-                new.disp = KPROBE_ON_FTRACE_NOP;
+                ftrace_generate_kprobe_call_insn(&orig);
+                ftrace_generate_kprobe_nop_insn(&new);
         } else {
                 /* Replace ftrace call with a nop. */
                 ftrace_generate_call_insn(&orig, rec->ip);
@@ -111,7 +141,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 
         if (probe_kernel_read(&old, (void *) rec->ip, sizeof(old)))
                 return -EFAULT;
-        if (old.opc == BREAKPOINT_INSTRUCTION) {
+        if (is_kprobe_on_ftrace(&old)) {
                 /*
                  * If we find a breakpoint instruction, a kprobe has been
                  * placed at the beginning of the function. We write the
@@ -119,9 +149,8 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
                  * bytes of the original instruction so that the kprobes
                  * handler can execute a brasl if it reaches this breakpoint.
                  */
-                new.opc = orig.opc = BREAKPOINT_INSTRUCTION;
-                orig.disp = KPROBE_ON_FTRACE_NOP;
-                new.disp = KPROBE_ON_FTRACE_CALL;
+                ftrace_generate_kprobe_nop_insn(&orig);
+                ftrace_generate_kprobe_call_insn(&new);
         } else {
                 /* Replace nop with an ftrace call. */
                 ftrace_generate_nop_insn(&orig);
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index c3f8d157cb0d..e6a1578fc000 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -1415,7 +1415,7 @@ CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC_DIAG, PERF_EVENT_CPUM_SF_DIAG);
 
 static struct attribute *cpumsf_pmu_events_attr[] = {
         CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC),
-        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC_DIAG),
+        NULL,
         NULL,
 };
 
@@ -1606,8 +1606,11 @@ static int __init init_cpum_sampling_pmu(void)
                 return -EINVAL;
         }
 
-        if (si.ad)
+        if (si.ad) {
                 sfb_set_limits(CPUM_SF_MIN_SDB, CPUM_SF_MAX_SDB);
+                cpumsf_pmu_events_attr[1] =
+                        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC_DIAG);
+        }
 
         sfdbg = debug_register(KMSG_COMPONENT, 2, 1, 80);
         if (!sfdbg)
diff --git a/arch/s390/kernel/swsusp_asm64.S b/arch/s390/kernel/swsusp_asm64.S
index 6b09fdffbd2f..ca6294645dd3 100644
--- a/arch/s390/kernel/swsusp_asm64.S
+++ b/arch/s390/kernel/swsusp_asm64.S
@@ -177,6 +177,17 @@ restart_entry:
         lhi     %r1,1
         sigp    %r1,%r0,SIGP_SET_ARCHITECTURE
         sam64
+#ifdef CONFIG_SMP
+        larl    %r1,smp_cpu_mt_shift
+        icm     %r1,15,0(%r1)
+        jz      smt_done
+        llgfr   %r1,%r1
+smt_loop:
+        sigp    %r1,%r0,SIGP_SET_MULTI_THREADING
+        brc     8,smt_done                      /* accepted */
+        brc     2,smt_loop                      /* busy, try again */
+smt_done:
+#endif
         larl    %r1,.Lnew_pgm_check_psw
         lpswe   0(%r1)
 pgm_check_entry:
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 3040b14751b8..afa2bd750ffc 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -173,7 +173,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_ONE_REG:
         case KVM_CAP_ENABLE_CAP:
         case KVM_CAP_S390_CSS_SUPPORT:
-        case KVM_CAP_IRQFD:
         case KVM_CAP_IOEVENTFD:
         case KVM_CAP_DEVICE_CTRL:
         case KVM_CAP_ENABLE_CAP_VM:
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 96ac69c5eba0..efb00ec75805 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -86,6 +86,9 @@ config ARCH_DEFCONFIG
         default "arch/sparc/configs/sparc32_defconfig" if SPARC32
         default "arch/sparc/configs/sparc64_defconfig" if SPARC64
 
+config ARCH_PROC_KCORE_TEXT
+        def_bool y
+
 config IOMMU_HELPER
         bool
         default y if SPARC64
diff --git a/arch/sparc/include/asm/hypervisor.h b/arch/sparc/include/asm/hypervisor.h
index 4f6725ff4c33..f5b6537306f0 100644
--- a/arch/sparc/include/asm/hypervisor.h
+++ b/arch/sparc/include/asm/hypervisor.h
@@ -2957,6 +2957,17 @@ unsigned long sun4v_t5_set_perfreg(unsigned long reg_num,
                                    unsigned long reg_val);
 #endif
 
+
+#define HV_FAST_M7_GET_PERFREG  0x43
+#define HV_FAST_M7_SET_PERFREG  0x44
+
+#ifndef __ASSEMBLY__
+unsigned long sun4v_m7_get_perfreg(unsigned long reg_num,
+                                      unsigned long *reg_val);
+unsigned long sun4v_m7_set_perfreg(unsigned long reg_num,
+                                      unsigned long reg_val);
+#endif
+
 /* Function numbers for HV_CORE_TRAP.  */
 #define HV_CORE_SET_VER                 0x00
 #define HV_CORE_PUTCHAR                 0x01
@@ -2981,6 +2992,7 @@ unsigned long sun4v_t5_set_perfreg(unsigned long reg_num,
 #define HV_GRP_SDIO                     0x0108
 #define HV_GRP_SDIO_ERR                 0x0109
 #define HV_GRP_REBOOT_DATA              0x0110
+#define HV_GRP_M7_PERF                  0x0114
 #define HV_GRP_NIAG_PERF                0x0200
 #define HV_GRP_FIRE_PERF                0x0201
 #define HV_GRP_N2_CPU                   0x0202
diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
index 9b672be70dda..50d4840d9aeb 100644
--- a/arch/sparc/include/asm/io_64.h
+++ b/arch/sparc/include/asm/io_64.h
@@ -407,16 +407,16 @@ static inline void iounmap(volatile void __iomem *addr)
 {
 }
 
-#define ioread8(X)                      readb(X)
-#define ioread16(X)                     readw(X)
-#define ioread16be(X)                   __raw_readw(X)
-#define ioread32(X)                     readl(X)
-#define ioread32be(X)                   __raw_readl(X)
-#define iowrite8(val,X)                 writeb(val,X)
-#define iowrite16(val,X)                writew(val,X)
-#define iowrite16be(val,X)              __raw_writew(val,X)
-#define iowrite32(val,X)                writel(val,X)
-#define iowrite32be(val,X)              __raw_writel(val,X)
+#define ioread8                 readb
+#define ioread16                readw
+#define ioread16be              __raw_readw
+#define ioread32                readl
+#define ioread32be              __raw_readl
+#define iowrite8                writeb
+#define iowrite16               writew
+#define iowrite16be             __raw_writew
+#define iowrite32               writel
+#define iowrite32be             __raw_writel
 
 /* Create a virtual mapping cookie for an IO port range */
 void __iomem *ioport_map(unsigned long port, unsigned int nr);
diff --git a/arch/sparc/include/asm/starfire.h b/arch/sparc/include/asm/starfire.h
index c100dc27a0a9..176fa0ad19f1 100644
--- a/arch/sparc/include/asm/starfire.h
+++ b/arch/sparc/include/asm/starfire.h
@@ -12,7 +12,6 @@
 extern int this_is_starfire;
 
 void check_if_starfire(void);
-int starfire_hard_smp_processor_id(void);
 void starfire_hookup(int);
 unsigned int starfire_translate(unsigned long imap, unsigned int upaid);
 
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index 88d322b67fac..07cc49e541f4 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -98,11 +98,7 @@ void sun4v_do_mna(struct pt_regs *regs,
 void do_privop(struct pt_regs *regs);
 void do_privact(struct pt_regs *regs);
 void do_cee(struct pt_regs *regs);
-void do_cee_tl1(struct pt_regs *regs);
-void do_dae_tl1(struct pt_regs *regs);
-void do_iae_tl1(struct pt_regs *regs);
 void do_div0_tl1(struct pt_regs *regs);
-void do_fpdis_tl1(struct pt_regs *regs);
 void do_fpieee_tl1(struct pt_regs *regs);
 void do_fpother_tl1(struct pt_regs *regs);
 void do_ill_tl1(struct pt_regs *regs);
diff --git a/arch/sparc/kernel/hvapi.c b/arch/sparc/kernel/hvapi.c
index 5c55145bfbf0..662500fa555f 100644
--- a/arch/sparc/kernel/hvapi.c
+++ b/arch/sparc/kernel/hvapi.c
@@ -48,6 +48,7 @@ static struct api_info api_table[] = {
         { .group = HV_GRP_VT_CPU,                               },
         { .group = HV_GRP_T5_CPU,                               },
         { .group = HV_GRP_DIAG,         .flags = FLAG_PRE_API   },
+        { .group = HV_GRP_M7_PERF,                              },
 };
 
 static DEFINE_SPINLOCK(hvapi_lock);
diff --git a/arch/sparc/kernel/hvcalls.S b/arch/sparc/kernel/hvcalls.S
index caedf8320416..afbaba52d2f1 100644
--- a/arch/sparc/kernel/hvcalls.S
+++ b/arch/sparc/kernel/hvcalls.S
@@ -837,3 +837,19 @@ ENTRY(sun4v_t5_set_perfreg)
         retl
          nop
 ENDPROC(sun4v_t5_set_perfreg)
+
+ENTRY(sun4v_m7_get_perfreg)
+        mov     %o1, %o4
+        mov     HV_FAST_M7_GET_PERFREG, %o5
+        ta      HV_FAST_TRAP
+        stx     %o1, [%o4]
+        retl
+        nop
+ENDPROC(sun4v_m7_get_perfreg)
+
+ENTRY(sun4v_m7_set_perfreg)
+        mov     HV_FAST_M7_SET_PERFREG, %o5
+        ta      HV_FAST_TRAP
+        retl
+        nop
+ENDPROC(sun4v_m7_set_perfreg)
diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
index 9ce5afe167ff..b36365f49478 100644
--- a/arch/sparc/kernel/pci.c
+++ b/arch/sparc/kernel/pci.c
@@ -639,10 +639,7 @@ static void pci_claim_bus_resources(struct pci_bus *bus)
                                        (unsigned long long)r->end,
                                        (unsigned int)r->flags);
 
-                        if (pci_claim_resource(dev, i) == 0)
-                                continue;
-
-                        pci_claim_bridge_resource(dev, i);
+                        pci_claim_resource(dev, i);
                 }
         }
 
diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
index 7e967c8018c8..eb978c77c76a 100644
--- a/arch/sparc/kernel/pcr.c
+++ b/arch/sparc/kernel/pcr.c
@@ -217,6 +217,31 @@ static const struct pcr_ops n5_pcr_ops = {
         .pcr_nmi_disable        = PCR_N4_PICNPT,
 };
 
+static u64 m7_pcr_read(unsigned long reg_num)
+{
+        unsigned long val;
+
+        (void) sun4v_m7_get_perfreg(reg_num, &val);
+
+        return val;
+}
+
+static void m7_pcr_write(unsigned long reg_num, u64 val)
+{
+        (void) sun4v_m7_set_perfreg(reg_num, val);
+}
+
+static const struct pcr_ops m7_pcr_ops = {
+        .read_pcr               = m7_pcr_read,
+        .write_pcr              = m7_pcr_write,
+        .read_pic               = n4_pic_read,
+        .write_pic              = n4_pic_write,
+        .nmi_picl_value         = n4_picl_value,
+        .pcr_nmi_enable         = (PCR_N4_PICNPT | PCR_N4_STRACE |
+                                   PCR_N4_UTRACE | PCR_N4_TOE |
+                                   (26 << PCR_N4_SL_SHIFT)),
+        .pcr_nmi_disable        = PCR_N4_PICNPT,
+};
 
 static unsigned long perf_hsvc_group;
 static unsigned long perf_hsvc_major;
@@ -248,6 +273,10 @@ static int __init register_perf_hsvc(void)
                         perf_hsvc_group = HV_GRP_T5_CPU;
                         break;
 
+                case SUN4V_CHIP_SPARC_M7:
+                        perf_hsvc_group = HV_GRP_M7_PERF;
+                        break;
+
                 default:
                         return -ENODEV;
                 }
@@ -293,6 +322,10 @@ static int __init setup_sun4v_pcr_ops(void)
                 pcr_ops = &n5_pcr_ops;
                 break;
 
+        case SUN4V_CHIP_SPARC_M7:
+                pcr_ops = &m7_pcr_ops;
+                break;
+
         default:
                 ret = -ENODEV;
                 break;
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index 46a5e4508752..86eebfa3b158 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -792,6 +792,42 @@ static const struct sparc_pmu niagara4_pmu = {
         .num_pic_regs   = 4,
 };
 
+static void sparc_m7_write_pmc(int idx, u64 val)
+{
+        u64 pcr;
+
+        pcr = pcr_ops->read_pcr(idx);
+        /* ensure ov and ntc are reset */
+        pcr &= ~(PCR_N4_OV | PCR_N4_NTC);
+
+        pcr_ops->write_pic(idx, val & 0xffffffff);
+
+        pcr_ops->write_pcr(idx, pcr);
+}
+
+static const struct sparc_pmu sparc_m7_pmu = {
+        .event_map      = niagara4_event_map,
+        .cache_map      = &niagara4_cache_map,
+        .max_events     = ARRAY_SIZE(niagara4_perfmon_event_map),
+        .read_pmc       = sparc_vt_read_pmc,
+        .write_pmc      = sparc_m7_write_pmc,
+        .upper_shift    = 5,
+        .lower_shift    = 5,
+        .event_mask     = 0x7ff,
+        .user_bit       = PCR_N4_UTRACE,
+        .priv_bit       = PCR_N4_STRACE,
+
+        /* We explicitly don't support hypervisor tracing. */
+        .hv_bit         = 0,
+
+        .irq_bit        = PCR_N4_TOE,
+        .upper_nop      = 0,
+        .lower_nop      = 0,
+        .flags          = 0,
+        .max_hw_events  = 4,
+        .num_pcrs       = 4,
+        .num_pic_regs   = 4,
+};
 static const struct sparc_pmu *sparc_pmu __read_mostly;
 
 static u64 event_encoding(u64 event_id, int idx)
@@ -960,6 +996,8 @@ out:
         cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
 }
 
+static void sparc_pmu_start(struct perf_event *event, int flags);
+
 /* On this PMU each PIC has it's own PCR control register.  */
 static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
 {
@@ -972,20 +1010,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
                 struct perf_event *cp = cpuc->event[i];
                 struct hw_perf_event *hwc = &cp->hw;
                 int idx = hwc->idx;
-                u64 enc;
 
                 if (cpuc->current_idx[i] != PIC_NO_INDEX)
                         continue;
 
-                sparc_perf_event_set_period(cp, hwc, idx);
                 cpuc->current_idx[i] = idx;
 
-                enc = perf_event_get_enc(cpuc->events[i]);
-                cpuc->pcr[idx] &= ~mask_for_index(idx);
-                if (hwc->state & PERF_HES_STOPPED)
-                        cpuc->pcr[idx] |= nop_for_index(idx);
-                else
-                        cpuc->pcr[idx] |= event_encoding(enc, idx);
+                sparc_pmu_start(cp, PERF_EF_RELOAD);
         }
 out:
         for (i = 0; i < cpuc->n_events; i++) {
@@ -1101,7 +1132,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
         int i;
 
         local_irq_save(flags);
-        perf_pmu_disable(event->pmu);
 
         for (i = 0; i < cpuc->n_events; i++) {
                 if (event == cpuc->event[i]) {
@@ -1127,7 +1157,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
                 }
         }
 
-        perf_pmu_enable(event->pmu);
         local_irq_restore(flags);
 }
 
@@ -1361,7 +1390,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags)
         unsigned long flags;
 
         local_irq_save(flags);
-        perf_pmu_disable(event->pmu);
 
         n0 = cpuc->n_events;
         if (n0 >= sparc_pmu->max_hw_events)
@@ -1394,7 +1422,6 @@ nocheck:
 
         ret = 0;
 out:
-        perf_pmu_enable(event->pmu);
         local_irq_restore(flags);
         return ret;
 }
@@ -1667,6 +1694,10 @@ static bool __init supported_pmu(void)
                 sparc_pmu = &niagara4_pmu;
                 return true;
         }
+        if (!strcmp(sparc_pmu_type, "sparc-m7")) {
+                sparc_pmu = &sparc_m7_pmu;
+                return true;
+        }
         return false;
 }
 
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 0be7bf978cb1..46a59643bb1c 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -287,6 +287,8 @@ void arch_trigger_all_cpu_backtrace(bool include_self)
                         printk("             TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
                                gp->tpc, gp->o7, gp->i7, gp->rpc);
                 }
+
+                touch_nmi_watchdog();
         }
 
         memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
@@ -362,6 +364,8 @@ static void pmu_snapshot_all_cpus(void)
                        (cpu == this_cpu ? '*' : ' '), cpu,
                        pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
                        pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
+
+                touch_nmi_watchdog();
         }
 
         memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index da6f1a7fc4db..61139d9924ca 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1406,11 +1406,32 @@ void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs)
         scheduler_ipi();
 }
 
-/* This is a nop because we capture all other cpus
- * anyways when making the PROM active.
- */
+static void stop_this_cpu(void *dummy)
+{
+        prom_stopself();
+}
+
 void smp_send_stop(void)
 {
+        int cpu;
+
+        if (tlb_type == hypervisor) {
+                for_each_online_cpu(cpu) {
+                        if (cpu == smp_processor_id())
+                                continue;
+#ifdef CONFIG_SUN_LDOMS
+                        if (ldom_domaining_enabled) {
+                                unsigned long hv_err;
+                                hv_err = sun4v_cpu_stop(cpu);
+                                if (hv_err)
+                                        printk(KERN_ERR "sun4v_cpu_stop() "
+                                               "failed err=%lu\n", hv_err);
+                        } else
+#endif
+                                prom_stopcpu_cpuid(cpu);
+                }
+        } else
+                smp_call_function(stop_this_cpu, NULL, 0);
 }
 
 /**
diff --git a/arch/sparc/kernel/starfire.c b/arch/sparc/kernel/starfire.c
index 82281a566bb8..167fdfd9c837 100644
--- a/arch/sparc/kernel/starfire.c
+++ b/arch/sparc/kernel/starfire.c
@@ -28,11 +28,6 @@ void check_if_starfire(void)
                 this_is_starfire = 1;
 }
 
-int starfire_hard_smp_processor_id(void)
-{
-        return upa_readl(0x1fff40000d0UL);
-}
-
 /*
  * Each Starfire board has 32 registers which perform translation
  * and delivery of traditional interrupt packets into the extended
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index c85403d0496c..30e7ddb27a3a 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
         long err;
 
         /* No need for backward compatibility. We can start fresh... */
-        if (call <= SEMCTL) {
+        if (call <= SEMTIMEDOP) {
                 switch (call) {
                 case SEMOP:
                         err = sys_semtimedop(first, ptr,
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index a27651e866e7..0e699745d643 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2427,6 +2427,8 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
                 }
                 user_instruction_dump ((unsigned int __user *) regs->tpc);
         }
+        if (panic_on_oops)
+                panic("Fatal exception");
         if (regs->tstate & TSTATE_PRIV)
                 do_exit(SIGKILL);
         do_exit(SIGSEGV);
@@ -2564,27 +2566,6 @@ void do_cee(struct pt_regs *regs)
         die_if_kernel("TL0: Cache Error Exception", regs);
 }
 
-void do_cee_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Cache Error Exception", regs);
-}
-
-void do_dae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Data Access Exception", regs);
-}
-
-void do_iae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Instruction Access Exception", regs);
-}
-
 void do_div0_tl1(struct pt_regs *regs)
 {
         exception_enter();
@@ -2592,13 +2573,6 @@ void do_div0_tl1(struct pt_regs *regs)
         die_if_kernel("TL1: DIV0 Exception", regs);
 }
 
-void do_fpdis_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: FPU Disabled", regs);
-}
-
 void do_fpieee_tl1(struct pt_regs *regs)
 {
         exception_enter();
diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S
index b7f6334e159f..857ad4f8905f 100644
--- a/arch/sparc/lib/memmove.S
+++ b/arch/sparc/lib/memmove.S
@@ -8,9 +8,11 @@
 
         .text
 ENTRY(memmove) /* o0=dst o1=src o2=len */
-        mov             %o0, %g1
+        brz,pn          %o2, 99f
+         mov            %o0, %g1
+
         cmp             %o0, %o1
-        bleu,pt         %xcc, memcpy
+        bleu,pt         %xcc, 2f
          add            %o1, %o2, %g7
         cmp             %g7, %o0
         bleu,pt         %xcc, memcpy
@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */
         stb             %g7, [%o0]
         bne,pt          %icc, 1b
          sub            %o0, 1, %o0
-
+99:
         retl
          mov            %g1, %o0
+
+        /* We can't just call memcpy for these memmove cases.  On some
+         * chips the memcpy uses cache initializing stores and when dst
+         * and src are close enough, those can clobber the source data
+         * before we've loaded it in.
+         */
+2:      or              %o0, %o1, %g7
+        or              %o2, %g7, %g7
+        andcc           %g7, 0x7, %g0
+        bne,pn          %xcc, 4f
+         nop
+
+3:      ldx             [%o1], %g7
+        add             %o1, 8, %o1
+        subcc           %o2, 8, %o2
+        add             %o0, 8, %o0
+        bne,pt          %icc, 3b
+         stx            %g7, [%o0 - 0x8]
+        ba,a,pt         %xcc, 99b
+
+4:      ldub            [%o1], %g7
+        add             %o1, 1, %o1
+        subcc           %o2, 1, %o2
+        add             %o0, 1, %o0
+        bne,pt          %icc, 4b
+         stb            %g7, [%o0 - 0x1]
+        ba,a,pt         %xcc, 99b
 ENDPROC(memmove)
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 3ea267c53320..4ca0d6ba5ec8 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2820,7 +2820,7 @@ static int __init report_memory(void)
 
         return 0;
 }
-device_initcall(report_memory);
+arch_initcall(report_memory);
 
 #ifdef CONFIG_SMP
 #define do_flush_tlb_kernel_range       smp_flush_tlb_kernel_range
diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
index 7083c16cccba..bb1376381985 100644
--- a/arch/x86/boot/compressed/aslr.c
+++ b/arch/x86/boot/compressed/aslr.c
@@ -14,13 +14,6 @@
 static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@"
                 LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION;
 
-struct kaslr_setup_data {
-        __u64 next;
-        __u32 type;
-        __u32 len;
-        __u8 data[1];
-} kaslr_setup_data;
-
 #define I8254_PORT_CONTROL      0x43
 #define I8254_PORT_COUNTER0     0x40
 #define I8254_CMD_READBACK      0xC0
@@ -302,29 +295,7 @@ static unsigned long find_random_addr(unsigned long minimum,
         return slots_fetch_random();
 }
 
-static void add_kaslr_setup_data(struct boot_params *params, __u8 enabled)
-{
-        struct setup_data *data;
-
-        kaslr_setup_data.type = SETUP_KASLR;
-        kaslr_setup_data.len = 1;
-        kaslr_setup_data.next = 0;
-        kaslr_setup_data.data[0] = enabled;
-
-        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
-
-        while (data && data->next)
-                data = (struct setup_data *)(unsigned long)data->next;
-
-        if (data)
-                data->next = (unsigned long)&kaslr_setup_data;
-        else
-                params->hdr.setup_data = (unsigned long)&kaslr_setup_data;
-
-}
-
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size)
@@ -335,17 +306,14 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 #ifdef CONFIG_HIBERNATION
         if (!cmdline_find_option_bool("kaslr")) {
                 debug_putstr("KASLR disabled by default...\n");
-                add_kaslr_setup_data(params, 0);
                 goto out;
         }
 #else
         if (cmdline_find_option_bool("nokaslr")) {
                 debug_putstr("KASLR disabled by cmdline...\n");
-                add_kaslr_setup_data(params, 0);
                 goto out;
         }
 #endif
-        add_kaslr_setup_data(params, 1);
 
         /* Record the various known unsafe memory ranges. */
         mem_avoid_init((unsigned long)input, input_size,
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 5903089c818f..a950864a64da 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -401,8 +401,7 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
          * the entire decompressed kernel plus relocation table, or the
          * entire decompressed kernel plus .bss and .brk sections.
          */
-        output = choose_kernel_location(real_mode, input_data, input_len,
-                                        output,
+        output = choose_kernel_location(input_data, input_len, output,
                                         output_len > run_size ? output_len
                                                               : run_size);
 
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index ee3576b2666b..04477d68403f 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -57,8 +57,7 @@ int cmdline_find_option_bool(const char *option);
 
 #if CONFIG_RANDOMIZE_BASE
 /* aslr.c */
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size);
@@ -66,8 +65,7 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 bool has_cpuflag(int flag);
 #else
 static inline
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size)
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 947c6bf52c33..54f60ab41c63 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1155,7 +1155,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                 src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
                 if (!src)
                         return -ENOMEM;
-                assoc = (src + req->cryptlen + auth_tag_len);
+                assoc = (src + req->cryptlen);
                 scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
                 scatterwalk_map_and_copy(assoc, req->assoc, 0,
                         req->assoclen, 0);
@@ -1180,7 +1180,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                 scatterwalk_done(&src_sg_walk, 0, 0);
                 scatterwalk_done(&assoc_sg_walk, 0, 0);
         } else {
-                scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
+                scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
                 kfree(src);
         }
         return retval;
diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
index 0dbc08282291..72ba21a8b5fc 100644
--- a/arch/x86/include/asm/fpu-internal.h
+++ b/arch/x86/include/asm/fpu-internal.h
@@ -370,7 +370,7 @@ static inline void drop_fpu(struct task_struct *tsk)
         preempt_disable();
         tsk->thread.fpu_counter = 0;
         __drop_fpu(tsk);
-        clear_used_math();
+        clear_stopped_child_used_math(tsk);
         preempt_enable();
 }
 
diff --git a/arch/x86/include/asm/page_types.h b/arch/x86/include/asm/page_types.h
index 95e11f79f123..f97fbe3abb67 100644
--- a/arch/x86/include/asm/page_types.h
+++ b/arch/x86/include/asm/page_types.h
@@ -51,8 +51,6 @@ extern int devmem_is_allowed(unsigned long pagenr);
 extern unsigned long max_low_pfn_mapped;
 extern unsigned long max_pfn_mapped;
 
-extern bool kaslr_enabled;
-
 static inline phys_addr_t get_max_mapped(void)
 {
         return (phys_addr_t)max_pfn_mapped << PAGE_SHIFT;
diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
index fa1195dae425..164e3f8d3c3d 100644
--- a/arch/x86/include/asm/pci_x86.h
+++ b/arch/x86/include/asm/pci_x86.h
@@ -93,6 +93,8 @@ extern raw_spinlock_t pci_config_lock;
 extern int (*pcibios_enable_irq)(struct pci_dev *dev);
 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
 
+extern bool mp_should_keep_irq(struct device *dev);
+
 struct pci_raw_ops {
         int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
                                                 int reg, int len, u32 *val);
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 12a26b979bf1..f2f9b39b274a 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -231,6 +231,6 @@ __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
 }
 
 unsigned long
-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
+copy_user_handle_tail(char *to, char *from, unsigned len);
 
 #endif /* _ASM_X86_UACCESS_64_H */
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 44e6dd7e36a2..225b0988043a 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -7,7 +7,6 @@
 #define SETUP_DTB                       2
 #define SETUP_PCI                       3
 #define SETUP_EFI                       4
-#define SETUP_KASLR                     5
 
 /* ram_size flags */
 #define RAMDISK_IMAGE_START_MASK        0x07FF
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 3d525c6124f6..803b684676ff 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1338,6 +1338,26 @@ static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
 }
 
 /*
+ * ACPI offers an alternative platform interface model that removes
+ * ACPI hardware requirements for platforms that do not implement
+ * the PC Architecture.
+ *
+ * We initialize the Hardware-reduced ACPI model here:
+ */
+static void __init acpi_reduced_hw_init(void)
+{
+        if (acpi_gbl_reduced_hardware) {
+                /*
+                 * Override x86_init functions and bypass legacy pic
+                 * in Hardware-reduced ACPI mode
+                 */
+                x86_init.timers.timer_init      = x86_init_noop;
+                x86_init.irqs.pre_vector_init   = x86_init_noop;
+                legacy_pic                      = &null_legacy_pic;
+        }
+}
+
+/*
  * If your system is blacklisted here, but you find that acpi=force
  * works for you, please contact linux-acpi@vger.kernel.org
  */
@@ -1536,6 +1556,11 @@ int __init early_acpi_boot_init(void)
          */
         early_acpi_process_madt();
 
+        /*
+         * Hardware-reduced ACPI mode initialization:
+         */
+        acpi_reduced_hw_init();
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
index c2fd21fed002..017149cded07 100644
--- a/arch/x86/kernel/apic/apic_numachip.c
+++ b/arch/x86/kernel/apic/apic_numachip.c
@@ -37,10 +37,12 @@ static const struct apic apic_numachip;
 static unsigned int get_apic_id(unsigned long x)
 {
         unsigned long value;
-        unsigned int id;
+        unsigned int id = (x >> 24) & 0xff;
 
-        rdmsrl(MSR_FAM10H_NODE_ID, value);
-        id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+                rdmsrl(MSR_FAM10H_NODE_ID, value);
+                id |= (value << 2) & 0xff00;
+        }
 
         return id;
 }
@@ -155,10 +157,18 @@ static int __init numachip_probe(void)
 
 static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
 {
-        if (c->phys_proc_id != node) {
-                c->phys_proc_id = node;
-                per_cpu(cpu_llc_id, smp_processor_id()) = node;
+        u64 val;
+        u32 nodes = 1;
+
+        this_cpu_write(cpu_llc_id, node);
+
+        /* Account for nodes per socket in multi-core-module processors */
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+                rdmsrl(MSR_FAM10H_NODE_ID, val);
+                nodes = ((val >> 3) & 7) + 1;
         }
+
+        c->phys_proc_id = node / nodes;
 }
 
 static int __init numachip_system_init(void)
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 498b6d967138..258990688a5e 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -212,11 +212,11 @@ static struct event_constraint intel_hsw_event_constraints[] = {
         INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PREC_DIST */
         INTEL_EVENT_CONSTRAINT(0xcd, 0x8), /* MEM_TRANS_RETIRED.LOAD_LATENCY */
         /* CYCLE_ACTIVITY.CYCLES_L1D_PENDING */
-        INTEL_EVENT_CONSTRAINT(0x08a3, 0x4),
+        INTEL_UEVENT_CONSTRAINT(0x08a3, 0x4),
         /* CYCLE_ACTIVITY.STALLS_L1D_PENDING */
-        INTEL_EVENT_CONSTRAINT(0x0ca3, 0x4),
+        INTEL_UEVENT_CONSTRAINT(0x0ca3, 0x4),
         /* CYCLE_ACTIVITY.CYCLES_NO_EXECUTE */
-        INTEL_EVENT_CONSTRAINT(0x04a3, 0xf),
+        INTEL_UEVENT_CONSTRAINT(0x04a3, 0xf),
         EVENT_CONSTRAINT_END
 };
 
@@ -1649,11 +1649,11 @@ intel_get_event_constraints(struct cpu_hw_events *cpuc, struct perf_event *event
         if (c)
                 return c;
 
-        c = intel_pebs_constraints(event);
+        c = intel_shared_regs_constraints(cpuc, event);
         if (c)
                 return c;
 
-        c = intel_shared_regs_constraints(cpuc, event);
+        c = intel_pebs_constraints(event);
         if (c)
                 return c;
 
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 1d74d161687c..f0095a76c182 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -364,12 +364,21 @@ system_call_fastpath:
  * Has incomplete stack frame and undefined top of stack.
  */
 ret_from_sys_call:
-        testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
-        jnz int_ret_from_sys_call_fixup /* Go the the slow path */
-
         LOCKDEP_SYS_EXIT
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
+
+        /*
+         * We must check ti flags with interrupts (or at least preemption)
+         * off because we must *never* return to userspace without
+         * processing exit work that is enqueued if we're preempted here.
+         * In particular, returning to userspace with any of the one-shot
+         * flags (TIF_NOTIFY_RESUME, TIF_USER_RETURN_NOTIFY, etc) set is
+         * very bad.
+         */
+        testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
+        jnz int_ret_from_sys_call_fixup /* Go the the slow path */
+
         CFI_REMEMBER_STATE
         /*
          * sysretq will re-enable interrupts:
@@ -386,7 +395,7 @@ ret_from_sys_call:
 
 int_ret_from_sys_call_fixup:
         FIXUP_TOP_OF_STACK %r11, -ARGOFFSET
-        jmp int_ret_from_sys_call
+        jmp int_ret_from_sys_call_irqs_off
 
         /* Do syscall tracing */
 tracesys:
@@ -432,6 +441,7 @@ tracesys_phase2:
 GLOBAL(int_ret_from_sys_call)
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
+int_ret_from_sys_call_irqs_off:
         movl $_TIF_ALLWORK_MASK,%edi
         /* edi: mask to check */
 GLOBAL(int_with_check)
@@ -789,7 +799,21 @@ retint_swapgs:		/* return to user-space */
         cmpq %r11,(EFLAGS-ARGOFFSET)(%rsp)      /* R11 == RFLAGS */
         jne opportunistic_sysret_failed
 
-        testq $X86_EFLAGS_RF,%r11               /* sysret can't restore RF */
+        /*
+         * SYSRET can't restore RF.  SYSRET can restore TF, but unlike IRET,
+         * restoring TF results in a trap from userspace immediately after
+         * SYSRET.  This would cause an infinite loop whenever #DB happens
+         * with register state that satisfies the opportunistic SYSRET
+         * conditions.  For example, single-stepping this user code:
+         *
+         *           movq $stuck_here,%rcx
+         *           pushfq
+         *           popq %r11
+         *   stuck_here:
+         *
+         * would never get past 'stuck_here'.
+         */
+        testq $(X86_EFLAGS_RF|X86_EFLAGS_TF), %r11
         jnz opportunistic_sysret_failed
 
         /* nothing to check for RSP */
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 7ec1d5f8d283..25ecd56cefa8 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -72,7 +72,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] =
         { "bx", 8, offsetof(struct pt_regs, bx) },
         { "cx", 8, offsetof(struct pt_regs, cx) },
         { "dx", 8, offsetof(struct pt_regs, dx) },
-        { "si", 8, offsetof(struct pt_regs, dx) },
+        { "si", 8, offsetof(struct pt_regs, si) },
         { "di", 8, offsetof(struct pt_regs, di) },
         { "bp", 8, offsetof(struct pt_regs, bp) },
         { "sp", 8, offsetof(struct pt_regs, sp) },
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index 9bbb9b35c144..d1ac80b72c72 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -47,13 +47,21 @@ do {							\
 
 #ifdef CONFIG_RANDOMIZE_BASE
 static unsigned long module_load_offset;
+static int randomize_modules = 1;
 
 /* Mutex protects the module_load_offset. */
 static DEFINE_MUTEX(module_kaslr_mutex);
 
+static int __init parse_nokaslr(char *p)
+{
+        randomize_modules = 0;
+        return 0;
+}
+early_param("nokaslr", parse_nokaslr);
+
 static unsigned long int get_module_load_offset(void)
 {
-        if (kaslr_enabled) {
+        if (randomize_modules) {
                 mutex_lock(&module_kaslr_mutex);
                 /*
                  * Calculate the module_load_offset the first time this
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index bae6c609888e..86db4bcd7ce5 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -183,6 +183,16 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                 },
         },
 
+        /* ASRock */
+        {       /* Handle problems with rebooting on ASRock Q1900DC-ITX */
+                .callback = set_pci_reboot,
+                .ident = "ASRock Q1900DC-ITX",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"),
+                        DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"),
+                },
+        },
+
         /* ASUS */
         {       /* Handle problems with rebooting on ASUS P4S800 */
                 .callback = set_bios_reboot,
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 98dc9317286e..0a2421cca01f 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -122,8 +122,6 @@
 unsigned long max_low_pfn_mapped;
 unsigned long max_pfn_mapped;
 
-bool __read_mostly kaslr_enabled = false;
-
 #ifdef CONFIG_DMI
 RESERVE_BRK(dmi_alloc, 65536);
 #endif
@@ -427,11 +425,6 @@ static void __init reserve_initrd(void)
 }
 #endif /* CONFIG_BLK_DEV_INITRD */
 
-static void __init parse_kaslr_setup(u64 pa_data, u32 data_len)
-{
-        kaslr_enabled = (bool)(pa_data + sizeof(struct setup_data));
-}
-
 static void __init parse_setup_data(void)
 {
         struct setup_data *data;
@@ -457,9 +450,6 @@ static void __init parse_setup_data(void)
                 case SETUP_EFI:
                         parse_efi_setup(pa_data, data_len);
                         break;
-                case SETUP_KASLR:
-                        parse_kaslr_setup(pa_data, data_len);
-                        break;
                 default:
                         break;
                 }
@@ -842,14 +832,10 @@ static void __init trim_low_memory_range(void)
 static int
 dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
 {
-        if (kaslr_enabled)
-                pr_emerg("Kernel Offset: 0x%lx from 0x%lx (relocation range: 0x%lx-0x%lx)\n",
-                         (unsigned long)&_text - __START_KERNEL,
-                         __START_KERNEL,
-                         __START_KERNEL_map,
-                         MODULES_VADDR-1);
-        else
-                pr_emerg("Kernel Offset: disabled\n");
+        pr_emerg("Kernel Offset: 0x%lx from 0x%lx "
+                 "(relocation range: 0x%lx-0x%lx)\n",
+                 (unsigned long)&_text - __START_KERNEL, __START_KERNEL,
+                 __START_KERNEL_map, MODULES_VADDR-1);
 
         return 0;
 }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 9d2073e2ecc9..4ff5d162ff9f 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -384,7 +384,7 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
                 goto exit;
         conditional_sti(regs);
 
-        if (!user_mode(regs))
+        if (!user_mode_vm(regs))
                 die("bounds", regs, error_code);
 
         if (!cpu_feature_enabled(X86_FEATURE_MPX)) {
@@ -637,7 +637,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
          * then it's very likely the result of an icebp/int01 trap.
          * User wants a sigtrap for that.
          */
-        if (!dr6 && user_mode(regs))
+        if (!dr6 && user_mode_vm(regs))
                 user_icebp = 1;
 
         /* Catch kmemcheck conditions first of all! */
diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index 34f66e58a896..cdc6cf903078 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -379,7 +379,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                  * thread's fpu state, reconstruct fxstate from the fsave
                  * header. Sanitize the copied state etc.
                  */
-                struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
+                struct fpu *fpu = &tsk->thread.fpu;
                 struct user_i387_ia32_struct env;
                 int err = 0;
 
@@ -393,14 +393,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                  */
                 drop_fpu(tsk);
 
-                if (__copy_from_user(xsave, buf_fx, state_size) ||
+                if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
                     __copy_from_user(&env, buf, sizeof(env))) {
+                        fpu_finit(fpu);
                         err = -1;
                 } else {
                         sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-                        set_used_math();
                 }
 
+                set_used_math();
                 if (use_eager_fpu()) {
                         preempt_disable();
                         math_state_restore();
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 51889ec847b0..28146f03c514 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -424,6 +424,7 @@ static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
                         struct kvm_ioapic *ioapic, int vector, int trigger_mode)
 {
         int i;
+        struct kvm_lapic *apic = vcpu->arch.apic;
 
         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
                 union kvm_ioapic_redirect_entry *ent = &ioapic->redirtbl[i];
@@ -445,7 +446,8 @@ static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
                 kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
                 spin_lock(&ioapic->lock);
 
-                if (trigger_mode != IOAPIC_LEVEL_TRIG)
+                if (trigger_mode != IOAPIC_LEVEL_TRIG ||
+                    kvm_apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_DIRECTED_EOI)
                         continue;
 
                 ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 4a6e58a967f7..d67206a7b99a 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -858,8 +858,7 @@ int kvm_apic_compare_prio(struct kvm_vcpu *vcpu1, struct kvm_vcpu *vcpu2)
 
 static void kvm_ioapic_send_eoi(struct kvm_lapic *apic, int vector)
 {
-        if (!(kvm_apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_DIRECTED_EOI) &&
-            kvm_ioapic_handles_vector(apic->vcpu->kvm, vector)) {
+        if (kvm_ioapic_handles_vector(apic->vcpu->kvm, vector)) {
                 int trigger_mode;
                 if (apic_test_vector(vector, apic->regs + APIC_TMR))
                         trigger_mode = IOAPIC_LEVEL_TRIG;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 8c14d6a455b0..f5e8dce8046c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2168,7 +2168,10 @@ static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu)
 {
         unsigned long *msr_bitmap;
 
-        if (irqchip_in_kernel(vcpu->kvm) && apic_x2apic_mode(vcpu->arch.apic)) {
+        if (is_guest_mode(vcpu))
+                msr_bitmap = vmx_msr_bitmap_nested;
+        else if (irqchip_in_kernel(vcpu->kvm) &&
+                apic_x2apic_mode(vcpu->arch.apic)) {
                 if (is_long_mode(vcpu))
                         msr_bitmap = vmx_msr_bitmap_longmode_x2apic;
                 else
@@ -2477,8 +2480,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
         if (enable_ept) {
                 /* nested EPT: emulate EPT also to L1 */
                 vmx->nested.nested_vmx_secondary_ctls_high |=
-                        SECONDARY_EXEC_ENABLE_EPT |
-                        SECONDARY_EXEC_UNRESTRICTED_GUEST;
+                        SECONDARY_EXEC_ENABLE_EPT;
                 vmx->nested.nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
                          VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
                          VMX_EPT_INVEPT_BIT;
@@ -2492,6 +2494,10 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
         } else
                 vmx->nested.nested_vmx_ept_caps = 0;
 
+        if (enable_unrestricted_guest)
+                vmx->nested.nested_vmx_secondary_ctls_high |=
+                        SECONDARY_EXEC_UNRESTRICTED_GUEST;
+
         /* miscellaneous data */
         rdmsr(MSR_IA32_VMX_MISC,
                 vmx->nested.nested_vmx_misc_low,
@@ -9225,9 +9231,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         }
 
         if (cpu_has_vmx_msr_bitmap() &&
-            exec_control & CPU_BASED_USE_MSR_BITMAPS &&
-            nested_vmx_merge_msr_bitmap(vcpu, vmcs12)) {
-                vmcs_write64(MSR_BITMAP, __pa(vmx_msr_bitmap_nested));
+            exec_control & CPU_BASED_USE_MSR_BITMAPS) {
+                nested_vmx_merge_msr_bitmap(vcpu, vmcs12);
+                /* MSR_BITMAP will be set by following vmx_set_efer. */
         } else
                 exec_control &= ~CPU_BASED_USE_MSR_BITMAPS;
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index b8cb1d091697..2b2dd030ea3b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2755,7 +2755,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_USER_NMI:
         case KVM_CAP_REINJECT_CONTROL:
         case KVM_CAP_IRQ_INJECT_STATUS:
-        case KVM_CAP_IRQFD:
         case KVM_CAP_IOEVENTFD:
         case KVM_CAP_IOEVENTFD_NO_LENGTH:
         case KVM_CAP_PIT2:
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index c905e89e19fe..1f33b3d1fd68 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -69,21 +69,20 @@ EXPORT_SYMBOL(copy_in_user);
  * it is not necessary to optimize tail handling.
  */
 __visible unsigned long
-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
+copy_user_handle_tail(char *to, char *from, unsigned len)
 {
-        char c;
-        unsigned zero_len;
-
         for (; len; --len, to++) {
+                char c;
+
                 if (__get_user_nocheck(c, from++, sizeof(char)))
                         break;
                 if (__put_user_nocheck(c, to, sizeof(char)))
                         break;
         }
-
-        for (c = 0, zero_len = len; zerorest && zero_len; --zero_len)
-                if (__put_user_nocheck(c, to++, sizeof(char)))
-                        break;
         clac();
+
+        /* If the destination is a kernel buffer, we always clear the end */
+        if ((unsigned long)to >= TASK_SIZE_MAX)
+                memset(to, 0, len);
         return len;
 }
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 3d2612b68694..2fb384724ebb 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -513,31 +513,6 @@ void __init pcibios_set_cache_line_size(void)
         }
 }
 
-/*
- * Some device drivers assume dev->irq won't change after calling
- * pci_disable_device(). So delay releasing of IRQ resource to driver
- * unbinding time. Otherwise it will break PM subsystem and drivers
- * like xen-pciback etc.
- */
-static int pci_irq_notifier(struct notifier_block *nb, unsigned long action,
-                            void *data)
-{
-        struct pci_dev *dev = to_pci_dev(data);
-
-        if (action != BUS_NOTIFY_UNBOUND_DRIVER)
-                return NOTIFY_DONE;
-
-        if (pcibios_disable_irq)
-                pcibios_disable_irq(dev);
-
-        return NOTIFY_OK;
-}
-
-static struct notifier_block pci_irq_nb = {
-        .notifier_call = pci_irq_notifier,
-        .priority = INT_MIN,
-};
-
 int __init pcibios_init(void)
 {
         if (!raw_pci_ops) {
@@ -550,9 +525,6 @@ int __init pcibios_init(void)
 
         if (pci_bf_sort >= pci_force_bf)
                 pci_sort_breadthfirst();
-
-        bus_register_notifier(&pci_bus_type, &pci_irq_nb);
-
         return 0;
 }
 
@@ -711,6 +683,12 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
         return 0;
 }
 
+void pcibios_disable_device (struct pci_dev *dev)
+{
+        if (!pci_dev_msi_enabled(dev) && pcibios_disable_irq)
+                pcibios_disable_irq(dev);
+}
+
 int pci_ext_cfg_avail(void)
 {
         if (raw_pci_ext_ops)
diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
index efb849323c74..852aa4c92da0 100644
--- a/arch/x86/pci/intel_mid_pci.c
+++ b/arch/x86/pci/intel_mid_pci.c
@@ -234,10 +234,10 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
 
 static void intel_mid_pci_irq_disable(struct pci_dev *dev)
 {
-        if (dev->irq_managed && dev->irq > 0) {
+        if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed &&
+            dev->irq > 0) {
                 mp_unmap_irq(dev->irq);
                 dev->irq_managed = 0;
-                dev->irq = 0;
         }
 }
 
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index e71b3dbd87b8..5dc6ca5e1741 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -1256,9 +1256,22 @@ static int pirq_enable_irq(struct pci_dev *dev)
         return 0;
 }
 
+bool mp_should_keep_irq(struct device *dev)
+{
+        if (dev->power.is_prepared)
+                return true;
+#ifdef CONFIG_PM
+        if (dev->power.runtime_status == RPM_SUSPENDING)
+                return true;
+#endif
+
+        return false;
+}
+
 static void pirq_disable_irq(struct pci_dev *dev)
 {
-        if (io_apic_assign_pci_irqs && dev->irq_managed && dev->irq) {
+        if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) &&
+            dev->irq_managed && dev->irq) {
                 mp_unmap_irq(dev->irq);
                 dev->irq = 0;
                 dev->irq_managed = 0;
diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
index 31776d0efc8c..d7ec4e251c0a 100644
--- a/arch/x86/vdso/vdso32/sigreturn.S
+++ b/arch/x86/vdso/vdso32/sigreturn.S
@@ -17,6 +17,7 @@
         .text
         .globl __kernel_sigreturn
         .type __kernel_sigreturn,@function
+        nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
         ALIGN
 __kernel_sigreturn:
 .LSTART_sigreturn:
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 740ae3026a14..b47124d4cd67 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -91,6 +91,12 @@ EXPORT_SYMBOL_GPL(xen_p2m_size);
 unsigned long xen_max_p2m_pfn __read_mostly;
 EXPORT_SYMBOL_GPL(xen_max_p2m_pfn);
 
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+#else
+#define P2M_LIMIT 0
+#endif
+
 static DEFINE_SPINLOCK(p2m_update_lock);
 
 static unsigned long *p2m_mid_missing_mfn;
@@ -385,9 +391,11 @@ static void __init xen_rebuild_p2m_list(unsigned long *p2m)
 void __init xen_vmalloc_p2m_tree(void)
 {
         static struct vm_struct vm;
+        unsigned long p2m_limit;
 
+        p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE;
         vm.flags = VM_ALLOC;
-        vm.size = ALIGN(sizeof(unsigned long) * xen_max_p2m_pfn,
+        vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit),
                         PMD_SIZE * PMDS_PER_MID_PAGE);
         vm_area_register_early(&vm, PMD_SIZE * PMDS_PER_MID_PAGE);
         pr_notice("p2m virtual area at %p, size is %lx\n", vm.addr, vm.size);
@@ -563,7 +571,7 @@ static bool alloc_p2m(unsigned long pfn)
                 if (p2m_pfn == PFN_DOWN(__pa(p2m_missing)))
                         p2m_init(p2m);
                 else
-                        p2m_init_identity(p2m, pfn);
+                        p2m_init_identity(p2m, pfn & ~(P2M_PER_PAGE - 1));
 
                 spin_lock_irqsave(&p2m_update_lock, flags);
 
diff --git a/block/blk-merge.c b/block/blk-merge.c
index fc1ff3b1ea1f..fd3fee81c23c 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -592,7 +592,7 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
         if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
                 struct bio_vec *bprev;
 
-                bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
+                bprev = &rq->biotail->bi_io_vec[rq->biotail->bi_vcnt - 1];
                 if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
                         return false;
         }
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index d53a764b05ea..be3290cc0644 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -278,9 +278,11 @@ static int bt_get(struct blk_mq_alloc_data *data,
                 /*
                  * We're out of tags on this hardware queue, kick any
                  * pending IO submits before going to sleep waiting for
-                 * some to complete.
+                 * some to complete. Note that hctx can be NULL here for
+                 * reserved tag allocation.
                  */
-                blk_mq_run_hw_queue(hctx, false);
+                if (hctx)
+                        blk_mq_run_hw_queue(hctx, false);
 
                 /*
                  * Retry tag allocation after running the hardware queue,
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 4f4bea21052e..33c428530193 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1457,7 +1457,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
 
                 do {
                         page = alloc_pages_node(set->numa_node,
-                                GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY,
+                                GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO,
                                 this_order);
                         if (page)
                                 break;
@@ -1479,8 +1479,6 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
                 left -= to_do * rq_size;
                 for (j = 0; j < to_do; j++) {
                         tags->rqs[i] = p;
-                        tags->rqs[i]->atomic_flags = 0;
-                        tags->rqs[i]->cmd_flags = 0;
                         if (set->ops->init_request) {
                                 if (set->ops->init_request(set->driver_data,
                                                 tags->rqs[i], hctx_idx, i,
@@ -1938,7 +1936,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
          */
         if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release,
                             PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
-                goto err_map;
+                goto err_mq_usage;
 
         setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
         blk_queue_rq_timeout(q, 30000);
@@ -1981,7 +1979,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
         blk_mq_init_cpu_queues(q, set->nr_hw_queues);
 
         if (blk_mq_init_hw_queues(q, set))
-                goto err_hw;
+                goto err_mq_usage;
 
         mutex_lock(&all_q_mutex);
         list_add_tail(&q->all_q_node, &all_q_list);
@@ -1993,7 +1991,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
 
         return q;
 
-err_hw:
+err_mq_usage:
         blk_cleanup_queue(q);
 err_hctxs:
         kfree(map);
diff --git a/block/blk-settings.c b/block/blk-settings.c
index 6ed2cbe5e8c9..12600bfffca9 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -585,7 +585,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
                                      b->physical_block_size);
 
         t->io_min = max(t->io_min, b->io_min);
-        t->io_opt = lcm(t->io_opt, b->io_opt);
+        t->io_opt = lcm_not_zero(t->io_opt, b->io_opt);
 
         t->cluster &= b->cluster;
         t->discard_zeroes_data &= b->discard_zeroes_data;
@@ -616,7 +616,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
                     b->raid_partial_stripes_expensive);
 
         /* Find lowest common alignment_offset */
-        t->alignment_offset = lcm(t->alignment_offset, alignment)
+        t->alignment_offset = lcm_not_zero(t->alignment_offset, alignment)
                 % max(t->physical_block_size, t->io_min);
 
         /* Verify that new alignment_offset is on a logical block boundary */
@@ -643,7 +643,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
                                                       b->max_discard_sectors);
                 t->discard_granularity = max(t->discard_granularity,
                                              b->discard_granularity);
-                t->discard_alignment = lcm(t->discard_alignment, alignment) %
+                t->discard_alignment = lcm_not_zero(t->discard_alignment, alignment) %
                         t->discard_granularity;
         }
 
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 657964e8ab7e..37fb19047603 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -65,6 +65,7 @@ struct lpss_private_data;
 
 struct lpss_device_desc {
         unsigned int flags;
+        const char *clk_con_id;
         unsigned int prv_offset;
         size_t prv_size_override;
         void (*setup)(struct lpss_private_data *pdata);
@@ -140,6 +141,7 @@ static struct lpss_device_desc lpt_i2c_dev_desc = {
 
 static struct lpss_device_desc lpt_uart_dev_desc = {
         .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_LTR,
+        .clk_con_id = "baudclk",
         .prv_offset = 0x800,
         .setup = lpss_uart_setup,
 };
@@ -156,6 +158,7 @@ static struct lpss_device_desc byt_pwm_dev_desc = {
 
 static struct lpss_device_desc byt_uart_dev_desc = {
         .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
+        .clk_con_id = "baudclk",
         .prv_offset = 0x800,
         .setup = lpss_uart_setup,
 };
@@ -313,7 +316,7 @@ out:
                 return PTR_ERR(clk);
 
         pdata->clk = clk;
-        clk_register_clkdev(clk, NULL, devname);
+        clk_register_clkdev(clk, dev_desc->clk_con_id, devname);
         return 0;
 }
 
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index e7f718d6918a..b1def411c0b8 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -485,6 +485,14 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
         if (!pin || !dev->irq_managed || dev->irq <= 0)
                 return;
 
+        /* Keep IOAPIC pin configuration when suspending */
+        if (dev->dev.power.is_prepared)
+                return;
+#ifdef  CONFIG_PM
+        if (dev->dev.power.runtime_status == RPM_SUSPENDING)
+                return;
+#endif
+
         entry = acpi_pci_irq_lookup(dev, pin);
         if (!entry)
                 return;
@@ -505,6 +513,5 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
         if (gsi >= 0) {
                 acpi_unregister_gsi(gsi);
                 dev->irq_managed = 0;
-                dev->irq = 0;
         }
 }
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index c6bb9f1257c9..f98db0b50551 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -922,7 +922,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
                 return -EINVAL;
 
         drv->safe_state_index = -1;
-        for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
+        for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) {
                 drv->states[i].name[0] = '\0';
                 drv->states[i].desc[0] = '\0';
         }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 4c35f0822d06..23dac3babfe3 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4204,9 +4204,18 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
 
         /* devices that don't properly handle queued TRIM commands */
-        { "Micron_M[56]*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial_CT*M500*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Micron_M5[15]0*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial_CT*M550*",           "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial_CT*MX100*",          "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Samsung SSD 850 PRO*",       NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Crucial_CT*SSD*",            NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
 
         /*
          * As defined, the DRAT (Deterministic Read After Trim) and RZAT
@@ -4226,6 +4235,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          */
         { "INTEL*SSDSC2MH*",            NULL,   0, },
 
+        { "Micron*",                    NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial*",                   NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "INTEL*SSD*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "SSD*INTEL*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Samsung*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -4737,7 +4748,7 @@ struct ata_queued_cmd *ata_qc_new_init(struct ata_device *dev, int tag)
                 return NULL;
 
         /* libsas case */
-        if (!ap->scsi_host) {
+        if (ap->flags & ATA_FLAG_SAS_HOST) {
                 tag = ata_sas_allocate_tag(ap);
                 if (tag < 0)
                         return NULL;
@@ -4776,7 +4787,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
         tag = qc->tag;
         if (likely(ata_tag_valid(tag))) {
                 qc->tag = ATA_TAG_POISON;
-                if (!ap->scsi_host)
+                if (ap->flags & ATA_FLAG_SAS_HOST)
                         ata_sas_free_tag(tag, ap);
         }
 }
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index beb8b27d4621..a13587b5c2be 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -243,4 +243,12 @@ extern struct regcache_ops regcache_rbtree_ops;
 extern struct regcache_ops regcache_lzo_ops;
 extern struct regcache_ops regcache_flat_ops;
 
+static inline const char *regmap_name(const struct regmap *map)
+{
+        if (map->dev)
+                return dev_name(map->dev);
+
+        return map->name;
+}
+
 #endif
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index d453a2c98ad0..81751a49d8bf 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
         if (pos == 0) {
                 memmove(blk + offset * map->cache_word_size,
                         blk, rbnode->blklen * map->cache_word_size);
-                bitmap_shift_right(present, present, offset, blklen);
+                bitmap_shift_left(present, present, offset, blklen);
         }
 
         /* update the rbnode block, its size and the base register */
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index f373c35f9e1d..87db9893b463 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -218,7 +218,7 @@ int regcache_read(struct regmap *map,
                 ret = map->cache_ops->read(map, reg, value);
 
                 if (ret == 0)
-                        trace_regmap_reg_read_cache(map->dev, reg, *value);
+                        trace_regmap_reg_read_cache(map, reg, *value);
 
                 return ret;
         }
@@ -311,7 +311,7 @@ int regcache_sync(struct regmap *map)
         dev_dbg(map->dev, "Syncing %s cache\n",
                 map->cache_ops->name);
         name = map->cache_ops->name;
-        trace_regcache_sync(map->dev, name, "start");
+        trace_regcache_sync(map, name, "start");
 
         if (!map->cache_dirty)
                 goto out;
@@ -346,7 +346,7 @@ out:
 
         regmap_async_complete(map);
 
-        trace_regcache_sync(map->dev, name, "stop");
+        trace_regcache_sync(map, name, "stop");
 
         return ret;
 }
@@ -381,7 +381,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
         name = map->cache_ops->name;
         dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
 
-        trace_regcache_sync(map->dev, name, "start region");
+        trace_regcache_sync(map, name, "start region");
 
         if (!map->cache_dirty)
                 goto out;
@@ -401,7 +401,7 @@ out:
 
         regmap_async_complete(map);
 
-        trace_regcache_sync(map->dev, name, "stop region");
+        trace_regcache_sync(map, name, "stop region");
 
         return ret;
 }
@@ -428,7 +428,7 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
 
         map->lock(map->lock_arg);
 
-        trace_regcache_drop_region(map->dev, min, max);
+        trace_regcache_drop_region(map, min, max);
 
         ret = map->cache_ops->drop(map, min, max);
 
@@ -455,7 +455,7 @@ void regcache_cache_only(struct regmap *map, bool enable)
         map->lock(map->lock_arg);
         WARN_ON(map->cache_bypass && enable);
         map->cache_only = enable;
-        trace_regmap_cache_only(map->dev, enable);
+        trace_regmap_cache_only(map, enable);
         map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_only);
@@ -493,7 +493,7 @@ void regcache_cache_bypass(struct regmap *map, bool enable)
         map->lock(map->lock_arg);
         WARN_ON(map->cache_only && enable);
         map->cache_bypass = enable;
-        trace_regmap_cache_bypass(map->dev, enable);
+        trace_regmap_cache_bypass(map, enable);
         map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_bypass);
@@ -608,7 +608,8 @@ static int regcache_sync_block_single(struct regmap *map, void *block,
         for (i = start; i < end; i++) {
                 regtmp = block_base + (i * map->reg_stride);
 
-                if (!regcache_reg_present(cache_present, i))
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp))
                         continue;
 
                 val = regcache_get_val(map, block, i);
@@ -677,7 +678,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
         for (i = start; i < end; i++) {
                 regtmp = block_base + (i * map->reg_stride);
 
-                if (!regcache_reg_present(cache_present, i)) {
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp)) {
                         ret = regcache_sync_block_raw_flush(map, &data,
                                                             base, regtmp);
                         if (ret != 0)
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 6299a50a5960..a6c3f75b4b01 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -499,7 +499,8 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                 goto err_alloc;
         }
 
-        ret = request_threaded_irq(irq, NULL, regmap_irq_thread, irq_flags,
+        ret = request_threaded_irq(irq, NULL, regmap_irq_thread,
+                                   irq_flags | IRQF_ONESHOT,
                                    chip->name, d);
         if (ret != 0) {
                 dev_err(map->dev, "Failed to request IRQ %d for %s: %d\n",
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index f99b098ddabf..dbfe6a69c3da 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1281,7 +1281,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
         if (map->async && map->bus->async_write) {
                 struct regmap_async *async;
 
-                trace_regmap_async_write_start(map->dev, reg, val_len);
+                trace_regmap_async_write_start(map, reg, val_len);
 
                 spin_lock_irqsave(&map->async_lock, flags);
                 async = list_first_entry_or_null(&map->async_free,
@@ -1339,8 +1339,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                 return ret;
         }
 
-        trace_regmap_hw_write_start(map->dev, reg,
-                                    val_len / map->format.val_bytes);
+        trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
 
         /* If we're doing a single register write we can probably just
          * send the work_buf directly, otherwise try to do a gather
@@ -1372,8 +1371,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                 kfree(buf);
         }
 
-        trace_regmap_hw_write_done(map->dev, reg,
-                                   val_len / map->format.val_bytes);
+        trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
 
         return ret;
 }
@@ -1407,12 +1405,12 @@ static int _regmap_bus_formatted_write(void *context, unsigned int reg,
 
         map->format.format_write(map, reg, val);
 
-        trace_regmap_hw_write_start(map->dev, reg, 1);
+        trace_regmap_hw_write_start(map, reg, 1);
 
         ret = map->bus->write(map->bus_context, map->work_buf,
                               map->format.buf_size);
 
-        trace_regmap_hw_write_done(map->dev, reg, 1);
+        trace_regmap_hw_write_done(map, reg, 1);
 
         return ret;
 }
@@ -1470,7 +1468,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
                 dev_info(map->dev, "%x <= %x\n", reg, val);
 #endif
 
-        trace_regmap_reg_write(map->dev, reg, val);
+        trace_regmap_reg_write(map, reg, val);
 
         return map->reg_write(context, reg, val);
 }
@@ -1773,7 +1771,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
         for (i = 0; i < num_regs; i++) {
                 int reg = regs[i].reg;
                 int val = regs[i].def;
-                trace_regmap_hw_write_start(map->dev, reg, 1);
+                trace_regmap_hw_write_start(map, reg, 1);
                 map->format.format_reg(u8, reg, map->reg_shift);
                 u8 += reg_bytes + pad_bytes;
                 map->format.format_val(u8, val, 0);
@@ -1788,7 +1786,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
 
         for (i = 0; i < num_regs; i++) {
                 int reg = regs[i].reg;
-                trace_regmap_hw_write_done(map->dev, reg, 1);
+                trace_regmap_hw_write_done(map, reg, 1);
         }
         return ret;
 }
@@ -2059,15 +2057,13 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
          */
         u8[0] |= map->read_flag_mask;
 
-        trace_regmap_hw_read_start(map->dev, reg,
-                                   val_len / map->format.val_bytes);
+        trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
 
         ret = map->bus->read(map->bus_context, map->work_buf,
                              map->format.reg_bytes + map->format.pad_bytes,
                              val, val_len);
 
-        trace_regmap_hw_read_done(map->dev, reg,
-                                  val_len / map->format.val_bytes);
+        trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
 
         return ret;
 }
@@ -2123,7 +2119,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
                         dev_info(map->dev, "%x => %x\n", reg, *val);
 #endif
 
-                trace_regmap_reg_read(map->dev, reg, *val);
+                trace_regmap_reg_read(map, reg, *val);
 
                 if (!map->cache_bypass)
                         regcache_write(map, reg, *val);
@@ -2480,7 +2476,7 @@ void regmap_async_complete_cb(struct regmap_async *async, int ret)
         struct regmap *map = async->map;
         bool wake;
 
-        trace_regmap_async_io_complete(map->dev);
+        trace_regmap_async_io_complete(map);
 
         spin_lock(&map->async_lock);
         list_move(&async->list, &map->async_free);
@@ -2525,7 +2521,7 @@ int regmap_async_complete(struct regmap *map)
         if (!map->bus || !map->bus->async_write)
                 return 0;
 
-        trace_regmap_async_complete_start(map->dev);
+        trace_regmap_async_complete_start(map);
 
         wait_event(map->async_waitq, regmap_async_is_done(map));
 
@@ -2534,7 +2530,7 @@ int regmap_async_complete(struct regmap *map)
         map->async_ret = 0;
         spin_unlock_irqrestore(&map->async_lock, flags);
 
-        trace_regmap_async_complete_done(map->dev);
+        trace_regmap_async_complete_done(map);
 
         return ret;
 }
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 4bc2a5cb9935..a98c41f72c63 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -803,10 +803,6 @@ static int __init nbd_init(void)
                 return -EINVAL;
         }
 
-        nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
-        if (!nbd_dev)
-                return -ENOMEM;
-
         part_shift = 0;
         if (max_part > 0) {
                 part_shift = fls(max_part);
@@ -828,6 +824,10 @@ static int __init nbd_init(void)
         if (nbds_max > 1UL << (MINORBITS - part_shift))
                 return -EINVAL;
 
+        nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
+        if (!nbd_dev)
+                return -ENOMEM;
+
         for (i = 0; i < nbds_max; i++) {
                 struct gendisk *disk = alloc_disk(1 << part_shift);
                 if (!disk)
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index ceb32dd52a6c..e23be20a3417 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -3003,6 +3003,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         }
         get_device(dev->device);
 
+        INIT_LIST_HEAD(&dev->node);
         INIT_WORK(&dev->probe_work, nvme_async_probe);
         schedule_work(&dev->probe_work);
         return 0;
diff --git a/drivers/char/ipmi/ipmi_powernv.c b/drivers/char/ipmi/ipmi_powernv.c
index 79524ed2a3cb..8753b0f6a317 100644
--- a/drivers/char/ipmi/ipmi_powernv.c
+++ b/drivers/char/ipmi/ipmi_powernv.c
@@ -125,6 +125,7 @@ static int ipmi_powernv_recv(struct ipmi_smi_powernv *smi)
         spin_lock_irqsave(&smi->msg_lock, flags);
 
         if (!smi->cur_msg) {
+                spin_unlock_irqrestore(&smi->msg_lock, flags);
                 pr_warn("no current message?\n");
                 return 0;
         }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index f6646ed3047e..518585c1ce94 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -263,6 +263,11 @@ struct smi_info {
         bool supports_event_msg_buff;
 
         /*
+         * Can we clear the global enables receive irq bit?
+         */
+        bool cannot_clear_recv_irq_bit;
+
+        /*
          * Did we get an attention that we did not handle?
          */
         bool got_attn;
@@ -461,6 +466,9 @@ static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
  * allocate messages, we just leave them in the BMC and run the system
  * polled until we can allocate some memory.  Once we have some
  * memory, we will re-enable the interrupt.
+ *
+ * Note that we cannot just use disable_irq(), since the interrupt may
+ * be shared.
  */
 static inline bool disable_si_irq(struct smi_info *smi_info)
 {
@@ -549,20 +557,15 @@ static u8 current_global_enables(struct smi_info *smi_info, u8 base,
 
         if (smi_info->supports_event_msg_buff)
                 enables |= IPMI_BMC_EVT_MSG_BUFF;
-        else
-                enables &= ~IPMI_BMC_EVT_MSG_BUFF;
 
-        if (smi_info->irq && !smi_info->interrupt_disabled)
+        if ((smi_info->irq && !smi_info->interrupt_disabled) ||
+            smi_info->cannot_clear_recv_irq_bit)
                 enables |= IPMI_BMC_RCV_MSG_INTR;
-        else
-                enables &= ~IPMI_BMC_RCV_MSG_INTR;
 
         if (smi_info->supports_event_msg_buff &&
             smi_info->irq && !smi_info->interrupt_disabled)
 
                 enables |= IPMI_BMC_EVT_MSG_INTR;
-        else
-                enables &= ~IPMI_BMC_EVT_MSG_INTR;
 
         *irq_on = enables & (IPMI_BMC_EVT_MSG_INTR | IPMI_BMC_RCV_MSG_INTR);
 
@@ -2900,6 +2903,96 @@ static int try_get_dev_id(struct smi_info *smi_info)
         return rv;
 }
 
+/*
+ * Some BMCs do not support clearing the receive irq bit in the global
+ * enables (even if they don't support interrupts on the BMC).  Check
+ * for this and handle it properly.
+ */
+static void check_clr_rcv_irq(struct smi_info *smi_info)
+{
+        unsigned char         msg[3];
+        unsigned char         *resp;
+        unsigned long         resp_len;
+        int                   rv;
+
+        resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
+        if (!resp) {
+                printk(KERN_WARNING PFX "Out of memory allocating response for"
+                       " global enables command, cannot check recv irq bit"
+                       " handling.\n");
+                return;
+        }
+
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
+        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+
+        rv = wait_for_msg_done(smi_info);
+        if (rv) {
+                printk(KERN_WARNING PFX "Error getting response from get"
+                       " global enables command, cannot check recv irq bit"
+                       " handling.\n");
+                goto out;
+        }
+
+        resp_len = smi_info->handlers->get_result(smi_info->si_sm,
+                                                  resp, IPMI_MAX_MSG_LENGTH);
+
+        if (resp_len < 4 ||
+                        resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
+                        resp[1] != IPMI_GET_BMC_GLOBAL_ENABLES_CMD   ||
+                        resp[2] != 0) {
+                printk(KERN_WARNING PFX "Invalid return from get global"
+                       " enables command, cannot check recv irq bit"
+                       " handling.\n");
+                rv = -EINVAL;
+                goto out;
+        }
+
+        if ((resp[3] & IPMI_BMC_RCV_MSG_INTR) == 0)
+                /* Already clear, should work ok. */
+                goto out;
+
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
+        msg[2] = resp[3] & ~IPMI_BMC_RCV_MSG_INTR;
+        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
+
+        rv = wait_for_msg_done(smi_info);
+        if (rv) {
+                printk(KERN_WARNING PFX "Error getting response from set"
+                       " global enables command, cannot check recv irq bit"
+                       " handling.\n");
+                goto out;
+        }
+
+        resp_len = smi_info->handlers->get_result(smi_info->si_sm,
+                                                  resp, IPMI_MAX_MSG_LENGTH);
+
+        if (resp_len < 3 ||
+                        resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
+                        resp[1] != IPMI_SET_BMC_GLOBAL_ENABLES_CMD) {
+                printk(KERN_WARNING PFX "Invalid return from get global"
+                       " enables command, cannot check recv irq bit"
+                       " handling.\n");
+                rv = -EINVAL;
+                goto out;
+        }
+
+        if (resp[2] != 0) {
+                /*
+                 * An error when setting the event buffer bit means
+                 * clearing the bit is not supported.
+                 */
+                printk(KERN_WARNING PFX "The BMC does not support clearing"
+                       " the recv irq bit, compensating, but the BMC needs to"
+                       " be fixed.\n");
+                smi_info->cannot_clear_recv_irq_bit = true;
+        }
+ out:
+        kfree(resp);
+}
+
 static int try_enable_event_buffer(struct smi_info *smi_info)
 {
         unsigned char         msg[3];
@@ -3395,6 +3488,8 @@ static int try_smi_init(struct smi_info *new_smi)
                 goto out_err;
         }
 
+        check_clr_rcv_irq(new_smi);
+
         setup_oem_data_handler(new_smi);
         setup_xaction_handlers(new_smi);
 
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index f6e378dac5f5..f40e3bd2c69c 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -468,11 +468,13 @@ static int ipmi_ssif_thread(void *data)
                 int result;
 
                 /* Wait for something to do */
-                wait_for_completion(&ssif_info->wake_thread);
-                init_completion(&ssif_info->wake_thread);
-
+                result = wait_for_completion_interruptible(
+                                                &ssif_info->wake_thread);
                 if (ssif_info->stopping)
                         break;
+                if (result == -ERESTARTSYS)
+                        continue;
+                init_completion(&ssif_info->wake_thread);
 
                 if (ssif_info->i2c_read_write == I2C_SMBUS_WRITE) {
                         result = i2c_smbus_write_block_data(
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index fae2dbbf5745..72d7028f779b 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -142,6 +142,7 @@ struct ports_device {
          * notification
          */
         struct work_struct control_work;
+        struct work_struct config_work;
 
         struct list_head ports;
 
@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_device *vdev)
 
         portdev = vdev->priv;
 
+        if (!use_multiport(portdev))
+                schedule_work(&portdev->config_work);
+}
+
+static void config_work_handler(struct work_struct *work)
+{
+        struct ports_device *portdev;
+
+        portdev = container_of(work, struct ports_device, control_work);
         if (!use_multiport(portdev)) {
+                struct virtio_device *vdev;
                 struct port *port;
                 u16 rows, cols;
 
+                vdev = portdev->vdev;
                 virtio_cread(vdev, struct virtio_console_config, cols, &cols);
                 virtio_cread(vdev, struct virtio_console_config, rows, &rows);
 
@@ -2040,12 +2052,14 @@ static int virtcons_probe(struct virtio_device *vdev)
 
         virtio_device_ready(portdev->vdev);
 
+        INIT_WORK(&portdev->config_work, &config_work_handler);
+        INIT_WORK(&portdev->control_work, &control_work_handler);
+
         if (multiport) {
                 unsigned int nr_added_bufs;
 
                 spin_lock_init(&portdev->c_ivq_lock);
                 spin_lock_init(&portdev->c_ovq_lock);
-                INIT_WORK(&portdev->control_work, &control_work_handler);
 
                 nr_added_bufs = fill_queue(portdev->c_ivq,
                                            &portdev->c_ivq_lock);
@@ -2113,6 +2127,8 @@ static void virtcons_remove(struct virtio_device *vdev)
         /* Finish up work that's lined up */
         if (use_multiport(portdev))
                 cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
 
         list_for_each_entry_safe(port, port2, &portdev->ports, list)
                 unplug_port(port);
@@ -2164,6 +2180,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
 
         virtqueue_disable_cb(portdev->c_ivq);
         cancel_work_sync(&portdev->control_work);
+        cancel_work_sync(&portdev->config_work);
         /*
          * Once more: if control_work_handler() was running, it would
          * enable the cb as the last step.
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index db7f8bce7467..25006a8bb8e6 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -144,12 +144,6 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw,
                                    divider->flags);
 }
 
-/*
- * The reverse of DIV_ROUND_UP: The maximum number which
- * divided by m is r
- */
-#define MULT_ROUND_UP(r, m) ((r) * (m) + (m) - 1)
-
 static bool _is_valid_table_div(const struct clk_div_table *table,
                                                          unsigned int div)
 {
@@ -225,19 +219,24 @@ static int _div_round_closest(const struct clk_div_table *table,
                               unsigned long parent_rate, unsigned long rate,
                               unsigned long flags)
 {
-        int up, down, div;
+        int up, down;
+        unsigned long up_rate, down_rate;
 
-        up = down = div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        up = DIV_ROUND_UP(parent_rate, rate);
+        down = parent_rate / rate;
 
         if (flags & CLK_DIVIDER_POWER_OF_TWO) {
-                up = __roundup_pow_of_two(div);
-                down = __rounddown_pow_of_two(div);
+                up = __roundup_pow_of_two(up);
+                down = __rounddown_pow_of_two(down);
         } else if (table) {
-                up = _round_up_table(table, div);
-                down = _round_down_table(table, div);
+                up = _round_up_table(table, up);
+                down = _round_down_table(table, down);
         }
 
-        return (up - div) <= (div - down) ? up : down;
+        up_rate = DIV_ROUND_UP(parent_rate, up);
+        down_rate = DIV_ROUND_UP(parent_rate, down);
+
+        return (rate - up_rate) <= (down_rate - rate) ? up : down;
 }
 
 static int _div_round(const struct clk_div_table *table,
@@ -313,7 +312,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
                         return i;
                 }
                 parent_rate = __clk_round_rate(__clk_get_parent(hw->clk),
-                                MULT_ROUND_UP(rate, i));
+                                               rate * i);
                 now = DIV_ROUND_UP(parent_rate, i);
                 if (_is_best_div(rate, now, best, flags)) {
                         bestdiv = i;
@@ -353,7 +352,7 @@ static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate,
                 bestdiv = readl(divider->reg) >> divider->shift;
                 bestdiv &= div_mask(divider->width);
                 bestdiv = _get_div(divider->table, bestdiv, divider->flags);
-                return bestdiv;
+                return DIV_ROUND_UP(*prate, bestdiv);
         }
 
         return divider_round_rate(hw, rate, prate, divider->table,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index eb0152961d3c..237f23f68bfc 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1350,7 +1350,6 @@ static unsigned long clk_core_get_rate(struct clk_core *clk)
 
         return rate;
 }
-EXPORT_SYMBOL_GPL(clk_core_get_rate);
 
 /**
  * clk_get_rate - return the rate of clk
@@ -2171,6 +2170,32 @@ int clk_get_phase(struct clk *clk)
 }
 
 /**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        /* trivial case: identical struct clk's or both NULL */
+        if (p == q)
+                return true;
+
+        /* true if clk->core pointers match. Avoid derefing garbage */
+        if (!IS_ERR_OR_NULL(p) && !IS_ERR_OR_NULL(q))
+                if (p->core == q->core)
+                        return true;
+
+        return false;
+}
+EXPORT_SYMBOL_GPL(clk_is_match);
+
+/**
  * __clk_init - initialize the data structures in a struct clk
  * @dev:        device initializing this clk, placeholder for now
  * @clk:        clk being initialized
diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
index b0b562b9ce0e..e60feffc10a1 100644
--- a/drivers/clk/qcom/gcc-msm8960.c
+++ b/drivers/clk/qcom/gcc-msm8960.c
@@ -48,6 +48,17 @@ static struct clk_pll pll3 = {
         },
 };
 
+static struct clk_regmap pll4_vote = {
+        .enable_reg = 0x34c0,
+        .enable_mask = BIT(4),
+        .hw.init = &(struct clk_init_data){
+                .name = "pll4_vote",
+                .parent_names = (const char *[]){ "pll4" },
+                .num_parents = 1,
+                .ops = &clk_pll_vote_ops,
+        },
+};
+
 static struct clk_pll pll8 = {
         .l_reg = 0x3144,
         .m_reg = 0x3148,
@@ -3023,6 +3034,7 @@ static struct clk_branch rpm_msg_ram_h_clk = {
 
 static struct clk_regmap *gcc_msm8960_clks[] = {
         [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
         [PLL8] = &pll8.clkr,
         [PLL8_VOTE] = &pll8_vote,
         [PLL14] = &pll14.clkr,
@@ -3247,6 +3259,7 @@ static const struct qcom_reset_map gcc_msm8960_resets[] = {
 
 static struct clk_regmap *gcc_apq8064_clks[] = {
         [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
         [PLL8] = &pll8.clkr,
         [PLL8_VOTE] = &pll8_vote,
         [PLL14] = &pll14.clkr,
diff --git a/drivers/clk/qcom/lcc-ipq806x.c b/drivers/clk/qcom/lcc-ipq806x.c
index 121ffde25dc3..c9ff27b4648b 100644
--- a/drivers/clk/qcom/lcc-ipq806x.c
+++ b/drivers/clk/qcom/lcc-ipq806x.c
@@ -462,7 +462,6 @@ static struct platform_driver lcc_ipq806x_driver = {
         .remove         = lcc_ipq806x_remove,
         .driver         = {
                 .name   = "lcc-ipq806x",
-                .owner  = THIS_MODULE,
                 .of_match_table = lcc_ipq806x_match_table,
         },
 };
diff --git a/drivers/clk/qcom/lcc-msm8960.c b/drivers/clk/qcom/lcc-msm8960.c
index a75a408cfccd..e2c863295f00 100644
--- a/drivers/clk/qcom/lcc-msm8960.c
+++ b/drivers/clk/qcom/lcc-msm8960.c
@@ -417,8 +417,8 @@ static struct clk_rcg slimbus_src = {
                 .mnctr_en_bit = 8,
                 .mnctr_reset_bit = 7,
                 .mnctr_mode_shift = 5,
-                .n_val_shift = 16,
-                .m_val_shift = 16,
+                .n_val_shift = 24,
+                .m_val_shift = 8,
                 .width = 8,
         },
         .p = {
@@ -547,7 +547,7 @@ static int lcc_msm8960_probe(struct platform_device *pdev)
                 return PTR_ERR(regmap);
 
         /* Use the correct frequency plan depending on speed of PLL4 */
-        val = regmap_read(regmap, 0x4, &val);
+        regmap_read(regmap, 0x4, &val);
         if (val == 0x12) {
                 slimbus_src.freq_tbl = clk_tbl_aif_osr_492;
                 mi2s_osr_src.freq_tbl = clk_tbl_aif_osr_492;
@@ -574,7 +574,6 @@ static struct platform_driver lcc_msm8960_driver = {
         .remove         = lcc_msm8960_remove,
         .driver         = {
                 .name   = "lcc-msm8960",
-                .owner  = THIS_MODULE,
                 .of_match_table = lcc_msm8960_match_table,
         },
 };
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 6ef89639a9f6..d21640634adf 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -84,7 +84,7 @@ static int ti_fapll_enable(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        v |= (1 << FAPLL_MAIN_PLLEN);
+        v |= FAPLL_MAIN_PLLEN;
         writel_relaxed(v, fd->base);
 
         return 0;
@@ -95,7 +95,7 @@ static void ti_fapll_disable(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        v &= ~(1 << FAPLL_MAIN_PLLEN);
+        v &= ~FAPLL_MAIN_PLLEN;
         writel_relaxed(v, fd->base);
 }
 
@@ -104,7 +104,7 @@ static int ti_fapll_is_enabled(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        return v & (1 << FAPLL_MAIN_PLLEN);
+        return v & FAPLL_MAIN_PLLEN;
 }
 
 static unsigned long ti_fapll_recalc_rate(struct clk_hw *hw,
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 68161f7a07d6..a0b036ccb118 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -192,6 +192,7 @@ config SYS_SUPPORTS_EM_STI
 config SH_TIMER_CMT
         bool "Renesas CMT timer driver" if COMPILE_TEST
         depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
         default SYS_SUPPORTS_SH_CMT
         help
           This enables build of a clocksource and clockevent driver for
@@ -201,6 +202,7 @@ config SH_TIMER_CMT
 config SH_TIMER_MTU2
         bool "Renesas MTU2 timer driver" if COMPILE_TEST
         depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
         default SYS_SUPPORTS_SH_MTU2
         help
           This enables build of a clockevent driver for the Multi-Function
@@ -210,6 +212,7 @@ config SH_TIMER_MTU2
 config SH_TIMER_TMU
         bool "Renesas TMU timer driver" if COMPILE_TEST
         depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
         default SYS_SUPPORTS_SH_TMU
         help
           This enables build of a clocksource and clockevent driver for
diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
index bba62f9deefb..ec57ba2bbd87 100644
--- a/drivers/clocksource/time-efm32.c
+++ b/drivers/clocksource/time-efm32.c
@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
         clock_event_ddata.base = base;
         clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
 
-        setup_irq(irq, &efm32_clock_event_irq);
-
         clockevents_config_and_register(&clock_event_ddata.evtdev,
                                         DIV_ROUND_CLOSEST(rate, 1024),
                                         0xf, 0xffff);
 
+        setup_irq(irq, &efm32_clock_event_irq);
+
         return 0;
 
 err_get_irq:
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 02268448dc85..58597fbcc046 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -17,7 +17,6 @@
 #include <linux/irq.h>
 #include <linux/irqreturn.h>
 #include <linux/reset.h>
-#include <linux/sched_clock.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
@@ -137,11 +136,6 @@ static struct irqaction sun5i_timer_irq = {
         .dev_id = &sun5i_clockevent,
 };
 
-static u64 sun5i_timer_sched_read(void)
-{
-        return ~readl(timer_base + TIMER_CNTVAL_LO_REG(1));
-}
-
 static void __init sun5i_timer_init(struct device_node *node)
 {
         struct reset_control *rstc;
@@ -172,16 +166,11 @@ static void __init sun5i_timer_init(struct device_node *node)
         writel(TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
                timer_base + TIMER_CTL_REG(1));
 
-        sched_clock_register(sun5i_timer_sched_read, 32, rate);
         clocksource_mmio_init(timer_base + TIMER_CNTVAL_LO_REG(1), node->name,
                               rate, 340, 32, clocksource_mmio_readl_down);
 
         ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
 
-        ret = setup_irq(irq, &sun5i_timer_irq);
-        if (ret)
-                pr_warn("failed to setup irq %d\n", irq);
-
         /* Enable timer0 interrupt */
         val = readl(timer_base + TIMER_IRQ_EN_REG);
         writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
@@ -191,6 +180,10 @@ static void __init sun5i_timer_init(struct device_node *node)
 
         clockevents_config_and_register(&sun5i_clockevent, rate,
                                         TIMER_SYNC_TICKS, 0xffffffff);
+
+        ret = setup_irq(irq, &sun5i_timer_irq);
+        if (ret)
+                pr_warn("failed to setup irq %d\n", irq);
 }
 CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
                        sun5i_timer_init);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 28e59a48b35f..8ae655c364f4 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1698,15 +1698,18 @@ void cpufreq_resume(void)
                     || __cpufreq_governor(policy, CPUFREQ_GOV_LIMITS))
                         pr_err("%s: Failed to start governor for policy: %p\n",
                                 __func__, policy);
-
-                /*
-                 * schedule call cpufreq_update_policy() for boot CPU, i.e. last
-                 * policy in list. It will verify that the current freq is in
-                 * sync with what we believe it to be.
-                 */
-                if (list_is_last(&policy->policy_list, &cpufreq_policy_list))
-                        schedule_work(&policy->update);
         }
+
+        /*
+         * schedule call cpufreq_update_policy() for first-online CPU, as that
+         * wouldn't be hotplugged-out on suspend. It will verify that the
+         * current freq is in sync with what we believe it to be.
+         */
+        policy = cpufreq_cpu_get_raw(cpumask_first(cpu_online_mask));
+        if (WARN_ON(!policy))
+                return;
+
+        schedule_work(&policy->update);
 }
 
 /**
diff --git a/drivers/cpuidle/cpuidle-mvebu-v7.c b/drivers/cpuidle/cpuidle-mvebu-v7.c
index 38e68618513a..980151f34707 100644
--- a/drivers/cpuidle/cpuidle-mvebu-v7.c
+++ b/drivers/cpuidle/cpuidle-mvebu-v7.c
@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cpuidle_device *dev,
                 deepidle = true;
 
         ret = mvebu_v7_cpu_suspend(deepidle);
+        cpu_pm_exit();
+
         if (ret)
                 return ret;
 
-        cpu_pm_exit();
-
         return index;
 }
 
@@ -50,17 +50,17 @@ static struct cpuidle_driver armadaxp_idle_driver = {
         .states[0]              = ARM_CPUIDLE_WFI_STATE,
         .states[1]              = {
                 .enter                  = mvebu_v7_enter_idle,
-                .exit_latency           = 10,
+                .exit_latency           = 100,
                 .power_usage            = 50,
-                .target_residency       = 100,
+                .target_residency       = 1000,
                 .name                   = "MV CPU IDLE",
                 .desc                   = "CPU power down",
         },
         .states[2]              = {
                 .enter                  = mvebu_v7_enter_idle,
-                .exit_latency           = 100,
+                .exit_latency           = 1000,
                 .power_usage            = 5,
-                .target_residency       = 1000,
+                .target_residency       = 10000,
                 .flags                  = MVEBU_V7_FLAG_DEEP_IDLE,
                 .name                   = "MV CPU DEEP IDLE",
                 .desc                   = "CPU and L2 Fabric power down",
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 080bd2dbde4b..7a73a279e179 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -330,9 +330,6 @@ int cpuidle_enable_device(struct cpuidle_device *dev)
         if (!dev->registered)
                 return -EINVAL;
 
-        if (!dev->state_count)
-                dev->state_count = drv->state_count;
-
         ret = cpuidle_add_device_sysfs(dev);
         if (ret)
                 return ret;
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 97c5903b4606..832a2c3f01ff 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -401,7 +401,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
 
         /* state statistics */
-        for (i = 0; i < device->state_count; i++) {
+        for (i = 0; i < drv->state_count; i++) {
                 kobj = kzalloc(sizeof(struct cpuidle_state_kobj), GFP_KERNEL);
                 if (!kobj)
                         goto error_state;
@@ -433,9 +433,10 @@ error_state:
  */
 static void cpuidle_remove_state_sysfs(struct cpuidle_device *device)
 {
+        struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
         int i;
 
-        for (i = 0; i < device->state_count; i++)
+        for (i = 0; i < drv->state_count; i++)
                 cpuidle_free_state_kobj(device, i);
 }
 
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index 4a5fd245014e..83aa55d6fa5d 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -97,6 +97,12 @@
 
 #define DRIVER_NAME     "pl08xdmac"
 
+#define PL80X_DMA_BUSWIDTHS \
+        BIT(DMA_SLAVE_BUSWIDTH_UNDEFINED) | \
+        BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
+        BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | \
+        BIT(DMA_SLAVE_BUSWIDTH_4_BYTES)
+
 static struct amba_driver pl08x_amba_driver;
 struct pl08x_driver_data;
 
@@ -2070,6 +2076,10 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
         pl08x->memcpy.device_pause = pl08x_pause;
         pl08x->memcpy.device_resume = pl08x_resume;
         pl08x->memcpy.device_terminate_all = pl08x_terminate_all;
+        pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM);
+        pl08x->memcpy.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
 
         /* Initialize slave engine */
         dma_cap_set(DMA_SLAVE, pl08x->slave.cap_mask);
@@ -2086,6 +2096,10 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
         pl08x->slave.device_pause = pl08x_pause;
         pl08x->slave.device_resume = pl08x_resume;
         pl08x->slave.device_terminate_all = pl08x_terminate_all;
+        pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->slave.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        pl08x->slave.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
 
         /* Get the platform data */
         pl08x->pd = dev_get_platdata(&adev->dev);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 1e1a4c567542..0b4fc6fb48ce 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -238,93 +238,126 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
 }
 
 /*
- * atc_get_current_descriptors -
- * locate the descriptor which equal to physical address in DSCR
- * @atchan: the channel we want to start
- * @dscr_addr: physical descriptor address in DSCR
+ * atc_get_desc_by_cookie - get the descriptor of a cookie
+ * @atchan: the DMA channel
+ * @cookie: the cookie to get the descriptor for
  */
-static struct at_desc *atc_get_current_descriptors(struct at_dma_chan *atchan,
-                                                        u32 dscr_addr)
+static struct at_desc *atc_get_desc_by_cookie(struct at_dma_chan *atchan,
+                                                dma_cookie_t cookie)
 {
-        struct at_desc  *desc, *_desc, *child, *desc_cur = NULL;
+        struct at_desc *desc, *_desc;
 
-        list_for_each_entry_safe(desc, _desc, &atchan->active_list, desc_node) {
-                if (desc->lli.dscr == dscr_addr) {
-                        desc_cur = desc;
-                        break;
-                }
+        list_for_each_entry_safe(desc, _desc, &atchan->queue, desc_node) {
+                if (desc->txd.cookie == cookie)
+                        return desc;
+        }
 
-                list_for_each_entry(child, &desc->tx_list, desc_node) {
-                        if (child->lli.dscr == dscr_addr) {
-                                desc_cur = child;
-                                break;
-                        }
-                }
+        list_for_each_entry_safe(desc, _desc, &atchan->active_list, desc_node) {
+                if (desc->txd.cookie == cookie)
+                        return desc;
         }
 
-        return desc_cur;
+        return NULL;
 }
 
-/*
- * atc_get_bytes_left -
- * Get the number of bytes residue in dma buffer,
- * @chan: the channel we want to start
+/**
+ * atc_calc_bytes_left - calculates the number of bytes left according to the
+ * value read from CTRLA.
+ *
+ * @current_len: the number of bytes left before reading CTRLA
+ * @ctrla: the value of CTRLA
+ * @desc: the descriptor containing the transfer width
+ */
+static inline int atc_calc_bytes_left(int current_len, u32 ctrla,
+                                        struct at_desc *desc)
+{
+        return current_len - ((ctrla & ATC_BTSIZE_MAX) << desc->tx_width);
+}
+
+/**
+ * atc_calc_bytes_left_from_reg - calculates the number of bytes left according
+ * to the current value of CTRLA.
+ *
+ * @current_len: the number of bytes left before reading CTRLA
+ * @atchan: the channel to read CTRLA for
+ * @desc: the descriptor containing the transfer width
+ */
+static inline int atc_calc_bytes_left_from_reg(int current_len,
+                        struct at_dma_chan *atchan, struct at_desc *desc)
+{
+        u32 ctrla = channel_readl(atchan, CTRLA);
+
+        return atc_calc_bytes_left(current_len, ctrla, desc);
+}
+
+/**
+ * atc_get_bytes_left - get the number of bytes residue for a cookie
+ * @chan: DMA channel
+ * @cookie: transaction identifier to check status of
  */
-static int atc_get_bytes_left(struct dma_chan *chan)
+static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
 {
         struct at_dma_chan      *atchan = to_at_dma_chan(chan);
-        struct at_dma           *atdma = to_at_dma(chan->device);
-        int     chan_id = atchan->chan_common.chan_id;
         struct at_desc *desc_first = atc_first_active(atchan);
-        struct at_desc *desc_cur;
-        int ret = 0, count = 0;
+        struct at_desc *desc;
+        int ret;
+        u32 ctrla, dscr;
 
         /*
-         * Initialize necessary values in the first time.
-         * remain_desc record remain desc length.
+         * If the cookie doesn't match to the currently running transfer then
+         * we can return the total length of the associated DMA transfer,
+         * because it is still queued.
          */
-        if (atchan->remain_desc == 0)
-                /* First descriptor embedds the transaction length */
-                atchan->remain_desc = desc_first->len;
+        desc = atc_get_desc_by_cookie(atchan, cookie);
+        if (desc == NULL)
+                return -EINVAL;
+        else if (desc != desc_first)
+                return desc->total_len;
 
-        /*
-         * This happens when current descriptor transfer complete.
-         * The residual buffer size should reduce current descriptor length.
-         */
-        if (unlikely(test_bit(ATC_IS_BTC, &atchan->status))) {
-                clear_bit(ATC_IS_BTC, &atchan->status);
-                desc_cur = atc_get_current_descriptors(atchan,
-                                                channel_readl(atchan, DSCR));
-                if (!desc_cur) {
-                        ret = -EINVAL;
-                        goto out;
-                }
+        /* cookie matches to the currently running transfer */
+        ret = desc_first->total_len;
 
-                count = (desc_cur->lli.ctrla & ATC_BTSIZE_MAX)
-                        << desc_first->tx_width;
-                if (atchan->remain_desc < count) {
-                        ret = -EINVAL;
-                        goto out;
+        if (desc_first->lli.dscr) {
+                /* hardware linked list transfer */
+
+                /*
+                 * Calculate the residue by removing the length of the child
+                 * descriptors already transferred from the total length.
+                 * To get the current child descriptor we can use the value of
+                 * the channel's DSCR register and compare it against the value
+                 * of the hardware linked list structure of each child
+                 * descriptor.
+                 */
+
+                ctrla = channel_readl(atchan, CTRLA);
+                rmb(); /* ensure CTRLA is read before DSCR */
+                dscr = channel_readl(atchan, DSCR);
+
+                /* for the first descriptor we can be more accurate */
+                if (desc_first->lli.dscr == dscr)
+                        return atc_calc_bytes_left(ret, ctrla, desc_first);
+
+                ret -= desc_first->len;
+                list_for_each_entry(desc, &desc_first->tx_list, desc_node) {
+                        if (desc->lli.dscr == dscr)
+                                break;
+
+                        ret -= desc->len;
                 }
 
-                atchan->remain_desc -= count;
-                ret = atchan->remain_desc;
-        } else {
                 /*
-                 * Get residual bytes when current
-                 * descriptor transfer in progress.
+                 * For the last descriptor in the chain we can calculate
+                 * the remaining bytes using the channel's register.
+                 * Note that the transfer width of the first and last
+                 * descriptor may differ.
                  */
-                count = (channel_readl(atchan, CTRLA) & ATC_BTSIZE_MAX)
-                                << (desc_first->tx_width);
-                ret = atchan->remain_desc - count;
+                if (!desc->lli.dscr)
+                        ret = atc_calc_bytes_left_from_reg(ret, atchan, desc);
+        } else {
+                /* single transfer */
+                ret = atc_calc_bytes_left_from_reg(ret, atchan, desc_first);
         }
-        /*
-         * Check fifo empty.
-         */
-        if (!(dma_readl(atdma, CHSR) & AT_DMA_EMPT(chan_id)))
-                atc_issue_pending(chan);
 
-out:
         return ret;
 }
 
@@ -539,8 +572,6 @@ static irqreturn_t at_dma_interrupt(int irq, void *dev_id)
                                         /* Give information to tasklet */
                                         set_bit(ATC_IS_ERROR, &atchan->status);
                                 }
-                                if (pending & AT_DMA_BTC(i))
-                                        set_bit(ATC_IS_BTC, &atchan->status);
                                 tasklet_schedule(&atchan->tasklet);
                                 ret = IRQ_HANDLED;
                         }
@@ -653,14 +684,18 @@ atc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
                 desc->lli.ctrlb = ctrlb;
 
                 desc->txd.cookie = 0;
+                desc->len = xfer_count << src_width;
 
                 atc_desc_chain(&first, &prev, desc);
         }
 
         /* First descriptor of the chain embedds additional information */
         first->txd.cookie = -EBUSY;
-        first->len = len;
+        first->total_len = len;
+
+        /* set transfer width for the calculation of the residue */
         first->tx_width = src_width;
+        prev->tx_width = src_width;
 
         /* set end-of-link to the last link descriptor of list*/
         set_desc_eol(desc);
@@ -752,6 +787,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                                         | ATC_SRC_WIDTH(mem_width)
                                         | len >> mem_width;
                         desc->lli.ctrlb = ctrlb;
+                        desc->len = len;
 
                         atc_desc_chain(&first, &prev, desc);
                         total_len += len;
@@ -792,6 +828,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                                         | ATC_DST_WIDTH(mem_width)
                                         | len >> reg_width;
                         desc->lli.ctrlb = ctrlb;
+                        desc->len = len;
 
                         atc_desc_chain(&first, &prev, desc);
                         total_len += len;
@@ -806,8 +843,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
         /* First descriptor of the chain embedds additional information */
         first->txd.cookie = -EBUSY;
-        first->len = total_len;
+        first->total_len = total_len;
+
+        /* set transfer width for the calculation of the residue */
         first->tx_width = reg_width;
+        prev->tx_width = reg_width;
 
         /* first link descriptor of list is responsible of flags */
         first->txd.flags = flags; /* client is in control of this ack */
@@ -872,6 +912,7 @@ atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
                                 | ATC_FC_MEM2PER
                                 | ATC_SIF(atchan->mem_if)
                                 | ATC_DIF(atchan->per_if);
+                desc->len = period_len;
                 break;
 
         case DMA_DEV_TO_MEM:
@@ -883,6 +924,7 @@ atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
                                 | ATC_FC_PER2MEM
                                 | ATC_SIF(atchan->per_if)
                                 | ATC_DIF(atchan->mem_if);
+                desc->len = period_len;
                 break;
 
         default:
@@ -964,7 +1006,7 @@ atc_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
 
         /* First descriptor of the chain embedds additional information */
         first->txd.cookie = -EBUSY;
-        first->len = buf_len;
+        first->total_len = buf_len;
         first->tx_width = reg_width;
 
         return &first->txd;
@@ -1118,7 +1160,7 @@ atc_tx_status(struct dma_chan *chan,
         spin_lock_irqsave(&atchan->lock, flags);
 
         /*  Get number of bytes left in the active transactions */
-        bytes = atc_get_bytes_left(chan);
+        bytes = atc_get_bytes_left(chan, cookie);
 
         spin_unlock_irqrestore(&atchan->lock, flags);
 
@@ -1214,7 +1256,6 @@ static int atc_alloc_chan_resources(struct dma_chan *chan)
 
         spin_lock_irqsave(&atchan->lock, flags);
         atchan->descs_allocated = i;
-        atchan->remain_desc = 0;
         list_splice(&tmp_list, &atchan->free_list);
         dma_cookie_init(chan);
         spin_unlock_irqrestore(&atchan->lock, flags);
@@ -1257,7 +1298,6 @@ static void atc_free_chan_resources(struct dma_chan *chan)
         list_splice_init(&atchan->free_list, &list);
         atchan->descs_allocated = 0;
         atchan->status = 0;
-        atchan->remain_desc = 0;
 
         dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
 }
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index d6bba6c636c2..2727ca560572 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -181,8 +181,9 @@ struct at_lli {
  * @at_lli: hardware lli structure
  * @txd: support for the async_tx api
  * @desc_node: node on the channed descriptors list
- * @len: total transaction bytecount
+ * @len: descriptor byte count
  * @tx_width: transfer width
+ * @total_len: total transaction byte count
  */
 struct at_desc {
         /* FIRST values the hardware uses */
@@ -194,6 +195,7 @@ struct at_desc {
         struct list_head                desc_node;
         size_t                          len;
         u32                             tx_width;
+        size_t                          total_len;
 };
 
 static inline struct at_desc *
@@ -213,7 +215,6 @@ txd_to_at_desc(struct dma_async_tx_descriptor *txd)
 enum atc_status {
         ATC_IS_ERROR = 0,
         ATC_IS_PAUSED = 1,
-        ATC_IS_BTC = 2,
         ATC_IS_CYCLIC = 24,
 };
 
@@ -231,7 +232,6 @@ enum atc_status {
  * @save_cfg: configuration register that is saved on suspend/resume cycle
  * @save_dscr: for cyclic operations, preserve next descriptor address in
  *             the cyclic list on suspend/resume cycle
- * @remain_desc: to save remain desc length
  * @dma_sconfig: configuration for slave transfers, passed via
  * .device_config
  * @lock: serializes enqueue/dequeue operations to descriptors lists
@@ -251,7 +251,6 @@ struct at_dma_chan {
         struct tasklet_struct   tasklet;
         u32                     save_cfg;
         u32                     save_dscr;
-        u32                     remain_desc;
         struct dma_slave_config dma_sconfig;
 
         spinlock_t              lock;
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 0723096fb50a..c92d6a70ccf3 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -475,6 +475,7 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
          * c->desc is NULL and exit.)
          */
         if (c->desc) {
+                bcm2835_dma_desc_free(&c->desc->vd);
                 c->desc = NULL;
                 bcm2835_dma_abort(c->chan_base);
 
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index 512cb8e2805e..ceedafbd23e0 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -903,6 +903,11 @@ static const struct cppi_glue_infos *get_glue_info(struct device *dev)
         return of_id->data;
 }
 
+#define CPPI41_DMA_BUSWIDTHS    (BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
+                                BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | \
+                                BIT(DMA_SLAVE_BUSWIDTH_3_BYTES) | \
+                                BIT(DMA_SLAVE_BUSWIDTH_4_BYTES))
+
 static int cppi41_dma_probe(struct platform_device *pdev)
 {
         struct cppi41_dd *cdd;
@@ -926,6 +931,10 @@ static int cppi41_dma_probe(struct platform_device *pdev)
         cdd->ddev.device_issue_pending = cppi41_dma_issue_pending;
         cdd->ddev.device_prep_slave_sg = cppi41_dma_prep_slave_sg;
         cdd->ddev.device_terminate_all = cppi41_stop_chan;
+        cdd->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        cdd->ddev.src_addr_widths = CPPI41_DMA_BUSWIDTHS;
+        cdd->ddev.dst_addr_widths = CPPI41_DMA_BUSWIDTHS;
+        cdd->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
         cdd->ddev.dev = dev;
         INIT_LIST_HEAD(&cdd->ddev.channels);
         cpp41_dma_info.dma_cap = cdd->ddev.cap_mask;
diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
index 4527a3ebeac4..84884418fd30 100644
--- a/drivers/dma/dma-jz4740.c
+++ b/drivers/dma/dma-jz4740.c
@@ -511,6 +511,9 @@ static void jz4740_dma_desc_free(struct virt_dma_desc *vdesc)
         kfree(container_of(vdesc, struct jz4740_dma_desc, vdesc));
 }
 
+#define JZ4740_DMA_BUSWIDTHS (BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
+        BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | BIT(DMA_SLAVE_BUSWIDTH_4_BYTES))
+
 static int jz4740_dma_probe(struct platform_device *pdev)
 {
         struct jz4740_dmaengine_chan *chan;
@@ -548,6 +551,10 @@ static int jz4740_dma_probe(struct platform_device *pdev)
         dd->device_prep_dma_cyclic = jz4740_dma_prep_dma_cyclic;
         dd->device_config = jz4740_dma_slave_config;
         dd->device_terminate_all = jz4740_dma_terminate_all;
+        dd->src_addr_widths = JZ4740_DMA_BUSWIDTHS;
+        dd->dst_addr_widths = JZ4740_DMA_BUSWIDTHS;
+        dd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        dd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
         dd->dev = &pdev->dev;
         INIT_LIST_HEAD(&dd->channels);
 
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index f15712f2fec6..ac336a961dea 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -859,9 +859,6 @@ int dma_async_device_register(struct dma_device *device)
         BUG_ON(!device->device_issue_pending);
         BUG_ON(!device->dev);
 
-        WARN(dma_has_cap(DMA_SLAVE, device->cap_mask) && !device->directions,
-             "this driver doesn't support generic slave capabilities reporting\n");
-
         /* note: this only matters in the
          * CONFIG_ASYNC_TX_ENABLE_CHANNEL_SWITCH=n case
          */
diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
index 6565a361e7e5..b2c3ae071429 100644
--- a/drivers/dma/dw/platform.c
+++ b/drivers/dma/dw/platform.c
@@ -26,6 +26,8 @@
 
 #include "internal.h"
 
+#define DRV_NAME        "dw_dmac"
+
 static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
                                         struct of_dma *ofdma)
 {
@@ -284,7 +286,7 @@ static struct platform_driver dw_driver = {
         .remove         = dw_remove,
         .shutdown       = dw_shutdown,
         .driver = {
-                .name   = "dw_dmac",
+                .name   = DRV_NAME,
                 .pm     = &dw_dev_pm_ops,
                 .of_match_table = of_match_ptr(dw_dma_of_id_table),
                 .acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
@@ -305,3 +307,4 @@ module_exit(dw_exit);
 
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 276157f22612..53dbd3b3384c 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -260,6 +260,13 @@ static int edma_terminate_all(struct dma_chan *chan)
          */
         if (echan->edesc) {
                 int cyclic = echan->edesc->cyclic;
+
+                /*
+                 * free the running request descriptor
+                 * since it is not in any of the vdesc lists
+                 */
+                edma_desc_free(&echan->edesc->vdesc);
+
                 echan->edesc = NULL;
                 edma_stop(echan->ch_num);
                 /* Move the cyclic channel back to default queue */
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 18c0a131e4e4..66a0efb9651d 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -531,6 +531,10 @@ static int sdma_run_channel0(struct sdma_engine *sdma)
                 dev_err(sdma->dev, "Timeout waiting for CH0 ready\n");
         }
 
+        /* Set bits of CONFIG register with dynamic context switching */
+        if (readl(sdma->regs + SDMA_H_CONFIG) == 0)
+                writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
+
         return ret ? 0 : -ETIMEDOUT;
 }
 
@@ -1394,9 +1398,6 @@ static int sdma_init(struct sdma_engine *sdma)
 
         writel_relaxed(ccb_phys, sdma->regs + SDMA_H_C0PTR);
 
-        /* Set bits of CONFIG register with given context switching mode */
-        writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
-
         /* Initializes channel's priorities */
         sdma_set_channel_priority(&sdma->channel[0], 7);
 
diff --git a/drivers/dma/moxart-dma.c b/drivers/dma/moxart-dma.c
index 15cab7d79525..b4634109e010 100644
--- a/drivers/dma/moxart-dma.c
+++ b/drivers/dma/moxart-dma.c
@@ -193,8 +193,10 @@ static int moxart_terminate_all(struct dma_chan *chan)
 
         spin_lock_irqsave(&ch->vc.lock, flags);
 
-        if (ch->desc)
+        if (ch->desc) {
+                moxart_dma_desc_free(&ch->desc->vd);
                 ch->desc = NULL;
+        }
 
         ctrl = readl(ch->base + REG_OFF_CTRL);
         ctrl &= ~(APB_DMA_ENABLE | APB_DMA_FIN_INT_EN | APB_DMA_ERR_INT_EN);
diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
index 7dd6dd121681..167dbaf65742 100644
--- a/drivers/dma/omap-dma.c
+++ b/drivers/dma/omap-dma.c
@@ -981,6 +981,7 @@ static int omap_dma_terminate_all(struct dma_chan *chan)
          * c->desc is NULL and exit.)
          */
         if (c->desc) {
+                omap_dma_desc_free(&c->desc->vd);
                 c->desc = NULL;
                 /* Avoid stopping the dma twice */
                 if (!c->paused)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 69fac068669f..2eebd28b4c40 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -86,10 +86,13 @@ static void dmi_table(u8 *buf, u32 len, int num,
         int i = 0;
 
         /*
-         *      Stop when we see all the items the table claimed to have
-         *      OR we run off the end of the table (also happens)
+         * Stop when we have seen all the items the table claimed to have
+         * (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run
+         * off the end of the table (should never happen but sometimes does
+         * on bogus implementations.)
          */
-        while ((i < num) && (data - buf + sizeof(struct dmi_header)) <= len) {
+        while ((!num || i < num) &&
+               (data - buf + sizeof(struct dmi_header)) <= len) {
                 const struct dmi_header *dm = (const struct dmi_header *)data;
 
                 /*
@@ -529,21 +532,10 @@ static int __init dmi_smbios3_present(const u8 *buf)
         if (memcmp(buf, "_SM3_", 5) == 0 &&
             buf[6] < 32 && dmi_checksum(buf, buf[6])) {
                 dmi_ver = get_unaligned_be16(buf + 7);
+                dmi_num = 0;                    /* No longer specified */
                 dmi_len = get_unaligned_le32(buf + 12);
                 dmi_base = get_unaligned_le64(buf + 16);
 
-                /*
-                 * The 64-bit SMBIOS 3.0 entry point no longer has a field
-                 * containing the number of structures present in the table.
-                 * Instead, it defines the table size as a maximum size, and
-                 * relies on the end-of-table structure type (#127) to be used
-                 * to signal the end of the table.
-                 * So let's define dmi_num as an upper bound as well: each
-                 * structure has a 4 byte header, so dmi_len / 4 is an upper
-                 * bound for the number of structures in the table.
-                 */
-                dmi_num = dmi_len / 4;
-
                 if (dmi_walk_early(dmi_decode) == 0) {
                         pr_info("SMBIOS %d.%d present.\n",
                                 dmi_ver >> 8, dmi_ver & 0xFF);
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index a6952ba343a8..a65b75161aa4 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -334,7 +334,7 @@ static struct irq_domain_ops mpc8xxx_gpio_irq_ops = {
         .xlate  = irq_domain_xlate_twocell,
 };
 
-static struct of_device_id mpc8xxx_gpio_ids[] __initdata = {
+static struct of_device_id mpc8xxx_gpio_ids[] = {
         { .compatible = "fsl,mpc8349-gpio", },
         { .compatible = "fsl,mpc8572-gpio", },
         { .compatible = "fsl,mpc8610-gpio", },
diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c
index 257e2989215c..045a952576c7 100644
--- a/drivers/gpio/gpio-syscon.c
+++ b/drivers/gpio/gpio-syscon.c
@@ -219,7 +219,7 @@ static int syscon_gpio_probe(struct platform_device *pdev)
                 ret = of_property_read_u32_index(np, "gpio,syscon-dev", 2,
                                                  &priv->dir_reg_offset);
                 if (ret)
-                        dev_err(dev, "can't read the dir register offset!\n");
+                        dev_dbg(dev, "can't read the dir register offset!\n");
 
                 priv->dir_reg_offset <<= 3;
         }
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index c0929d938ced..df990f29757a 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -201,6 +201,10 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
         if (!handler)
                 return AE_BAD_PARAMETER;
 
+        pin = acpi_gpiochip_pin_to_gpio_offset(chip, pin);
+        if (pin < 0)
+                return AE_BAD_PARAMETER;
+
         desc = gpiochip_request_own_desc(chip, pin, "ACPI:Event");
         if (IS_ERR(desc)) {
                 dev_err(chip->dev, "Failed to request GPIO\n");
@@ -551,6 +555,12 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address,
                 struct gpio_desc *desc;
                 bool found;
 
+                pin = acpi_gpiochip_pin_to_gpio_offset(chip, pin);
+                if (pin < 0) {
+                        status = AE_BAD_PARAMETER;
+                        goto out;
+                }
+
                 mutex_lock(&achip->conn_lock);
 
                 found = false;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 910ff8ab9c9c..d8135adb2238 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -645,6 +645,7 @@ static int create_sdma_queue_nocpsch(struct device_queue_manager *dqm,
         pr_debug("     sdma queue id: %d\n", q->properties.sdma_queue_id);
         pr_debug("     sdma engine id: %d\n", q->properties.sdma_engine_id);
 
+        init_sdma_vm(dqm, q, qpd);
         retval = mqd->init_mqd(mqd, &q->mqd, &q->mqd_mem_obj,
                                 &q->gart_mqd_addr, &q->properties);
         if (retval != 0) {
@@ -652,7 +653,14 @@ static int create_sdma_queue_nocpsch(struct device_queue_manager *dqm,
                 return retval;
         }
 
-        init_sdma_vm(dqm, q, qpd);
+        retval = mqd->load_mqd(mqd, q->mqd, 0,
+                                0, NULL);
+        if (retval != 0) {
+                deallocate_sdma_queue(dqm, q->sdma_id);
+                mqd->uninit_mqd(mqd, q->mqd, q->mqd_mem_obj);
+                return retval;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index e415a2a9207e..c7d298e62c96 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -44,7 +44,7 @@ static bool initialize(struct kernel_queue *kq, struct kfd_dev *dev,
         BUG_ON(!kq || !dev);
         BUG_ON(type != KFD_QUEUE_TYPE_DIQ && type != KFD_QUEUE_TYPE_HIQ);
 
-        pr_debug("kfd: In func %s initializing queue type %d size %d\n",
+        pr_debug("amdkfd: In func %s initializing queue type %d size %d\n",
                         __func__, KFD_QUEUE_TYPE_HIQ, queue_size);
 
         nop.opcode = IT_NOP;
@@ -69,12 +69,16 @@ static bool initialize(struct kernel_queue *kq, struct kfd_dev *dev,
 
         prop.doorbell_ptr = kfd_get_kernel_doorbell(dev, &prop.doorbell_off);
 
-        if (prop.doorbell_ptr == NULL)
+        if (prop.doorbell_ptr == NULL) {
+                pr_err("amdkfd: error init doorbell");
                 goto err_get_kernel_doorbell;
+        }
 
         retval = kfd_gtt_sa_allocate(dev, queue_size, &kq->pq);
-        if (retval != 0)
+        if (retval != 0) {
+                pr_err("amdkfd: error init pq queues size (%d)\n", queue_size);
                 goto err_pq_allocate_vidmem;
+        }
 
         kq->pq_kernel_addr = kq->pq->cpu_ptr;
         kq->pq_gpu_addr = kq->pq->gpu_addr;
@@ -165,10 +169,8 @@ err_rptr_allocate_vidmem:
 err_eop_allocate_vidmem:
         kfd_gtt_sa_free(dev, kq->pq);
 err_pq_allocate_vidmem:
-        pr_err("kfd: error init pq\n");
         kfd_release_kernel_doorbell(dev, prop.doorbell_ptr);
 err_get_kernel_doorbell:
-        pr_err("kfd: error init doorbell");
         return false;
 
 }
@@ -187,6 +189,8 @@ static void uninitialize(struct kernel_queue *kq)
         else if (kq->queue->properties.type == KFD_QUEUE_TYPE_DIQ)
                 kfd_gtt_sa_free(kq->dev, kq->fence_mem_obj);
 
+        kq->mqd->uninit_mqd(kq->mqd, kq->queue->mqd, kq->queue->mqd_mem_obj);
+
         kfd_gtt_sa_free(kq->dev, kq->rptr_mem);
         kfd_gtt_sa_free(kq->dev, kq->wptr_mem);
         kq->ops_asic_specific.uninitialize(kq);
@@ -211,7 +215,7 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         queue_address = (unsigned int *)kq->pq_kernel_addr;
         queue_size_dwords = kq->queue->properties.queue_size / sizeof(uint32_t);
 
-        pr_debug("kfd: In func %s\nrptr: %d\nwptr: %d\nqueue_address 0x%p\n",
+        pr_debug("amdkfd: In func %s\nrptr: %d\nwptr: %d\nqueue_address 0x%p\n",
                         __func__, rptr, wptr, queue_address);
 
         available_size = (rptr - 1 - wptr + queue_size_dwords) %
@@ -296,7 +300,7 @@ struct kernel_queue *kernel_queue_init(struct kfd_dev *dev,
         }
 
         if (kq->ops.initialize(kq, dev, type, KFD_KERNEL_QUEUE_SIZE) == false) {
-                pr_err("kfd: failed to init kernel queue\n");
+                pr_err("amdkfd: failed to init kernel queue\n");
                 kfree(kq);
                 return NULL;
         }
@@ -319,7 +323,7 @@ static __attribute__((unused)) void test_kq(struct kfd_dev *dev)
 
         BUG_ON(!dev);
 
-        pr_err("kfd: starting kernel queue test\n");
+        pr_err("amdkfd: starting kernel queue test\n");
 
         kq = kernel_queue_init(dev, KFD_QUEUE_TYPE_HIQ);
         BUG_ON(!kq);
@@ -330,7 +334,7 @@ static __attribute__((unused)) void test_kq(struct kfd_dev *dev)
                 buffer[i] = kq->nop_packet;
         kq->ops.submit_packet(kq);
 
-        pr_err("kfd: ending kernel queue test\n");
+        pr_err("amdkfd: ending kernel queue test\n");
 }
 
 
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6b6b07ff720b..b6f076b213bc 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -43,9 +43,10 @@
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv);
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv);
 
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)                          \
@@ -524,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
 }
 EXPORT_SYMBOL(drm_framebuffer_reference);
 
-static void drm_framebuffer_free_bug(struct kref *kref)
-{
-        BUG();
-}
-
-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
-{
-        DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
-        kref_put(&fb->refcount, drm_framebuffer_free_bug);
-}
-
 /**
  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
  * @fb: fb to unregister
@@ -1319,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
                 return;
         }
         /* disconnect the plane from the fb and crtc: */
-        __drm_framebuffer_unreference(plane->old_fb);
+        drm_framebuffer_unreference(plane->old_fb);
         plane->old_fb = NULL;
         plane->fb = NULL;
         plane->crtc = NULL;
@@ -2131,7 +2121,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
         connector = drm_connector_find(dev, out_resp->connector_id);
         if (!connector) {
                 ret = -ENOENT;
-                goto out;
+                goto out_unlock;
         }
 
         for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
@@ -2211,6 +2201,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
 
 out:
         drm_modeset_unlock(&dev->mode_config.connection_mutex);
+
+out_unlock:
         mutex_unlock(&dev->mode_config.mutex);
 
         return ret;
@@ -2908,13 +2900,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
          */
         if (req->flags & DRM_MODE_CURSOR_BO) {
                 if (req->handle) {
-                        fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+                        fb = internal_framebuffer_create(dev, &fbreq, file_priv);
                         if (IS_ERR(fb)) {
                                 DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
                                 return PTR_ERR(fb);
                         }
-
-                        drm_framebuffer_reference(fb);
                 } else {
                         fb = NULL;
                 }
@@ -3267,9 +3257,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
         return 0;
 }
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv)
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv)
 {
         struct drm_mode_config *config = &dev->mode_config;
         struct drm_framebuffer *fb;
@@ -3301,12 +3292,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
                 return fb;
         }
 
-        mutex_lock(&file_priv->fbs_lock);
-        r->fb_id = fb->base.id;
-        list_add(&fb->filp_head, &file_priv->fbs);
-        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-        mutex_unlock(&file_priv->fbs_lock);
-
         return fb;
 }
 
@@ -3328,15 +3313,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
 int drm_mode_addfb2(struct drm_device *dev,
                     void *data, struct drm_file *file_priv)
 {
+        struct drm_mode_fb_cmd2 *r = data;
         struct drm_framebuffer *fb;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        fb = add_framebuffer_internal(dev, data, file_priv);
+        fb = internal_framebuffer_create(dev, r, file_priv);
         if (IS_ERR(fb))
                 return PTR_ERR(fb);
 
+        /* Transfer ownership to the filp for reaping on close */
+
+        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_lock(&file_priv->fbs_lock);
+        r->fb_id = fb->base.id;
+        list_add(&fb->filp_head, &file_priv->fbs);
+        mutex_unlock(&file_priv->fbs_lock);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 9a5b68717ec8..379ab4555756 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -733,10 +733,14 @@ static bool check_txmsg_state(struct drm_dp_mst_topology_mgr *mgr,
                               struct drm_dp_sideband_msg_tx *txmsg)
 {
         bool ret;
-        mutex_lock(&mgr->qlock);
+
+        /*
+         * All updates to txmsg->state are protected by mgr->qlock, and the two
+         * cases we check here are terminal states. For those the barriers
+         * provided by the wake_up/wait_event pair are enough.
+         */
         ret = (txmsg->state == DRM_DP_SIDEBAND_TX_RX ||
                txmsg->state == DRM_DP_SIDEBAND_TX_TIMEOUT);
-        mutex_unlock(&mgr->qlock);
         return ret;
 }
 
@@ -1363,12 +1367,13 @@ static int process_single_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
         return 0;
 }
 
-/* must be called holding qlock */
 static void process_single_down_tx_qlock(struct drm_dp_mst_topology_mgr *mgr)
 {
         struct drm_dp_sideband_msg_tx *txmsg;
         int ret;
 
+        WARN_ON(!mutex_is_locked(&mgr->qlock));
+
         /* construct a chunk from the first msg in the tx_msg queue */
         if (list_empty(&mgr->tx_msg_downq)) {
                 mgr->tx_down_in_progress = false;
diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
index 732cb6f8e653..4c0aa97aaf03 100644
--- a/drivers/gpu/drm/drm_edid_load.c
+++ b/drivers/gpu/drm/drm_edid_load.c
@@ -287,6 +287,7 @@ int drm_load_edid_firmware(struct drm_connector *connector)
 
         drm_mode_connector_update_edid_property(connector, edid);
         ret = drm_add_edid_modes(connector, edid);
+        drm_edid_to_eld(connector, edid);
         kfree(edid);
 
         return ret;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 7fc6f8bd4821..1134526286c8 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -403,7 +403,7 @@ static int check_free_hole(u64 start, u64 end, u64 size, unsigned alignment)
                 unsigned rem;
 
                 rem = do_div(tmp, alignment);
-                if (tmp)
+                if (rem)
                         start += alignment - rem;
         }
 
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
index 6591d48c1b9d..3fee587bc284 100644
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -174,6 +174,7 @@ static int drm_helper_probe_single_connector_modes_merge_bits(struct drm_connect
                         struct edid *edid = (struct edid *) connector->edid_blob_ptr->data;
 
                         count = drm_add_edid_modes(connector, edid);
+                        drm_edid_to_eld(connector, edid);
                 } else
                         count = (*connector_funcs->get_modes)(connector);
         }
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index a5e74612100e..0a6780367d28 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -50,7 +50,7 @@ config DRM_EXYNOS_DSI
 
 config DRM_EXYNOS_DP
         bool "EXYNOS DRM DP driver support"
-        depends on (DRM_EXYNOS_FIMD || DRM_EXYNOS7DECON) && ARCH_EXYNOS && (DRM_PTN3460=n || DRM_PTN3460=y || DRM_PTN3460=DRM_EXYNOS)
+        depends on (DRM_EXYNOS_FIMD || DRM_EXYNOS7_DECON) && ARCH_EXYNOS && (DRM_PTN3460=n || DRM_PTN3460=y || DRM_PTN3460=DRM_EXYNOS)
         default DRM_EXYNOS
         select DRM_PANEL
         help
diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
index 63f02e2380ae..970046199608 100644
--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
@@ -888,8 +888,8 @@ static int decon_probe(struct platform_device *pdev)
         of_node_put(i80_if_timings);
 
         ctx->regs = of_iomap(dev->of_node, 0);
-        if (IS_ERR(ctx->regs)) {
-                ret = PTR_ERR(ctx->regs);
+        if (!ctx->regs) {
+                ret = -ENOMEM;
                 goto err_del_component;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
deleted file mode 100644
index ba9b3d5ed672..000000000000
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Copyright (c) 2011 Samsung Electronics Co., Ltd.
- * Authors:
- *      Inki Dae <inki.dae@samsung.com>
- *      Joonyoung Shim <jy0922.shim@samsung.com>
- *      Seung-Woo Kim <sw0312.kim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-
-#include <drm/drmP.h>
-#include <drm/drm_crtc_helper.h>
-
-#include <drm/exynos_drm.h>
-#include "exynos_drm_drv.h"
-#include "exynos_drm_encoder.h"
-#include "exynos_drm_connector.h"
-
-#define to_exynos_connector(x)  container_of(x, struct exynos_drm_connector,\
-                                drm_connector)
-
-struct exynos_drm_connector {
-        struct drm_connector            drm_connector;
-        uint32_t                        encoder_id;
-        struct exynos_drm_display       *display;
-};
-
-static int exynos_drm_connector_get_modes(struct drm_connector *connector)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        struct edid *edid = NULL;
-        unsigned int count = 0;
-        int ret;
-
-        /*
-         * if get_edid() exists then get_edid() callback of hdmi side
-         * is called to get edid data through i2c interface else
-         * get timing from the FIMD driver(display controller).
-         *
-         * P.S. in case of lcd panel, count is always 1 if success
-         * because lcd panel has only one mode.
-         */
-        if (display->ops->get_edid) {
-                edid = display->ops->get_edid(display, connector);
-                if (IS_ERR_OR_NULL(edid)) {
-                        ret = PTR_ERR(edid);
-                        edid = NULL;
-                        DRM_ERROR("Panel operation get_edid failed %d\n", ret);
-                        goto out;
-                }
-
-                count = drm_add_edid_modes(connector, edid);
-                if (!count) {
-                        DRM_ERROR("Add edid modes failed %d\n", count);
-                        goto out;
-                }
-
-                drm_mode_connector_update_edid_property(connector, edid);
-        } else {
-                struct exynos_drm_panel_info *panel;
-                struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                if (!mode) {
-                        DRM_ERROR("failed to create a new display mode.\n");
-                        return 0;
-                }
-
-                if (display->ops->get_panel)
-                        panel = display->ops->get_panel(display);
-                else {
-                        drm_mode_destroy(connector->dev, mode);
-                        return 0;
-                }
-
-                drm_display_mode_from_videomode(&panel->vm, mode);
-                mode->width_mm = panel->width_mm;
-                mode->height_mm = panel->height_mm;
-                connector->display_info.width_mm = mode->width_mm;
-                connector->display_info.height_mm = mode->height_mm;
-
-                mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
-                drm_mode_set_name(mode);
-                drm_mode_probed_add(connector, mode);
-
-                count = 1;
-        }
-
-out:
-        kfree(edid);
-        return count;
-}
-
-static int exynos_drm_connector_mode_valid(struct drm_connector *connector,
-                                            struct drm_display_mode *mode)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        int ret = MODE_BAD;
-
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-
-        if (display->ops->check_mode)
-                if (!display->ops->check_mode(display, mode))
-                        ret = MODE_OK;
-
-        return ret;
-}
-
-static struct drm_encoder *exynos_drm_best_encoder(
-                struct drm_connector *connector)
-{
-        struct drm_device *dev = connector->dev;
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        return drm_encoder_find(dev, exynos_connector->encoder_id);
-}
-
-static struct drm_connector_helper_funcs exynos_connector_helper_funcs = {
-        .get_modes      = exynos_drm_connector_get_modes,
-        .mode_valid     = exynos_drm_connector_mode_valid,
-        .best_encoder   = exynos_drm_best_encoder,
-};
-
-static int exynos_drm_connector_fill_modes(struct drm_connector *connector,
-                                unsigned int max_width, unsigned int max_height)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        unsigned int width, height;
-
-        width = max_width;
-        height = max_height;
-
-        /*
-         * if specific driver want to find desired_mode using maxmum
-         * resolution then get max width and height from that driver.
-         */
-        if (display->ops->get_max_resol)
-                display->ops->get_max_resol(display, &width, &height);
-
-        return drm_helper_probe_single_connector_modes(connector, width,
-                                                        height);
-}
-
-/* get detection status of display device. */
-static enum drm_connector_status
-exynos_drm_connector_detect(struct drm_connector *connector, bool force)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        enum drm_connector_status status = connector_status_disconnected;
-
-        if (display->ops->is_connected) {
-                if (display->ops->is_connected(display))
-                        status = connector_status_connected;
-                else
-                        status = connector_status_disconnected;
-        }
-
-        return status;
-}
-
-static void exynos_drm_connector_destroy(struct drm_connector *connector)
-{
-        struct exynos_drm_connector *exynos_connector =
-                to_exynos_connector(connector);
-
-        drm_connector_unregister(connector);
-        drm_connector_cleanup(connector);
-        kfree(exynos_connector);
-}
-
-static struct drm_connector_funcs exynos_connector_funcs = {
-        .dpms           = drm_helper_connector_dpms,
-        .fill_modes     = exynos_drm_connector_fill_modes,
-        .detect         = exynos_drm_connector_detect,
-        .destroy        = exynos_drm_connector_destroy,
-};
-
-struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
-                                                   struct drm_encoder *encoder)
-{
-        struct exynos_drm_connector *exynos_connector;
-        struct exynos_drm_display *display = exynos_drm_get_display(encoder);
-        struct drm_connector *connector;
-        int type;
-        int err;
-
-        exynos_connector = kzalloc(sizeof(*exynos_connector), GFP_KERNEL);
-        if (!exynos_connector)
-                return NULL;
-
-        connector = &exynos_connector->drm_connector;
-
-        switch (display->type) {
-        case EXYNOS_DISPLAY_TYPE_HDMI:
-                type = DRM_MODE_CONNECTOR_HDMIA;
-                connector->interlace_allowed = true;
-                connector->polled = DRM_CONNECTOR_POLL_HPD;
-                break;
-        case EXYNOS_DISPLAY_TYPE_VIDI:
-                type = DRM_MODE_CONNECTOR_VIRTUAL;
-                connector->polled = DRM_CONNECTOR_POLL_HPD;
-                break;
-        default:
-                type = DRM_MODE_CONNECTOR_Unknown;
-                break;
-        }
-
-        drm_connector_init(dev, connector, &exynos_connector_funcs, type);
-        drm_connector_helper_add(connector, &exynos_connector_helper_funcs);
-
-        err = drm_connector_register(connector);
-        if (err)
-                goto err_connector;
-
-        exynos_connector->encoder_id = encoder->base.id;
-        exynos_connector->display = display;
-        connector->dpms = DRM_MODE_DPMS_OFF;
-        connector->encoder = encoder;
-
-        err = drm_mode_connector_attach_encoder(connector, encoder);
-        if (err) {
-                DRM_ERROR("failed to attach a connector to a encoder\n");
-                goto err_sysfs;
-        }
-
-        DRM_DEBUG_KMS("connector has been created\n");
-
-        return connector;
-
-err_sysfs:
-        drm_connector_unregister(connector);
-err_connector:
-        drm_connector_cleanup(connector);
-        kfree(exynos_connector);
-        return NULL;
-}
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.h b/drivers/gpu/drm/exynos/exynos_drm_connector.h
deleted file mode 100644
index 4eb20d78379a..000000000000
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (c) 2011 Samsung Electronics Co., Ltd.
- * Authors:
- *      Inki Dae <inki.dae@samsung.com>
- *      Joonyoung Shim <jy0922.shim@samsung.com>
- *      Seung-Woo Kim <sw0312.kim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-
-#ifndef _EXYNOS_DRM_CONNECTOR_H_
-#define _EXYNOS_DRM_CONNECTOR_H_
-
-struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
-                                                   struct drm_encoder *encoder);
-
-#endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 925fc69af1a0..33a10ce967ea 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -147,6 +147,7 @@ struct fimd_win_data {
         unsigned int            ovl_height;
         unsigned int            fb_width;
         unsigned int            fb_height;
+        unsigned int            fb_pitch;
         unsigned int            bpp;
         unsigned int            pixel_format;
         dma_addr_t              dma_addr;
@@ -284,14 +285,9 @@ static void fimd_clear_channel(struct fimd_context *ctx)
         }
 }
 
-static int fimd_ctx_initialize(struct fimd_context *ctx,
+static int fimd_iommu_attach_devices(struct fimd_context *ctx,
                         struct drm_device *drm_dev)
 {
-        struct exynos_drm_private *priv;
-        priv = drm_dev->dev_private;
-
-        ctx->drm_dev = drm_dev;
-        ctx->pipe = priv->pipe++;
 
         /* attach this sub driver to iommu mapping if supported. */
         if (is_drm_iommu_supported(ctx->drm_dev)) {
@@ -313,7 +309,7 @@ static int fimd_ctx_initialize(struct fimd_context *ctx,
         return 0;
 }
 
-static void fimd_ctx_remove(struct fimd_context *ctx)
+static void fimd_iommu_detach_devices(struct fimd_context *ctx)
 {
         /* detach this sub driver from iommu mapping if supported. */
         if (is_drm_iommu_supported(ctx->drm_dev))
@@ -537,13 +533,14 @@ static void fimd_win_mode_set(struct exynos_drm_crtc *crtc,
         win_data->offset_y = plane->crtc_y;
         win_data->ovl_width = plane->crtc_width;
         win_data->ovl_height = plane->crtc_height;
+        win_data->fb_pitch = plane->pitch;
         win_data->fb_width = plane->fb_width;
         win_data->fb_height = plane->fb_height;
         win_data->dma_addr = plane->dma_addr[0] + offset;
         win_data->bpp = plane->bpp;
         win_data->pixel_format = plane->pixel_format;
-        win_data->buf_offsize = (plane->fb_width - plane->crtc_width) *
-                                (plane->bpp >> 3);
+        win_data->buf_offsize =
+                plane->pitch - (plane->crtc_width * (plane->bpp >> 3));
         win_data->line_size = plane->crtc_width * (plane->bpp >> 3);
 
         DRM_DEBUG_KMS("offset_x = %d, offset_y = %d\n",
@@ -709,7 +706,7 @@ static void fimd_win_commit(struct exynos_drm_crtc *crtc, int zpos)
         writel(val, ctx->regs + VIDWx_BUF_START(win, 0));
 
         /* buffer end address */
-        size = win_data->fb_width * win_data->ovl_height * (win_data->bpp >> 3);
+        size = win_data->fb_pitch * win_data->ovl_height * (win_data->bpp >> 3);
         val = (unsigned long)(win_data->dma_addr + size);
         writel(val, ctx->regs + VIDWx_BUF_END(win, 0));
 
@@ -1056,25 +1053,23 @@ static int fimd_bind(struct device *dev, struct device *master, void *data)
 {
         struct fimd_context *ctx = dev_get_drvdata(dev);
         struct drm_device *drm_dev = data;
+        struct exynos_drm_private *priv = drm_dev->dev_private;
         int ret;
 
-        ret = fimd_ctx_initialize(ctx, drm_dev);
-        if (ret) {
-                DRM_ERROR("fimd_ctx_initialize failed.\n");
-                return ret;
-        }
+        ctx->drm_dev = drm_dev;
+        ctx->pipe = priv->pipe++;
 
         ctx->crtc = exynos_drm_crtc_create(drm_dev, ctx->pipe,
                                            EXYNOS_DISPLAY_TYPE_LCD,
                                            &fimd_crtc_ops, ctx);
-        if (IS_ERR(ctx->crtc)) {
-                fimd_ctx_remove(ctx);
-                return PTR_ERR(ctx->crtc);
-        }
 
         if (ctx->display)
                 exynos_drm_create_enc_conn(drm_dev, ctx->display);
 
+        ret = fimd_iommu_attach_devices(ctx, drm_dev);
+        if (ret)
+                return ret;
+
         return 0;
 
 }
@@ -1086,10 +1081,10 @@ static void fimd_unbind(struct device *dev, struct device *master,
 
         fimd_dpms(ctx->crtc, DRM_MODE_DPMS_OFF);
 
+        fimd_iommu_detach_devices(ctx);
+
         if (ctx->display)
                 exynos_dpi_remove(ctx->display);
-
-        fimd_ctx_remove(ctx);
 }
 
 static const struct component_ops fimd_component_ops = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index a5616872eee7..8ad5b7294eb4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -175,7 +175,7 @@ static int exynos_disable_plane(struct drm_plane *plane)
         struct exynos_drm_plane *exynos_plane = to_exynos_plane(plane);
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(plane->crtc);
 
-        if (exynos_crtc->ops->win_disable)
+        if (exynos_crtc && exynos_crtc->ops->win_disable)
                 exynos_crtc->ops->win_disable(exynos_crtc,
                                               exynos_plane->zpos);
 
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 3518bc4654c5..2e3bc57ea50e 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -55,6 +55,7 @@ struct hdmi_win_data {
         unsigned int            fb_x;
         unsigned int            fb_y;
         unsigned int            fb_width;
+        unsigned int            fb_pitch;
         unsigned int            fb_height;
         unsigned int            src_width;
         unsigned int            src_height;
@@ -438,7 +439,7 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
         } else {
                 luma_addr[0] = win_data->dma_addr;
                 chroma_addr[0] = win_data->dma_addr
-                        + (win_data->fb_width * win_data->fb_height);
+                        + (win_data->fb_pitch * win_data->fb_height);
         }
 
         if (win_data->scan_flags & DRM_MODE_FLAG_INTERLACE) {
@@ -447,8 +448,8 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
                         luma_addr[1] = luma_addr[0] + 0x40;
                         chroma_addr[1] = chroma_addr[0] + 0x40;
                 } else {
-                        luma_addr[1] = luma_addr[0] + win_data->fb_width;
-                        chroma_addr[1] = chroma_addr[0] + win_data->fb_width;
+                        luma_addr[1] = luma_addr[0] + win_data->fb_pitch;
+                        chroma_addr[1] = chroma_addr[0] + win_data->fb_pitch;
                 }
         } else {
                 ctx->interlace = false;
@@ -469,10 +470,10 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
         vp_reg_writemask(res, VP_MODE, val, VP_MODE_FMT_MASK);
 
         /* setting size of input image */
-        vp_reg_write(res, VP_IMG_SIZE_Y, VP_IMG_HSIZE(win_data->fb_width) |
+        vp_reg_write(res, VP_IMG_SIZE_Y, VP_IMG_HSIZE(win_data->fb_pitch) |
                 VP_IMG_VSIZE(win_data->fb_height));
         /* chroma height has to reduced by 2 to avoid chroma distorions */
-        vp_reg_write(res, VP_IMG_SIZE_C, VP_IMG_HSIZE(win_data->fb_width) |
+        vp_reg_write(res, VP_IMG_SIZE_C, VP_IMG_HSIZE(win_data->fb_pitch) |
                 VP_IMG_VSIZE(win_data->fb_height / 2));
 
         vp_reg_write(res, VP_SRC_WIDTH, win_data->src_width);
@@ -559,7 +560,7 @@ static void mixer_graph_buffer(struct mixer_context *ctx, int win)
         /* converting dma address base and source offset */
         dma_addr = win_data->dma_addr
                 + (win_data->fb_x * win_data->bpp >> 3)
-                + (win_data->fb_y * win_data->fb_width * win_data->bpp >> 3);
+                + (win_data->fb_y * win_data->fb_pitch);
         src_x_offset = 0;
         src_y_offset = 0;
 
@@ -576,7 +577,8 @@ static void mixer_graph_buffer(struct mixer_context *ctx, int win)
                 MXR_GRP_CFG_FORMAT_VAL(fmt), MXR_GRP_CFG_FORMAT_MASK);
 
         /* setup geometry */
-        mixer_reg_write(res, MXR_GRAPHIC_SPAN(win), win_data->fb_width);
+        mixer_reg_write(res, MXR_GRAPHIC_SPAN(win),
+                        win_data->fb_pitch / (win_data->bpp >> 3));
 
         /* setup display size */
         if (ctx->mxr_ver == MXR_VER_128_0_0_184 &&
@@ -961,6 +963,7 @@ static void mixer_win_mode_set(struct exynos_drm_crtc *crtc,
         win_data->fb_y = plane->fb_y;
         win_data->fb_width = plane->fb_width;
         win_data->fb_height = plane->fb_height;
+        win_data->fb_pitch = plane->pitch;
         win_data->src_width = plane->src_width;
         win_data->src_height = plane->src_height;
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index cc6ea53d2b81..5c66b568bb81 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1095,6 +1095,7 @@ static void vlv_save_gunit_s0ix_state(struct drm_i915_private *dev_priv)
         /* Gunit-Display CZ domain, 0x182028-0x1821CF */
         s->gu_ctl0              = I915_READ(VLV_GU_CTL0);
         s->gu_ctl1              = I915_READ(VLV_GU_CTL1);
+        s->pcbr                 = I915_READ(VLV_PCBR);
         s->clock_gate_dis2      = I915_READ(VLV_GUNIT_CLOCK_GATE2);
 
         /*
@@ -1189,6 +1190,7 @@ static void vlv_restore_gunit_s0ix_state(struct drm_i915_private *dev_priv)
         /* Gunit-Display CZ domain, 0x182028-0x1821CF */
         I915_WRITE(VLV_GU_CTL0,                 s->gu_ctl0);
         I915_WRITE(VLV_GU_CTL1,                 s->gu_ctl1);
+        I915_WRITE(VLV_PCBR,                    s->pcbr);
         I915_WRITE(VLV_GUNIT_CLOCK_GATE2,       s->clock_gate_dis2);
 }
 
@@ -1197,19 +1199,7 @@ int vlv_force_gfx_clock(struct drm_i915_private *dev_priv, bool force_on)
         u32 val;
         int err;
 
-        val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
-        WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on);
-
 #define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT)
-        /* Wait for a previous force-off to settle */
-        if (force_on) {
-                err = wait_for(!COND, 20);
-                if (err) {
-                        DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n",
-                                  I915_READ(VLV_GTLC_SURVIVABILITY_REG));
-                        return err;
-                }
-        }
 
         val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
         val &= ~VLV_GFX_CLK_FORCE_ON_BIT;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8727086cf48c..b4faa2df9d3d 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1094,6 +1094,7 @@ struct vlv_s0ix_state {
         /* Display 2 CZ domain */
         u32 gu_ctl0;
         u32 gu_ctl1;
+        u32 pcbr;
         u32 clock_gate_dis2;
 };
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index e5daad5f75fb..27ea6bdebce7 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2737,24 +2737,11 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
 
         WARN_ON(i915_verify_lists(ring->dev));
 
-        /* Move any buffers on the active list that are no longer referenced
-         * by the ringbuffer to the flushing/inactive lists as appropriate,
-         * before we free the context associated with the requests.
+        /* Retire requests first as we use it above for the early return.
+         * If we retire requests last, we may use a later seqno and so clear
+         * the requests lists without clearing the active list, leading to
+         * confusion.
          */
-        while (!list_empty(&ring->active_list)) {
-                struct drm_i915_gem_object *obj;
-
-                obj = list_first_entry(&ring->active_list,
-                                      struct drm_i915_gem_object,
-                                      ring_list);
-
-                if (!i915_gem_request_completed(obj->last_read_req, true))
-                        break;
-
-                i915_gem_object_move_to_inactive(obj);
-        }
-
-
         while (!list_empty(&ring->request_list)) {
                 struct drm_i915_gem_request *request;
                 struct intel_ringbuffer *ringbuf;
@@ -2789,6 +2776,23 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
                 i915_gem_free_request(request);
         }
 
+        /* Move any buffers on the active list that are no longer referenced
+         * by the ringbuffer to the flushing/inactive lists as appropriate,
+         * before we free the context associated with the requests.
+         */
+        while (!list_empty(&ring->active_list)) {
+                struct drm_i915_gem_object *obj;
+
+                obj = list_first_entry(&ring->active_list,
+                                      struct drm_i915_gem_object,
+                                      ring_list);
+
+                if (!i915_gem_request_completed(obj->last_read_req, true))
+                        break;
+
+                i915_gem_object_move_to_inactive(obj);
+        }
+
         if (unlikely(ring->trace_irq_req &&
                      i915_gem_request_completed(ring->trace_irq_req, true))) {
                 ring->irq_put(ring);
@@ -2936,9 +2940,9 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
         req = obj->last_read_req;
 
         /* Do this after OLR check to make sure we make forward progress polling
-         * on this IOCTL with a timeout <=0 (like busy ioctl)
+         * on this IOCTL with a timeout == 0 (like busy ioctl)
          */
-        if (args->timeout_ns <= 0) {
+        if (args->timeout_ns == 0) {
                 ret = -ETIME;
                 goto out;
         }
@@ -2948,7 +2952,8 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
         i915_gem_request_reference(req);
         mutex_unlock(&dev->struct_mutex);
 
-        ret = __i915_wait_request(req, reset_counter, true, &args->timeout_ns,
+        ret = __i915_wait_request(req, reset_counter, true,
+                                  args->timeout_ns > 0 ? &args->timeout_ns : NULL,
                                   file->driver_priv);
         mutex_lock(&dev->struct_mutex);
         i915_gem_request_unreference(req);
@@ -4792,6 +4797,9 @@ i915_gem_init_hw(struct drm_device *dev)
         if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
                 return -EIO;
 
+        /* Double layer security blanket, see i915_gem_init() */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
+
         if (dev_priv->ellc_size)
                 I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
 
@@ -4824,7 +4832,7 @@ i915_gem_init_hw(struct drm_device *dev)
         for_each_ring(ring, dev_priv, i) {
                 ret = ring->init_hw(ring);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
         for (i = 0; i < NUM_L3_SLICES(dev); i++)
@@ -4841,9 +4849,11 @@ i915_gem_init_hw(struct drm_device *dev)
                 DRM_ERROR("Context enable failed %d\n", ret);
                 i915_gem_cleanup_ringbuffer(dev);
 
-                return ret;
+                goto out;
         }
 
+out:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
         return ret;
 }
 
@@ -4877,6 +4887,14 @@ int i915_gem_init(struct drm_device *dev)
                 dev_priv->gt.stop_ring = intel_logical_ring_stop;
         }
 
+        /* This is just a security blanket to placate dragons.
+         * On some systems, we very sporadically observe that the first TLBs
+         * used by the CS may be stale, despite us poking the TLB reset. If
+         * we hold the forcewake during initialisation these problems
+         * just magically go away.
+         */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
+
         ret = i915_gem_init_userptr(dev);
         if (ret)
                 goto out_unlock;
@@ -4903,6 +4921,7 @@ int i915_gem_init(struct drm_device *dev)
         }
 
 out_unlock:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
         mutex_unlock(&dev->struct_mutex);
 
         return ret;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index b773368fc62c..38a742532c4f 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1487,7 +1487,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 goto err;
         }
 
-        if (i915_needs_cmd_parser(ring)) {
+        if (i915_needs_cmd_parser(ring) && args->batch_len) {
                 batch_obj = i915_gem_execbuffer_parse(ring,
                                                       &shadow_exec_entry,
                                                       eb,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e730789b53b7..f75173c20f47 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -37,6 +37,7 @@
 #include <drm/i915_drm.h>
 #include "i915_drv.h"
 #include "i915_trace.h"
+#include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_dp_helper.h>
 #include <drm/drm_crtc_helper.h>
@@ -2416,6 +2417,14 @@ out_unref_obj:
         return false;
 }
 
+/* Update plane->state->fb to match plane->fb after driver-internal updates */
+static void
+update_state_fb(struct drm_plane *plane)
+{
+        if (plane->fb != plane->state->fb)
+                drm_atomic_set_fb_for_plane(plane->state, plane->fb);
+}
+
 static void
 intel_find_plane_obj(struct intel_crtc *intel_crtc,
                      struct intel_initial_plane_config *plane_config)
@@ -2429,8 +2438,15 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
         if (!intel_crtc->base.primary->fb)
                 return;
 
-        if (intel_alloc_plane_obj(intel_crtc, plane_config))
+        if (intel_alloc_plane_obj(intel_crtc, plane_config)) {
+                struct drm_plane *primary = intel_crtc->base.primary;
+
+                primary->state->crtc = &intel_crtc->base;
+                primary->crtc = &intel_crtc->base;
+                update_state_fb(primary);
+
                 return;
+        }
 
         kfree(intel_crtc->base.primary->fb);
         intel_crtc->base.primary->fb = NULL;
@@ -2453,15 +2469,21 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
                         continue;
 
                 if (i915_gem_obj_ggtt_offset(obj) == plane_config->base) {
+                        struct drm_plane *primary = intel_crtc->base.primary;
+
                         if (obj->tiling_mode != I915_TILING_NONE)
                                 dev_priv->preserve_bios_swizzle = true;
 
                         drm_framebuffer_reference(c->primary->fb);
-                        intel_crtc->base.primary->fb = c->primary->fb;
+                        primary->fb = c->primary->fb;
+                        primary->state->crtc = &intel_crtc->base;
+                        primary->crtc = &intel_crtc->base;
                         obj->frontbuffer_bits |= INTEL_FRONTBUFFER_PRIMARY(intel_crtc->pipe);
                         break;
                 }
         }
+
+        update_state_fb(intel_crtc->base.primary);
 }
 
 static void i9xx_update_primary_plane(struct drm_crtc *crtc,
@@ -6602,6 +6624,10 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
         struct drm_framebuffer *fb;
         struct intel_framebuffer *intel_fb;
 
+        val = I915_READ(DSPCNTR(plane));
+        if (!(val & DISPLAY_PLANE_ENABLE))
+                return;
+
         intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
         if (!intel_fb) {
                 DRM_DEBUG_KMS("failed to alloc fb\n");
@@ -6610,8 +6636,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
 
         fb = &intel_fb->base;
 
-        val = I915_READ(DSPCNTR(plane));
-
         if (INTEL_INFO(dev)->gen >= 4)
                 if (val & DISPPLANE_TILED)
                         plane_config->tiling = I915_TILING_X;
@@ -7643,6 +7667,9 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
         fb = &intel_fb->base;
 
         val = I915_READ(PLANE_CTL(pipe, 0));
+        if (!(val & PLANE_CTL_ENABLE))
+                goto error;
+
         if (val & PLANE_CTL_TILED_MASK)
                 plane_config->tiling = I915_TILING_X;
 
@@ -7730,6 +7757,10 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
         struct drm_framebuffer *fb;
         struct intel_framebuffer *intel_fb;
 
+        val = I915_READ(DSPCNTR(pipe));
+        if (!(val & DISPLAY_PLANE_ENABLE))
+                return;
+
         intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
         if (!intel_fb) {
                 DRM_DEBUG_KMS("failed to alloc fb\n");
@@ -7738,8 +7769,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
 
         fb = &intel_fb->base;
 
-        val = I915_READ(DSPCNTR(pipe));
-
         if (INTEL_INFO(dev)->gen >= 4)
                 if (val & DISPPLANE_TILED)
                         plane_config->tiling = I915_TILING_X;
@@ -9716,7 +9745,7 @@ void intel_check_page_flip(struct drm_device *dev, int pipe)
         struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
 
-        WARN_ON(!in_irq());
+        WARN_ON(!in_interrupt());
 
         if (crtc == NULL)
                 return;
@@ -9816,6 +9845,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         drm_gem_object_reference(&obj->base);
 
         crtc->primary->fb = fb;
+        update_state_fb(crtc->primary);
 
         work->pending_flip_obj = obj;
 
@@ -9884,6 +9914,7 @@ cleanup_unpin:
 cleanup_pending:
         atomic_dec(&intel_crtc->unpin_work_count);
         crtc->primary->fb = old_fb;
+        update_state_fb(crtc->primary);
         drm_gem_object_unreference(&work->old_fb_obj->base);
         drm_gem_object_unreference(&obj->base);
         mutex_unlock(&dev->struct_mutex);
@@ -13718,6 +13749,7 @@ void intel_modeset_gem_init(struct drm_device *dev)
                                   to_intel_crtc(c)->pipe);
                         drm_framebuffer_unreference(c->primary->fb);
                         c->primary->fb = NULL;
+                        update_state_fb(c->primary);
                 }
         }
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 0a52c44ad03d..9c5451c97942 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -1322,7 +1322,7 @@ int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
         drm_modeset_lock_all(dev);
 
         plane = drm_plane_find(dev, set->plane_id);
-        if (!plane) {
+        if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
                 ret = -ENOENT;
                 goto out_unlock;
         }
@@ -1349,7 +1349,7 @@ int intel_sprite_get_colorkey(struct drm_device *dev, void *data,
         drm_modeset_lock_all(dev);
 
         plane = drm_plane_find(dev, get->plane_id);
-        if (!plane) {
+        if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
                 ret = -ENOENT;
                 goto out_unlock;
         }
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index c47a3baa53d5..4e8fb891d4ea 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -1048,8 +1048,14 @@ static void intel_uncore_fw_domains_init(struct drm_device *dev)
 
                 /* We need to init first for ECOBUS access and then
                  * determine later if we want to reinit, in case of MT access is
-                 * not working
+                 * not working. In this stage we don't know which flavour this
+                 * ivb is, so it is better to reset also the gen6 fw registers
+                 * before the ecobus check.
                  */
+
+                __raw_i915_write32(dev_priv, FORCEWAKE, 0);
+                __raw_posting_read(dev_priv, ECOBUS);
+
                 fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
                                FORCEWAKE_MT, FORCEWAKE_MT_ACK);
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 29bd539af183..6efa8f38ff54 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -340,11 +340,13 @@ nvkm_devobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
 
                 /* switch mmio to cpu's native endianness */
 #ifndef __BIG_ENDIAN
-                if (ioread32_native(map + 0x000004) != 0x00000000)
+                if (ioread32_native(map + 0x000004) != 0x00000000) {
 #else
-                if (ioread32_native(map + 0x000004) == 0x00000000)
+                if (ioread32_native(map + 0x000004) == 0x00000000) {
 #endif
                         iowrite32_native(0x01000001, map + 0x000004);
+                        ioread32_native(map);
+                }
 
                 /* read boot0 and strapping information */
                 boot0 = ioread32_native(map + 0x000000);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
index 539561ed3281..108d048da764 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
@@ -142,6 +142,49 @@ gm100_identify(struct nvkm_device *device)
                 device->oclass[NVDEV_ENGINE_MSPPP  ] = &gf100_msppp_oclass;
 #endif
                 break;
+        case 0x126:
+                device->cname = "GM206";
+                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nvkm_bios_oclass;
+                device->oclass[NVDEV_SUBDEV_GPIO   ] =  gk104_gpio_oclass;
+                device->oclass[NVDEV_SUBDEV_I2C    ] =  gm204_i2c_oclass;
+                device->oclass[NVDEV_SUBDEV_FUSE   ] = &gm107_fuse_oclass;
+#if 0
+                /* looks to be some non-trivial changes */
+                device->oclass[NVDEV_SUBDEV_CLK    ] = &gk104_clk_oclass;
+                /* priv ring says no to 0x10eb14 writes */
+                device->oclass[NVDEV_SUBDEV_THERM  ] = &gm107_therm_oclass;
+#endif
+                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
+                device->oclass[NVDEV_SUBDEV_DEVINIT] =  gm204_devinit_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  gk20a_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_BUS    ] =  gf100_bus_oclass;
+                device->oclass[NVDEV_SUBDEV_TIMER  ] = &gk20a_timer_oclass;
+                device->oclass[NVDEV_SUBDEV_FB     ] =  gm107_fb_oclass;
+                device->oclass[NVDEV_SUBDEV_LTC    ] =  gm107_ltc_oclass;
+                device->oclass[NVDEV_SUBDEV_IBUS   ] = &gk104_ibus_oclass;
+                device->oclass[NVDEV_SUBDEV_INSTMEM] =  nv50_instmem_oclass;
+                device->oclass[NVDEV_SUBDEV_MMU    ] = &gf100_mmu_oclass;
+                device->oclass[NVDEV_SUBDEV_BAR    ] = &gf100_bar_oclass;
+                device->oclass[NVDEV_SUBDEV_PMU    ] =  gk208_pmu_oclass;
+#if 0
+                device->oclass[NVDEV_SUBDEV_VOLT   ] = &nv40_volt_oclass;
+#endif
+                device->oclass[NVDEV_ENGINE_DMAOBJ ] =  gf110_dmaeng_oclass;
+#if 0
+                device->oclass[NVDEV_ENGINE_FIFO   ] =  gk208_fifo_oclass;
+                device->oclass[NVDEV_ENGINE_SW     ] =  gf100_sw_oclass;
+                device->oclass[NVDEV_ENGINE_GR     ] =  gm107_gr_oclass;
+#endif
+                device->oclass[NVDEV_ENGINE_DISP   ] =  gm204_disp_oclass;
+#if 0
+                device->oclass[NVDEV_ENGINE_CE0    ] = &gm204_ce0_oclass;
+                device->oclass[NVDEV_ENGINE_CE1    ] = &gm204_ce1_oclass;
+                device->oclass[NVDEV_ENGINE_CE2    ] = &gm204_ce2_oclass;
+                device->oclass[NVDEV_ENGINE_MSVLD  ] = &gk104_msvld_oclass;
+                device->oclass[NVDEV_ENGINE_MSPDEC ] = &gk104_mspdec_oclass;
+                device->oclass[NVDEV_ENGINE_MSPPP  ] = &gf100_msppp_oclass;
+#endif
+                break;
         default:
                 nv_fatal(device, "unknown Maxwell chipset\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
index b038b6eb51db..043e4296084c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
@@ -502,72 +502,57 @@ nv04_fifo_intr(struct nvkm_subdev *subdev)
 {
         struct nvkm_device *device = nv_device(subdev);
         struct nv04_fifo_priv *priv = (void *)subdev;
-        uint32_t status, reassign;
-        int cnt = 0;
+        u32 mask = nv_rd32(priv, NV03_PFIFO_INTR_EN_0);
+        u32 stat = nv_rd32(priv, NV03_PFIFO_INTR_0) & mask;
+        u32 reassign, chid, get, sem;
 
         reassign = nv_rd32(priv, NV03_PFIFO_CACHES) & 1;
-        while ((status = nv_rd32(priv, NV03_PFIFO_INTR_0)) && (cnt++ < 100)) {
-                uint32_t chid, get;
-
-                nv_wr32(priv, NV03_PFIFO_CACHES, 0);
-
-                chid = nv_rd32(priv, NV03_PFIFO_CACHE1_PUSH1) & priv->base.max;
-                get  = nv_rd32(priv, NV03_PFIFO_CACHE1_GET);
+        nv_wr32(priv, NV03_PFIFO_CACHES, 0);
 
-                if (status & NV_PFIFO_INTR_CACHE_ERROR) {
-                        nv04_fifo_cache_error(device, priv, chid, get);
-                        status &= ~NV_PFIFO_INTR_CACHE_ERROR;
-                }
+        chid = nv_rd32(priv, NV03_PFIFO_CACHE1_PUSH1) & priv->base.max;
+        get  = nv_rd32(priv, NV03_PFIFO_CACHE1_GET);
 
-                if (status & NV_PFIFO_INTR_DMA_PUSHER) {
-                        nv04_fifo_dma_pusher(device, priv, chid);
-                        status &= ~NV_PFIFO_INTR_DMA_PUSHER;
-                }
+        if (stat & NV_PFIFO_INTR_CACHE_ERROR) {
+                nv04_fifo_cache_error(device, priv, chid, get);
+                stat &= ~NV_PFIFO_INTR_CACHE_ERROR;
+        }
 
-                if (status & NV_PFIFO_INTR_SEMAPHORE) {
-                        uint32_t sem;
+        if (stat & NV_PFIFO_INTR_DMA_PUSHER) {
+                nv04_fifo_dma_pusher(device, priv, chid);
+                stat &= ~NV_PFIFO_INTR_DMA_PUSHER;
+        }
 
-                        status &= ~NV_PFIFO_INTR_SEMAPHORE;
-                        nv_wr32(priv, NV03_PFIFO_INTR_0,
-                                NV_PFIFO_INTR_SEMAPHORE);
+        if (stat & NV_PFIFO_INTR_SEMAPHORE) {
+                stat &= ~NV_PFIFO_INTR_SEMAPHORE;
+                nv_wr32(priv, NV03_PFIFO_INTR_0, NV_PFIFO_INTR_SEMAPHORE);
 
-                        sem = nv_rd32(priv, NV10_PFIFO_CACHE1_SEMAPHORE);
-                        nv_wr32(priv, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
+                sem = nv_rd32(priv, NV10_PFIFO_CACHE1_SEMAPHORE);
+                nv_wr32(priv, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
 
-                        nv_wr32(priv, NV03_PFIFO_CACHE1_GET, get + 4);
-                        nv_wr32(priv, NV04_PFIFO_CACHE1_PULL0, 1);
-                }
+                nv_wr32(priv, NV03_PFIFO_CACHE1_GET, get + 4);
+                nv_wr32(priv, NV04_PFIFO_CACHE1_PULL0, 1);
+        }
 
-                if (device->card_type == NV_50) {
-                        if (status & 0x00000010) {
-                                status &= ~0x00000010;
-                                nv_wr32(priv, 0x002100, 0x00000010);
-                        }
-
-                        if (status & 0x40000000) {
-                                nv_wr32(priv, 0x002100, 0x40000000);
-                                nvkm_fifo_uevent(&priv->base);
-                                status &= ~0x40000000;
-                        }
+        if (device->card_type == NV_50) {
+                if (stat & 0x00000010) {
+                        stat &= ~0x00000010;
+                        nv_wr32(priv, 0x002100, 0x00000010);
                 }
 
-                if (status) {
-                        nv_warn(priv, "unknown intr 0x%08x, ch %d\n",
-                                status, chid);
-                        nv_wr32(priv, NV03_PFIFO_INTR_0, status);
-                        status = 0;
+                if (stat & 0x40000000) {
+                        nv_wr32(priv, 0x002100, 0x40000000);
+                        nvkm_fifo_uevent(&priv->base);
+                        stat &= ~0x40000000;
                 }
-
-                nv_wr32(priv, NV03_PFIFO_CACHES, reassign);
         }
 
-        if (status) {
-                nv_error(priv, "still angry after %d spins, halt\n", cnt);
-                nv_wr32(priv, 0x002140, 0);
-                nv_wr32(priv, 0x000140, 0);
+        if (stat) {
+                nv_warn(priv, "unknown intr 0x%08x\n", stat);
+                nv_mask(priv, NV03_PFIFO_INTR_EN_0, stat, 0x00000000);
+                nv_wr32(priv, NV03_PFIFO_INTR_0, stat);
         }
 
-        nv_wr32(priv, 0x000100, 0x00000100);
+        nv_wr32(priv, NV03_PFIFO_CACHES, reassign);
 }
 
 static int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
index 2e7ec389eea7..57e2c5b13123 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
@@ -1032,9 +1032,9 @@ gf100_grctx_generate_bundle(struct gf100_grctx *info)
         const int s = 8;
         const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
         mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
         mmio_refn(info, 0x418808, 0x00000000, s, b);
-        mmio_refn(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s));
 }
 
 void
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
index b52300d8861a..5e9454ba158f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
@@ -851,9 +851,9 @@ gk104_grctx_generate_bundle(struct gf100_grctx *info)
         const int s = 8;
         const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
         mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
         mmio_refn(info, 0x418808, 0x00000000, s, b);
-        mmio_refn(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s));
         mmio_wr32(info, 0x4064c8, (state_limit << 16) | token_limit);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
index 956f4dce960c..b2fae6e389e2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
@@ -871,9 +871,9 @@ gm107_grctx_generate_bundle(struct gf100_grctx *info)
         const int s = 8;
         const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
         mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
         mmio_refn(info, 0x418e24, 0x00000000, s, b);
-        mmio_refn(info, 0x418e28, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x418e28, 0x80000000 | (impl->bundle_size >> s));
         mmio_wr32(info, 0x4064c8, (state_limit << 16) | token_limit);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
index d1a89b2bd5c1..c4e1f085ee10 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
@@ -74,7 +74,11 @@ dcb_i2c_parse(struct nvkm_bios *bios, u8 idx, struct dcb_i2c_entry *info)
         u16 ent = dcb_i2c_entry(bios, idx, &ver, &len);
         if (ent) {
                 if (ver >= 0x41) {
-                        if (!(nv_ro32(bios, ent) & 0x80000000))
+                        u32 ent_value = nv_ro32(bios, ent);
+                        u8 i2c_port = (ent_value >> 27) & 0x1f;
+                        u8 dpaux_port = (ent_value >> 22) & 0x1f;
+                        /* value 0x1f means unused according to DCB 4.x spec */
+                        if (i2c_port == 0x1f && dpaux_port == 0x1f)
                                 info->type = DCB_I2C_UNUSED;
                         else
                                 info->type = DCB_I2C_PMGR;
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index c648e1996dab..243a36c93b8f 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -2129,6 +2129,7 @@
 #define VCE_UENC_REG_CLOCK_GATING       0x207c0
 #define VCE_SYS_INT_EN                  0x21300
 #       define VCE_SYS_INT_TRAP_INTERRUPT_EN    (1 << 3)
+#define VCE_LMI_VCPU_CACHE_40BIT_BAR    0x2145c
 #define VCE_LMI_CTRL2                   0x21474
 #define VCE_LMI_CTRL                    0x21498
 #define VCE_LMI_VM_CTRL                 0x214a0
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 5587603b4a89..33d5a4f4eebd 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1565,6 +1565,7 @@ struct radeon_dpm {
         int                     new_active_crtc_count;
         u32                     current_active_crtcs;
         int                     current_active_crtc_count;
+        bool single_display;
         struct radeon_dpm_dynamic_state dyn_state;
         struct radeon_dpm_fan fan;
         u32 tdp_limit;
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 63ccb8fa799c..d27e4ccb848c 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
 
 static bool radeon_read_bios(struct radeon_device *rdev)
 {
-        uint8_t __iomem *bios;
+        uint8_t __iomem *bios, val1, val2;
         size_t size;
 
         rdev->bios = NULL;
@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
                 return false;
         }
 
-        if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
+        val1 = readb(&bios[0]);
+        val2 = readb(&bios[1]);
+
+        if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
                 pci_unmap_rom(rdev->pdev, bios);
                 return false;
         }
-        rdev->bios = kmemdup(bios, size, GFP_KERNEL);
+        rdev->bios = kzalloc(size, GFP_KERNEL);
         if (rdev->bios == NULL) {
                 pci_unmap_rom(rdev->pdev, bios);
                 return false;
         }
+        memcpy_fromio(rdev->bios, bios, size);
         pci_unmap_rom(rdev->pdev, bios);
         return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index d13d1b5a859f..df09ca7c4889 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
         return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
 }
 
+struct radeon_wait_cb {
+        struct fence_cb base;
+        struct task_struct *task;
+};
+
+static void
+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
+{
+        struct radeon_wait_cb *wait =
+                container_of(cb, struct radeon_wait_cb, base);
+
+        wake_up_process(wait->task);
+}
+
 static signed long radeon_fence_default_wait(struct fence *f, bool intr,
                                              signed long t)
 {
         struct radeon_fence *fence = to_radeon_fence(f);
         struct radeon_device *rdev = fence->rdev;
-        bool signaled;
+        struct radeon_wait_cb cb;
 
-        fence_enable_sw_signaling(&fence->base);
+        cb.task = current;
 
-        /*
-         * This function has to return -EDEADLK, but cannot hold
-         * exclusive_lock during the wait because some callers
-         * may already hold it. This means checking needs_reset without
-         * lock, and not fiddling with any gpu internals.
-         *
-         * The callback installed with fence_enable_sw_signaling will
-         * run before our wait_event_*timeout call, so we will see
-         * both the signaled fence and the changes to needs_reset.
-         */
+        if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
+                return t;
+
+        while (t > 0) {
+                if (intr)
+                        set_current_state(TASK_INTERRUPTIBLE);
+                else
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+
+                /*
+                 * radeon_test_signaled must be called after
+                 * set_current_state to prevent a race with wake_up_process
+                 */
+                if (radeon_test_signaled(fence))
+                        break;
+
+                if (rdev->needs_reset) {
+                        t = -EDEADLK;
+                        break;
+                }
+
+                t = schedule_timeout(t);
+
+                if (t > 0 && intr && signal_pending(current))
+                        t = -ERESTARTSYS;
+        }
+
+        __set_current_state(TASK_RUNNING);
+        fence_remove_callback(f, &cb.base);
 
-        if (intr)
-                t = wait_event_interruptible_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-        else
-                t = wait_event_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-
-        if (t > 0 && !signaled)
-                return -EDEADLK;
         return t;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 061eaa9c19c7..122eb5693ba1 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -153,7 +153,7 @@ void radeon_kfd_device_init(struct radeon_device *rdev)
                         .compute_vmid_bitmap = 0xFF00,
 
                         .first_compute_pipe = 1,
-                        .compute_pipe_count = 8 - 1,
+                        .compute_pipe_count = 4 - 1,
                 };
 
                 radeon_doorbell_get_kfd_info(rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_mn.c b/drivers/gpu/drm/radeon/radeon_mn.c
index a69bd441dd2d..572b4dbec186 100644
--- a/drivers/gpu/drm/radeon/radeon_mn.c
+++ b/drivers/gpu/drm/radeon/radeon_mn.c
@@ -122,7 +122,6 @@ static void radeon_mn_invalidate_range_start(struct mmu_notifier *mn,
         it = interval_tree_iter_first(&rmn->objects, start, end);
         while (it) {
                 struct radeon_bo *bo;
-                struct fence *fence;
                 int r;
 
                 bo = container_of(it, struct radeon_bo, mn_it);
@@ -134,12 +133,10 @@ static void radeon_mn_invalidate_range_start(struct mmu_notifier *mn,
                         continue;
                 }
 
-                fence = reservation_object_get_excl(bo->tbo.resv);
-                if (fence) {
-                        r = radeon_fence_wait((struct radeon_fence *)fence, false);
-                        if (r)
-                                DRM_ERROR("(%d) failed to wait for user bo\n", r);
-                }
+                r = reservation_object_wait_timeout_rcu(bo->tbo.resv, true,
+                        false, MAX_SCHEDULE_TIMEOUT);
+                if (r)
+                        DRM_ERROR("(%d) failed to wait for user bo\n", r);
 
                 radeon_ttm_placement_from_domain(bo, RADEON_GEM_DOMAIN_CPU);
                 r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 43e09942823e..318165d4855c 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -173,17 +173,6 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
                 else
                         rbo->placements[i].lpfn = 0;
         }
-
-        /*
-         * Use two-ended allocation depending on the buffer size to
-         * improve fragmentation quality.
-         * 512kb was measured as the most optimal number.
-         */
-        if (rbo->tbo.mem.size > 512 * 1024) {
-                for (i = 0; i < c; i++) {
-                        rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
-                }
-        }
 }
 
 int radeon_bo_create(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 33cf4108386d..c1ba83a8dd8c 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -837,12 +837,8 @@ static void radeon_dpm_thermal_work_handler(struct work_struct *work)
         radeon_pm_compute_clocks(rdev);
 }
 
-static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
-                                                     enum radeon_pm_state_type dpm_state)
+static bool radeon_dpm_single_display(struct radeon_device *rdev)
 {
-        int i;
-        struct radeon_ps *ps;
-        u32 ui_class;
         bool single_display = (rdev->pm.dpm.new_active_crtc_count < 2) ?
                 true : false;
 
@@ -858,6 +854,17 @@ static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
         if (single_display && (r600_dpm_get_vrefresh(rdev) >= 120))
                 single_display = false;
 
+        return single_display;
+}
+
+static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+                                                     enum radeon_pm_state_type dpm_state)
+{
+        int i;
+        struct radeon_ps *ps;
+        u32 ui_class;
+        bool single_display = radeon_dpm_single_display(rdev);
+
         /* certain older asics have a separare 3D performance state,
          * so try that first if the user selected performance
          */
@@ -983,6 +990,7 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
         struct radeon_ps *ps;
         enum radeon_pm_state_type dpm_state;
         int ret;
+        bool single_display = radeon_dpm_single_display(rdev);
 
         /* if dpm init failed */
         if (!rdev->pm.dpm_enabled)
@@ -1007,6 +1015,9 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
                 /* vce just modifies an existing state so force a change */
                 if (ps->vce_active != rdev->pm.dpm.vce_active)
                         goto force;
+                /* user has made a display change (such as timing) */
+                if (rdev->pm.dpm.single_display != single_display)
+                        goto force;
                 if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) {
                         /* for pre-BTC and APUs if the num crtcs changed but state is the same,
                          * all we need to do is update the display configuration.
@@ -1069,6 +1080,7 @@ force:
 
         rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
         rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+        rdev->pm.dpm.single_display = single_display;
 
         /* wait for the rings to drain */
         for (i = 0; i < RADEON_NUM_RINGS; i++) {
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 2456f69efd23..8c7872339c2a 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -495,7 +495,7 @@ static int radeon_debugfs_ring_info(struct seq_file *m, void *data)
         seq_printf(m, "%u free dwords in ring\n", ring->ring_free_dw);
         seq_printf(m, "%u dwords in ring\n", count);
 
-        if (!ring->ready)
+        if (!ring->ring)
                 return 0;
 
         /* print 8 dw before current rptr as often it's the last executed
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index d02aa1d0f588..b292aca0f342 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -598,6 +598,10 @@ static void radeon_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
         enum dma_data_direction direction = write ?
                 DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
 
+        /* double check that we don't free the table twice */
+        if (!ttm->sg->sgl)
+                return;
+
         /* free the sg table and pages again */
         dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index e088e5558da0..a7fb2735d4a9 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -7130,8 +7130,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
         WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
 
         if (!vclk || !dclk) {
-                /* keep the Bypass mode, put PLL to sleep */
-                WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+                /* keep the Bypass mode */
                 return 0;
         }
 
@@ -7147,8 +7146,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
         /* set VCO_MODE to 1 */
         WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
 
-        /* toggle UPLL_SLEEP to 1 then back to 0 */
-        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+        /* disable sleep mode */
         WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
 
         /* deassert UPLL_RESET */
diff --git a/drivers/gpu/drm/radeon/vce_v2_0.c b/drivers/gpu/drm/radeon/vce_v2_0.c
index 1ac7bb825a1b..fbbe78fbd087 100644
--- a/drivers/gpu/drm/radeon/vce_v2_0.c
+++ b/drivers/gpu/drm/radeon/vce_v2_0.c
@@ -156,6 +156,9 @@ int vce_v2_0_resume(struct radeon_device *rdev)
         WREG32(VCE_LMI_SWAP_CNTL1, 0);
         WREG32(VCE_LMI_VM_CTRL, 0);
 
+        WREG32(VCE_LMI_VCPU_CACHE_40BIT_BAR, addr >> 8);
+
+        addr &= 0xff;
         size = RADEON_GPU_PAGE_ALIGN(rdev->vce_fw->size);
         WREG32(VCE_VCPU_CACHE_OFFSET0, addr & 0x7fffffff);
         WREG32(VCE_VCPU_CACHE_SIZE0, size);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 6c6b655defcf..e13b9cbc304e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_err1;
         }
 
-        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-                             (dev_priv->vram_size >> PAGE_SHIFT));
-        if (unlikely(ret != 0)) {
-                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-                goto out_err2;
-        }
-
-        dev_priv->has_gmr = true;
-        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-                                         VMW_PL_GMR) != 0) {
-                DRM_INFO("No GMR memory available. "
-                         "Graphics memory resources are very limited.\n");
-                dev_priv->has_gmr = false;
-        }
-
-        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-                dev_priv->has_mob = true;
-                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-                                   VMW_PL_MOB) != 0) {
-                        DRM_INFO("No MOB memory available. "
-                                 "3D will be disabled.\n");
-                        dev_priv->has_mob = false;
-                }
-        }
-
         dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
                                                dev_priv->mmio_size);
 
@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_no_fman;
         }
 
+
+        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+                             (dev_priv->vram_size >> PAGE_SHIFT));
+        if (unlikely(ret != 0)) {
+                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+                goto out_no_vram;
+        }
+
+        dev_priv->has_gmr = true;
+        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+                                         VMW_PL_GMR) != 0) {
+                DRM_INFO("No GMR memory available. "
+                         "Graphics memory resources are very limited.\n");
+                dev_priv->has_gmr = false;
+        }
+
+        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+                dev_priv->has_mob = true;
+                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+                                   VMW_PL_MOB) != 0) {
+                        DRM_INFO("No MOB memory available. "
+                                 "3D will be disabled.\n");
+                        dev_priv->has_mob = false;
+                }
+        }
+
         vmw_kms_save_vga(dev_priv);
 
         /* Start kms and overlay systems, needs fifo. */
@@ -838,6 +839,12 @@ out_no_fifo:
         vmw_kms_close(dev_priv);
 out_no_kms:
         vmw_kms_restore_vga(dev_priv);
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_no_vram:
         vmw_fence_manager_takedown(dev_priv->fman);
 out_no_fman:
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
@@ -853,12 +860,6 @@ out_err4:
         iounmap(dev_priv->mmio_virt);
 out_err3:
         arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-out_err2:
         (void)ttm_bo_device_release(&dev_priv->bdev);
 out_err1:
         vmw_ttm_global_release(dev_priv);
@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_device *dev)
         }
         vmw_kms_close(dev_priv);
         vmw_overlay_close(dev_priv);
+
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+
         vmw_fence_manager_takedown(dev_priv->fman);
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
                 drm_irq_uninstall(dev_priv->dev);
@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_device *dev)
         ttm_object_device_release(&dev_priv->tdev);
         iounmap(dev_priv->mmio_virt);
         arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
         (void)ttm_bo_device_release(&dev_priv->bdev);
         vmw_ttm_global_release(dev_priv);
 
@@ -1235,6 +1238,7 @@ static void vmw_remove(struct pci_dev *pdev)
 {
         struct drm_device *dev = pci_get_drvdata(pdev);
 
+        pci_disable_device(pdev);
         drm_put_dev(dev);
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 33176d05db35..654c8daeb5ab 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -890,7 +890,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
         ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use MOB buffer.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
         }
         bo = &vmw_bo->base;
 
@@ -914,7 +915,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
 
 out_no_reloc:
         vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
         return ret;
 }
 
@@ -951,7 +952,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
         ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use GMR region.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
         }
         bo = &vmw_bo->base;
 
@@ -974,7 +976,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
 
 out_no_reloc:
         vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
         return ret;
 }
 
@@ -2780,13 +2782,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
                                   NULL, arg->command_size, arg->throttle_us,
                                   (void __user *)(unsigned long)arg->fence_rep,
                                   NULL);
-
+        ttm_read_unlock(&dev_priv->reservation_sem);
         if (unlikely(ret != 0))
-                goto out_unlock;
+                return ret;
 
         vmw_kms_cursor_post_execbuf(dev_priv);
 
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
-        return ret;
+        return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 8725b79e7847..07cda8cbbddb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         int i;
         struct drm_mode_config *mode_config = &dev->mode_config;
 
-        ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-        if (unlikely(ret != 0))
-                return ret;
-
         if (!arg->num_outputs) {
                 struct drm_vmw_rect def_rect = {0, 0, 800, 600};
                 vmw_du_update_layout(dev_priv, 1, &def_rect);
-                goto out_unlock;
+                return 0;
         }
 
         rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
         rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
                         GFP_KERNEL);
-        if (unlikely(!rects)) {
-                ret = -ENOMEM;
-                goto out_unlock;
-        }
+        if (unlikely(!rects))
+                return -ENOMEM;
 
         user_rects = (void __user *)(unsigned long)arg->rects;
         ret = copy_from_user(rects, user_rects, rects_size);
@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
 
 out_free:
         kfree(rects);
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
         return ret;
 }
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 7c669c328c4c..56ce8c2b5530 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1959,6 +1959,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 204312bfab2c..9c4786759f16 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -586,6 +586,7 @@
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
 #define USB_DEVICE_ID_LOGITECH_T651     0xb00c
+#define USB_DEVICE_ID_LOGITECH_C077     0xc007
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
@@ -898,6 +899,7 @@
 #define USB_VENDOR_ID_TIVO              0x150a
 #define USB_DEVICE_ID_TIVO_SLIDE_BT     0x1200
 #define USB_DEVICE_ID_TIVO_SLIDE        0x1201
+#define USB_DEVICE_ID_TIVO_SLIDE_PRO    0x1203
 
 #define USB_VENDOR_ID_TOPSEED           0x0766
 #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c
index d790d8d71f7f..d98696927453 100644
--- a/drivers/hid/hid-tivo.c
+++ b/drivers/hid/hid-tivo.c
@@ -64,6 +64,7 @@ static const struct hid_device_id tivo_devices[] = {
         /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, tivo_devices);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 9be99a67bfe2..a82127753461 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -78,6 +78,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 046351cf17f3..bbe32d66e500 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -551,9 +551,13 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
            (features->type == CINTIQ && !(data[1] & 0x40)))
                 return 1;
 
-        if (features->quirks & WACOM_QUIRK_MULTI_INPUT)
+        if (wacom->shared) {
                 wacom->shared->stylus_in_proximity = true;
 
+                if (wacom->shared->touch_down)
+                        return 1;
+        }
+
         /* in Range while exiting */
         if (((data[1] & 0xfe) == 0x20) && wacom->reporting_data) {
                 input_report_key(input, BTN_TOUCH, 0);
@@ -1043,27 +1047,28 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
         struct input_dev *input = wacom->input;
         unsigned char *data = wacom->data;
         int i;
-        int current_num_contacts = 0;
+        int current_num_contacts = data[61];
         int contacts_to_send = 0;
         int num_contacts_left = 4; /* maximum contacts per packet */
         int byte_per_packet = WACOM_BYTES_PER_24HDT_PACKET;
         int y_offset = 2;
+        static int contact_with_no_pen_down_count = 0;
 
         if (wacom->features.type == WACOM_27QHDT) {
                 current_num_contacts = data[63];
                 num_contacts_left = 10;
                 byte_per_packet = WACOM_BYTES_PER_QHDTHID_PACKET;
                 y_offset = 0;
-        } else {
-                current_num_contacts = data[61];
         }
 
         /*
          * First packet resets the counter since only the first
          * packet in series will have non-zero current_num_contacts.
          */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                 wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
 
         contacts_to_send = min(num_contacts_left, wacom->num_contacts_left);
 
@@ -1096,15 +1101,16 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
                                 input_report_abs(input, ABS_MT_WIDTH_MINOR, min(w, h));
                                 input_report_abs(input, ABS_MT_ORIENTATION, w > h);
                         }
+                        contact_with_no_pen_down_count++;
                 }
         }
         input_mt_report_pointer_emulation(input, true);
 
         wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left <= 0)
+        if (wacom->num_contacts_left <= 0) {
                 wacom->num_contacts_left = 0;
-
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
+        }
         return 1;
 }
 
@@ -1116,6 +1122,7 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
         int current_num_contacts = data[2];
         int contacts_to_send = 0;
         int x_offset = 0;
+        static int contact_with_no_pen_down_count = 0;
 
         /* MTTPC does not support Height and Width */
         if (wacom->features.type == MTTPC || wacom->features.type == MTTPC_B)
@@ -1125,8 +1132,10 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
          * First packet resets the counter since only the first
          * packet in series will have non-zero current_num_contacts.
          */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                 wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
 
         /* There are at most 5 contacts per packet */
         contacts_to_send = min(5, wacom->num_contacts_left);
@@ -1147,15 +1156,16 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
                         int y = get_unaligned_le16(&data[offset + x_offset + 9]);
                         input_report_abs(input, ABS_MT_POSITION_X, x);
                         input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                 }
         }
         input_mt_report_pointer_emulation(input, true);
 
         wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left < 0)
+        if (wacom->num_contacts_left <= 0) {
                 wacom->num_contacts_left = 0;
-
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
+        }
         return 1;
 }
 
@@ -1193,29 +1203,25 @@ static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 {
         unsigned char *data = wacom->data;
         struct input_dev *input = wacom->input;
-        bool prox;
+        bool prox = !wacom->shared->stylus_in_proximity;
         int x = 0, y = 0;
 
         if (wacom->features.touch_max > 1 || len > WACOM_PKGLEN_TPC2FG)
                 return 0;
 
-        if (!wacom->shared->stylus_in_proximity) {
-                if (len == WACOM_PKGLEN_TPC1FG) {
-                        prox = data[0] & 0x01;
-                        x = get_unaligned_le16(&data[1]);
-                        y = get_unaligned_le16(&data[3]);
-                } else if (len == WACOM_PKGLEN_TPC1FG_B) {
-                        prox = data[2] & 0x01;
-                        x = get_unaligned_le16(&data[3]);
-                        y = get_unaligned_le16(&data[5]);
-                } else {
-                        prox = data[1] & 0x01;
-                        x = le16_to_cpup((__le16 *)&data[2]);
-                        y = le16_to_cpup((__le16 *)&data[4]);
-                }
-        } else
-                /* force touch out when pen is in prox */
-                prox = 0;
+        if (len == WACOM_PKGLEN_TPC1FG) {
+                prox = prox && (data[0] & 0x01);
+                x = get_unaligned_le16(&data[1]);
+                y = get_unaligned_le16(&data[3]);
+        } else if (len == WACOM_PKGLEN_TPC1FG_B) {
+                prox = prox && (data[2] & 0x01);
+                x = get_unaligned_le16(&data[3]);
+                y = get_unaligned_le16(&data[5]);
+        } else {
+                prox = prox && (data[1] & 0x01);
+                x = le16_to_cpup((__le16 *)&data[2]);
+                y = le16_to_cpup((__le16 *)&data[4]);
+        }
 
         if (prox) {
                 input_report_abs(input, ABS_X, x);
@@ -1613,6 +1619,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
         struct input_dev *pad_input = wacom->pad_input;
         unsigned char *data = wacom->data;
         int i;
+        int contact_with_no_pen_down_count = 0;
 
         if (data[0] != 0x02)
             return 0;
@@ -1640,6 +1647,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
                         }
                         input_report_abs(input, ABS_MT_POSITION_X, x);
                         input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                 }
         }
 
@@ -1649,11 +1657,12 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
         input_report_key(pad_input, BTN_FORWARD, (data[1] & 0x04) != 0);
         input_report_key(pad_input, BTN_BACK, (data[1] & 0x02) != 0);
         input_report_key(pad_input, BTN_RIGHT, (data[1] & 0x01) != 0);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
 
         return 1;
 }
 
-static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
+static int wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data, int last_touch_count)
 {
         struct wacom_features *features = &wacom->features;
         struct input_dev *input = wacom->input;
@@ -1661,7 +1670,7 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
         int slot = input_mt_get_slot_by_key(input, data[0]);
 
         if (slot < 0)
-                return;
+                return 0;
 
         touch = touch && !wacom->shared->stylus_in_proximity;
 
@@ -1693,7 +1702,9 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
                 input_report_abs(input, ABS_MT_POSITION_Y, y);
                 input_report_abs(input, ABS_MT_TOUCH_MAJOR, width);
                 input_report_abs(input, ABS_MT_TOUCH_MINOR, height);
+                last_touch_count++;
         }
+        return last_touch_count;
 }
 
 static void wacom_bpt3_button_msg(struct wacom_wac *wacom, unsigned char *data)
@@ -1718,6 +1729,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
         unsigned char *data = wacom->data;
         int count = data[1] & 0x07;
         int i;
+        int contact_with_no_pen_down_count = 0;
 
         if (data[0] != 0x02)
             return 0;
@@ -1728,12 +1740,15 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
                 int msg_id = data[offset];
 
                 if (msg_id >= 2 && msg_id <= 17)
-                        wacom_bpt3_touch_msg(wacom, data + offset);
+                        contact_with_no_pen_down_count = 
+                            wacom_bpt3_touch_msg(wacom, data + offset,
+                                                 contact_with_no_pen_down_count);
                 else if (msg_id == 128)
                         wacom_bpt3_button_msg(wacom, data + offset);
 
         }
         input_mt_report_pointer_emulation(input, true);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
 
         return 1;
 }
@@ -1759,6 +1774,9 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
                 return 0;
         }
 
+        if (wacom->shared->touch_down)
+                return 0;
+
         prox = (data[1] & 0x20) == 0x20;
 
         /*
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 210cf4874cb7..edf274cabe81 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -679,9 +679,6 @@ static int i2c_device_remove(struct device *dev)
                 status = driver->remove(client);
         }
 
-        if (dev->of_node)
-                irq_dispose_mapping(client->irq);
-
         dev_pm_domain_detach(&client->dev, true);
         return status;
 }
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 1793aea4a7d2..6eb738ca6d2f 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1793,11 +1793,11 @@ static void idetape_setup(ide_drive_t *drive, idetape_tape_t *tape, int minor)
         tape->best_dsc_rw_freq = clamp_t(unsigned long, t, IDETAPE_DSC_RW_MIN,
                                          IDETAPE_DSC_RW_MAX);
         printk(KERN_INFO "ide-tape: %s <-> %s: %dKBps, %d*%dkB buffer, "
-                "%lums tDSC%s\n",
+                "%ums tDSC%s\n",
                 drive->name, tape->name, *(u16 *)&tape->caps[14],
                 (*(u16 *)&tape->caps[16] * 512) / tape->buffer_size,
                 tape->buffer_size / 1024,
-                tape->best_dsc_rw_freq * 1000 / HZ,
+                jiffies_to_msecs(tape->best_dsc_rw_freq),
                 (drive->dev_flags & IDE_DFLAG_USING_DMA) ? ", DMA" : "");
 
         ide_proc_register_driver(drive, tape->driver);
diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index 1096da327130..75c6d2103e07 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -659,7 +659,7 @@ static irqreturn_t bma180_trigger_handler(int irq, void *p)
 
         mutex_lock(&data->mutex);
 
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                          indio_dev->masklength) {
                 ret = bma180_get_data_reg(data, bit);
                 if (ret < 0) {
diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
index 066d0c04072c..75567fd457dc 100644
--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -168,14 +168,14 @@ static const struct {
         int val;
         int val2;
         u8 bw_bits;
-} bmc150_accel_samp_freq_table[] = { {7, 810000, 0x08},
-                                     {15, 630000, 0x09},
-                                     {31, 250000, 0x0A},
-                                     {62, 500000, 0x0B},
-                                     {125, 0, 0x0C},
-                                     {250, 0, 0x0D},
-                                     {500, 0, 0x0E},
-                                     {1000, 0, 0x0F} };
+} bmc150_accel_samp_freq_table[] = { {15, 620000, 0x08},
+                                     {31, 260000, 0x09},
+                                     {62, 500000, 0x0A},
+                                     {125, 0, 0x0B},
+                                     {250, 0, 0x0C},
+                                     {500, 0, 0x0D},
+                                     {1000, 0, 0x0E},
+                                     {2000, 0, 0x0F} };
 
 static const struct {
         int bw_bits;
@@ -840,7 +840,7 @@ static int bmc150_accel_validate_trigger(struct iio_dev *indio_dev,
 }
 
 static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
-                "7.810000 15.630000 31.250000 62.500000 125 250 500 1000");
+                "15.620000 31.260000 62.50000 125 250 500 1000 2000");
 
 static struct attribute *bmc150_accel_attributes[] = {
         &iio_const_attr_sampling_frequency_available.dev_attr.attr,
@@ -986,7 +986,7 @@ static irqreturn_t bmc150_accel_trigger_handler(int irq, void *p)
         int bit, ret, i = 0;
 
         mutex_lock(&data->mutex);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                          indio_dev->masklength) {
                 ret = i2c_smbus_read_word_data(data->client,
                                                BMC150_ACCEL_AXIS_TO_REG(bit));
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 567de269cc00..1a6379525fa4 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -956,7 +956,7 @@ static irqreturn_t kxcjk1013_trigger_handler(int irq, void *p)
 
         mutex_lock(&data->mutex);
 
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                          indio_dev->masklength) {
                 ret = kxcjk1013_get_acc_reg(data, bit);
                 if (ret < 0) {
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 202daf889be2..46379b1fb25b 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -137,7 +137,8 @@ config AXP288_ADC
 
 config CC10001_ADC
         tristate "Cosmic Circuits 10001 ADC driver"
-        depends on HAS_IOMEM || HAVE_CLK || REGULATOR
+        depends on HAVE_CLK || REGULATOR
+        depends on HAS_IOMEM
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         help
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index ff61ae55dd3f..8a0eb4a04fb5 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -544,7 +544,6 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
 {
         struct iio_dev *idev = iio_trigger_get_drvdata(trig);
         struct at91_adc_state *st = iio_priv(idev);
-        struct iio_buffer *buffer = idev->buffer;
         struct at91_adc_reg_desc *reg = st->registers;
         u32 status = at91_adc_readl(st, reg->trigger_register);
         int value;
@@ -564,7 +563,7 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
                 at91_adc_writel(st, reg->trigger_register,
                                 status | value);
 
-                for_each_set_bit(bit, buffer->scan_mask,
+                for_each_set_bit(bit, idev->active_scan_mask,
                                  st->num_channels) {
                         struct iio_chan_spec const *chan = idev->channels + bit;
                         at91_adc_writel(st, AT91_ADC_CHER,
@@ -579,7 +578,7 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
                 at91_adc_writel(st, reg->trigger_register,
                                 status & ~value);
 
-                for_each_set_bit(bit, buffer->scan_mask,
+                for_each_set_bit(bit, idev->active_scan_mask,
                                  st->num_channels) {
                         struct iio_chan_spec const *chan = idev->channels + bit;
                         at91_adc_writel(st, AT91_ADC_CHDR,
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 2e5cc4409f78..a0e7161f040c 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -188,12 +188,11 @@ static int tiadc_buffer_preenable(struct iio_dev *indio_dev)
 static int tiadc_buffer_postenable(struct iio_dev *indio_dev)
 {
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
-        struct iio_buffer *buffer = indio_dev->buffer;
         unsigned int enb = 0;
         u8 bit;
 
         tiadc_step_config(indio_dev);
-        for_each_set_bit(bit, buffer->scan_mask, adc_dev->channels)
+        for_each_set_bit(bit, indio_dev->active_scan_mask, adc_dev->channels)
                 enb |= (get_adc_step_bit(adc_dev, bit) << 1);
         adc_dev->buffer_en_ch_steps = enb;
 
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 8ec353c01d98..e63b8e76d4c3 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -141,9 +141,13 @@ struct vf610_adc {
         struct regulator *vref;
         struct vf610_adc_feature adc_feature;
 
+        u32 sample_freq_avail[5];
+
         struct completion completion;
 };
 
+static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 };
+
 #define VF610_ADC_CHAN(_idx, _chan_type) {                      \
         .type = (_chan_type),                                   \
         .indexed = 1,                                           \
@@ -180,35 +184,47 @@ static const struct iio_chan_spec vf610_adc_iio_channels[] = {
         /* sentinel */
 };
 
-/*
- * ADC sample frequency, unit is ADCK cycles.
- * ADC clk source is ipg clock, which is the same as bus clock.
- *
- * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
- * SFCAdder: fixed to 6 ADCK cycles
- * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
- * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
- * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
- *
- * By default, enable 12 bit resolution mode, clock source
- * set to ipg clock, So get below frequency group:
- */
-static const u32 vf610_sample_freq_avail[5] =
-{1941176, 559332, 286957, 145374, 73171};
+static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
+{
+        unsigned long adck_rate, ipg_rate = clk_get_rate(info->clk);
+        int i;
+
+        /*
+         * Calculate ADC sample frequencies
+         * Sample time unit is ADCK cycles. ADCK clk source is ipg clock,
+         * which is the same as bus clock.
+         *
+         * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
+         * SFCAdder: fixed to 6 ADCK cycles
+         * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
+         * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
+         * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
+         */
+        adck_rate = ipg_rate / info->adc_feature.clk_div;
+        for (i = 0; i < ARRAY_SIZE(vf610_hw_avgs); i++)
+                info->sample_freq_avail[i] =
+                        adck_rate / (6 + vf610_hw_avgs[i] * (25 + 3));
+}
 
 static inline void vf610_adc_cfg_init(struct vf610_adc *info)
 {
+        struct vf610_adc_feature *adc_feature = &info->adc_feature;
+
         /* set default Configuration for ADC controller */
-        info->adc_feature.clk_sel = VF610_ADCIOC_BUSCLK_SET;
-        info->adc_feature.vol_ref = VF610_ADCIOC_VR_VREF_SET;
+        adc_feature->clk_sel = VF610_ADCIOC_BUSCLK_SET;
+        adc_feature->vol_ref = VF610_ADCIOC_VR_VREF_SET;
+
+        adc_feature->calibration = true;
+        adc_feature->ovwren = true;
+
+        adc_feature->res_mode = 12;
+        adc_feature->sample_rate = 1;
+        adc_feature->lpm = true;
 
-        info->adc_feature.calibration = true;
-        info->adc_feature.ovwren = true;
+        /* Use a save ADCK which is below 20MHz on all devices */
+        adc_feature->clk_div = 8;
 
-        info->adc_feature.clk_div = 1;
-        info->adc_feature.res_mode = 12;
-        info->adc_feature.sample_rate = 1;
-        info->adc_feature.lpm = true;
+        vf610_adc_calculate_rates(info);
 }
 
 static void vf610_adc_cfg_post_set(struct vf610_adc *info)
@@ -290,12 +306,10 @@ static void vf610_adc_cfg_set(struct vf610_adc *info)
 
         cfg_data = readl(info->regs + VF610_REG_ADC_CFG);
 
-        /* low power configuration */
         cfg_data &= ~VF610_ADC_ADLPC_EN;
         if (adc_feature->lpm)
                 cfg_data |= VF610_ADC_ADLPC_EN;
 
-        /* disable high speed */
         cfg_data &= ~VF610_ADC_ADHSC_EN;
 
         writel(cfg_data, info->regs + VF610_REG_ADC_CFG);
@@ -435,10 +449,27 @@ static irqreturn_t vf610_adc_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("1941176, 559332, 286957, 145374, 73171");
+static ssize_t vf610_show_samp_freq_avail(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct vf610_adc *info = iio_priv(dev_to_iio_dev(dev));
+        size_t len = 0;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(info->sample_freq_avail); i++)
+                len += scnprintf(buf + len, PAGE_SIZE - len,
+                        "%u ", info->sample_freq_avail[i]);
+
+        /* replace trailing space by newline */
+        buf[len - 1] = '\n';
+
+        return len;
+}
+
+static IIO_DEV_ATTR_SAMP_FREQ_AVAIL(vf610_show_samp_freq_avail);
 
 static struct attribute *vf610_attributes[] = {
-        &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+        &iio_dev_attr_sampling_frequency_available.dev_attr.attr,
         NULL
 };
 
@@ -502,7 +533,7 @@ static int vf610_read_raw(struct iio_dev *indio_dev,
                 return IIO_VAL_FRACTIONAL_LOG2;
 
         case IIO_CHAN_INFO_SAMP_FREQ:
-                *val = vf610_sample_freq_avail[info->adc_feature.sample_rate];
+                *val = info->sample_freq_avail[info->adc_feature.sample_rate];
                 *val2 = 0;
                 return IIO_VAL_INT;
 
@@ -525,9 +556,9 @@ static int vf610_write_raw(struct iio_dev *indio_dev,
         switch (mask) {
                 case IIO_CHAN_INFO_SAMP_FREQ:
                         for (i = 0;
-                                i < ARRAY_SIZE(vf610_sample_freq_avail);
+                                i < ARRAY_SIZE(info->sample_freq_avail);
                                 i++)
-                                if (val == vf610_sample_freq_avail[i]) {
+                                if (val == info->sample_freq_avail[i]) {
                                         info->adc_feature.sample_rate = i;
                                         vf610_adc_sample_set(info);
                                         return 0;
diff --git a/drivers/iio/gyro/bmg160.c b/drivers/iio/gyro/bmg160.c
index 60451b328242..ccf3ea7e1afa 100644
--- a/drivers/iio/gyro/bmg160.c
+++ b/drivers/iio/gyro/bmg160.c
@@ -822,7 +822,7 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p)
         int bit, ret, i = 0;
 
         mutex_lock(&data->mutex);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                          indio_dev->masklength) {
                 ret = i2c_smbus_read_word_data(data->client,
                                                BMG160_AXIS_TO_REG(bit));
diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
index e0017c22bb9c..f53e9a803a0e 100644
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
         iio_trigger_set_drvdata(adis->trig, adis);
         ret = iio_trigger_register(adis->trig);
 
-        indio_dev->trig = adis->trig;
+        indio_dev->trig = iio_trigger_get(adis->trig);
         if (ret)
                 goto error_free_irq;
 
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index d8d5bed65e07..ef76afe2643c 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -410,42 +410,46 @@ error_read_raw:
         }
 }
 
-static int inv_mpu6050_write_fsr(struct inv_mpu6050_state *st, int fsr)
+static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val)
 {
-        int result;
+        int result, i;
         u8 d;
 
-        if (fsr < 0 || fsr > INV_MPU6050_MAX_GYRO_FS_PARAM)
-                return -EINVAL;
-        if (fsr == st->chip_config.fsr)
-                return 0;
+        for (i = 0; i < ARRAY_SIZE(gyro_scale_6050); ++i) {
+                if (gyro_scale_6050[i] == val) {
+                        d = (i << INV_MPU6050_GYRO_CONFIG_FSR_SHIFT);
+                        result = inv_mpu6050_write_reg(st,
+                                        st->reg->gyro_config, d);
+                        if (result)
+                                return result;
 
-        d = (fsr << INV_MPU6050_GYRO_CONFIG_FSR_SHIFT);
-        result = inv_mpu6050_write_reg(st, st->reg->gyro_config, d);
-        if (result)
-                return result;
-        st->chip_config.fsr = fsr;
+                        st->chip_config.fsr = i;
+                        return 0;
+                }
+        }
 
-        return 0;
+        return -EINVAL;
 }
 
-static int inv_mpu6050_write_accel_fs(struct inv_mpu6050_state *st, int fs)
+static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
 {
-        int result;
+        int result, i;
         u8 d;
 
-        if (fs < 0 || fs > INV_MPU6050_MAX_ACCL_FS_PARAM)
-                return -EINVAL;
-        if (fs == st->chip_config.accl_fs)
-                return 0;
+        for (i = 0; i < ARRAY_SIZE(accel_scale); ++i) {
+                if (accel_scale[i] == val) {
+                        d = (i << INV_MPU6050_ACCL_CONFIG_FSR_SHIFT);
+                        result = inv_mpu6050_write_reg(st,
+                                        st->reg->accl_config, d);
+                        if (result)
+                                return result;
 
-        d = (fs << INV_MPU6050_ACCL_CONFIG_FSR_SHIFT);
-        result = inv_mpu6050_write_reg(st, st->reg->accl_config, d);
-        if (result)
-                return result;
-        st->chip_config.accl_fs = fs;
+                        st->chip_config.accl_fs = i;
+                        return 0;
+                }
+        }
 
-        return 0;
+        return -EINVAL;
 }
 
 static int inv_mpu6050_write_raw(struct iio_dev *indio_dev,
@@ -471,10 +475,10 @@ static int inv_mpu6050_write_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_ANGL_VEL:
-                        result = inv_mpu6050_write_fsr(st, val);
+                        result = inv_mpu6050_write_gyro_scale(st, val2);
                         break;
                 case IIO_ACCEL:
-                        result = inv_mpu6050_write_accel_fs(st, val);
+                        result = inv_mpu6050_write_accel_scale(st, val2);
                         break;
                 default:
                         result = -EINVAL;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
index 0cd306a72a6e..ba27e277511f 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@@ -24,6 +24,16 @@
 #include <linux/poll.h>
 #include "inv_mpu_iio.h"
 
+static void inv_clear_kfifo(struct inv_mpu6050_state *st)
+{
+        unsigned long flags;
+
+        /* take the spin lock sem to avoid interrupt kick in */
+        spin_lock_irqsave(&st->time_stamp_lock, flags);
+        kfifo_reset(&st->timestamps);
+        spin_unlock_irqrestore(&st->time_stamp_lock, flags);
+}
+
 int inv_reset_fifo(struct iio_dev *indio_dev)
 {
         int result;
@@ -50,6 +60,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev)
                                         INV_MPU6050_BIT_FIFO_RST);
         if (result)
                 goto reset_fifo_fail;
+
+        /* clear timestamps fifo */
+        inv_clear_kfifo(st);
+
         /* enable interrupt */
         if (st->chip_config.accl_fifo_enable ||
             st->chip_config.gyro_fifo_enable) {
@@ -83,16 +97,6 @@ reset_fifo_fail:
         return result;
 }
 
-static void inv_clear_kfifo(struct inv_mpu6050_state *st)
-{
-        unsigned long flags;
-
-        /* take the spin lock sem to avoid interrupt kick in */
-        spin_lock_irqsave(&st->time_stamp_lock, flags);
-        kfifo_reset(&st->timestamps);
-        spin_unlock_irqrestore(&st->time_stamp_lock, flags);
-}
-
 /**
  * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
  */
@@ -184,7 +188,6 @@ end_session:
 flush_fifo:
         /* Flush HW and SW FIFOs. */
         inv_reset_fifo(indio_dev);
-        inv_clear_kfifo(st);
         mutex_unlock(&indio_dev->mlock);
         iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/imu/kmx61.c b/drivers/iio/imu/kmx61.c
index 5cc3692acf37..b3a36376c719 100644
--- a/drivers/iio/imu/kmx61.c
+++ b/drivers/iio/imu/kmx61.c
@@ -1227,7 +1227,7 @@ static irqreturn_t kmx61_trigger_handler(int irq, void *p)
                 base = KMX61_MAG_XOUT_L;
 
         mutex_lock(&data->lock);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                          indio_dev->masklength) {
                 ret = kmx61_read_measurement(data, base, bit);
                 if (ret < 0) {
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index aaba9d3d980e..4df97f650e44 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -847,8 +847,7 @@ static int iio_device_add_channel_sysfs(struct iio_dev *indio_dev,
  * @attr_list: List of IIO device attributes
  *
  * This function frees the memory allocated for each of the IIO device
- * attributes in the list. Note: if you want to reuse the list after calling
- * this function you have to reinitialize it using INIT_LIST_HEAD().
+ * attributes in the list.
  */
 void iio_free_chan_devattr_list(struct list_head *attr_list)
 {
@@ -856,6 +855,7 @@ void iio_free_chan_devattr_list(struct list_head *attr_list)
 
         list_for_each_entry_safe(p, n, attr_list, l) {
                 kfree(p->dev_attr.attr.name);
+                list_del(&p->l);
                 kfree(p);
         }
 }
@@ -936,6 +936,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *indio_dev)
 
         iio_free_chan_devattr_list(&indio_dev->channel_attr_list);
         kfree(indio_dev->chan_attr_group.attrs);
+        indio_dev->chan_attr_group.attrs = NULL;
 }
 
 static void iio_dev_release(struct device *device)
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index a4b397048f71..a99692ba91bc 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -500,6 +500,7 @@ int iio_device_register_eventset(struct iio_dev *indio_dev)
 error_free_setup_event_lines:
         iio_free_chan_devattr_list(&indio_dev->event_interface->dev_attr_list);
         kfree(indio_dev->event_interface);
+        indio_dev->event_interface = NULL;
         return ret;
 }
 
diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
index 74dff4e4a11a..89fca3a70750 100644
--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -494,7 +494,7 @@ static irqreturn_t sx9500_trigger_handler(int irq, void *private)
 
         mutex_lock(&data->mutex);
 
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                          indio_dev->masklength) {
                 ret = sx9500_read_proximity(data, &indio_dev->channels[bit],
                                             &val);
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index aec7a6aa2951..8c014b5dab4c 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
         if (dmasync)
                 dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
 
+        /*
+         * If the combination of the addr and size requested for this memory
+         * region causes an integer overflow, return error.
+         */
+        if ((PAGE_ALIGN(addr + size) <= size) ||
+            (PAGE_ALIGN(addr + size) <= addr))
+                return ERR_PTR(-EINVAL);
+
         if (!can_do_mlock())
                 return ERR_PTR(-EPERM);
 
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c7619716c31d..59040265e361 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -64,6 +64,14 @@ enum {
 #define GUID_TBL_BLK_NUM_ENTRIES 8
 #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
 
+/* Counters should be saturate once they reach their maximum value */
+#define ASSIGN_32BIT_COUNTER(counter, value) do {\
+        if ((value) > U32_MAX)                   \
+                counter = cpu_to_be32(U32_MAX); \
+        else                                     \
+                counter = cpu_to_be32(value);    \
+} while (0)
+
 struct mlx4_mad_rcv_buf {
         struct ib_grh grh;
         u8 payload[256];
@@ -806,10 +814,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
 static void edit_counter(struct mlx4_counter *cnt,
                                         struct ib_pma_portcounters *pma_cnt)
 {
-        pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
-        pma_cnt->port_rcv_data  = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
-        pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
-        pma_cnt->port_rcv_packets  = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
+                             (be64_to_cpu(cnt->tx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
+                             (be64_to_cpu(cnt->rx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+                             be64_to_cpu(cnt->tx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+                             be64_to_cpu(cnt->rx_frames));
 }
 
 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ac6e2b710ea6..b972c0b41799 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2697,8 +2697,12 @@ static void handle_bonded_port_state_event(struct work_struct *work)
         spin_lock_bh(&ibdev->iboe.lock);
         for (i = 0; i < MLX4_MAX_PORTS; ++i) {
                 struct net_device *curr_netdev = ibdev->iboe.netdevs[i];
+                enum ib_port_state curr_port_state;
 
-                enum ib_port_state curr_port_state =
+                if (!curr_netdev)
+                        continue;
+
+                curr_port_state =
                         (netif_running(curr_netdev) &&
                          netif_carrier_ok(curr_netdev)) ?
                         IB_PORT_ACTIVE : IB_PORT_DOWN;
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 1bd15ebc01f2..27bcdbc950c9 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1154,10 +1154,28 @@ out:
         mutex_unlock(&alps_mutex);
 }
 
-static void alps_report_bare_ps2_packet(struct input_dev *dev,
+static void alps_report_bare_ps2_packet(struct psmouse *psmouse,
                                         unsigned char packet[],
                                         bool report_buttons)
 {
+        struct alps_data *priv = psmouse->private;
+        struct input_dev *dev;
+
+        /* Figure out which device to use to report the bare packet */
+        if (priv->proto_version == ALPS_PROTO_V2 &&
+            (priv->flags & ALPS_DUALPOINT)) {
+                /* On V2 devices the DualPoint Stick reports bare packets */
+                dev = priv->dev2;
+        } else if (unlikely(IS_ERR_OR_NULL(priv->dev3))) {
+                /* Register dev3 mouse if we received PS/2 packet first time */
+                if (!IS_ERR(priv->dev3))
+                        psmouse_queue_work(psmouse, &priv->dev3_register_work,
+                                           0);
+                return;
+        } else {
+                dev = priv->dev3;
+        }
+
         if (report_buttons)
                 alps_report_buttons(dev, NULL,
                                 packet[0] & 1, packet[0] & 2, packet[0] & 4);
@@ -1232,8 +1250,8 @@ static psmouse_ret_t alps_handle_interleaved_ps2(struct psmouse *psmouse)
                  * de-synchronization.
                  */
 
-                alps_report_bare_ps2_packet(priv->dev2,
-                                            &psmouse->packet[3], false);
+                alps_report_bare_ps2_packet(psmouse, &psmouse->packet[3],
+                                            false);
 
                 /*
                  * Continue with the standard ALPS protocol handling,
@@ -1289,18 +1307,9 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
          * properly we only do this if the device is fully synchronized.
          */
         if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) {
-
-                /* Register dev3 mouse if we received PS/2 packet first time */
-                if (unlikely(!priv->dev3))
-                        psmouse_queue_work(psmouse,
-                                           &priv->dev3_register_work, 0);
-
                 if (psmouse->pktcnt == 3) {
-                        /* Once dev3 mouse device is registered report data */
-                        if (likely(!IS_ERR_OR_NULL(priv->dev3)))
-                                alps_report_bare_ps2_packet(priv->dev3,
-                                                            psmouse->packet,
-                                                            true);
+                        alps_report_bare_ps2_packet(psmouse, psmouse->packet,
+                                                    true);
                         return PSMOUSE_FULL_PACKET;
                 }
                 return PSMOUSE_GOOD_DATA;
@@ -2281,10 +2290,12 @@ static int alps_set_protocol(struct psmouse *psmouse,
                 priv->set_abs_params = alps_set_abs_params_mt;
                 priv->nibble_commands = alps_v3_nibble_commands;
                 priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
-                priv->x_max = 1360;
-                priv->y_max = 660;
                 priv->x_bits = 23;
                 priv->y_bits = 12;
+
+                if (alps_dolphin_get_device_area(psmouse, priv))
+                        return -EIO;
+
                 break;
 
         case ALPS_PROTO_V6:
@@ -2303,9 +2314,8 @@ static int alps_set_protocol(struct psmouse *psmouse,
                 priv->set_abs_params = alps_set_abs_params_mt;
                 priv->nibble_commands = alps_v3_nibble_commands;
                 priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
-
-                if (alps_dolphin_get_device_area(psmouse, priv))
-                        return -EIO;
+                priv->x_max = 0xfff;
+                priv->y_max = 0x7ff;
 
                 if (priv->fw_ver[1] != 0xba)
                         priv->flags |= ALPS_BUTTONPAD;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f2cceb6493a0..3b06c8a360b6 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -67,9 +67,6 @@
 #define X_MAX_POSITIVE 8176
 #define Y_MAX_POSITIVE 8176
 
-/* maximum ABS_MT_POSITION displacement (in mm) */
-#define DMAX 10
-
 /*****************************************************************************
  *      Stuff we need even when we do not want native Synaptics support
  ****************************************************************************/
@@ -123,32 +120,46 @@ void synaptics_reset(struct psmouse *psmouse)
 
 static bool cr48_profile_sensor;
 
+#define ANY_BOARD_ID 0
 struct min_max_quirk {
         const char * const *pnp_ids;
+        struct {
+                unsigned long int min, max;
+        } board_id;
         int x_min, x_max, y_min, y_max;
 };
 
 static const struct min_max_quirk min_max_pnpid_table[] = {
         {
                 (const char * const []){"LEN0033", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1024, 5052, 2258, 4832
         },
         {
-                (const char * const []){"LEN0035", "LEN0042", NULL},
+                (const char * const []){"LEN0042", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1232, 5710, 1156, 4696
         },
         {
                 (const char * const []){"LEN0034", "LEN0036", "LEN0037",
                                         "LEN0039", "LEN2002", "LEN2004",
                                         NULL},
+                {ANY_BOARD_ID, 2961},
                 1024, 5112, 2024, 4832
         },
         {
                 (const char * const []){"LEN2001", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1024, 5022, 2508, 4832
         },
         {
                 (const char * const []){"LEN2006", NULL},
+                {2691, 2691},
+                1024, 5045, 2457, 4832
+        },
+        {
+                (const char * const []){"LEN2006", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1264, 5675, 1171, 4688
         },
         { }
@@ -175,9 +186,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0041",
         "LEN0042", /* Yoga */
         "LEN0045",
-        "LEN0046",
         "LEN0047",
-        "LEN0048",
         "LEN0049",
         "LEN2000",
         "LEN2001", /* Edge E431 */
@@ -185,7 +194,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN2003",
         "LEN2004", /* L440 */
         "LEN2005",
-        "LEN2006",
+        "LEN2006", /* Edge E440/E540 */
         "LEN2007",
         "LEN2008",
         "LEN2009",
@@ -235,18 +244,39 @@ static int synaptics_model_id(struct psmouse *psmouse)
         return 0;
 }
 
+static int synaptics_more_extended_queries(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        unsigned char buf[3];
+
+        if (synaptics_send_cmd(psmouse, SYN_QUE_MEXT_CAPAB_10, buf))
+                return -1;
+
+        priv->ext_cap_10 = (buf[0]<<16) | (buf[1]<<8) | buf[2];
+
+        return 0;
+}
+
 /*
- * Read the board id from the touchpad
+ * Read the board id and the "More Extended Queries" from the touchpad
  * The board id is encoded in the "QUERY MODES" response
  */
-static int synaptics_board_id(struct psmouse *psmouse)
+static int synaptics_query_modes(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         unsigned char bid[3];
 
+        /* firmwares prior 7.5 have no board_id encoded */
+        if (SYN_ID_FULL(priv->identity) < 0x705)
+                return 0;
+
         if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
                 return -1;
         priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+
+        if (SYN_MEXT_CAP_BIT(bid[0]))
+                return synaptics_more_extended_queries(psmouse);
+
         return 0;
 }
 
@@ -346,7 +376,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         unsigned char resp[3];
-        int i;
 
         if (SYN_ID_MAJOR(priv->identity) < 4)
                 return 0;
@@ -358,17 +387,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
                 }
         }
 
-        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
-                if (psmouse_matches_pnp_id(psmouse,
-                                           min_max_pnpid_table[i].pnp_ids)) {
-                        priv->x_min = min_max_pnpid_table[i].x_min;
-                        priv->x_max = min_max_pnpid_table[i].x_max;
-                        priv->y_min = min_max_pnpid_table[i].y_min;
-                        priv->y_max = min_max_pnpid_table[i].y_max;
-                        return 0;
-                }
-        }
-
         if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
             SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
@@ -377,23 +395,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
                 } else {
                         priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                         priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried max coordinates: x [..%d], y [..%d]\n",
+                                     priv->x_max, priv->y_max);
                 }
         }
 
-        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
-            SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
+        if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
+            (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
+             /*
+              * Firmware v8.1 does not report proper number of extended
+              * capabilities, but has been proven to report correct min
+              * coordinates.
+              */
+             SYN_ID_FULL(priv->identity) == 0x801)) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
                         psmouse_warn(psmouse,
                                      "device claims to have min coordinates query, but I'm not able to read it.\n");
                 } else {
                         priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                         priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried min coordinates: x [%d..], y [%d..]\n",
+                                     priv->x_min, priv->y_min);
                 }
         }
 
         return 0;
 }
 
+/*
+ * Apply quirk(s) if the hardware matches
+ */
+
+static void synaptics_apply_quirks(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        int i;
+
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+                if (!psmouse_matches_pnp_id(psmouse,
+                                            min_max_pnpid_table[i].pnp_ids))
+                        continue;
+
+                if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
+                    priv->board_id < min_max_pnpid_table[i].board_id.min)
+                        continue;
+
+                if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
+                    priv->board_id > min_max_pnpid_table[i].board_id.max)
+                        continue;
+
+                priv->x_min = min_max_pnpid_table[i].x_min;
+                priv->x_max = min_max_pnpid_table[i].x_max;
+                priv->y_min = min_max_pnpid_table[i].y_min;
+                priv->y_max = min_max_pnpid_table[i].y_max;
+                psmouse_info(psmouse,
+                             "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
+                             priv->x_min, priv->x_max,
+                             priv->y_min, priv->y_max);
+                break;
+        }
+}
+
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
         if (synaptics_identify(psmouse))
@@ -402,13 +466,15 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
                 return -1;
         if (synaptics_firmware_id(psmouse))
                 return -1;
-        if (synaptics_board_id(psmouse))
+        if (synaptics_query_modes(psmouse))
                 return -1;
         if (synaptics_capability(psmouse))
                 return -1;
         if (synaptics_resolution(psmouse))
                 return -1;
 
+        synaptics_apply_quirks(psmouse);
+
         return 0;
 }
 
@@ -516,18 +582,22 @@ static int synaptics_is_pt_packet(unsigned char *buf)
         return (buf[0] & 0xFC) == 0x84 && (buf[3] & 0xCC) == 0xC4;
 }
 
-static void synaptics_pass_pt_packet(struct serio *ptport, unsigned char *packet)
+static void synaptics_pass_pt_packet(struct psmouse *psmouse,
+                                     struct serio *ptport,
+                                     unsigned char *packet)
 {
+        struct synaptics_data *priv = psmouse->private;
         struct psmouse *child = serio_get_drvdata(ptport);
 
         if (child && child->state == PSMOUSE_ACTIVATED) {
-                serio_interrupt(ptport, packet[1], 0);
+                serio_interrupt(ptport, packet[1] | priv->pt_buttons, 0);
                 serio_interrupt(ptport, packet[4], 0);
                 serio_interrupt(ptport, packet[5], 0);
                 if (child->pktsize == 4)
                         serio_interrupt(ptport, packet[2], 0);
-        } else
+        } else {
                 serio_interrupt(ptport, packet[1], 0);
+        }
 }
 
 static void synaptics_pt_activate(struct psmouse *psmouse)
@@ -605,6 +675,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
         }
 }
 
+static void synaptics_parse_ext_buttons(const unsigned char buf[],
+                                        struct synaptics_data *priv,
+                                        struct synaptics_hw_state *hw)
+{
+        unsigned int ext_bits =
+                (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
+
+        hw->ext_buttons = buf[4] & ext_mask;
+        hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
+}
+
 static bool is_forcepad;
 
 static int synaptics_parse_hw_state(const unsigned char buf[],
@@ -691,28 +773,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
                         hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
                 }
 
-                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
                     ((buf[0] ^ buf[3]) & 0x02)) {
-                        switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
-                        default:
-                                /*
-                                 * if nExtBtn is greater than 8 it should be
-                                 * considered invalid and treated as 0
-                                 */
-                                break;
-                        case 8:
-                                hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
-                        case 6:
-                                hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
-                        case 4:
-                                hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
-                        case 2:
-                                hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
-                        }
+                        synaptics_parse_ext_buttons(buf, priv, hw);
                 }
         } else {
                 hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
@@ -774,12 +837,54 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
         }
 }
 
+static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+                                         const struct synaptics_hw_state *hw)
+{
+        struct input_dev *dev = psmouse->dev;
+        struct synaptics_data *priv = psmouse->private;
+        int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        char buf[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+        int i;
+
+        if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
+                return;
+
+        /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+        if (SYN_ID_FULL(priv->identity) == 0x801 &&
+            !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+                return;
+
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10)) {
+                for (i = 0; i < ext_bits; i++) {
+                        input_report_key(dev, BTN_0 + 2 * i,
+                                hw->ext_buttons & (1 << i));
+                        input_report_key(dev, BTN_1 + 2 * i,
+                                hw->ext_buttons & (1 << (i + ext_bits)));
+                }
+                return;
+        }
+
+        /*
+         * This generation of touchpads has the trackstick buttons
+         * physically wired to the touchpad. Re-route them through
+         * the pass-through interface.
+         */
+        if (!priv->pt_port)
+                return;
+
+        /* The trackstick expects at most 3 buttons */
+        priv->pt_buttons = SYN_CAP_EXT_BUTTON_STICK_L(hw->ext_buttons)      |
+                           SYN_CAP_EXT_BUTTON_STICK_R(hw->ext_buttons) << 1 |
+                           SYN_CAP_EXT_BUTTON_STICK_M(hw->ext_buttons) << 2;
+
+        synaptics_pass_pt_packet(psmouse, priv->pt_port, buf);
+}
+
 static void synaptics_report_buttons(struct psmouse *psmouse,
                                      const struct synaptics_hw_state *hw)
 {
         struct input_dev *dev = psmouse->dev;
         struct synaptics_data *priv = psmouse->private;
-        int i;
 
         input_report_key(dev, BTN_LEFT, hw->left);
         input_report_key(dev, BTN_RIGHT, hw->right);
@@ -792,8 +897,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
                 input_report_key(dev, BTN_BACK, hw->down);
         }
 
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
-                input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
+        synaptics_report_ext_buttons(psmouse, hw);
 }
 
 static void synaptics_report_mt_data(struct psmouse *psmouse,
@@ -813,7 +917,7 @@ static void synaptics_report_mt_data(struct psmouse *psmouse,
                 pos[i].y = synaptics_invert_y(hw[i]->y);
         }
 
-        input_mt_assign_slots(dev, slot, pos, nsemi, DMAX * priv->x_res);
+        input_mt_assign_slots(dev, slot, pos, nsemi, 0);
 
         for (i = 0; i < nsemi; i++) {
                 input_mt_slot(dev, slot[i]);
@@ -1014,7 +1118,8 @@ static psmouse_ret_t synaptics_process_byte(struct psmouse *psmouse)
                 if (SYN_CAP_PASS_THROUGH(priv->capabilities) &&
                     synaptics_is_pt_packet(psmouse->packet)) {
                         if (priv->pt_port)
-                                synaptics_pass_pt_packet(priv->pt_port, psmouse->packet);
+                                synaptics_pass_pt_packet(psmouse, priv->pt_port,
+                                                         psmouse->packet);
                 } else
                         synaptics_process_packet(psmouse);
 
@@ -1116,8 +1221,9 @@ static void set_input_params(struct psmouse *psmouse,
                 __set_bit(BTN_BACK, dev->keybit);
         }
 
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
-                __set_bit(BTN_0 + i, dev->keybit);
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
+                for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+                        __set_bit(BTN_0 + i, dev->keybit);
 
         __clear_bit(EV_REL, dev->evbit);
         __clear_bit(REL_X, dev->relbit);
@@ -1125,7 +1231,8 @@ static void set_input_params(struct psmouse *psmouse,
 
         if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                 __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
-                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
+                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
+                    !SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
                         __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
                 /* Clickpads report only left button */
                 __clear_bit(BTN_RIGHT, dev->keybit);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index aedc3299b14e..ee4bd0d12b26 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -22,6 +22,7 @@
 #define SYN_QUE_EXT_CAPAB_0C            0x0c
 #define SYN_QUE_EXT_MAX_COORDS          0x0d
 #define SYN_QUE_EXT_MIN_COORDS          0x0f
+#define SYN_QUE_MEXT_CAPAB_10           0x10
 
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -53,6 +54,7 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_MEXT_CAP_BIT(m)             ((m) & (1 << 1))
 
 /*
  * The following describes response for the 0x0c query.
@@ -89,6 +91,30 @@
 #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
 #define SYN_CAP_IMAGE_SENSOR(ex0c)      ((ex0c) & 0x000800)
 
+/*
+ * The following descibes response for the 0x10 query.
+ *
+ * byte mask    name                    meaning
+ * ---- ----    -------                 ------------
+ * 1    0x01    ext buttons are stick   buttons exported in the extended
+ *                                      capability are actually meant to be used
+ *                                      by the tracktick (pass-through).
+ * 1    0x02    SecurePad               the touchpad is a SecurePad, so it
+ *                                      contains a built-in fingerprint reader.
+ * 1    0xe0    more ext count          how many more extented queries are
+ *                                      available after this one.
+ * 2    0xff    SecurePad width         the width of the SecurePad fingerprint
+ *                                      reader.
+ * 3    0xff    SecurePad height        the height of the SecurePad fingerprint
+ *                                      reader.
+ */
+#define SYN_CAP_EXT_BUTTONS_STICK(ex10) ((ex10) & 0x010000)
+#define SYN_CAP_SECUREPAD(ex10)         ((ex10) & 0x020000)
+
+#define SYN_CAP_EXT_BUTTON_STICK_L(eb)  (!!((eb) & 0x01))
+#define SYN_CAP_EXT_BUTTON_STICK_M(eb)  (!!((eb) & 0x02))
+#define SYN_CAP_EXT_BUTTON_STICK_R(eb)  (!!((eb) & 0x04))
+
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
 #define SYN_MODE_RATE(m)                ((m) & (1 << 6))
@@ -143,6 +169,7 @@ struct synaptics_data {
         unsigned long int capabilities;         /* Capabilities */
         unsigned long int ext_cap;              /* Extended Capabilities */
         unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
+        unsigned long int ext_cap_10;           /* Ext Caps from 0x10 query */
         unsigned long int identity;             /* Identification */
         unsigned int x_res, y_res;              /* X/Y resolution in units/mm */
         unsigned int x_max, y_max;              /* Max coordinates (from FW) */
@@ -156,6 +183,7 @@ struct synaptics_data {
         bool disable_gesture;                   /* disable gestures */
 
         struct serio *pt_port;                  /* Pass-through serio port */
+        unsigned char pt_buttons;               /* Pass-through buttons */
 
         /*
          * Last received Advanced Gesture Mode (AGM) packet. An AGM packet
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index baa0d9786f50..1ae4e547b419 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -23,6 +23,7 @@ config IOMMU_IO_PGTABLE
 config IOMMU_IO_PGTABLE_LPAE
         bool "ARMv7/v8 Long Descriptor Format"
         select IOMMU_IO_PGTABLE
+        depends on ARM || ARM64 || COMPILE_TEST
         help
           Enable support for the ARM long descriptor pagetable format.
           This allocator supports 4K/2M/1G, 16K/32M and 64K/512M page
@@ -63,6 +64,7 @@ config MSM_IOMMU
         bool "MSM IOMMU Support"
         depends on ARM
         depends on ARCH_MSM8X60 || ARCH_MSM8960 || COMPILE_TEST
+        depends on BROKEN
         select IOMMU_API
         help
           Support for the IOMMUs found on certain Qualcomm SOCs.
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index fc13dd56953e..a3adde6519f0 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1288,10 +1288,13 @@ static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
                 return 0;
 
         spin_lock_irqsave(&smmu_domain->pgtbl_lock, flags);
-        if (smmu_domain->smmu->features & ARM_SMMU_FEAT_TRANS_OPS)
+        if (smmu_domain->smmu->features & ARM_SMMU_FEAT_TRANS_OPS &&
+                        smmu_domain->stage == ARM_SMMU_DOMAIN_S1) {
                 ret = arm_smmu_iova_to_phys_hard(domain, iova);
-        else
+        } else {
                 ret = ops->iova_to_phys(ops, iova);
+        }
+
         spin_unlock_irqrestore(&smmu_domain->pgtbl_lock, flags);
 
         return ret;
@@ -1556,7 +1559,7 @@ static int arm_smmu_device_cfg_probe(struct arm_smmu_device *smmu)
                 return -ENODEV;
         }
 
-        if (smmu->version == 1 || (!(id & ID0_ATOSNS) && (id & ID0_S1TS))) {
+        if ((id & ID0_S1TS) && ((smmu->version == 1) || (id & ID0_ATOSNS))) {
                 smmu->features |= ARM_SMMU_FEAT_TRANS_OPS;
                 dev_notice(smmu->dev, "\taddress translation ops\n");
         }
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index 7ce52737c7a1..dc14fec4ede1 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -1186,8 +1186,15 @@ static const struct iommu_ops exynos_iommu_ops = {
 
 static int __init exynos_iommu_init(void)
 {
+        struct device_node *np;
         int ret;
 
+        np = of_find_matching_node(NULL, sysmmu_of_match);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
+
         lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table",
                                 LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL);
         if (!lv2table_kmem_cache) {
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index ae4c1a854e57..2d1e05bdbb53 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1742,9 +1742,8 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
 
 static void domain_exit(struct dmar_domain *domain)
 {
-        struct dmar_drhd_unit *drhd;
-        struct intel_iommu *iommu;
         struct page *freelist = NULL;
+        int i;
 
         /* Domain 0 is reserved, so dont process it */
         if (!domain)
@@ -1764,8 +1763,8 @@ static void domain_exit(struct dmar_domain *domain)
 
         /* clear attached or cached domains */
         rcu_read_lock();
-        for_each_active_iommu(iommu, drhd)
-                iommu_detach_domain(domain, iommu);
+        for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+                iommu_detach_domain(domain, g_iommus[i]);
         rcu_read_unlock();
 
         dma_free_pagelist(freelist);
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index 5a500edf00cc..b610a8dee238 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -56,7 +56,8 @@
         ((((d)->levels - ((l) - ARM_LPAE_START_LVL(d) + 1))             \
           * (d)->bits_per_level) + (d)->pg_shift)
 
-#define ARM_LPAE_PAGES_PER_PGD(d)       ((d)->pgd_size >> (d)->pg_shift)
+#define ARM_LPAE_PAGES_PER_PGD(d)                                       \
+        DIV_ROUND_UP((d)->pgd_size, 1UL << (d)->pg_shift)
 
 /*
  * Calculate the index at level l used to map virtual address a using the
@@ -66,7 +67,7 @@
         ((l) == ARM_LPAE_START_LVL(d) ? ilog2(ARM_LPAE_PAGES_PER_PGD(d)) : 0)
 
 #define ARM_LPAE_LVL_IDX(a,l,d)                                         \
-        (((a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                             \
+        (((u64)(a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                        \
          ((1 << ((d)->bits_per_level + ARM_LPAE_PGD_IDX(l,d))) - 1))
 
 /* Calculate the block/page mapping size at level l for pagetable in d. */
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index 10186cac7716..bc39bdf7b99b 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -851,6 +851,7 @@ static int ipmmu_remove(struct platform_device *pdev)
 
 static const struct of_device_id ipmmu_of_ids[] = {
         { .compatible = "renesas,ipmmu-vmsa", },
+        { }
 };
 
 static struct platform_driver ipmmu_driver = {
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index f59f857b702e..a4ba851825c2 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1376,6 +1376,13 @@ static int __init omap_iommu_init(void)
         struct kmem_cache *p;
         const unsigned long flags = SLAB_HWCACHE_ALIGN;
         size_t align = 1 << 10; /* L2 pagetable alignement */
+        struct device_node *np;
+
+        np = of_find_matching_node(NULL, omap_iommu_of_match);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
 
         p = kmem_cache_create("iopte_cache", IOPTE_TABLE_SIZE, align, flags,
                               iopte_cachep_ctor);
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 6a8b1ec4a48a..9f74fddcd304 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1015,8 +1015,15 @@ static struct platform_driver rk_iommu_driver = {
 
 static int __init rk_iommu_init(void)
 {
+        struct device_node *np;
         int ret;
 
+        np = of_find_matching_node(NULL, rk_iommu_dt_ids);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
+
         ret = bus_set_iommu(&platform_bus_type, &rk_iommu_ops);
         if (ret)
                 return ret;
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 463c235acbdc..4387dae14e45 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
 static void __iomem *main_int_base;
 static struct irq_domain *armada_370_xp_mpic_domain;
 static u32 doorbell_mask_reg;
+static int parent_irq;
 #ifdef CONFIG_PCI_MSI
 static struct irq_domain *armada_370_xp_msi_domain;
 static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
 {
         if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
                 armada_xp_mpic_smp_cpu_init();
+
         return NOTIFY_OK;
 }
 
@@ -364,6 +366,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
         .priority = 100,
 };
 
+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
+                                        unsigned long action, void *hcpu)
+{
+        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+                enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block mpic_cascaded_cpu_notifier = {
+        .notifier_call = mpic_cascaded_secondary_init,
+        .priority = 100,
+};
+
 #endif /* CONFIG_SMP */
 
 static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                                              struct device_node *parent)
 {
         struct resource main_int_res, per_cpu_int_res;
-        int parent_irq, nr_irqs, i;
+        int nr_irqs, i;
         u32 control;
 
         BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                 register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
 #endif
         } else {
+#ifdef CONFIG_SMP
+                register_cpu_notifier(&mpic_cascaded_cpu_notifier);
+#endif
                 irq_set_chained_handler(parent_irq,
                                         armada_370_xp_mpic_handle_cascade_irq);
         }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d8996bdf0f61..9687f8afebff 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -169,7 +169,7 @@ static void its_encode_cmd(struct its_cmd_block *cmd, u8 cmd_nr)
 
 static void its_encode_devid(struct its_cmd_block *cmd, u32 devid)
 {
-        cmd->raw_cmd[0] &= ~(0xffffUL << 32);
+        cmd->raw_cmd[0] &= BIT_ULL(32) - 1;
         cmd->raw_cmd[0] |= ((u64)devid) << 32;
 }
 
@@ -416,13 +416,14 @@ static void its_send_single_command(struct its_node *its,
 {
         struct its_cmd_block *cmd, *sync_cmd, *next_cmd;
         struct its_collection *sync_col;
+        unsigned long flags;
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
 
         cmd = its_allocate_entry(its);
         if (!cmd) {             /* We're soooooo screewed... */
                 pr_err_ratelimited("ITS can't allocate, dropping command\n");
-                raw_spin_unlock(&its->lock);
+                raw_spin_unlock_irqrestore(&its->lock, flags);
                 return;
         }
         sync_col = builder(cmd, desc);
@@ -442,7 +443,7 @@ static void its_send_single_command(struct its_node *its,
 
 post:
         next_cmd = its_post_commands(its);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         its_wait_for_range_completion(its, cmd, next_cmd);
 }
@@ -799,21 +800,44 @@ static int its_alloc_tables(struct its_node *its)
 {
         int err;
         int i;
-        int psz = PAGE_SIZE;
+        int psz = SZ_64K;
         u64 shr = GITS_BASER_InnerShareable;
+        u64 cache = GITS_BASER_WaWb;
 
         for (i = 0; i < GITS_BASER_NR_REGS; i++) {
                 u64 val = readq_relaxed(its->base + GITS_BASER + i * 8);
                 u64 type = GITS_BASER_TYPE(val);
                 u64 entry_size = GITS_BASER_ENTRY_SIZE(val);
+                int order = get_order(psz);
+                int alloc_size;
                 u64 tmp;
                 void *base;
 
                 if (type == GITS_BASER_TYPE_NONE)
                         continue;
 
-                /* We're lazy and only allocate a single page for now */
-                base = (void *)get_zeroed_page(GFP_KERNEL);
+                /*
+                 * Allocate as many entries as required to fit the
+                 * range of device IDs that the ITS can grok... The ID
+                 * space being incredibly sparse, this results in a
+                 * massive waste of memory.
+                 *
+                 * For other tables, only allocate a single page.
+                 */
+                if (type == GITS_BASER_TYPE_DEVICE) {
+                        u64 typer = readq_relaxed(its->base + GITS_TYPER);
+                        u32 ids = GITS_TYPER_DEVBITS(typer);
+
+                        order = get_order((1UL << ids) * entry_size);
+                        if (order >= MAX_ORDER) {
+                                order = MAX_ORDER - 1;
+                                pr_warn("%s: Device Table too large, reduce its page order to %u\n",
+                                        its->msi_chip.of_node->full_name, order);
+                        }
+                }
+
+                alloc_size = (1 << order) * PAGE_SIZE;
+                base = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
                 if (!base) {
                         err = -ENOMEM;
                         goto out_free;
@@ -825,7 +849,7 @@ retry_baser:
                 val = (virt_to_phys(base)                                |
                        (type << GITS_BASER_TYPE_SHIFT)                   |
                        ((entry_size - 1) << GITS_BASER_ENTRY_SIZE_SHIFT) |
-                       GITS_BASER_WaWb                                   |
+                       cache                                             |
                        shr                                               |
                        GITS_BASER_VALID);
 
@@ -841,7 +865,7 @@ retry_baser:
                         break;
                 }
 
-                val |= (PAGE_SIZE / psz) - 1;
+                val |= (alloc_size / psz) - 1;
 
                 writeq_relaxed(val, its->base + GITS_BASER + i * 8);
                 tmp = readq_relaxed(its->base + GITS_BASER + i * 8);
@@ -851,9 +875,12 @@ retry_baser:
                          * Shareability didn't stick. Just use
                          * whatever the read reported, which is likely
                          * to be the only thing this redistributor
-                         * supports.
+                         * supports. If that's zero, make it
+                         * non-cacheable as well.
                          */
                         shr = tmp & GITS_BASER_SHAREABILITY_MASK;
+                        if (!shr)
+                                cache = GITS_BASER_nC;
                         goto retry_baser;
                 }
 
@@ -882,7 +909,7 @@ retry_baser:
                 }
 
                 pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n",
-                        (int)(PAGE_SIZE / entry_size),
+                        (int)(alloc_size / entry_size),
                         its_base_type_string[type],
                         (unsigned long)virt_to_phys(base),
                         psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
@@ -957,16 +984,39 @@ static void its_cpu_init_lpis(void)
         tmp = readq_relaxed(rbase + GICR_PROPBASER);
 
         if ((tmp ^ val) & GICR_PROPBASER_SHAREABILITY_MASK) {
+                if (!(tmp & GICR_PROPBASER_SHAREABILITY_MASK)) {
+                        /*
+                         * The HW reports non-shareable, we must
+                         * remove the cacheability attributes as
+                         * well.
+                         */
+                        val &= ~(GICR_PROPBASER_SHAREABILITY_MASK |
+                                 GICR_PROPBASER_CACHEABILITY_MASK);
+                        val |= GICR_PROPBASER_nC;
+                        writeq_relaxed(val, rbase + GICR_PROPBASER);
+                }
                 pr_info_once("GIC: using cache flushing for LPI property table\n");
                 gic_rdists->flags |= RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING;
         }
 
         /* set PENDBASE */
         val = (page_to_phys(pend_page) |
-               GICR_PROPBASER_InnerShareable |
-               GICR_PROPBASER_WaWb);
+               GICR_PENDBASER_InnerShareable |
+               GICR_PENDBASER_WaWb);
 
         writeq_relaxed(val, rbase + GICR_PENDBASER);
+        tmp = readq_relaxed(rbase + GICR_PENDBASER);
+
+        if (!(tmp & GICR_PENDBASER_SHAREABILITY_MASK)) {
+                /*
+                 * The HW reports non-shareable, we must remove the
+                 * cacheability attributes as well.
+                 */
+                val &= ~(GICR_PENDBASER_SHAREABILITY_MASK |
+                         GICR_PENDBASER_CACHEABILITY_MASK);
+                val |= GICR_PENDBASER_nC;
+                writeq_relaxed(val, rbase + GICR_PENDBASER);
+        }
 
         /* Enable LPIs */
         val = readl_relaxed(rbase + GICR_CTLR);
@@ -1003,7 +1053,7 @@ static void its_cpu_init_collection(void)
                          * This ITS wants a linear CPU number.
                          */
                         target = readq_relaxed(gic_data_rdist_rd_base() + GICR_TYPER);
-                        target = GICR_TYPER_CPU_NUMBER(target);
+                        target = GICR_TYPER_CPU_NUMBER(target) << 16;
                 }
 
                 /* Perform collection mapping */
@@ -1020,8 +1070,9 @@ static void its_cpu_init_collection(void)
 static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
 {
         struct its_device *its_dev = NULL, *tmp;
+        unsigned long flags;
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
 
         list_for_each_entry(tmp, &its->its_device_list, entry) {
                 if (tmp->device_id == dev_id) {
@@ -1030,7 +1081,7 @@ static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
                 }
         }
 
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         return its_dev;
 }
@@ -1040,6 +1091,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 {
         struct its_device *dev;
         unsigned long *lpi_map;
+        unsigned long flags;
         void *itt;
         int lpi_base;
         int nr_lpis;
@@ -1056,7 +1108,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         nr_ites = max(2UL, roundup_pow_of_two(nvecs));
         sz = nr_ites * its->ite_size;
         sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
-        itt = kmalloc(sz, GFP_KERNEL);
+        itt = kzalloc(sz, GFP_KERNEL);
         lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
 
         if (!dev || !itt || !lpi_map) {
@@ -1075,9 +1127,9 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         dev->device_id = dev_id;
         INIT_LIST_HEAD(&dev->entry);
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
         list_add(&dev->entry, &its->its_device_list);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         /* Bind the device to the first possible CPU */
         cpu = cpumask_first(cpu_online_mask);
@@ -1091,9 +1143,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 
 static void its_free_device(struct its_device *its_dev)
 {
-        raw_spin_lock(&its_dev->its->lock);
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&its_dev->its->lock, flags);
         list_del(&its_dev->entry);
-        raw_spin_unlock(&its_dev->its->lock);
+        raw_spin_unlock_irqrestore(&its_dev->its->lock, flags);
         kfree(its_dev->itt);
         kfree(its_dev);
 }
@@ -1112,31 +1166,69 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
         return 0;
 }
 
+struct its_pci_alias {
+        struct pci_dev  *pdev;
+        u32             dev_id;
+        u32             count;
+};
+
+static int its_pci_msi_vec_count(struct pci_dev *pdev)
+{
+        int msi, msix;
+
+        msi = max(pci_msi_vec_count(pdev), 0);
+        msix = max(pci_msix_vec_count(pdev), 0);
+
+        return max(msi, msix);
+}
+
+static int its_get_pci_alias(struct pci_dev *pdev, u16 alias, void *data)
+{
+        struct its_pci_alias *dev_alias = data;
+
+        dev_alias->dev_id = alias;
+        if (pdev != dev_alias->pdev)
+                dev_alias->count += its_pci_msi_vec_count(dev_alias->pdev);
+
+        return 0;
+}
+
 static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                            int nvec, msi_alloc_info_t *info)
 {
         struct pci_dev *pdev;
         struct its_node *its;
-        u32 dev_id;
         struct its_device *its_dev;
+        struct its_pci_alias dev_alias;
 
         if (!dev_is_pci(dev))
                 return -EINVAL;
 
         pdev = to_pci_dev(dev);
-        dev_id = PCI_DEVID(pdev->bus->number, pdev->devfn);
+        dev_alias.pdev = pdev;
+        dev_alias.count = nvec;
+
+        pci_for_each_dma_alias(pdev, its_get_pci_alias, &dev_alias);
         its = domain->parent->host_data;
 
-        its_dev = its_find_device(its, dev_id);
-        if (WARN_ON(its_dev))
-                return -EINVAL;
+        its_dev = its_find_device(its, dev_alias.dev_id);
+        if (its_dev) {
+                /*
+                 * We already have seen this ID, probably through
+                 * another alias (PCI bridge of some sort). No need to
+                 * create the device.
+                 */
+                dev_dbg(dev, "Reusing ITT for devID %x\n", dev_alias.dev_id);
+                goto out;
+        }
 
-        its_dev = its_create_device(its, dev_id, nvec);
+        its_dev = its_create_device(its, dev_alias.dev_id, dev_alias.count);
         if (!its_dev)
                 return -ENOMEM;
 
-        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n", nvec, ilog2(nvec));
-
+        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n",
+                dev_alias.count, ilog2(dev_alias.count));
+out:
         info->scratchpad[0].ptr = its_dev;
         info->scratchpad[1].ptr = dev;
         return 0;
@@ -1255,6 +1347,34 @@ static const struct irq_domain_ops its_domain_ops = {
         .deactivate             = its_irq_domain_deactivate,
 };
 
+static int its_force_quiescent(void __iomem *base)
+{
+        u32 count = 1000000;    /* 1s */
+        u32 val;
+
+        val = readl_relaxed(base + GITS_CTLR);
+        if (val & GITS_CTLR_QUIESCENT)
+                return 0;
+
+        /* Disable the generation of all interrupts to this ITS */
+        val &= ~GITS_CTLR_ENABLE;
+        writel_relaxed(val, base + GITS_CTLR);
+
+        /* Poll GITS_CTLR and wait until ITS becomes quiescent */
+        while (1) {
+                val = readl_relaxed(base + GITS_CTLR);
+                if (val & GITS_CTLR_QUIESCENT)
+                        return 0;
+
+                count--;
+                if (!count)
+                        return -EBUSY;
+
+                cpu_relax();
+                udelay(1);
+        }
+}
+
 static int its_probe(struct device_node *node, struct irq_domain *parent)
 {
         struct resource res;
@@ -1283,6 +1403,13 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
                 goto out_unmap;
         }
 
+        err = its_force_quiescent(its_base);
+        if (err) {
+                pr_warn("%s: failed to quiesce, giving up\n",
+                        node->full_name);
+                goto out_unmap;
+        }
+
         pr_info("ITS: %s\n", node->full_name);
 
         its = kzalloc(sizeof(*its), GFP_KERNEL);
@@ -1322,14 +1449,26 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
 
         writeq_relaxed(baser, its->base + GITS_CBASER);
         tmp = readq_relaxed(its->base + GITS_CBASER);
-        writeq_relaxed(0, its->base + GITS_CWRITER);
-        writel_relaxed(1, its->base + GITS_CTLR);
 
-        if ((tmp ^ baser) & GITS_BASER_SHAREABILITY_MASK) {
+        if ((tmp ^ baser) & GITS_CBASER_SHAREABILITY_MASK) {
+                if (!(tmp & GITS_CBASER_SHAREABILITY_MASK)) {
+                        /*
+                         * The HW reports non-shareable, we must
+                         * remove the cacheability attributes as
+                         * well.
+                         */
+                        baser &= ~(GITS_CBASER_SHAREABILITY_MASK |
+                                   GITS_CBASER_CACHEABILITY_MASK);
+                        baser |= GITS_CBASER_nC;
+                        writeq_relaxed(baser, its->base + GITS_CBASER);
+                }
                 pr_info("ITS: using cache flushing for cmd queue\n");
                 its->flags |= ITS_FLAGS_CMDQ_NEEDS_FLUSHING;
         }
 
+        writeq_relaxed(0, its->base + GITS_CWRITER);
+        writel_relaxed(GITS_CTLR_ENABLE, its->base + GITS_CTLR);
+
         if (of_property_read_bool(its->msi_chip.of_node, "msi-controller")) {
                 its->domain = irq_domain_add_tree(NULL, &its_domain_ops, its);
                 if (!its->domain) {
@@ -1382,12 +1521,11 @@ static bool gic_rdists_supports_plpis(void)
 
 int its_cpu_init(void)
 {
-        if (!gic_rdists_supports_plpis()) {
-                pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
-                return -ENXIO;
-        }
-
         if (!list_empty(&its_nodes)) {
+                if (!gic_rdists_supports_plpis()) {
+                        pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
+                        return -ENXIO;
+                }
                 its_cpu_init_lpis();
                 its_cpu_init_collection();
         }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 1c6dea2fbc34..fd8850def1b8 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -466,7 +466,7 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
                 tlist |= 1 << (mpidr & 0xf);
 
                 cpu = cpumask_next(cpu, mask);
-                if (cpu == nr_cpu_ids)
+                if (cpu >= nr_cpu_ids)
                         goto out;
 
                 mpidr = cpu_logical_map(cpu);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 4634cf7d0ec3..471e1cdc1933 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -154,23 +154,25 @@ static inline unsigned int gic_irq(struct irq_data *d)
 static void gic_mask_irq(struct irq_data *d)
 {
         u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_CLEAR + (gic_irq(d) / 32) * 4);
         if (gic_arch_extn.irq_mask)
                 gic_arch_extn.irq_mask(d);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 
 static void gic_unmask_irq(struct irq_data *d)
 {
         u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         if (gic_arch_extn.irq_unmask)
                 gic_arch_extn.irq_unmask(d);
         writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_SET + (gic_irq(d) / 32) * 4);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 
 static void gic_eoi_irq(struct irq_data *d)
@@ -188,6 +190,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
 {
         void __iomem *base = gic_dist_base(d);
         unsigned int gicirq = gic_irq(d);
+        unsigned long flags;
         int ret;
 
         /* Interrupt configuration for SGIs can't be changed */
@@ -199,14 +202,14 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
                             type != IRQ_TYPE_EDGE_RISING)
                 return -EINVAL;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
 
         if (gic_arch_extn.irq_set_type)
                 gic_arch_extn.irq_set_type(d, type);
 
         ret = gic_configure_irq(gicirq, type, base, NULL);
 
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 
         return ret;
 }
@@ -227,6 +230,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
         void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
         unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
         u32 val, mask, bit;
+        unsigned long flags;
 
         if (!force)
                 cpu = cpumask_any_and(mask_val, cpu_online_mask);
@@ -236,12 +240,12 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
         if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
                 return -EINVAL;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         mask = 0xff << shift;
         bit = gic_cpu_map[cpu] << shift;
         val = readl_relaxed(reg) & ~mask;
         writel_relaxed(val | bit, reg);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 
         return IRQ_SET_MASK_OK;
 }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6a7447c304ac..358a574d9e8b 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1609,7 +1609,7 @@ icn_setup(char *line)
         if (ints[0] > 1)
                 membase = (unsigned long)ints[2];
         if (str && *str) {
-                strcpy(sid, str);
+                strlcpy(sid, str, sizeof(sid));
                 icn_id = sid;
                 if ((p = strchr(sid, ','))) {
                         *p++ = 0;
diff --git a/drivers/lguest/Kconfig b/drivers/lguest/Kconfig
index ee035ec4526b..169172d2ba05 100644
--- a/drivers/lguest/Kconfig
+++ b/drivers/lguest/Kconfig
@@ -1,6 +1,6 @@
 config LGUEST
         tristate "Linux hypervisor example code"
-        depends on X86_32 && EVENTFD && TTY
+        depends on X86_32 && EVENTFD && TTY && PCI_DIRECT
         select HVC_DRIVER
         ---help---
           This is a very simple module which allows you to run
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 37de0173b6d2..74adcd2c967e 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -289,9 +289,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
         struct request_queue *q = bdev_get_queue(where->bdev);
         unsigned short logical_block_size = queue_logical_block_size(q);
         sector_t num_sectors;
+        unsigned int uninitialized_var(special_cmd_max_sectors);
 
-        /* Reject unsupported discard requests */
-        if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
+        /*
+         * Reject unsupported discard and write same requests.
+         */
+        if (rw & REQ_DISCARD)
+                special_cmd_max_sectors = q->limits.max_discard_sectors;
+        else if (rw & REQ_WRITE_SAME)
+                special_cmd_max_sectors = q->limits.max_write_same_sectors;
+        if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
                 dec_count(io, region, -EOPNOTSUPP);
                 return;
         }
@@ -317,7 +324,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                 store_io_and_region_in_bio(bio, io, region);
 
                 if (rw & REQ_DISCARD) {
-                        num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
+                        num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
                         bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
                         remaining -= num_sectors;
                 } else if (rw & REQ_WRITE_SAME) {
@@ -326,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                          */
                         dp->get_page(dp, &page, &len, &offset);
                         bio_add_page(bio, page, logical_block_size, offset);
-                        num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
+                        num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
                         bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
 
                         offset = 0;
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 8b204ae216ab..f83a0f3fc365 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -20,6 +20,8 @@
 #include <linux/log2.h>
 #include <linux/dm-kcopyd.h>
 
+#include "dm.h"
+
 #include "dm-exception-store.h"
 
 #define DM_MSG_PREFIX "snapshots"
@@ -291,12 +293,23 @@ struct origin {
 };
 
 /*
+ * This structure is allocated for each origin target
+ */
+struct dm_origin {
+        struct dm_dev *dev;
+        struct dm_target *ti;
+        unsigned split_boundary;
+        struct list_head hash_list;
+};
+
+/*
  * Size of the hash table for origin volumes. If we make this
  * the size of the minors list then it should be nearly perfect
  */
 #define ORIGIN_HASH_SIZE 256
 #define ORIGIN_MASK      0xFF
 static struct list_head *_origins;
+static struct list_head *_dm_origins;
 static struct rw_semaphore _origins_lock;
 
 static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
@@ -310,12 +323,22 @@ static int init_origin_hash(void)
         _origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
                            GFP_KERNEL);
         if (!_origins) {
-                DMERR("unable to allocate memory");
+                DMERR("unable to allocate memory for _origins");
                 return -ENOMEM;
         }
-
         for (i = 0; i < ORIGIN_HASH_SIZE; i++)
                 INIT_LIST_HEAD(_origins + i);
+
+        _dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
+                              GFP_KERNEL);
+        if (!_dm_origins) {
+                DMERR("unable to allocate memory for _dm_origins");
+                kfree(_origins);
+                return -ENOMEM;
+        }
+        for (i = 0; i < ORIGIN_HASH_SIZE; i++)
+                INIT_LIST_HEAD(_dm_origins + i);
+
         init_rwsem(&_origins_lock);
 
         return 0;
@@ -324,6 +347,7 @@ static int init_origin_hash(void)
 static void exit_origin_hash(void)
 {
         kfree(_origins);
+        kfree(_dm_origins);
 }
 
 static unsigned origin_hash(struct block_device *bdev)
@@ -350,6 +374,30 @@ static void __insert_origin(struct origin *o)
         list_add_tail(&o->hash_list, sl);
 }
 
+static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
+{
+        struct list_head *ol;
+        struct dm_origin *o;
+
+        ol = &_dm_origins[origin_hash(origin)];
+        list_for_each_entry (o, ol, hash_list)
+                if (bdev_equal(o->dev->bdev, origin))
+                        return o;
+
+        return NULL;
+}
+
+static void __insert_dm_origin(struct dm_origin *o)
+{
+        struct list_head *sl = &_dm_origins[origin_hash(o->dev->bdev)];
+        list_add_tail(&o->hash_list, sl);
+}
+
+static void __remove_dm_origin(struct dm_origin *o)
+{
+        list_del(&o->hash_list);
+}
+
 /*
  * _origins_lock must be held when calling this function.
  * Returns number of snapshots registered using the supplied cow device, plus:
@@ -1840,9 +1888,40 @@ static int snapshot_preresume(struct dm_target *ti)
 static void snapshot_resume(struct dm_target *ti)
 {
         struct dm_snapshot *s = ti->private;
-        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL, *snap_merging = NULL;
+        struct dm_origin *o;
+        struct mapped_device *origin_md = NULL;
+        bool must_restart_merging = false;
 
         down_read(&_origins_lock);
+
+        o = __lookup_dm_origin(s->origin->bdev);
+        if (o)
+                origin_md = dm_table_get_md(o->ti->table);
+        if (!origin_md) {
+                (void) __find_snapshots_sharing_cow(s, NULL, NULL, &snap_merging);
+                if (snap_merging)
+                        origin_md = dm_table_get_md(snap_merging->ti->table);
+        }
+        if (origin_md == dm_table_get_md(ti->table))
+                origin_md = NULL;
+        if (origin_md) {
+                if (dm_hold(origin_md))
+                        origin_md = NULL;
+        }
+
+        up_read(&_origins_lock);
+
+        if (origin_md) {
+                dm_internal_suspend_fast(origin_md);
+                if (snap_merging && test_bit(RUNNING_MERGE, &snap_merging->state_bits)) {
+                        must_restart_merging = true;
+                        stop_merge(snap_merging);
+                }
+        }
+
+        down_read(&_origins_lock);
+
         (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
         if (snap_src && snap_dest) {
                 down_write(&snap_src->lock);
@@ -1851,8 +1930,16 @@ static void snapshot_resume(struct dm_target *ti)
                 up_write(&snap_dest->lock);
                 up_write(&snap_src->lock);
         }
+
         up_read(&_origins_lock);
 
+        if (origin_md) {
+                if (must_restart_merging)
+                        start_merge(snap_merging);
+                dm_internal_resume_fast(origin_md);
+                dm_put(origin_md);
+        }
+
         /* Now we have correct chunk size, reregister */
         reregister_snapshot(s);
 
@@ -2133,11 +2220,6 @@ static int origin_write_extent(struct dm_snapshot *merging_snap,
  * Origin: maps a linear range of a device, with hooks for snapshotting.
  */
 
-struct dm_origin {
-        struct dm_dev *dev;
-        unsigned split_boundary;
-};
-
 /*
  * Construct an origin mapping: <dev_path>
  * The context for an origin is merely a 'struct dm_dev *'
@@ -2166,6 +2248,7 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad_open;
         }
 
+        o->ti = ti;
         ti->private = o;
         ti->num_flush_bios = 1;
 
@@ -2180,6 +2263,7 @@ bad_alloc:
 static void origin_dtr(struct dm_target *ti)
 {
         struct dm_origin *o = ti->private;
+
         dm_put_device(ti, o->dev);
         kfree(o);
 }
@@ -2216,6 +2300,19 @@ static void origin_resume(struct dm_target *ti)
         struct dm_origin *o = ti->private;
 
         o->split_boundary = get_origin_minimum_chunksize(o->dev->bdev);
+
+        down_write(&_origins_lock);
+        __insert_dm_origin(o);
+        up_write(&_origins_lock);
+}
+
+static void origin_postsuspend(struct dm_target *ti)
+{
+        struct dm_origin *o = ti->private;
+
+        down_write(&_origins_lock);
+        __remove_dm_origin(o);
+        up_write(&_origins_lock);
 }
 
 static void origin_status(struct dm_target *ti, status_type_t type,
@@ -2258,12 +2355,13 @@ static int origin_iterate_devices(struct dm_target *ti,
 
 static struct target_type origin_target = {
         .name    = "snapshot-origin",
-        .version = {1, 8, 1},
+        .version = {1, 9, 0},
         .module  = THIS_MODULE,
         .ctr     = origin_ctr,
         .dtr     = origin_dtr,
         .map     = origin_map,
         .resume  = origin_resume,
+        .postsuspend = origin_postsuspend,
         .status  = origin_status,
         .merge   = origin_merge,
         .iterate_devices = origin_iterate_devices,
@@ -2271,7 +2369,7 @@ static struct target_type origin_target = {
 
 static struct target_type snapshot_target = {
         .name    = "snapshot",
-        .version = {1, 12, 0},
+        .version = {1, 13, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
@@ -2285,7 +2383,7 @@ static struct target_type snapshot_target = {
 
 static struct target_type merge_target = {
         .name    = dm_snapshot_merge_target_name,
-        .version = {1, 2, 0},
+        .version = {1, 3, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 654773cb1eee..921aafd12aee 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2358,17 +2358,6 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_REMAPPED;
 
         case -ENODATA:
-                if (get_pool_mode(tc->pool) == PM_READ_ONLY) {
-                        /*
-                         * This block isn't provisioned, and we have no way
-                         * of doing so.
-                         */
-                        handle_unserviceable_bio(tc->pool, bio);
-                        cell_defer_no_holder(tc, virt_cell);
-                        return DM_MAPIO_SUBMITTED;
-                }
-                /* fall through */
-
         case -EWOULDBLOCK:
                 thin_defer_cell(tc, virt_cell);
                 return DM_MAPIO_SUBMITTED;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 73f28802dc7a..8001fe9e3434 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
 
         dm_get(md);
         atomic_inc(&md->open_count);
-
 out:
         spin_unlock(&_minor_lock);
 
@@ -442,16 +441,20 @@ out:
 
 static void dm_blk_close(struct gendisk *disk, fmode_t mode)
 {
-        struct mapped_device *md = disk->private_data;
+        struct mapped_device *md;
 
         spin_lock(&_minor_lock);
 
+        md = disk->private_data;
+        if (WARN_ON(!md))
+                goto out;
+
         if (atomic_dec_and_test(&md->open_count) &&
             (test_bit(DMF_DEFERRED_REMOVE, &md->flags)))
                 queue_work(deferred_remove_workqueue, &deferred_remove_work);
 
         dm_put(md);
-
+out:
         spin_unlock(&_minor_lock);
 }
 
@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md)
         int minor = MINOR(disk_devt(md->disk));
 
         unlock_fs(md);
-        bdput(md->bdev);
         destroy_workqueue(md->wq);
 
         if (md->kworker_task)
@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md)
                 mempool_destroy(md->rq_pool);
         if (md->bs)
                 bioset_free(md->bs);
-        blk_integrity_unregister(md->disk);
-        del_gendisk(md->disk);
+
         cleanup_srcu_struct(&md->io_barrier);
         free_table_devices(&md->table_devices);
-        free_minor(minor);
+        dm_stats_cleanup(&md->stats);
 
         spin_lock(&_minor_lock);
         md->disk->private_data = NULL;
         spin_unlock(&_minor_lock);
-
+        if (blk_get_integrity(md->disk))
+                blk_integrity_unregister(md->disk);
+        del_gendisk(md->disk);
         put_disk(md->disk);
         blk_cleanup_queue(md->queue);
-        dm_stats_cleanup(&md->stats);
+        bdput(md->bdev);
+        free_minor(minor);
+
         module_put(THIS_MODULE);
         kfree(md);
 }
@@ -2616,6 +2621,19 @@ void dm_get(struct mapped_device *md)
         BUG_ON(test_bit(DMF_FREEING, &md->flags));
 }
 
+int dm_hold(struct mapped_device *md)
+{
+        spin_lock(&_minor_lock);
+        if (test_bit(DMF_FREEING, &md->flags)) {
+                spin_unlock(&_minor_lock);
+                return -EBUSY;
+        }
+        dm_get(md);
+        spin_unlock(&_minor_lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dm_hold);
+
 const char *dm_device_name(struct mapped_device *md)
 {
         return md->name;
@@ -2629,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
 
         might_sleep();
 
-        spin_lock(&_minor_lock);
         map = dm_get_live_table(md, &srcu_idx);
+
+        spin_lock(&_minor_lock);
         idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
         set_bit(DMF_FREEING, &md->flags);
         spin_unlock(&_minor_lock);
@@ -2638,10 +2657,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
         if (dm_request_based(md))
                 flush_kthread_worker(&md->kworker);
 
+        /*
+         * Take suspend_lock so that presuspend and postsuspend methods
+         * do not race with internal suspend.
+         */
+        mutex_lock(&md->suspend_lock);
         if (!dm_suspended_md(md)) {
                 dm_table_presuspend_targets(map);
                 dm_table_postsuspend_targets(map);
         }
+        mutex_unlock(&md->suspend_lock);
 
         /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
         dm_put_live_table(md, srcu_idx);
@@ -3115,6 +3140,7 @@ void dm_internal_suspend_fast(struct mapped_device *md)
         flush_workqueue(md->wq);
         dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
 }
+EXPORT_SYMBOL_GPL(dm_internal_suspend_fast);
 
 void dm_internal_resume_fast(struct mapped_device *md)
 {
@@ -3126,6 +3152,7 @@ void dm_internal_resume_fast(struct mapped_device *md)
 done:
         mutex_unlock(&md->suspend_lock);
 }
+EXPORT_SYMBOL_GPL(dm_internal_resume_fast);
 
 /*-----------------------------------------------------------------
  * Event notification.
diff --git a/drivers/md/md.c b/drivers/md/md.c
index cadf9cc02b25..717daad71fb1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5080,7 +5080,8 @@ int md_run(struct mddev *mddev)
         }
         if (err) {
                 mddev_detach(mddev);
-                pers->free(mddev, mddev->private);
+                if (mddev->private)
+                        pers->free(mddev, mddev->private);
                 module_put(pers->owner);
                 bitmap_destroy(mddev);
                 return err;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index a13f738a7b39..3ed9f42ddca6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -467,8 +467,6 @@ static int raid0_run(struct mddev *mddev)
         dump_zones(mddev);
 
         ret = md_integrity_register(mddev);
-        if (ret)
-                raid0_free(mddev, conf);
 
         return ret;
 }
diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c
index 5d2d8f45b4b6..67faa8d6950e 100644
--- a/drivers/media/dvb-frontends/rtl2832.c
+++ b/drivers/media/dvb-frontends/rtl2832.c
@@ -1240,7 +1240,7 @@ static int rtl2832_probe(struct i2c_client *client,
         dev->regmap_config.max_register = 5 * 0x100,
         dev->regmap_config.ranges = regmap_range_cfg,
         dev->regmap_config.num_ranges = ARRAY_SIZE(regmap_range_cfg),
-        dev->regmap_config.cache_type = REGCACHE_RBTREE,
+        dev->regmap_config.cache_type = REGCACHE_NONE,
         dev->regmap = regmap_init(&client->dev, &regmap_bus, client,
                                   &dev->regmap_config);
         if (IS_ERR(dev->regmap)) {
diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index e4901a503c73..63c0ee5d0bf5 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -1339,14 +1339,13 @@ static int vidioc_querycap(struct file *file, void  *priv,
         strlcpy(cap->driver, dev->name, sizeof(cap->driver));
         strlcpy(cap->card, cx23885_boards[tsport->dev->board].name,
                 sizeof(cap->card));
-        sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
-        cap->capabilities =
-                V4L2_CAP_VIDEO_CAPTURE |
-                V4L2_CAP_READWRITE     |
-                V4L2_CAP_STREAMING     |
-                0;
+        sprintf(cap->bus_info, "PCIe:%s", pci_name(dev->pci));
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE |
+                           V4L2_CAP_STREAMING;
         if (dev->tuner_type != TUNER_ABSENT)
-                cap->capabilities |= V4L2_CAP_TUNER;
+                cap->device_caps |= V4L2_CAP_TUNER;
+        cap->capabilities = cap->device_caps | V4L2_CAP_VBI_CAPTURE |
+                V4L2_CAP_AUDIO | V4L2_CAP_DEVICE_CAPS;
 
         return 0;
 }
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 12f7452edce3..a92ff4249d10 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1845,6 +1845,9 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
         struct s5p_jpeg_addr jpeg_addr;
         u32 pix_size, padding_bytes = 0;
 
+        jpeg_addr.cb = 0;
+        jpeg_addr.cr = 0;
+
         pix_size = ctx->cap_q.w * ctx->cap_q.h;
 
         if (ctx->mode == S5P_JPEG_ENCODE) {
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c b/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c
index e8c2cad93962..0974b9a7a584 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c
@@ -20,7 +20,7 @@
 
 void exynos3250_jpeg_reset(void __iomem *regs)
 {
-        u32 reg = 0;
+        u32 reg = 1;
         int count = 1000;
 
         writel(1, regs + EXYNOS3250_SW_RESET);
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 8e44a59d8ec2..98374e8bad3e 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -833,6 +833,7 @@ static int s5p_mfc_open(struct file *file)
         q->type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
         q->io_modes = VB2_MMAP;
         q->drv_priv = &ctx->fh;
+        q->lock = &dev->mfc_mutex;
         if (vdev == dev->vfd_dec) {
                 q->io_modes = VB2_MMAP;
                 q->ops = get_dec_queue_ops();
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
index 15f7663dd9f5..24262bbb1a35 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
@@ -29,7 +29,7 @@
 
 /* Offset base used to differentiate between CAPTURE and OUTPUT
 *  while mmaping */
-#define DST_QUEUE_OFF_BASE      (TASK_SIZE / 2)
+#define DST_QUEUE_OFF_BASE      (1 << 30)
 
 #define MFC_BANK1_ALLOC_CTX     0
 #define MFC_BANK2_ALLOC_CTX     1
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h b/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h
index de2b8c69daa5..22dfb3effda8 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h
@@ -302,7 +302,7 @@ struct s5p_mfc_hw_ops {
         void (*write_info)(struct s5p_mfc_ctx *ctx, unsigned int data,
                         unsigned int ofs);
         unsigned int (*read_info)(struct s5p_mfc_ctx *ctx,
-                        unsigned int ofs);
+                        unsigned long ofs);
         int (*get_dspl_y_adr)(struct s5p_mfc_dev *dev);
         int (*get_dec_y_adr)(struct s5p_mfc_dev *dev);
         int (*get_dspl_status)(struct s5p_mfc_dev *dev);
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
index 0c4fcf2dfd09..b09bcd140491 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
@@ -263,15 +263,15 @@ static void s5p_mfc_release_dev_context_buffer_v5(struct s5p_mfc_dev *dev)
 static void s5p_mfc_write_info_v5(struct s5p_mfc_ctx *ctx, unsigned int data,
                         unsigned int ofs)
 {
-        writel(data, (volatile void __iomem *)(ctx->shm.virt + ofs));
+        writel(data, (void *)(ctx->shm.virt + ofs));
         wmb();
 }
 
 static unsigned int s5p_mfc_read_info_v5(struct s5p_mfc_ctx *ctx,
-                                unsigned int ofs)
+                                unsigned long ofs)
 {
         rmb();
-        return readl((volatile void __iomem *)(ctx->shm.virt + ofs));
+        return readl((void *)(ctx->shm.virt + ofs));
 }
 
 static void s5p_mfc_dec_calc_dpb_size_v5(struct s5p_mfc_ctx *ctx)
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
index d826c58b5d53..cefad184fe96 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
@@ -1852,17 +1852,17 @@ static void s5p_mfc_write_info_v6(struct s5p_mfc_ctx *ctx, unsigned int data,
                 unsigned int ofs)
 {
         s5p_mfc_clock_on();
-        writel(data, (volatile void __iomem *)((unsigned long)ofs));
+        writel(data, (void *)((unsigned long)ofs));
         s5p_mfc_clock_off();
 }
 
 static unsigned int
-s5p_mfc_read_info_v6(struct s5p_mfc_ctx *ctx, unsigned int ofs)
+s5p_mfc_read_info_v6(struct s5p_mfc_ctx *ctx, unsigned long ofs)
 {
         int ret;
 
         s5p_mfc_clock_on();
-        ret = readl((volatile void __iomem *)((unsigned long)ofs));
+        ret = readl((void *)ofs);
         s5p_mfc_clock_off();
 
         return ret;
diff --git a/drivers/media/platform/s5p-tv/Kconfig b/drivers/media/platform/s5p-tv/Kconfig
index 5a1835dd65e8..697aaed42486 100644
--- a/drivers/media/platform/s5p-tv/Kconfig
+++ b/drivers/media/platform/s5p-tv/Kconfig
@@ -20,6 +20,7 @@ if VIDEO_SAMSUNG_S5P_TV
 config VIDEO_SAMSUNG_S5P_HDMI
         tristate "Samsung HDMI Driver"
         depends on VIDEO_V4L2
+        depends on I2C
         depends on VIDEO_SAMSUNG_S5P_TV
         select VIDEO_SAMSUNG_S5P_HDMIPHY
         help
diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
index a901b6248557..2554f3719b9e 100644
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -1158,6 +1158,7 @@ static int sh_veu_probe(struct platform_device *pdev)
         }
 
         *vdev = sh_veu_videodev;
+        vdev->v4l2_dev = &veu->v4l2_dev;
         spin_lock_init(&veu->lock);
         mutex_init(&veu->fop_lock);
         vdev->lock = &veu->fop_lock;
diff --git a/drivers/media/platform/soc_camera/atmel-isi.c b/drivers/media/platform/soc_camera/atmel-isi.c
index 8526bf5c8429..c835beb2a1a8 100644
--- a/drivers/media/platform/soc_camera/atmel-isi.c
+++ b/drivers/media/platform/soc_camera/atmel-isi.c
@@ -843,6 +843,8 @@ static int isi_camera_set_bus_param(struct soc_camera_device *icd)
         if (isi->pdata.full_mode)
                 cfg1 |= ISI_CFG1_FULL_MODE;
 
+        cfg1 |= ISI_CFG1_THMASK_BEATS_16;
+
         isi_writel(isi, ISI_CTRL, ISI_CTRL_DIS);
         isi_writel(isi, ISI_CFG1, cfg1);
 
diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c
index cee7b56f8404..66634b469c98 100644
--- a/drivers/media/platform/soc_camera/soc_camera.c
+++ b/drivers/media/platform/soc_camera/soc_camera.c
@@ -1665,7 +1665,7 @@ eclkreg:
 eaddpdev:
         platform_device_put(sasc->pdev);
 eallocpdev:
-        devm_kfree(ici->v4l2_dev.dev, sasc);
+        devm_kfree(ici->v4l2_dev.dev, info);
         dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret);
 
         return ret;
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 77dcfdf547ac..87fc0fe29ebd 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -780,8 +780,6 @@ static int rtl2832u_frontend_callback(void *adapter_priv, int component,
                 case TUNER_RTL2832_TUA9001:
                         return rtl2832u_tua9001_tuner_callback(d, cmd, arg);
                 }
-        default:
-                return -EINVAL;
         }
 
         return 0;
diff --git a/drivers/media/usb/gspca/Kconfig b/drivers/media/usb/gspca/Kconfig
index 60af3b167f3b..3fd94fe7e1eb 100644
--- a/drivers/media/usb/gspca/Kconfig
+++ b/drivers/media/usb/gspca/Kconfig
@@ -1,6 +1,7 @@
 menuconfig USB_GSPCA
         tristate "GSPCA based webcams"
         depends on VIDEO_V4L2
+        depends on INPUT || INPUT=n
         default m
         ---help---
           Say Y here if you want to enable selecting webcams based
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index bc08a829bc13..cc16e76a2493 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -3230,18 +3230,13 @@ int vb2_thread_stop(struct vb2_queue *q)
 
         if (threadio == NULL)
                 return 0;
-        call_void_qop(q, wait_finish, q);
         threadio->stop = true;
-        vb2_internal_streamoff(q, q->type);
-        call_void_qop(q, wait_prepare, q);
+        /* Wake up all pending sleeps in the thread */
+        vb2_queue_error(q);
         err = kthread_stop(threadio->thread);
-        q->fileio = NULL;
-        fileio->req.count = 0;
-        vb2_reqbufs(q, &fileio->req);
-        kfree(fileio);
+        __vb2_cleanup_fileio(q);
         threadio->thread = NULL;
         kfree(threadio);
-        q->fileio = NULL;
         q->threadio = NULL;
         return err;
 }
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index b481d20c8372..69e0483adfee 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -632,8 +632,7 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         }
 
         /* extract page list from userspace mapping */
-        ret = vb2_dc_get_user_pages(start, pages, n_pages, vma,
-                                    dma_dir == DMA_FROM_DEVICE);
+        ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, dma_dir);
         if (ret) {
                 unsigned long pfn;
                 if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
index f38ec424872e..5615522f8d62 100644
--- a/drivers/mfd/kempld-core.c
+++ b/drivers/mfd/kempld-core.c
@@ -739,7 +739,7 @@ static int __init kempld_init(void)
                 for (id = kempld_dmi_table;
                      id->matches[0].slot != DMI_NONE; id++)
                         if (strstr(id->ident, force_device_id))
-                                if (id->callback && id->callback(id))
+                                if (id->callback && !id->callback(id))
                                         break;
                 if (id->matches[0].slot == DMI_NONE)
                         return -ENODEV;
diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
index ede50244f265..dbd907d7170e 100644
--- a/drivers/mfd/rtsx_usb.c
+++ b/drivers/mfd/rtsx_usb.c
@@ -196,18 +196,27 @@ EXPORT_SYMBOL_GPL(rtsx_usb_ep0_write_register);
 int rtsx_usb_ep0_read_register(struct rtsx_ucr *ucr, u16 addr, u8 *data)
 {
         u16 value;
+        u8 *buf;
+        int ret;
 
         if (!data)
                 return -EINVAL;
-        *data = 0;
+
+        buf = kzalloc(sizeof(u8), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
         addr |= EP0_READ_REG_CMD << EP0_OP_SHIFT;
         value = swab16(addr);
 
-        return usb_control_msg(ucr->pusb_dev,
+        ret = usb_control_msg(ucr->pusb_dev,
                         usb_rcvctrlpipe(ucr->pusb_dev, 0), RTSX_USB_REQ_REG_OP,
                         USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                        value, 0, data, 1, 100);
+                        value, 0, buf, 1, 100);
+        *data = *buf;
+
+        kfree(buf);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(rtsx_usb_ep0_read_register);
 
@@ -288,18 +297,27 @@ static int rtsx_usb_get_status_with_bulk(struct rtsx_ucr *ucr, u16 *status)
 int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status)
 {
         int ret;
+        u16 *buf;
 
         if (!status)
                 return -EINVAL;
 
-        if (polling_pipe == 0)
+        if (polling_pipe == 0) {
+                buf = kzalloc(sizeof(u16), GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
+
                 ret = usb_control_msg(ucr->pusb_dev,
                                 usb_rcvctrlpipe(ucr->pusb_dev, 0),
                                 RTSX_USB_REQ_POLL,
                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                0, 0, status, 2, 100);
-        else
+                                0, 0, buf, 2, 100);
+                *status = *buf;
+
+                kfree(buf);
+        } else {
                 ret = rtsx_usb_get_status_with_bulk(ucr, status);
+        }
 
         /* usb_control_msg may return positive when success */
         if (ret < 0)
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index 38552a31304a..65fed7146e9b 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -202,16 +202,17 @@ static void enclosure_remove_links(struct enclosure_component *cdev)
 {
         char name[ENCLOSURE_NAME_SIZE];
 
+        enclosure_link_name(cdev, name);
+
         /*
          * In odd circumstances, like multipath devices, something else may
          * already have removed the links, so check for this condition first.
          */
-        if (!cdev->dev->kobj.sd)
-                return;
+        if (cdev->dev->kobj.sd)
+                sysfs_remove_link(&cdev->dev->kobj, name);
 
-        enclosure_link_name(cdev, name);
-        sysfs_remove_link(&cdev->dev->kobj, name);
-        sysfs_remove_link(&cdev->cdev.kobj, "device");
+        if (cdev->cdev.kobj.sd)
+                sysfs_remove_link(&cdev->cdev.kobj, "device");
 }
 
 static int enclosure_add_links(struct enclosure_component *cdev)
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index e9f1d8d84613..c53f14a7ce54 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -124,7 +124,7 @@ int mmc_pwrseq_simple_alloc(struct mmc_host *host, struct device *dev)
                     PTR_ERR(pwrseq->reset_gpios[i]) != -ENOSYS) {
                         ret = PTR_ERR(pwrseq->reset_gpios[i]);
 
-                        while (--i)
+                        while (i--)
                                 gpiod_put(pwrseq->reset_gpios[i]);
 
                         goto clk_put;
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 5b76a173cd95..5897d8d8fa5a 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -526,6 +526,7 @@ config MTD_NAND_SUNXI
 
 config MTD_NAND_HISI504
         tristate "Support for NAND controller on Hisilicon SoC Hip04"
+        depends on HAS_DMA
         help
           Enables support for NAND controller on Hisilicon SoC Hip04.
 
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 96b0b1d27df1..10b1f7a4fe50 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
         nand_writel(info, NDCR, ndcr | int_mask);
 }
 
+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
+{
+        if (info->ecc_bch) {
+                int timeout;
+
+                /*
+                 * According to the datasheet, when reading from NDDB
+                 * with BCH enabled, after each 32 bytes reads, we
+                 * have to make sure that the NDSR.RDDREQ bit is set.
+                 *
+                 * Drain the FIFO 8 32 bits reads at a time, and skip
+                 * the polling on the last read.
+                 */
+                while (len > 8) {
+                        __raw_readsl(info->mmio_base + NDDB, data, 8);
+
+                        for (timeout = 0;
+                             !(nand_readl(info, NDSR) & NDSR_RDDREQ);
+                             timeout++) {
+                                if (timeout >= 5) {
+                                        dev_err(&info->pdev->dev,
+                                                "Timeout on RDDREQ while draining the FIFO\n");
+                                        return;
+                                }
+
+                                mdelay(1);
+                        }
+
+                        data += 32;
+                        len -= 8;
+                }
+        }
+
+        __raw_readsl(info->mmio_base + NDDB, data, len);
+}
+
 static void handle_data_pio(struct pxa3xx_nand_info *info)
 {
         unsigned int do_bytes = min(info->data_size, info->chunk_size);
@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
                                       DIV_ROUND_UP(info->oob_size, 4));
                 break;
         case STATE_PIO_READING:
-                __raw_readsl(info->mmio_base + NDDB,
-                             info->data_buff + info->data_buff_pos,
-                             DIV_ROUND_UP(do_bytes, 4));
+                drain_fifo(info,
+                           info->data_buff + info->data_buff_pos,
+                           DIV_ROUND_UP(do_bytes, 4));
 
                 if (info->oob_size > 0)
-                        __raw_readsl(info->mmio_base + NDDB,
-                                     info->oob_buff + info->oob_buff_pos,
-                                     DIV_ROUND_UP(info->oob_size, 4));
+                        drain_fifo(info,
+                                   info->oob_buff + info->oob_buff_pos,
+                                   DIV_ROUND_UP(info->oob_size, 4));
                 break;
         default:
                 dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
@@ -1572,6 +1608,8 @@ static int alloc_nand_resource(struct platform_device *pdev)
         int ret, irq, cs;
 
         pdata = dev_get_platdata(&pdev->dev);
+        if (pdata->num_cs <= 0)
+                return -ENODEV;
         info = devm_kzalloc(&pdev->dev, sizeof(*info) + (sizeof(*mtd) +
                             sizeof(*host)) * pdata->num_cs, GFP_KERNEL);
         if (!info)
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index da4c79259f67..16e34b37d134 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -425,9 +425,10 @@ retry:
                                         ubi_warn(ubi, "corrupted VID header at PEB %d, LEB %d:%d",
                                                  pnum, vol_id, lnum);
                                         err = -EBADMSG;
-                                } else
+                                } else {
                                         err = -EINVAL;
                                         ubi_ro_mode(ubi);
+                                }
                         }
                         goto out_free;
                 } else if (err == UBI_IO_BITFLIPS)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b979c265fc51..089a4028859d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3850,7 +3850,8 @@ static inline int bond_slave_override(struct bonding *bond,
         /* Find out if any slaves have the same mapping as this skb. */
         bond_for_each_slave_rcu(bond, slave, iter) {
                 if (slave->queue_id == skb->queue_mapping) {
-                        if (bond_slave_can_tx(slave)) {
+                        if (bond_slave_is_up(slave) &&
+                            slave->link == BOND_LINK_UP) {
                                 bond_dev_queue_xmit(bond, skb, slave->dev);
                                 return 0;
                         }
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index 98d73aab52fe..58808f651452 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -131,7 +131,7 @@ config CAN_RCAR
 
 config CAN_XILINXCAN
         tristate "Xilinx CAN"
-        depends on ARCH_ZYNQ || MICROBLAZE || COMPILE_TEST
+        depends on ARCH_ZYNQ || ARM64 || MICROBLAZE || COMPILE_TEST
         depends on COMMON_CLK && HAS_IOMEM
         ---help---
           Xilinx CAN driver. This driver supports both soft AXI CAN IP and
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 80c46ad4cee4..ad0a7e8c2c2b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -592,13 +592,12 @@ static int flexcan_poll_state(struct net_device *dev, u32 reg_esr)
                 rx_state = unlikely(reg_esr & FLEXCAN_ESR_RX_WRN) ?
                            CAN_STATE_ERROR_WARNING : CAN_STATE_ERROR_ACTIVE;
                 new_state = max(tx_state, rx_state);
-        } else if (unlikely(flt == FLEXCAN_ESR_FLT_CONF_PASSIVE)) {
+        } else {
                 __flexcan_get_berr_counter(dev, &bec);
-                new_state = CAN_STATE_ERROR_PASSIVE;
+                new_state = flt == FLEXCAN_ESR_FLT_CONF_PASSIVE ?
+                            CAN_STATE_ERROR_PASSIVE : CAN_STATE_BUS_OFF;
                 rx_state = bec.rxerr >= bec.txerr ? new_state : 0;
                 tx_state = bec.rxerr <= bec.txerr ? new_state : 0;
-        } else {
-                new_state = CAN_STATE_BUS_OFF;
         }
 
         /* state hasn't changed */
@@ -1158,12 +1157,19 @@ static int flexcan_probe(struct platform_device *pdev)
         const struct flexcan_devtype_data *devtype_data;
         struct net_device *dev;
         struct flexcan_priv *priv;
+        struct regulator *reg_xceiver;
         struct resource *mem;
         struct clk *clk_ipg = NULL, *clk_per = NULL;
         void __iomem *base;
         int err, irq;
         u32 clock_freq = 0;
 
+        reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
+        if (PTR_ERR(reg_xceiver) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
+        else if (IS_ERR(reg_xceiver))
+                reg_xceiver = NULL;
+
         if (pdev->dev.of_node)
                 of_property_read_u32(pdev->dev.of_node,
                                                 "clock-frequency", &clock_freq);
@@ -1224,9 +1230,7 @@ static int flexcan_probe(struct platform_device *pdev)
         priv->pdata = dev_get_platdata(&pdev->dev);
         priv->devtype_data = devtype_data;
 
-        priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
-        if (IS_ERR(priv->reg_xceiver))
-                priv->reg_xceiver = NULL;
+        priv->reg_xceiver = reg_xceiver;
 
         netif_napi_add(dev, &priv->napi, flexcan_poll, FLEXCAN_NAPI_WEIGHT);
 
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 009acc8641fc..8b4d3e6875eb 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -901,6 +901,8 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *
         }
 
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
         init_usb_anchor(&dev->rx_submitted);
 
         atomic_set(&dev->active_channels, 0);
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index a316fa4b91ab..57611fd91229 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 Valeo S.A.
  */
 
+#include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
@@ -24,7 +25,6 @@
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
 
-#define MAX_TX_URBS                     16
 #define MAX_RX_URBS                     4
 #define START_TIMEOUT                   1000 /* msecs */
 #define STOP_TIMEOUT                    1000 /* msecs */
@@ -442,6 +442,7 @@ struct kvaser_usb_error_summary {
         };
 };
 
+/* Context for an outstanding, not yet ACKed, transmission */
 struct kvaser_usb_tx_urb_context {
         struct kvaser_usb_net_priv *priv;
         u32 echo_index;
@@ -455,8 +456,13 @@ struct kvaser_usb {
         struct usb_endpoint_descriptor *bulk_in, *bulk_out;
         struct usb_anchor rx_submitted;
 
+        /* @max_tx_urbs: Firmware-reported maximum number of oustanding,
+         * not yet ACKed, transmissions on this device. This value is
+         * also used as a sentinel for marking free tx contexts.
+         */
         u32 fw_version;
         unsigned int nchannels;
+        unsigned int max_tx_urbs;
         enum kvaser_usb_family family;
 
         bool rxinitdone;
@@ -466,18 +472,18 @@ struct kvaser_usb {
 
 struct kvaser_usb_net_priv {
         struct can_priv can;
-
-        atomic_t active_tx_urbs;
-        struct usb_anchor tx_submitted;
-        struct kvaser_usb_tx_urb_context tx_contexts[MAX_TX_URBS];
-
-        struct completion start_comp, stop_comp;
+        struct can_berr_counter bec;
 
         struct kvaser_usb *dev;
         struct net_device *netdev;
         int channel;
 
-        struct can_berr_counter bec;
+        struct completion start_comp, stop_comp;
+        struct usb_anchor tx_submitted;
+
+        spinlock_t tx_contexts_lock;
+        int active_tx_contexts;
+        struct kvaser_usb_tx_urb_context tx_contexts[];
 };
 
 static const struct usb_device_id kvaser_usb_table[] = {
@@ -590,8 +596,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
                          * for further details.
                          */
                         if (tmp->len == 0) {
-                                pos = round_up(pos,
-                                               dev->bulk_in->wMaxPacketSize);
+                                pos = round_up(pos, le16_to_cpu(dev->bulk_in->
+                                                                wMaxPacketSize));
                                 continue;
                         }
 
@@ -655,9 +661,13 @@ static int kvaser_usb_get_software_info(struct kvaser_usb *dev)
         switch (dev->family) {
         case KVASER_LEAF:
                 dev->fw_version = le32_to_cpu(msg.u.leaf.softinfo.fw_version);
+                dev->max_tx_urbs =
+                        le16_to_cpu(msg.u.leaf.softinfo.max_outstanding_tx);
                 break;
         case KVASER_USBCAN:
                 dev->fw_version = le32_to_cpu(msg.u.usbcan.softinfo.fw_version);
+                dev->max_tx_urbs =
+                        le16_to_cpu(msg.u.usbcan.softinfo.max_outstanding_tx);
                 break;
         }
 
@@ -694,6 +704,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
         struct kvaser_usb_net_priv *priv;
         struct sk_buff *skb;
         struct can_frame *cf;
+        unsigned long flags;
         u8 channel, tid;
 
         channel = msg->u.tx_acknowledge_header.channel;
@@ -712,7 +723,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
 
         stats = &priv->netdev->stats;
 
-        context = &priv->tx_contexts[tid % MAX_TX_URBS];
+        context = &priv->tx_contexts[tid % dev->max_tx_urbs];
 
         /* Sometimes the state change doesn't come after a bus-off event */
         if (priv->can.restart_ms &&
@@ -737,12 +748,15 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
 
         stats->tx_packets++;
         stats->tx_bytes += context->dlc;
-        can_get_echo_skb(priv->netdev, context->echo_index);
 
-        context->echo_index = MAX_TX_URBS;
-        atomic_dec(&priv->active_tx_urbs);
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
 
+        can_get_echo_skb(priv->netdev, context->echo_index);
+        context->echo_index = dev->max_tx_urbs;
+        --priv->active_tx_contexts;
         netif_wake_queue(priv->netdev);
+
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 }
 
 static void kvaser_usb_simple_msg_callback(struct urb *urb)
@@ -803,17 +817,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
         return 0;
 }
 
-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
-{
-        int i;
-
-        usb_kill_anchored_urbs(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-
-        for (i = 0; i < MAX_TX_URBS; i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-}
-
 static void kvaser_usb_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
                                                  const struct kvaser_usb_error_summary *es,
                                                  struct can_frame *cf)
@@ -1334,7 +1337,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
                  * number of events in case of a heavy rx load on the bus.
                  */
                 if (msg->len == 0) {
-                        pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
+                        pos = round_up(pos, le16_to_cpu(dev->bulk_in->
+                                                        wMaxPacketSize));
                         continue;
                 }
 
@@ -1515,6 +1519,26 @@ error:
         return err;
 }
 
+static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
+{
+        int i, max_tx_urbs;
+
+        max_tx_urbs = priv->dev->max_tx_urbs;
+
+        priv->active_tx_contexts = 0;
+        for (i = 0; i < max_tx_urbs; i++)
+                priv->tx_contexts[i].echo_index = max_tx_urbs;
+}
+
+/* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+{
+        usb_kill_anchored_urbs(&priv->tx_submitted);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+}
+
 static void kvaser_usb_unlink_all_urbs(struct kvaser_usb *dev)
 {
         int i;
@@ -1634,6 +1658,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         struct kvaser_msg *msg;
         int i, err, ret = NETDEV_TX_OK;
         u8 *msg_tx_can_flags = NULL;            /* GCC */
+        unsigned long flags;
 
         if (can_dropped_invalid_skb(netdev, skb))
                 return NETDEV_TX_OK;
@@ -1687,12 +1712,21 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         if (cf->can_id & CAN_RTR_FLAG)
                 *msg_tx_can_flags |= MSG_FLAG_REMOTE_FRAME;
 
-        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++) {
-                if (priv->tx_contexts[i].echo_index == MAX_TX_URBS) {
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
+        for (i = 0; i < dev->max_tx_urbs; i++) {
+                if (priv->tx_contexts[i].echo_index == dev->max_tx_urbs) {
                         context = &priv->tx_contexts[i];
+
+                        context->echo_index = i;
+                        can_put_echo_skb(skb, netdev, context->echo_index);
+                        ++priv->active_tx_contexts;
+                        if (priv->active_tx_contexts >= dev->max_tx_urbs)
+                                netif_stop_queue(netdev);
+
                         break;
                 }
         }
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 
         /* This should never happen; it implies a flow control bug */
         if (!context) {
@@ -1704,7 +1738,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         }
 
         context->priv = priv;
-        context->echo_index = i;
         context->dlc = cf->can_dlc;
 
         msg->u.tx_can.tid = context->echo_index;
@@ -1716,18 +1749,17 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                           kvaser_usb_write_bulk_callback, context);
         usb_anchor_urb(urb, &priv->tx_submitted);
 
-        can_put_echo_skb(skb, netdev, context->echo_index);
-
-        atomic_inc(&priv->active_tx_urbs);
-
-        if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
-                netif_stop_queue(netdev);
-
         err = usb_submit_urb(urb, GFP_ATOMIC);
         if (unlikely(err)) {
+                spin_lock_irqsave(&priv->tx_contexts_lock, flags);
+
                 can_free_echo_skb(netdev, context->echo_index);
+                context->echo_index = dev->max_tx_urbs;
+                --priv->active_tx_contexts;
+                netif_wake_queue(netdev);
+
+                spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 
-                atomic_dec(&priv->active_tx_urbs);
                 usb_unanchor_urb(urb);
 
                 stats->tx_dropped++;
@@ -1854,13 +1886,15 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
         struct kvaser_usb *dev = usb_get_intfdata(intf);
         struct net_device *netdev;
         struct kvaser_usb_net_priv *priv;
-        int i, err;
+        int err;
 
         err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
         if (err)
                 return err;
 
-        netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
+        netdev = alloc_candev(sizeof(*priv) +
+                              dev->max_tx_urbs * sizeof(*priv->tx_contexts),
+                              dev->max_tx_urbs);
         if (!netdev) {
                 dev_err(&intf->dev, "Cannot alloc candev\n");
                 return -ENOMEM;
@@ -1868,19 +1902,17 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
 
         priv = netdev_priv(netdev);
 
+        init_usb_anchor(&priv->tx_submitted);
         init_completion(&priv->start_comp);
         init_completion(&priv->stop_comp);
 
-        init_usb_anchor(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-
-        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-
         priv->dev = dev;
         priv->netdev = netdev;
         priv->channel = channel;
 
+        spin_lock_init(&priv->tx_contexts_lock);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+
         priv->can.state = CAN_STATE_STOPPED;
         priv->can.clock.freq = CAN_USB_CLOCK;
         priv->can.bittiming_const = &kvaser_usb_bittiming_const;
@@ -1990,6 +2022,13 @@ static int kvaser_usb_probe(struct usb_interface *intf,
                 return err;
         }
 
+        dev_dbg(&intf->dev, "Firmware version: %d.%d.%d\n",
+                ((dev->fw_version >> 24) & 0xff),
+                ((dev->fw_version >> 16) & 0xff),
+                (dev->fw_version & 0xffff));
+
+        dev_dbg(&intf->dev, "Max oustanding tx = %d URBs\n", dev->max_tx_urbs);
+
         err = kvaser_usb_get_card_info(dev);
         if (err) {
                 dev_err(&intf->dev,
@@ -1997,11 +2036,6 @@ static int kvaser_usb_probe(struct usb_interface *intf,
                 return err;
         }
 
-        dev_dbg(&intf->dev, "Firmware version: %d.%d.%d\n",
-                ((dev->fw_version >> 24) & 0xff),
-                ((dev->fw_version >> 16) & 0xff),
-                (dev->fw_version & 0xffff));
-
         for (i = 0; i < dev->nchannels; i++) {
                 err = kvaser_usb_init_one(intf, id, i);
                 if (err) {
diff --git a/drivers/net/can/usb/peak_usb/pcan_ucan.h b/drivers/net/can/usb/peak_usb/pcan_ucan.h
index 1ba7c25002e1..e8fc4952c6b0 100644
--- a/drivers/net/can/usb/peak_usb/pcan_ucan.h
+++ b/drivers/net/can/usb/peak_usb/pcan_ucan.h
@@ -26,8 +26,8 @@
 #define PUCAN_CMD_FILTER_STD            0x008
 #define PUCAN_CMD_TX_ABORT              0x009
 #define PUCAN_CMD_WR_ERR_CNT            0x00a
-#define PUCAN_CMD_RX_FRAME_ENABLE       0x00b
-#define PUCAN_CMD_RX_FRAME_DISABLE      0x00c
+#define PUCAN_CMD_SET_EN_OPTION         0x00b
+#define PUCAN_CMD_CLR_DIS_OPTION        0x00c
 #define PUCAN_CMD_END_OF_COLLECTION     0x3ff
 
 /* uCAN received messages list */
@@ -101,14 +101,15 @@ struct __packed pucan_wr_err_cnt {
         u16     unused;
 };
 
-/* uCAN RX_FRAME_ENABLE command fields */
-#define PUCAN_FLTEXT_ERROR              0x0001
-#define PUCAN_FLTEXT_BUSLOAD            0x0002
+/* uCAN SET_EN/CLR_DIS _OPTION command fields */
+#define PUCAN_OPTION_ERROR              0x0001
+#define PUCAN_OPTION_BUSLOAD            0x0002
+#define PUCAN_OPTION_CANDFDISO          0x0004
 
-struct __packed pucan_filter_ext {
+struct __packed pucan_options {
         __le16  opcode_channel;
 
-        __le16  ext_mask;
+        __le16  options;
         u32     unused;
 };
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 0bac0f14edc3..a9221ad9f1a0 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -110,13 +110,13 @@ struct __packed pcan_ufd_led {
         u8      unused[5];
 };
 
-/* Extended usage of uCAN commands CMD_RX_FRAME_xxxABLE for PCAN-USB Pro FD */
+/* Extended usage of uCAN commands CMD_xxx_xx_OPTION for PCAN-USB Pro FD */
 #define PCAN_UFD_FLTEXT_CALIBRATION     0x8000
 
-struct __packed pcan_ufd_filter_ext {
+struct __packed pcan_ufd_options {
         __le16  opcode_channel;
 
-        __le16  ext_mask;
+        __le16  ucan_mask;
         u16     unused;
         __le16  usb_mask;
 };
@@ -251,6 +251,27 @@ static int pcan_usb_fd_build_restart_cmd(struct peak_usb_device *dev, u8 *buf)
         /* moves the pointer forward */
         pc += sizeof(struct pucan_wr_err_cnt);
 
+        /* add command to switch from ISO to non-ISO mode, if fw allows it */
+        if (dev->can.ctrlmode_supported & CAN_CTRLMODE_FD_NON_ISO) {
+                struct pucan_options *puo = (struct pucan_options *)pc;
+
+                puo->opcode_channel =
+                        (dev->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO) ?
+                        pucan_cmd_opcode_channel(dev,
+                                                 PUCAN_CMD_CLR_DIS_OPTION) :
+                        pucan_cmd_opcode_channel(dev, PUCAN_CMD_SET_EN_OPTION);
+
+                puo->options = cpu_to_le16(PUCAN_OPTION_CANDFDISO);
+
+                /* to be sure that no other extended bits will be taken into
+                 * account
+                 */
+                puo->unused = 0;
+
+                /* moves the pointer forward */
+                pc += sizeof(struct pucan_options);
+        }
+
         /* next, go back to operational mode */
         cmd = (struct pucan_command *)pc;
         cmd->opcode_channel = pucan_cmd_opcode_channel(dev,
@@ -321,21 +342,21 @@ static int pcan_usb_fd_set_filter_std(struct peak_usb_device *dev, int idx,
         return pcan_usb_fd_send_cmd(dev, cmd);
 }
 
-/* set/unset notifications filter:
+/* set/unset options
  *
- *      onoff   sets(1)/unset(0) notifications
- *      mask    each bit defines a kind of notification to set/unset
+ *      onoff   set(1)/unset(0) options
+ *      mask    each bit defines a kind of options to set/unset
  */
-static int pcan_usb_fd_set_filter_ext(struct peak_usb_device *dev,
-                                      bool onoff, u16 ext_mask, u16 usb_mask)
+static int pcan_usb_fd_set_options(struct peak_usb_device *dev,
+                                   bool onoff, u16 ucan_mask, u16 usb_mask)
 {
-        struct pcan_ufd_filter_ext *cmd = pcan_usb_fd_cmd_buffer(dev);
+        struct pcan_ufd_options *cmd = pcan_usb_fd_cmd_buffer(dev);
 
         cmd->opcode_channel = pucan_cmd_opcode_channel(dev,
-                                        (onoff) ? PUCAN_CMD_RX_FRAME_ENABLE :
-                                                  PUCAN_CMD_RX_FRAME_DISABLE);
+                                        (onoff) ? PUCAN_CMD_SET_EN_OPTION :
+                                                  PUCAN_CMD_CLR_DIS_OPTION);
 
-        cmd->ext_mask = cpu_to_le16(ext_mask);
+        cmd->ucan_mask = cpu_to_le16(ucan_mask);
         cmd->usb_mask = cpu_to_le16(usb_mask);
 
         /* send the command */
@@ -770,9 +791,9 @@ static int pcan_usb_fd_start(struct peak_usb_device *dev)
                                        &pcan_usb_pro_fd);
 
                 /* enable USB calibration messages */
-                err = pcan_usb_fd_set_filter_ext(dev, 1,
-                                                 PUCAN_FLTEXT_ERROR,
-                                                 PCAN_UFD_FLTEXT_CALIBRATION);
+                err = pcan_usb_fd_set_options(dev, 1,
+                                              PUCAN_OPTION_ERROR,
+                                              PCAN_UFD_FLTEXT_CALIBRATION);
         }
 
         pdev->usb_if->dev_opened_count++;
@@ -806,9 +827,9 @@ static int pcan_usb_fd_stop(struct peak_usb_device *dev)
 
         /* turn off special msgs for that interface if no other dev opened */
         if (pdev->usb_if->dev_opened_count == 1)
-                pcan_usb_fd_set_filter_ext(dev, 0,
-                                           PUCAN_FLTEXT_ERROR,
-                                           PCAN_UFD_FLTEXT_CALIBRATION);
+                pcan_usb_fd_set_options(dev, 0,
+                                        PUCAN_OPTION_ERROR,
+                                        PCAN_UFD_FLTEXT_CALIBRATION);
         pdev->usb_if->dev_opened_count--;
 
         return 0;
@@ -860,8 +881,14 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
                          pdev->usb_if->fw_info.fw_version[2],
                          dev->adapter->ctrl_count);
 
-                /* the currently supported hw is non-ISO */
-                dev->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO;
+                /* check for ability to switch between ISO/non-ISO modes */
+                if (pdev->usb_if->fw_info.fw_version[0] >= 2) {
+                        /* firmware >= 2.x supports ISO/non-ISO switching */
+                        dev->can.ctrlmode_supported |= CAN_CTRLMODE_FD_NON_ISO;
+                } else {
+                        /* firmware < 2.x only supports fixed(!) non-ISO */
+                        dev->can.ctrlmode |= CAN_CTRLMODE_FD_NON_ISO;
+                }
 
                 /* tell the hardware the can driver is running */
                 err = pcan_usb_fd_drv_loaded(dev, 1);
@@ -937,9 +964,9 @@ static void pcan_usb_fd_exit(struct peak_usb_device *dev)
         if (dev->ctrl_idx == 0) {
                 /* turn off calibration message if any device were opened */
                 if (pdev->usb_if->dev_opened_count > 0)
-                        pcan_usb_fd_set_filter_ext(dev, 0,
-                                                   PUCAN_FLTEXT_ERROR,
-                                                   PCAN_UFD_FLTEXT_CALIBRATION);
+                        pcan_usb_fd_set_options(dev, 0,
+                                                PUCAN_OPTION_ERROR,
+                                                PCAN_UFD_FLTEXT_CALIBRATION);
 
                 /* tell USB adapter that the driver is being unloaded */
                 pcan_usb_fd_drv_loaded(dev, 0);
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 11d6e6561df1..15a8190a6f75 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 {
         struct pcnet32_private *lp;
         int i, media;
-        int fdx, mii, fset, dxsuflo;
+        int fdx, mii, fset, dxsuflo, sram;
         int chip_version;
         char *chipname;
         struct net_device *dev;
@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
         }
 
         /* initialize variables */
-        fdx = mii = fset = dxsuflo = 0;
+        fdx = mii = fset = dxsuflo = sram = 0;
         chip_version = (chip_version >> 12) & 0xffff;
 
         switch (chip_version) {
@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C973";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2626:
                 chipname = "PCnet/Home 79C978"; /* PCI */
@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C975";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2628:
                 chipname = "PCnet/PRO 79C976";
@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 dxsuflo = 1;
         }
 
+        /*
+         * The Am79C973/Am79C975 controllers come with 12K of SRAM
+         * which we can use for the Tx/Rx buffers but most importantly,
+         * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+         * Tx fifo underflows.
+         */
+        if (sram) {
+                /*
+                 * The SRAM is being configured in two steps. First we
+                 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+                 * to the datasheet, each bit corresponds to a 512-byte
+                 * page so we can have at most 24 pages. The SRAM_SIZE
+                 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+                 * The low 8-bits start at 0x00 and end at 0xff. So the
+                 * address range is from 0x0000 up to 0x17ff. Therefore,
+                 * the SRAM_SIZE is set to 0x17. The next step is to set
+                 * the BCR26:SRAM_BND midway through so the Tx and Rx
+                 * buffers can share the SRAM equally.
+                 */
+                a->write_bcr(ioaddr, 25, 0x17);
+                a->write_bcr(ioaddr, 26, 0xc);
+                /* And finally enable the NOUFLO bit */
+                a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+        }
+
         dev = alloc_etherdev(sizeof(*lp));
         if (!dev) {
                 ret = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 756053c028be..4085c4b31047 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1811,7 +1811,7 @@ struct bnx2x {
         int                     stats_state;
 
         /* used for synchronization of concurrent threads statistics handling */
-        spinlock_t              stats_lock;
+        struct mutex            stats_lock;
 
         /* used by dmae command loader */
         struct dmae_command     stats_dmae;
@@ -1935,8 +1935,6 @@ struct bnx2x {
 
         int fp_array_size;
         u32 dump_preset_idx;
-        bool                                    stats_started;
-        struct semaphore                        stats_sema;
 
         u8                                      phys_port_id[ETH_ALEN];
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index bef750a09027..1ec635f54994 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -129,8 +129,8 @@ struct bnx2x_mac_vals {
         u32 xmac_val;
         u32 emac_addr;
         u32 emac_val;
-        u32 umac_addr;
-        u32 umac_val;
+        u32 umac_addr[2];
+        u32 umac_val[2];
         u32 bmac_addr;
         u32 bmac_val[2];
 };
@@ -7866,6 +7866,20 @@ int bnx2x_init_hw_func_cnic(struct bnx2x *bp)
         return 0;
 }
 
+/* previous driver DMAE transaction may have occurred when pre-boot stage ended
+ * and boot began, or when kdump kernel was loaded. Either case would invalidate
+ * the addresses of the transaction, resulting in was-error bit set in the pci
+ * causing all hw-to-host pcie transactions to timeout. If this happened we want
+ * to clear the interrupt which detected this from the pglueb and the was done
+ * bit
+ */
+static void bnx2x_clean_pglue_errors(struct bnx2x *bp)
+{
+        if (!CHIP_IS_E1x(bp))
+                REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR,
+                       1 << BP_ABS_FUNC(bp));
+}
+
 static int bnx2x_init_hw_func(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
@@ -7958,8 +7972,7 @@ static int bnx2x_init_hw_func(struct bnx2x *bp)
 
         bnx2x_init_block(bp, BLOCK_PGLUE_B, init_phase);
 
-        if (!CHIP_IS_E1x(bp))
-                REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR, func);
+        bnx2x_clean_pglue_errors(bp);
 
         bnx2x_init_block(bp, BLOCK_ATC, init_phase);
         bnx2x_init_block(bp, BLOCK_DMAE, init_phase);
@@ -10141,6 +10154,25 @@ static u32 bnx2x_get_pretend_reg(struct bnx2x *bp)
         return base + (BP_ABS_FUNC(bp)) * stride;
 }
 
+static bool bnx2x_prev_unload_close_umac(struct bnx2x *bp,
+                                         u8 port, u32 reset_reg,
+                                         struct bnx2x_mac_vals *vals)
+{
+        u32 mask = MISC_REGISTERS_RESET_REG_2_UMAC0 << port;
+        u32 base_addr;
+
+        if (!(mask & reset_reg))
+                return false;
+
+        BNX2X_DEV_INFO("Disable umac Rx %02x\n", port);
+        base_addr = port ? GRCBASE_UMAC1 : GRCBASE_UMAC0;
+        vals->umac_addr[port] = base_addr + UMAC_REG_COMMAND_CONFIG;
+        vals->umac_val[port] = REG_RD(bp, vals->umac_addr[port]);
+        REG_WR(bp, vals->umac_addr[port], 0);
+
+        return true;
+}
+
 static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
                                         struct bnx2x_mac_vals *vals)
 {
@@ -10149,10 +10181,7 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
         u8 port = BP_PORT(bp);
 
         /* reset addresses as they also mark which values were changed */
-        vals->bmac_addr = 0;
-        vals->umac_addr = 0;
-        vals->xmac_addr = 0;
-        vals->emac_addr = 0;
+        memset(vals, 0, sizeof(*vals));
 
         reset_reg = REG_RD(bp, MISC_REG_RESET_REG_2);
 
@@ -10201,15 +10230,11 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
                         REG_WR(bp, vals->xmac_addr, 0);
                         mac_stopped = true;
                 }
-                mask = MISC_REGISTERS_RESET_REG_2_UMAC0 << port;
-                if (mask & reset_reg) {
-                        BNX2X_DEV_INFO("Disable umac Rx\n");
-                        base_addr = BP_PORT(bp) ? GRCBASE_UMAC1 : GRCBASE_UMAC0;
-                        vals->umac_addr = base_addr + UMAC_REG_COMMAND_CONFIG;
-                        vals->umac_val = REG_RD(bp, vals->umac_addr);
-                        REG_WR(bp, vals->umac_addr, 0);
-                        mac_stopped = true;
-                }
+
+                mac_stopped |= bnx2x_prev_unload_close_umac(bp, 0,
+                                                            reset_reg, vals);
+                mac_stopped |= bnx2x_prev_unload_close_umac(bp, 1,
+                                                            reset_reg, vals);
         }
 
         if (mac_stopped)
@@ -10505,8 +10530,11 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
                 /* Close the MAC Rx to prevent BRB from filling up */
                 bnx2x_prev_unload_close_mac(bp, &mac_vals);
 
-                /* close LLH filters towards the BRB */
+                /* close LLH filters for both ports towards the BRB */
                 bnx2x_set_rx_filter(&bp->link_params, 0);
+                bp->link_params.port ^= 1;
+                bnx2x_set_rx_filter(&bp->link_params, 0);
+                bp->link_params.port ^= 1;
 
                 /* Check if the UNDI driver was previously loaded */
                 if (bnx2x_prev_is_after_undi(bp)) {
@@ -10553,8 +10581,10 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
 
         if (mac_vals.xmac_addr)
                 REG_WR(bp, mac_vals.xmac_addr, mac_vals.xmac_val);
-        if (mac_vals.umac_addr)
-                REG_WR(bp, mac_vals.umac_addr, mac_vals.umac_val);
+        if (mac_vals.umac_addr[0])
+                REG_WR(bp, mac_vals.umac_addr[0], mac_vals.umac_val[0]);
+        if (mac_vals.umac_addr[1])
+                REG_WR(bp, mac_vals.umac_addr[1], mac_vals.umac_val[1]);
         if (mac_vals.emac_addr)
                 REG_WR(bp, mac_vals.emac_addr, mac_vals.emac_val);
         if (mac_vals.bmac_addr) {
@@ -10571,26 +10601,6 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
         return bnx2x_prev_mcp_done(bp);
 }
 
-/* previous driver DMAE transaction may have occurred when pre-boot stage ended
- * and boot began, or when kdump kernel was loaded. Either case would invalidate
- * the addresses of the transaction, resulting in was-error bit set in the pci
- * causing all hw-to-host pcie transactions to timeout. If this happened we want
- * to clear the interrupt which detected this from the pglueb and the was done
- * bit
- */
-static void bnx2x_prev_interrupted_dmae(struct bnx2x *bp)
-{
-        if (!CHIP_IS_E1x(bp)) {
-                u32 val = REG_RD(bp, PGLUE_B_REG_PGLUE_B_INT_STS);
-                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_WAS_ERROR_ATTN) {
-                        DP(BNX2X_MSG_SP,
-                           "'was error' bit was found to be set in pglueb upon startup. Clearing\n");
-                        REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR,
-                               1 << BP_FUNC(bp));
-                }
-        }
-}
-
 static int bnx2x_prev_unload(struct bnx2x *bp)
 {
         int time_counter = 10;
@@ -10600,7 +10610,7 @@ static int bnx2x_prev_unload(struct bnx2x *bp)
         /* clear hw from errors which may have resulted from an interrupted
          * dmae transaction.
          */
-        bnx2x_prev_interrupted_dmae(bp);
+        bnx2x_clean_pglue_errors(bp);
 
         /* Release previously held locks */
         hw_lock_reg = (BP_FUNC(bp) <= 5) ?
@@ -12037,9 +12047,8 @@ static int bnx2x_init_bp(struct bnx2x *bp)
         mutex_init(&bp->port.phy_mutex);
         mutex_init(&bp->fw_mb_mutex);
         mutex_init(&bp->drv_info_mutex);
+        mutex_init(&bp->stats_lock);
         bp->drv_info_mng_owner = false;
-        spin_lock_init(&bp->stats_lock);
-        sema_init(&bp->stats_sema, 1);
 
         INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
         INIT_DELAYED_WORK(&bp->sp_rtnl_task, bnx2x_sp_rtnl_task);
@@ -12769,7 +12778,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                 NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 |
                 NETIF_F_RXCSUM | NETIF_F_LRO | NETIF_F_GRO |
                 NETIF_F_RXHASH | NETIF_F_HW_VLAN_CTAG_TX;
-        if (!CHIP_IS_E1x(bp)) {
+        if (!chip_is_e1x) {
                 dev->hw_features |= NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL |
                                     NETIF_F_GSO_IPIP | NETIF_F_GSO_SIT;
                 dev->hw_enc_features =
@@ -13668,9 +13677,9 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
         cancel_delayed_work_sync(&bp->sp_task);
         cancel_delayed_work_sync(&bp->period_task);
 
-        spin_lock_bh(&bp->stats_lock);
+        mutex_lock(&bp->stats_lock);
         bp->stats_state = STATS_STATE_DISABLED;
-        spin_unlock_bh(&bp->stats_lock);
+        mutex_unlock(&bp->stats_lock);
 
         bnx2x_save_statistics(bp);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index e5aca2de1871..cfe3c7695455 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -2238,7 +2238,9 @@ int bnx2x_vf_close(struct bnx2x *bp, struct bnx2x_virtf *vf)
 
                 cookie.vf = vf;
                 cookie.state = VF_ACQUIRED;
-                bnx2x_stats_safe_exec(bp, bnx2x_set_vf_state, &cookie);
+                rc = bnx2x_stats_safe_exec(bp, bnx2x_set_vf_state, &cookie);
+                if (rc)
+                        goto op_err;
         }
 
         DP(BNX2X_MSG_IOV, "set state to acquired\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index d1608297c773..800ab44a07ce 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -123,36 +123,28 @@ static void bnx2x_dp_stats(struct bnx2x *bp)
  */
 static void bnx2x_storm_stats_post(struct bnx2x *bp)
 {
-        if (!bp->stats_pending) {
-                int rc;
+        int rc;
 
-                spin_lock_bh(&bp->stats_lock);
-
-                if (bp->stats_pending) {
-                        spin_unlock_bh(&bp->stats_lock);
-                        return;
-                }
-
-                bp->fw_stats_req->hdr.drv_stats_counter =
-                        cpu_to_le16(bp->stats_counter++);
+        if (bp->stats_pending)
+                return;
 
-                DP(BNX2X_MSG_STATS, "Sending statistics ramrod %d\n",
-                   le16_to_cpu(bp->fw_stats_req->hdr.drv_stats_counter));
+        bp->fw_stats_req->hdr.drv_stats_counter =
+                cpu_to_le16(bp->stats_counter++);
 
-                /* adjust the ramrod to include VF queues statistics */
-                bnx2x_iov_adjust_stats_req(bp);
-                bnx2x_dp_stats(bp);
+        DP(BNX2X_MSG_STATS, "Sending statistics ramrod %d\n",
+           le16_to_cpu(bp->fw_stats_req->hdr.drv_stats_counter));
 
-                /* send FW stats ramrod */
-                rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_STAT_QUERY, 0,
-                                   U64_HI(bp->fw_stats_req_mapping),
-                                   U64_LO(bp->fw_stats_req_mapping),
-                                   NONE_CONNECTION_TYPE);
-                if (rc == 0)
-                        bp->stats_pending = 1;
+        /* adjust the ramrod to include VF queues statistics */
+        bnx2x_iov_adjust_stats_req(bp);
+        bnx2x_dp_stats(bp);
 
-                spin_unlock_bh(&bp->stats_lock);
-        }
+        /* send FW stats ramrod */
+        rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_STAT_QUERY, 0,
+                           U64_HI(bp->fw_stats_req_mapping),
+                           U64_LO(bp->fw_stats_req_mapping),
+                           NONE_CONNECTION_TYPE);
+        if (rc == 0)
+                bp->stats_pending = 1;
 }
 
 static void bnx2x_hw_stats_post(struct bnx2x *bp)
@@ -221,7 +213,7 @@ static void bnx2x_stats_comp(struct bnx2x *bp)
  */
 
 /* should be called under stats_sema */
-static void __bnx2x_stats_pmf_update(struct bnx2x *bp)
+static void bnx2x_stats_pmf_update(struct bnx2x *bp)
 {
         struct dmae_command *dmae;
         u32 opcode;
@@ -519,7 +511,7 @@ static void bnx2x_func_stats_init(struct bnx2x *bp)
 }
 
 /* should be called under stats_sema */
-static void __bnx2x_stats_start(struct bnx2x *bp)
+static void bnx2x_stats_start(struct bnx2x *bp)
 {
         if (IS_PF(bp)) {
                 if (bp->port.pmf)
@@ -531,34 +523,13 @@ static void __bnx2x_stats_start(struct bnx2x *bp)
                 bnx2x_hw_stats_post(bp);
                 bnx2x_storm_stats_post(bp);
         }
-
-        bp->stats_started = true;
-}
-
-static void bnx2x_stats_start(struct bnx2x *bp)
-{
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
-        __bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
 }
 
 static void bnx2x_stats_pmf_start(struct bnx2x *bp)
 {
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
         bnx2x_stats_comp(bp);
-        __bnx2x_stats_pmf_update(bp);
-        __bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
-}
-
-static void bnx2x_stats_pmf_update(struct bnx2x *bp)
-{
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
-        __bnx2x_stats_pmf_update(bp);
-        up(&bp->stats_sema);
+        bnx2x_stats_pmf_update(bp);
+        bnx2x_stats_start(bp);
 }
 
 static void bnx2x_stats_restart(struct bnx2x *bp)
@@ -568,11 +539,9 @@ static void bnx2x_stats_restart(struct bnx2x *bp)
          */
         if (IS_VF(bp))
                 return;
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
+
         bnx2x_stats_comp(bp);
-        __bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
+        bnx2x_stats_start(bp);
 }
 
 static void bnx2x_bmac_stats_update(struct bnx2x *bp)
@@ -1246,18 +1215,12 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 {
         u32 *stats_comp = bnx2x_sp(bp, stats_comp);
 
-        /* we run update from timer context, so give up
-         * if somebody is in the middle of transition
-         */
-        if (down_trylock(&bp->stats_sema))
+        if (bnx2x_edebug_stats_stopped(bp))
                 return;
 
-        if (bnx2x_edebug_stats_stopped(bp) || !bp->stats_started)
-                goto out;
-
         if (IS_PF(bp)) {
                 if (*stats_comp != DMAE_COMP_VAL)
-                        goto out;
+                        return;
 
                 if (bp->port.pmf)
                         bnx2x_hw_stats_update(bp);
@@ -1267,7 +1230,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
                                 BNX2X_ERR("storm stats were not updated for 3 times\n");
                                 bnx2x_panic();
                         }
-                        goto out;
+                        return;
                 }
         } else {
                 /* vf doesn't collect HW statistics, and doesn't get completions
@@ -1281,7 +1244,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 
         /* vf is done */
         if (IS_VF(bp))
-                goto out;
+                return;
 
         if (netif_msg_timer(bp)) {
                 struct bnx2x_eth_stats *estats = &bp->eth_stats;
@@ -1292,9 +1255,6 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 
         bnx2x_hw_stats_post(bp);
         bnx2x_storm_stats_post(bp);
-
-out:
-        up(&bp->stats_sema);
 }
 
 static void bnx2x_port_stats_stop(struct bnx2x *bp)
@@ -1358,12 +1318,7 @@ static void bnx2x_port_stats_stop(struct bnx2x *bp)
 
 static void bnx2x_stats_stop(struct bnx2x *bp)
 {
-        int update = 0;
-
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
-
-        bp->stats_started = false;
+        bool update = false;
 
         bnx2x_stats_comp(bp);
 
@@ -1381,8 +1336,6 @@ static void bnx2x_stats_stop(struct bnx2x *bp)
                 bnx2x_hw_stats_post(bp);
                 bnx2x_stats_comp(bp);
         }
-
-        up(&bp->stats_sema);
 }
 
 static void bnx2x_stats_do_nothing(struct bnx2x *bp)
@@ -1410,18 +1363,28 @@ static const struct {
 
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
 {
-        enum bnx2x_stats_state state;
-        void (*action)(struct bnx2x *bp);
+        enum bnx2x_stats_state state = bp->stats_state;
+
         if (unlikely(bp->panic))
                 return;
 
-        spin_lock_bh(&bp->stats_lock);
-        state = bp->stats_state;
+        /* Statistics update run from timer context, and we don't want to stop
+         * that context in case someone is in the middle of a transition.
+         * For other events, wait a bit until lock is taken.
+         */
+        if (!mutex_trylock(&bp->stats_lock)) {
+                if (event == STATS_EVENT_UPDATE)
+                        return;
+
+                DP(BNX2X_MSG_STATS,
+                   "Unlikely stats' lock contention [event %d]\n", event);
+                mutex_lock(&bp->stats_lock);
+        }
+
+        bnx2x_stats_stm[state][event].action(bp);
         bp->stats_state = bnx2x_stats_stm[state][event].next_state;
-        action = bnx2x_stats_stm[state][event].action;
-        spin_unlock_bh(&bp->stats_lock);
 
-        action(bp);
+        mutex_unlock(&bp->stats_lock);
 
         if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                 DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
@@ -1998,13 +1961,34 @@ void bnx2x_afex_collect_stats(struct bnx2x *bp, void *void_afex_stats,
         }
 }
 
-void bnx2x_stats_safe_exec(struct bnx2x *bp,
-                           void (func_to_exec)(void *cookie),
-                           void *cookie){
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
+int bnx2x_stats_safe_exec(struct bnx2x *bp,
+                          void (func_to_exec)(void *cookie),
+                          void *cookie)
+{
+        int cnt = 10, rc = 0;
+
+        /* Wait for statistics to end [while blocking further requests],
+         * then run supplied function 'safely'.
+         */
+        mutex_lock(&bp->stats_lock);
+
         bnx2x_stats_comp(bp);
+        while (bp->stats_pending && cnt--)
+                if (bnx2x_storm_stats_update(bp))
+                        usleep_range(1000, 2000);
+        if (bp->stats_pending) {
+                BNX2X_ERR("Failed to wait for stats pending to clear [possibly FW is stuck]\n");
+                rc = -EBUSY;
+                goto out;
+        }
+
         func_to_exec(cookie);
-        __bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
+
+out:
+        /* No need to restart statistics - if they're enabled, the timer
+         * will restart the statistics.
+         */
+        mutex_unlock(&bp->stats_lock);
+
+        return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index 2beceaefdeea..965539a9dabe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -539,9 +539,9 @@ struct bnx2x;
 void bnx2x_memset_stats(struct bnx2x *bp);
 void bnx2x_stats_init(struct bnx2x *bp);
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event);
-void bnx2x_stats_safe_exec(struct bnx2x *bp,
-                           void (func_to_exec)(void *cookie),
-                           void *cookie);
+int bnx2x_stats_safe_exec(struct bnx2x *bp,
+                          void (func_to_exec)(void *cookie),
+                          void *cookie);
 
 /**
  * bnx2x_save_statistics - save statistics when unloading.
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 97842d03675b..c6ff4890d171 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -376,8 +376,6 @@ enum {
 enum {
         INGQ_EXTRAS = 2,        /* firmware event queue and */
                                 /*   forwarded interrupts */
-        MAX_EGRQ = MAX_ETH_QSETS*2 + MAX_OFLD_QSETS*2
-                   + MAX_CTRL_QUEUES + MAX_RDMA_QUEUES + MAX_ISCSI_QUEUES,
         MAX_INGQ = MAX_ETH_QSETS + MAX_OFLD_QSETS + MAX_RDMA_QUEUES
                    + MAX_RDMA_CIQS + MAX_ISCSI_QUEUES + INGQ_EXTRAS,
 };
@@ -616,11 +614,13 @@ struct sge {
         unsigned int idma_qid[2];   /* SGE IDMA Hung Ingress Queue ID */
 
         unsigned int egr_start;
+        unsigned int egr_sz;
         unsigned int ingr_start;
-        void *egr_map[MAX_EGRQ];    /* qid->queue egress queue map */
-        struct sge_rspq *ingr_map[MAX_INGQ]; /* qid->queue ingress queue map */
-        DECLARE_BITMAP(starving_fl, MAX_EGRQ);
-        DECLARE_BITMAP(txq_maperr, MAX_EGRQ);
+        unsigned int ingr_sz;
+        void **egr_map;    /* qid->queue egress queue map */
+        struct sge_rspq **ingr_map; /* qid->queue ingress queue map */
+        unsigned long *starving_fl;
+        unsigned long *txq_maperr;
         struct timer_list rx_timer; /* refills starving FLs */
         struct timer_list tx_timer; /* checks Tx queues */
 };
@@ -1136,6 +1136,8 @@ int cxgb4_t4_bar2_sge_qregs(struct adapter *adapter,
 
 unsigned int qtimer_val(const struct adapter *adap,
                         const struct sge_rspq *q);
+
+int t4_init_devlog_params(struct adapter *adapter);
 int t4_init_sge_params(struct adapter *adapter);
 int t4_init_tp_params(struct adapter *adap);
 int t4_filter_field_shift(const struct adapter *adap, int filter_sel);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 78854ceb0870..dcb047945290 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -670,9 +670,13 @@ static int cctrl_tbl_show(struct seq_file *seq, void *v)
                 "0.9375" };
 
         int i;
-        u16 incr[NMTUS][NCCTRL_WIN];
+        u16 (*incr)[NCCTRL_WIN];
         struct adapter *adap = seq->private;
 
+        incr = kmalloc(sizeof(*incr) * NMTUS, GFP_KERNEL);
+        if (!incr)
+                return -ENOMEM;
+
         t4_read_cong_tbl(adap, incr);
 
         for (i = 0; i < NCCTRL_WIN; ++i) {
@@ -685,6 +689,8 @@ static int cctrl_tbl_show(struct seq_file *seq, void *v)
                            adap->params.a_wnd[i],
                            dec_fac[adap->params.b_wnd[i]]);
         }
+
+        kfree(incr);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index a22cf932ca35..d92995138f7e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -920,7 +920,7 @@ static void quiesce_rx(struct adapter *adap)
 {
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(adap->sge.ingr_map); i++) {
+        for (i = 0; i < adap->sge.ingr_sz; i++) {
                 struct sge_rspq *q = adap->sge.ingr_map[i];
 
                 if (q && q->handler) {
@@ -934,6 +934,21 @@ static void quiesce_rx(struct adapter *adap)
         }
 }
 
+/* Disable interrupt and napi handler */
+static void disable_interrupts(struct adapter *adap)
+{
+        if (adap->flags & FULL_INIT_DONE) {
+                t4_intr_disable(adap);
+                if (adap->flags & USING_MSIX) {
+                        free_msix_queue_irqs(adap);
+                        free_irq(adap->msix_info[0].vec, adap);
+                } else {
+                        free_irq(adap->pdev->irq, adap);
+                }
+                quiesce_rx(adap);
+        }
+}
+
 /*
  * Enable NAPI scheduling and interrupt generation for all Rx queues.
  */
@@ -941,7 +956,7 @@ static void enable_rx(struct adapter *adap)
 {
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(adap->sge.ingr_map); i++) {
+        for (i = 0; i < adap->sge.ingr_sz; i++) {
                 struct sge_rspq *q = adap->sge.ingr_map[i];
 
                 if (!q)
@@ -970,8 +985,8 @@ static int setup_sge_queues(struct adapter *adap)
         int err, msi_idx, i, j;
         struct sge *s = &adap->sge;
 
-        bitmap_zero(s->starving_fl, MAX_EGRQ);
-        bitmap_zero(s->txq_maperr, MAX_EGRQ);
+        bitmap_zero(s->starving_fl, s->egr_sz);
+        bitmap_zero(s->txq_maperr, s->egr_sz);
 
         if (adap->flags & USING_MSIX)
                 msi_idx = 1;         /* vector 0 is for non-queue interrupts */
@@ -983,6 +998,19 @@ static int setup_sge_queues(struct adapter *adap)
                 msi_idx = -((int)s->intrq.abs_id + 1);
         }
 
+        /* NOTE: If you add/delete any Ingress/Egress Queue allocations in here,
+         * don't forget to update the following which need to be
+         * synchronized to and changes here.
+         *
+         * 1. The calculations of MAX_INGQ in cxgb4.h.
+         *
+         * 2. Update enable_msix/name_msix_vecs/request_msix_queue_irqs
+         *    to accommodate any new/deleted Ingress Queues
+         *    which need MSI-X Vectors.
+         *
+         * 3. Update sge_qinfo_show() to include information on the
+         *    new/deleted queues.
+         */
         err = t4_sge_alloc_rxq(adap, &s->fw_evtq, true, adap->port[0],
                                msi_idx, NULL, fwevtq_handler);
         if (err) {
@@ -4244,19 +4272,12 @@ static int cxgb_up(struct adapter *adap)
 
 static void cxgb_down(struct adapter *adapter)
 {
-        t4_intr_disable(adapter);
         cancel_work_sync(&adapter->tid_release_task);
         cancel_work_sync(&adapter->db_full_task);
         cancel_work_sync(&adapter->db_drop_task);
         adapter->tid_release_task_busy = false;
         adapter->tid_release_head = NULL;
 
-        if (adapter->flags & USING_MSIX) {
-                free_msix_queue_irqs(adapter);
-                free_irq(adapter->msix_info[0].vec, adapter);
-        } else
-                free_irq(adapter->pdev->irq, adapter);
-        quiesce_rx(adapter);
         t4_sge_stop(adapter);
         t4_free_sge_resources(adapter);
         adapter->flags &= ~FULL_INIT_DONE;
@@ -4733,8 +4754,9 @@ static int adap_init1(struct adapter *adap, struct fw_caps_config_cmd *c)
         if (ret < 0)
                 return ret;
 
-        ret = t4_cfg_pfvf(adap, adap->fn, adap->fn, 0, MAX_EGRQ, 64, MAX_INGQ,
-                          0, 0, 4, 0xf, 0xf, 16, FW_CMD_CAP_PF, FW_CMD_CAP_PF);
+        ret = t4_cfg_pfvf(adap, adap->fn, adap->fn, 0, adap->sge.egr_sz, 64,
+                          MAX_INGQ, 0, 0, 4, 0xf, 0xf, 16, FW_CMD_CAP_PF,
+                          FW_CMD_CAP_PF);
         if (ret < 0)
                 return ret;
 
@@ -5088,10 +5110,15 @@ static int adap_init0(struct adapter *adap)
         enum dev_state state;
         u32 params[7], val[7];
         struct fw_caps_config_cmd caps_cmd;
-        struct fw_devlog_cmd devlog_cmd;
-        u32 devlog_meminfo;
         int reset = 1;
 
+        /* Grab Firmware Device Log parameters as early as possible so we have
+         * access to it for debugging, etc.
+         */
+        ret = t4_init_devlog_params(adap);
+        if (ret < 0)
+                return ret;
+
         /* Contact FW, advertising Master capability */
         ret = t4_fw_hello(adap, adap->mbox, adap->mbox, MASTER_MAY, &state);
         if (ret < 0) {
@@ -5169,30 +5196,6 @@ static int adap_init0(struct adapter *adap)
         if (ret < 0)
                 goto bye;
 
-        /* Read firmware device log parameters.  We really need to find a way
-         * to get these parameters initialized with some default values (which
-         * are likely to be correct) for the case where we either don't
-         * attache to the firmware or it's crashed when we probe the adapter.
-         * That way we'll still be able to perform early firmware startup
-         * debugging ...  If the request to get the Firmware's Device Log
-         * parameters fails, we'll live so we don't make that a fatal error.
-         */
-        memset(&devlog_cmd, 0, sizeof(devlog_cmd));
-        devlog_cmd.op_to_write = htonl(FW_CMD_OP_V(FW_DEVLOG_CMD) |
-                                       FW_CMD_REQUEST_F | FW_CMD_READ_F);
-        devlog_cmd.retval_len16 = htonl(FW_LEN16(devlog_cmd));
-        ret = t4_wr_mbox(adap, adap->mbox, &devlog_cmd, sizeof(devlog_cmd),
-                         &devlog_cmd);
-        if (ret == 0) {
-                devlog_meminfo =
-                        ntohl(devlog_cmd.memtype_devlog_memaddr16_devlog);
-                adap->params.devlog.memtype =
-                        FW_DEVLOG_CMD_MEMTYPE_DEVLOG_G(devlog_meminfo);
-                adap->params.devlog.start =
-                        FW_DEVLOG_CMD_MEMADDR16_DEVLOG_G(devlog_meminfo) << 4;
-                adap->params.devlog.size = ntohl(devlog_cmd.memsize_devlog);
-        }
-
         /*
          * Find out what ports are available to us.  Note that we need to do
          * this before calling adap_init0_no_config() since it needs nports
@@ -5293,6 +5296,51 @@ static int adap_init0(struct adapter *adap)
         adap->tids.nftids = val[4] - val[3] + 1;
         adap->sge.ingr_start = val[5];
 
+        /* qids (ingress/egress) returned from firmware can be anywhere
+         * in the range from EQ(IQFLINT)_START to EQ(IQFLINT)_END.
+         * Hence driver needs to allocate memory for this range to
+         * store the queue info. Get the highest IQFLINT/EQ index returned
+         * in FW_EQ_*_CMD.alloc command.
+         */
+        params[0] = FW_PARAM_PFVF(EQ_END);
+        params[1] = FW_PARAM_PFVF(IQFLINT_END);
+        ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 2, params, val);
+        if (ret < 0)
+                goto bye;
+        adap->sge.egr_sz = val[0] - adap->sge.egr_start + 1;
+        adap->sge.ingr_sz = val[1] - adap->sge.ingr_start + 1;
+
+        adap->sge.egr_map = kcalloc(adap->sge.egr_sz,
+                                    sizeof(*adap->sge.egr_map), GFP_KERNEL);
+        if (!adap->sge.egr_map) {
+                ret = -ENOMEM;
+                goto bye;
+        }
+
+        adap->sge.ingr_map = kcalloc(adap->sge.ingr_sz,
+                                     sizeof(*adap->sge.ingr_map), GFP_KERNEL);
+        if (!adap->sge.ingr_map) {
+                ret = -ENOMEM;
+                goto bye;
+        }
+
+        /* Allocate the memory for the vaious egress queue bitmaps
+         * ie starving_fl and txq_maperr.
+         */
+        adap->sge.starving_fl = kcalloc(BITS_TO_LONGS(adap->sge.egr_sz),
+                                        sizeof(long), GFP_KERNEL);
+        if (!adap->sge.starving_fl) {
+                ret = -ENOMEM;
+                goto bye;
+        }
+
+        adap->sge.txq_maperr = kcalloc(BITS_TO_LONGS(adap->sge.egr_sz),
+                                       sizeof(long), GFP_KERNEL);
+        if (!adap->sge.txq_maperr) {
+                ret = -ENOMEM;
+                goto bye;
+        }
+
         params[0] = FW_PARAM_PFVF(CLIP_START);
         params[1] = FW_PARAM_PFVF(CLIP_END);
         ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 2, params, val);
@@ -5501,6 +5549,10 @@ static int adap_init0(struct adapter *adap)
          * happened to HW/FW, stop issuing commands.
          */
 bye:
+        kfree(adap->sge.egr_map);
+        kfree(adap->sge.ingr_map);
+        kfree(adap->sge.starving_fl);
+        kfree(adap->sge.txq_maperr);
         if (ret != -ETIMEDOUT && ret != -EIO)
                 t4_fw_bye(adap, adap->mbox);
         return ret;
@@ -5528,6 +5580,7 @@ static pci_ers_result_t eeh_err_detected(struct pci_dev *pdev,
                 netif_carrier_off(dev);
         }
         spin_unlock(&adap->stats_lock);
+        disable_interrupts(adap);
         if (adap->flags & FULL_INIT_DONE)
                 cxgb_down(adap);
         rtnl_unlock();
@@ -5912,6 +5965,10 @@ static void free_some_resources(struct adapter *adapter)
 
         t4_free_mem(adapter->l2t);
         t4_free_mem(adapter->tids.tid_tab);
+        kfree(adapter->sge.egr_map);
+        kfree(adapter->sge.ingr_map);
+        kfree(adapter->sge.starving_fl);
+        kfree(adapter->sge.txq_maperr);
         disable_msi(adapter);
 
         for_each_port(adapter, i)
@@ -6237,6 +6294,8 @@ static void remove_one(struct pci_dev *pdev)
                 if (is_offload(adapter))
                         detach_ulds(adapter);
 
+                disable_interrupts(adapter);
+
                 for_each_port(adapter, i)
                         if (adapter->port[i]->reg_state == NETREG_REGISTERED)
                                 unregister_netdev(adapter->port[i]);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index b4b9f6048fe7..b688b32c21fe 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2171,7 +2171,7 @@ static void sge_rx_timer_cb(unsigned long data)
         struct adapter *adap = (struct adapter *)data;
         struct sge *s = &adap->sge;
 
-        for (i = 0; i < ARRAY_SIZE(s->starving_fl); i++)
+        for (i = 0; i < BITS_TO_LONGS(s->egr_sz); i++)
                 for (m = s->starving_fl[i]; m; m &= m - 1) {
                         struct sge_eth_rxq *rxq;
                         unsigned int id = __ffs(m) + i * BITS_PER_LONG;
@@ -2259,7 +2259,7 @@ static void sge_tx_timer_cb(unsigned long data)
         struct adapter *adap = (struct adapter *)data;
         struct sge *s = &adap->sge;
 
-        for (i = 0; i < ARRAY_SIZE(s->txq_maperr); i++)
+        for (i = 0; i < BITS_TO_LONGS(s->egr_sz); i++)
                 for (m = s->txq_maperr[i]; m; m &= m - 1) {
                         unsigned long id = __ffs(m) + i * BITS_PER_LONG;
                         struct sge_ofld_txq *txq = s->egr_map[id];
@@ -2741,7 +2741,8 @@ void t4_free_sge_resources(struct adapter *adap)
                 free_rspq_fl(adap, &adap->sge.intrq, NULL);
 
         /* clear the reverse egress queue map */
-        memset(adap->sge.egr_map, 0, sizeof(adap->sge.egr_map));
+        memset(adap->sge.egr_map, 0,
+               adap->sge.egr_sz * sizeof(*adap->sge.egr_map));
 }
 
 void t4_sge_start(struct adapter *adap)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 853c38997c82..ee394dc68303 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -1120,7 +1120,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
                 }
 
                 /* Installed successfully, update the cached header too. */
-                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                *card_fw = *fs_fw;
                 card_fw_usable = 1;
                 *reset = 0;     /* already reset as part of load_fw */
         }
@@ -4459,6 +4459,59 @@ int cxgb4_t4_bar2_sge_qregs(struct adapter *adapter,
 }
 
 /**
+ *      t4_init_devlog_params - initialize adapter->params.devlog
+ *      @adap: the adapter
+ *
+ *      Initialize various fields of the adapter's Firmware Device Log
+ *      Parameters structure.
+ */
+int t4_init_devlog_params(struct adapter *adap)
+{
+        struct devlog_params *dparams = &adap->params.devlog;
+        u32 pf_dparams;
+        unsigned int devlog_meminfo;
+        struct fw_devlog_cmd devlog_cmd;
+        int ret;
+
+        /* If we're dealing with newer firmware, the Device Log Paramerters
+         * are stored in a designated register which allows us to access the
+         * Device Log even if we can't talk to the firmware.
+         */
+        pf_dparams =
+                t4_read_reg(adap, PCIE_FW_REG(PCIE_FW_PF_A, PCIE_FW_PF_DEVLOG));
+        if (pf_dparams) {
+                unsigned int nentries, nentries128;
+
+                dparams->memtype = PCIE_FW_PF_DEVLOG_MEMTYPE_G(pf_dparams);
+                dparams->start = PCIE_FW_PF_DEVLOG_ADDR16_G(pf_dparams) << 4;
+
+                nentries128 = PCIE_FW_PF_DEVLOG_NENTRIES128_G(pf_dparams);
+                nentries = (nentries128 + 1) * 128;
+                dparams->size = nentries * sizeof(struct fw_devlog_e);
+
+                return 0;
+        }
+
+        /* Otherwise, ask the firmware for it's Device Log Parameters.
+         */
+        memset(&devlog_cmd, 0, sizeof(devlog_cmd));
+        devlog_cmd.op_to_write = htonl(FW_CMD_OP_V(FW_DEVLOG_CMD) |
+                                       FW_CMD_REQUEST_F | FW_CMD_READ_F);
+        devlog_cmd.retval_len16 = htonl(FW_LEN16(devlog_cmd));
+        ret = t4_wr_mbox(adap, adap->mbox, &devlog_cmd, sizeof(devlog_cmd),
+                         &devlog_cmd);
+        if (ret)
+                return ret;
+
+        devlog_meminfo = ntohl(devlog_cmd.memtype_devlog_memaddr16_devlog);
+        dparams->memtype = FW_DEVLOG_CMD_MEMTYPE_DEVLOG_G(devlog_meminfo);
+        dparams->start = FW_DEVLOG_CMD_MEMADDR16_DEVLOG_G(devlog_meminfo) << 4;
+        dparams->size = ntohl(devlog_cmd.memsize_devlog);
+
+        return 0;
+}
+
+/**
  *      t4_init_sge_params - initialize adap->params.sge
  *      @adapter: the adapter
  *
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index 231a725f6d5d..326674b19983 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -63,6 +63,8 @@
 #define MC_BIST_STATUS_REG(reg_addr, idx) ((reg_addr) + (idx) * 4)
 #define EDC_BIST_STATUS_REG(reg_addr, idx) ((reg_addr) + (idx) * 4)
 
+#define PCIE_FW_REG(reg_addr, idx) ((reg_addr) + (idx) * 4)
+
 #define SGE_PF_KDOORBELL_A 0x0
 
 #define QID_S    15
@@ -707,6 +709,7 @@
 #define PFNUM_V(x) ((x) << PFNUM_S)
 
 #define PCIE_FW_A 0x30b8
+#define PCIE_FW_PF_A 0x30bc
 
 #define PCIE_CORE_UTL_SYSTEM_BUS_AGENT_STATUS_A 0x5908
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index 9b353a88cbda..a4a19e0ec7f5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -101,7 +101,7 @@ enum fw_wr_opcodes {
         FW_RI_BIND_MW_WR               = 0x18,
         FW_RI_FR_NSMR_WR               = 0x19,
         FW_RI_INV_LSTAG_WR             = 0x1a,
-        FW_LASTC2E_WR                  = 0x40
+        FW_LASTC2E_WR                  = 0x70
 };
 
 struct fw_wr_hdr {
@@ -993,6 +993,7 @@ enum fw_memtype_cf {
         FW_MEMTYPE_CF_EXTMEM            = 0x2,
         FW_MEMTYPE_CF_FLASH             = 0x4,
         FW_MEMTYPE_CF_INTERNAL          = 0x5,
+        FW_MEMTYPE_CF_EXTMEM1           = 0x6,
 };
 
 struct fw_caps_config_cmd {
@@ -1035,6 +1036,7 @@ enum fw_params_mnem {
         FW_PARAMS_MNEM_PFVF             = 2,    /* function params */
         FW_PARAMS_MNEM_REG              = 3,    /* limited register access */
         FW_PARAMS_MNEM_DMAQ             = 4,    /* dma queue params */
+        FW_PARAMS_MNEM_CHNET            = 5,    /* chnet params */
         FW_PARAMS_MNEM_LAST
 };
 
@@ -3102,7 +3104,8 @@ enum fw_devlog_facility {
         FW_DEVLOG_FACILITY_FCOE         = 0x2E,
         FW_DEVLOG_FACILITY_FOISCSI      = 0x30,
         FW_DEVLOG_FACILITY_FOFCOE       = 0x32,
-        FW_DEVLOG_FACILITY_MAX          = 0x32,
+        FW_DEVLOG_FACILITY_CHNET        = 0x34,
+        FW_DEVLOG_FACILITY_MAX          = 0x34,
 };
 
 /* log message format */
@@ -3139,4 +3142,36 @@ struct fw_devlog_cmd {
         (((x) >> FW_DEVLOG_CMD_MEMADDR16_DEVLOG_S) & \
          FW_DEVLOG_CMD_MEMADDR16_DEVLOG_M)
 
+/* P C I E   F W   P F 7   R E G I S T E R */
+
+/* PF7 stores the Firmware Device Log parameters which allows Host Drivers to
+ * access the "devlog" which needing to contact firmware.  The encoding is
+ * mostly the same as that returned by the DEVLOG command except for the size
+ * which is encoded as the number of entries in multiples-1 of 128 here rather
+ * than the memory size as is done in the DEVLOG command.  Thus, 0 means 128
+ * and 15 means 2048.  This of course in turn constrains the allowed values
+ * for the devlog size ...
+ */
+#define PCIE_FW_PF_DEVLOG               7
+
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_S 28
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_M 0xf
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_V(x) \
+        ((x) << PCIE_FW_PF_DEVLOG_NENTRIES128_S)
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_G(x) \
+        (((x) >> PCIE_FW_PF_DEVLOG_NENTRIES128_S) & \
+         PCIE_FW_PF_DEVLOG_NENTRIES128_M)
+
+#define PCIE_FW_PF_DEVLOG_ADDR16_S      4
+#define PCIE_FW_PF_DEVLOG_ADDR16_M      0xffffff
+#define PCIE_FW_PF_DEVLOG_ADDR16_V(x)   ((x) << PCIE_FW_PF_DEVLOG_ADDR16_S)
+#define PCIE_FW_PF_DEVLOG_ADDR16_G(x) \
+        (((x) >> PCIE_FW_PF_DEVLOG_ADDR16_S) & PCIE_FW_PF_DEVLOG_ADDR16_M)
+
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_S     0
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_M     0xf
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_V(x)  ((x) << PCIE_FW_PF_DEVLOG_MEMTYPE_S)
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_G(x) \
+        (((x) >> PCIE_FW_PF_DEVLOG_MEMTYPE_S) & PCIE_FW_PF_DEVLOG_MEMTYPE_M)
+
 #endif /* _T4FW_INTERFACE_H_ */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index e2bd3f747858..b9d1cbac0eee 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -36,13 +36,13 @@
 #define __T4FW_VERSION_H__
 
 #define T4FW_VERSION_MAJOR 0x01
-#define T4FW_VERSION_MINOR 0x0C
-#define T4FW_VERSION_MICRO 0x19
+#define T4FW_VERSION_MINOR 0x0D
+#define T4FW_VERSION_MICRO 0x20
 #define T4FW_VERSION_BUILD 0x00
 
 #define T5FW_VERSION_MAJOR 0x01
-#define T5FW_VERSION_MINOR 0x0C
-#define T5FW_VERSION_MICRO 0x19
+#define T5FW_VERSION_MINOR 0x0D
+#define T5FW_VERSION_MICRO 0x20
 #define T5FW_VERSION_BUILD 0x00
 
 #endif
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 0545f0de1c52..e0d711071afb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -1004,7 +1004,7 @@ static inline void ring_tx_db(struct adapter *adapter, struct sge_txq *tq,
                                               ? (tq->pidx - 1)
                                               : (tq->size - 1));
                         __be64 *src = (__be64 *)&tq->desc[index];
-                        __be64 __iomem *dst = (__be64 *)(tq->bar2_addr +
+                        __be64 __iomem *dst = (__be64 __iomem *)(tq->bar2_addr +
                                                          SGE_UDB_WCDOORBELL);
                         unsigned int count = EQ_UNIT / sizeof(__be64);
 
@@ -1018,7 +1018,11 @@ static inline void ring_tx_db(struct adapter *adapter, struct sge_txq *tq,
                          * DMA.
                          */
                         while (count) {
-                                writeq(*src, dst);
+                                /* the (__force u64) is because the compiler
+                                 * doesn't understand the endian swizzling
+                                 * going on
+                                 */
+                                writeq((__force u64)*src, dst);
                                 src++;
                                 dst++;
                                 count--;
@@ -1252,8 +1256,8 @@ int t4vf_eth_xmit(struct sk_buff *skb, struct net_device *dev)
         BUG_ON(DIV_ROUND_UP(ETHTXQ_MAX_HDR, TXD_PER_EQ_UNIT) > 1);
         wr = (void *)&txq->q.desc[txq->q.pidx];
         wr->equiq_to_len16 = cpu_to_be32(wr_mid);
-        wr->r3[0] = cpu_to_be64(0);
-        wr->r3[1] = cpu_to_be64(0);
+        wr->r3[0] = cpu_to_be32(0);
+        wr->r3[1] = cpu_to_be32(0);
         skb_copy_from_linear_data(skb, (void *)wr->ethmacdst, fw_hdr_copy_len);
         end = (u64 *)wr + flits;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 1b5506df35b1..280b4a215849 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -210,10 +210,10 @@ int t4vf_wr_mbox_core(struct adapter *adapter, const void *cmd, int size,
 
                         if (rpl) {
                                 /* request bit in high-order BE word */
-                                WARN_ON((be32_to_cpu(*(const u32 *)cmd)
+                                WARN_ON((be32_to_cpu(*(const __be32 *)cmd)
                                          & FW_CMD_REQUEST_F) == 0);
                                 get_mbox_rpl(adapter, rpl, size, mbox_data);
-                                WARN_ON((be32_to_cpu(*(u32 *)rpl)
+                                WARN_ON((be32_to_cpu(*(__be32 *)rpl)
                                          & FW_CMD_REQUEST_F) != 0);
                         }
                         t4_write_reg(adapter, mbox_ctl,
@@ -484,7 +484,7 @@ int t4_bar2_sge_qregs(struct adapter *adapter,
          *  o The BAR2 Queue ID.
          *  o The BAR2 Queue ID Offset into the BAR2 page.
          */
-        bar2_page_offset = ((qid >> qpp_shift) << page_shift);
+        bar2_page_offset = ((u64)(qid >> qpp_shift) << page_shift);
         bar2_qid = qid & qpp_mask;
         bar2_qid_offset = bar2_qid * SGE_UDB_SIZE;
 
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index 3b42556f7f8d..ed41559bae77 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -589,7 +589,7 @@ static void tulip_tx_timeout(struct net_device *dev)
                                (unsigned int)tp->rx_ring[i].buffer1,
                                (unsigned int)tp->rx_ring[i].buffer2,
                                buf[0], buf[1], buf[2]);
-                        for (j = 0; buf[j] != 0xee && j < 1600; j++)
+                        for (j = 0; ((j < 1600) && buf[j] != 0xee); j++)
                                 if (j < 100)
                                         pr_cont(" %02x", buf[j]);
                         pr_cont(" j=%d\n", j);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 27de37aa90af..27b9fe99a9bd 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -354,6 +354,7 @@ struct be_vf_cfg {
         u16 vlan_tag;
         u32 tx_rate;
         u32 plink_tracking;
+        u32 privileges;
 };
 
 enum vf_state {
@@ -423,6 +424,7 @@ struct be_adapter {
 
         u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
         u8 __iomem *db;         /* Door Bell */
+        u8 __iomem *pcicfg;     /* On SH,BEx only. Shadow of PCI config space */
 
         struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
         struct be_dma_mem mbox_mem;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 36916cfa70f9..7f05f309e935 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1902,15 +1902,11 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 {
         int num_eqs, i = 0;
 
-        if (lancer_chip(adapter) && num > 8) {
-                while (num) {
-                        num_eqs = min(num, 8);
-                        __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
-                        i += num_eqs;
-                        num -= num_eqs;
-                }
-        } else {
-                __be_cmd_modify_eqd(adapter, set_eqd, num);
+        while (num) {
+                num_eqs = min(num, 8);
+                __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
+                i += num_eqs;
+                num -= num_eqs;
         }
 
         return 0;
@@ -1918,7 +1914,7 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num)
+                       u32 num, u32 domain)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_vlan_config *req;
@@ -1936,6 +1932,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
         be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                                OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req),
                                wrb, NULL);
+        req->hdr.domain = domain;
 
         req->interface_id = if_id;
         req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index db761e8e42a3..a7634a3f052a 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -2256,7 +2256,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
 int be_cmd_get_fw_ver(struct be_adapter *adapter);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num);
+                       u32 num, u32 domain);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0a816859aca5..e6b790f0d9dc 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1171,7 +1171,7 @@ static int be_vid_config(struct be_adapter *adapter)
         for_each_set_bit(i, adapter->vids, VLAN_N_VID)
                 vids[num++] = cpu_to_le16(i);
 
-        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num);
+        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num, 0);
         if (status) {
                 dev_err(dev, "Setting HW VLAN filtering failed\n");
                 /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -1380,11 +1380,67 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
         return 0;
 }
 
+static int be_set_vf_tvt(struct be_adapter *adapter, int vf, u16 vlan)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        u16 vids[BE_NUM_VLANS_SUPPORTED];
+        int vf_if_id = vf_cfg->if_handle;
+        int status;
+
+        /* Enable Transparent VLAN Tagging */
+        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1, vf_if_id, 0);
+        if (status)
+                return status;
+
+        /* Clear pre-programmed VLAN filters on VF if any, if TVT is enabled */
+        vids[0] = 0;
+        status = be_cmd_vlan_config(adapter, vf_if_id, vids, 1, vf + 1);
+        if (!status)
+                dev_info(&adapter->pdev->dev,
+                         "Cleared guest VLANs on VF%d", vf);
+
+        /* After TVT is enabled, disallow VFs to program VLAN filters */
+        if (vf_cfg->privileges & BE_PRIV_FILTMGMT) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges &
+                                                  ~BE_PRIV_FILTMGMT, vf + 1);
+                if (!status)
+                        vf_cfg->privileges &= ~BE_PRIV_FILTMGMT;
+        }
+        return 0;
+}
+
+static int be_clear_vf_tvt(struct be_adapter *adapter, int vf)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        struct device *dev = &adapter->pdev->dev;
+        int status;
+
+        /* Reset Transparent VLAN Tagging. */
+        status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID, vf + 1,
+                                       vf_cfg->if_handle, 0);
+        if (status)
+                return status;
+
+        /* Allow VFs to program VLAN filtering */
+        if (!(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges |
+                                                  BE_PRIV_FILTMGMT, vf + 1);
+                if (!status) {
+                        vf_cfg->privileges |= BE_PRIV_FILTMGMT;
+                        dev_info(dev, "VF%d: FILTMGMT priv enabled", vf);
+                }
+        }
+
+        dev_info(dev,
+                 "Disable/re-enable i/f in VM to clear Transparent VLAN tag");
+        return 0;
+}
+
 static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
         struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
-        int status = 0;
+        int status;
 
         if (!sriov_enabled(adapter))
                 return -EPERM;
@@ -1394,24 +1450,19 @@ static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 
         if (vlan || qos) {
                 vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan)
-                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                                       vf_cfg->if_handle, 0);
+                status = be_set_vf_tvt(adapter, vf, vlan);
         } else {
-                /* Reset Transparent Vlan Tagging. */
-                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                                               vf + 1, vf_cfg->if_handle, 0);
+                status = be_clear_vf_tvt(adapter, vf);
         }
 
         if (status) {
                 dev_err(&adapter->pdev->dev,
-                        "VLAN %d config on VF %d failed : %#x\n", vlan,
-                        vf, status);
+                        "VLAN %d config on VF %d failed : %#x\n", vlan, vf,
+                        status);
                 return be_cmd_status(status);
         }
 
         vf_cfg->vlan_tag = vlan;
-
         return 0;
 }
 
@@ -2772,14 +2823,12 @@ void be_detect_error(struct be_adapter *adapter)
                         }
                 }
         } else {
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW, &ue_lo);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HIGH, &ue_hi);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW_MASK, &ue_lo_mask);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HI_MASK, &ue_hi_mask);
+                ue_lo = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_LOW);
+                ue_hi = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_HIGH);
+                ue_lo_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_LOW_MASK);
+                ue_hi_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_HI_MASK);
 
                 ue_lo = (ue_lo & ~ue_lo_mask);
                 ue_hi = (ue_hi & ~ue_hi_mask);
@@ -3339,7 +3388,6 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
                         u32 cap_flags, u32 vf)
 {
         u32 en_flags;
-        int status;
 
         en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                    BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
@@ -3347,10 +3395,7 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
 
         en_flags &= cap_flags;
 
-        status = be_cmd_if_create(adapter, cap_flags, en_flags,
-                                  if_handle, vf);
-
-        return status;
+        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
 }
 
 static int be_vfs_if_create(struct be_adapter *adapter)
@@ -3368,8 +3413,13 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                 if (!BE3_chip(adapter)) {
                         status = be_cmd_get_profile_config(adapter, &res,
                                                            vf + 1);
-                        if (!status)
+                        if (!status) {
                                 cap_flags = res.if_cap_flags;
+                                /* Prevent VFs from enabling VLAN promiscuous
+                                 * mode
+                                 */
+                                cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+                        }
                 }
 
                 status = be_if_create(adapter, &vf_cfg->if_handle,
@@ -3403,7 +3453,6 @@ static int be_vf_setup(struct be_adapter *adapter)
         struct device *dev = &adapter->pdev->dev;
         struct be_vf_cfg *vf_cfg;
         int status, old_vfs, vf;
-        u32 privileges;
 
         old_vfs = pci_num_vf(adapter->pdev);
 
@@ -3433,15 +3482,18 @@ static int be_vf_setup(struct be_adapter *adapter)
 
         for_all_vfs(adapter, vf_cfg, vf) {
                 /* Allow VFs to programs MAC/VLAN filters */
-                status = be_cmd_get_fn_privileges(adapter, &privileges, vf + 1);
-                if (!status && !(privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_get_fn_privileges(adapter, &vf_cfg->privileges,
+                                                  vf + 1);
+                if (!status && !(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
                         status = be_cmd_set_fn_privileges(adapter,
-                                                          privileges |
+                                                          vf_cfg->privileges |
                                                           BE_PRIV_FILTMGMT,
                                                           vf + 1);
-                        if (!status)
+                        if (!status) {
+                                vf_cfg->privileges |= BE_PRIV_FILTMGMT;
                                 dev_info(dev, "VF%d has FILTMGMT privilege\n",
                                          vf);
+                        }
                 }
 
                 /* Allow full available bandwidth */
@@ -4820,24 +4872,37 @@ static int be_roce_map_pci_bars(struct be_adapter *adapter)
 
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
+        struct pci_dev *pdev = adapter->pdev;
         u8 __iomem *addr;
 
         if (BEx_chip(adapter) && be_physfn(adapter)) {
-                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                adapter->csr = pci_iomap(pdev, 2, 0);
                 if (!adapter->csr)
                         return -ENOMEM;
         }
 
-        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
+        addr = pci_iomap(pdev, db_bar(adapter), 0);
         if (!addr)
                 goto pci_map_err;
         adapter->db = addr;
 
+        if (skyhawk_chip(adapter) || BEx_chip(adapter)) {
+                if (be_physfn(adapter)) {
+                        /* PCICFG is the 2nd BAR in BE2 */
+                        addr = pci_iomap(pdev, BE2_chip(adapter) ? 1 : 0, 0);
+                        if (!addr)
+                                goto pci_map_err;
+                        adapter->pcicfg = addr;
+                } else {
+                        adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                }
+        }
+
         be_roce_map_pci_bars(adapter);
         return 0;
 
 pci_map_err:
-        dev_err(&adapter->pdev->dev, "Error in mapping PCI BARs\n");
+        dev_err(&pdev->dev, "Error in mapping PCI BARs\n");
         be_unmap_pci_bars(adapter);
         return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 99492b7e3713..f6a3a7abd468 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1189,13 +1189,12 @@ static void
 fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
 {
         struct  fec_enet_private *fep;
-        struct bufdesc *bdp, *bdp_t;
+        struct bufdesc *bdp;
         unsigned short status;
         struct  sk_buff *skb;
         struct fec_enet_priv_tx_q *txq;
         struct netdev_queue *nq;
         int     index = 0;
-        int     i, bdnum;
         int     entries_free;
 
         fep = netdev_priv(ndev);
@@ -1216,29 +1215,18 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
                 if (bdp == txq->cur_tx)
                         break;
 
-                bdp_t = bdp;
-                bdnum = 1;
-                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                skb = txq->tx_skbuff[index];
-                while (!skb) {
-                        bdp_t = fec_enet_get_nextdesc(bdp_t, fep, queue_id);
-                        index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                        skb = txq->tx_skbuff[index];
-                        bdnum++;
-                }
-                if (skb_shinfo(skb)->nr_frags &&
-                    (status = bdp_t->cbd_sc) & BD_ENET_TX_READY)
-                        break;
+                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp, fep);
 
-                for (i = 0; i < bdnum; i++) {
-                        if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
-                                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                                 bdp->cbd_datlen, DMA_TO_DEVICE);
-                        bdp->cbd_bufaddr = 0;
-                        if (i < bdnum - 1)
-                                bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
-                }
+                skb = txq->tx_skbuff[index];
                 txq->tx_skbuff[index] = NULL;
+                if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
+                        dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        bdp->cbd_datlen, DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
+                if (!skb) {
+                        bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
+                        continue;
+                }
 
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
@@ -1479,8 +1467,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
 
                         vlan_packet_rcvd = true;
 
-                        skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
-                                                       data, (2 * ETH_ALEN));
+                        memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
                         skb_pull(skb, VLAN_HLEN);
                 }
 
@@ -1967,6 +1954,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         struct device_node *node;
         int err = -ENXIO, i;
+        u32 mii_speed, holdtime;
 
         /*
          * The i.MX28 dual fec interfaces are not equal.
@@ -2004,10 +1992,33 @@ static int fec_enet_mii_init(struct platform_device *pdev)
          * Reference Manual has an error on this, and gets fixed on i.MX6Q
          * document.
          */
-        fep->phy_speed = DIV_ROUND_UP(clk_get_rate(fep->clk_ipg), 5000000);
+        mii_speed = DIV_ROUND_UP(clk_get_rate(fep->clk_ipg), 5000000);
         if (fep->quirks & FEC_QUIRK_ENET_MAC)
-                fep->phy_speed--;
-        fep->phy_speed <<= 1;
+                mii_speed--;
+        if (mii_speed > 63) {
+                dev_err(&pdev->dev,
+                        "fec clock (%lu) to fast to get right mii speed\n",
+                        clk_get_rate(fep->clk_ipg));
+                err = -EINVAL;
+                goto err_out;
+        }
+
+        /*
+         * The i.MX28 and i.MX6 types have another filed in the MSCR (aka
+         * MII_SPEED) register that defines the MDIO output hold time. Earlier
+         * versions are RAZ there, so just ignore the difference and write the
+         * register always.
+         * The minimal hold time according to IEE802.3 (clause 22) is 10 ns.
+         * HOLDTIME + 1 is the number of clk cycles the fec is holding the
+         * output.
+         * The HOLDTIME bitfield takes values between 0 and 7 (inclusive).
+         * Given that ceil(clkrate / 5000000) <= 64, the calculation for
+         * holdtime cannot result in a value greater than 3.
+         */
+        holdtime = DIV_ROUND_UP(clk_get_rate(fep->clk_ipg), 100000000) - 1;
+
+        fep->phy_speed = mii_speed << 1 | holdtime << 8;
+
         writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
 
         fep->mii_bus = mdiobus_alloc();
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 357e8b576905..56b774d3a13d 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -3893,6 +3893,9 @@ static int ucc_geth_probe(struct platform_device* ofdev)
         ugeth->phy_interface = phy_interface;
         ugeth->max_speed = max_speed;
 
+        /* Carrier starts down, phylib will bring it up */
+        netif_carrier_off(dev);
+
         err = register_netdev(dev);
         if (err) {
                 if (netif_msg_probe(ugeth))
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 072426a72745..cd7675ac5bf9 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1136,6 +1136,8 @@ restart_poll:
         ibmveth_replenish_task(adapter);
 
         if (frames_processed < budget) {
+                napi_complete(napi);
+
                 /* We think we are done - reenable interrupts,
                  * then check once more to make sure we are done.
                  */
@@ -1144,8 +1146,6 @@ restart_poll:
 
                 BUG_ON(lpar_rc != H_SUCCESS);
 
-                napi_complete(napi);
-
                 if (ibmveth_rxq_pending_buffer(adapter) &&
                     napi_reschedule(napi)) {
                         lpar_rc = h_vio_signal(adapter->vdev->unit_address,
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 96208f17bb53..2db653225a0e 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -2658,16 +2658,11 @@ static int mvneta_stop(struct net_device *dev)
 static int mvneta_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         struct mvneta_port *pp = netdev_priv(dev);
-        int ret;
 
         if (!pp->phy_dev)
                 return -ENOTSUPP;
 
-        ret = phy_mii_ioctl(pp->phy_dev, ifr, cmd);
-        if (!ret)
-                mvneta_adjust_link(dev);
-
-        return ret;
+        return phy_mii_ioctl(pp->phy_dev, ifr, cmd);
 }
 
 /* Ethtool methods */
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index a681d7c0bb9f..546ca4226916 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -724,7 +724,8 @@ static int mlx4_cmd_wait(struct mlx4_dev *dev, u64 in_param, u64 *out_param,
                  * on the host, we deprecate the error message for this
                  * specific command/input_mod/opcode_mod/fw-status to be debug.
                  */
-                if (op == MLX4_CMD_SET_PORT && in_modifier == 1 &&
+                if (op == MLX4_CMD_SET_PORT &&
+                    (in_modifier == 1 || in_modifier == 2) &&
                     op_modifier == 0 && context->fw_status == CMD_STAT_BAD_SIZE)
                         mlx4_dbg(dev, "command 0x%x failed: fw status = 0x%x\n",
                                  op, context->fw_status);
@@ -1993,7 +1994,6 @@ static void mlx4_master_do_cmd(struct mlx4_dev *dev, int slave, u8 cmd,
                         goto reset_slave;
                 slave_state[slave].vhcr_dma = ((u64) param) << 48;
                 priv->mfunc.master.slave_state[slave].cookie = 0;
-                mutex_init(&priv->mfunc.master.gen_eqe_mutex[slave]);
                 break;
         case MLX4_COMM_CMD_VHCR1:
                 if (slave_state[slave].last_cmd != MLX4_COMM_CMD_VHCR0)
@@ -2225,6 +2225,7 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
                 for (i = 0; i < dev->num_slaves; ++i) {
                         s_state = &priv->mfunc.master.slave_state[i];
                         s_state->last_cmd = MLX4_COMM_CMD_RESET;
+                        mutex_init(&priv->mfunc.master.gen_eqe_mutex[i]);
                         for (j = 0; j < MLX4_EVENT_TYPES_NUM; ++j)
                                 s_state->event_eq[j].eqn = -1;
                         __raw_writel((__force u32) 0,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 2a210c4efb89..3485acf03014 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1698,8 +1698,6 @@ int mlx4_en_start_port(struct net_device *dev)
         /* Schedule multicast task to populate multicast list */
         queue_work(mdev->workqueue, &priv->rx_mode_task);
 
-        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
-
 #ifdef CONFIG_MLX4_EN_VXLAN
         if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 vxlan_get_rx_port(dev);
@@ -2807,13 +2805,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         netif_carrier_off(dev);
         mlx4_en_set_default_moderation(priv);
 
-        err = register_netdev(dev);
-        if (err) {
-                en_err(priv, "Netdev registration failed for port %d\n", port);
-                goto out;
-        }
-        priv->registered = 1;
-
         en_warn(priv, "Using %d TX rings\n", prof->tx_ring_num);
         en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num);
 
@@ -2853,6 +2844,16 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                 queue_delayed_work(mdev->workqueue, &priv->service_task,
                                    SERVICE_TASK_DELAY);
 
+        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
+
+        err = register_netdev(dev);
+        if (err) {
+                en_err(priv, "Netdev registration failed for port %d\n", port);
+                goto out;
+        }
+
+        priv->registered = 1;
+
         return 0;
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 264bc15c1ff2..6e70ffee8e87 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -153,12 +153,10 @@ void mlx4_gen_slave_eqe(struct work_struct *work)
 
                 /* All active slaves need to receive the event */
                 if (slave == ALL_SLAVES) {
-                        for (i = 0; i < dev->num_slaves; i++) {
-                                if (i != dev->caps.function &&
-                                    master->slave_state[i].active)
-                                        if (mlx4_GEN_EQE(dev, i, eqe))
-                                                mlx4_warn(dev, "Failed to generate event for slave %d\n",
-                                                          i);
+                        for (i = 0; i <= dev->persist->num_vfs; i++) {
+                                if (mlx4_GEN_EQE(dev, i, eqe))
+                                        mlx4_warn(dev, "Failed to generate event for slave %d\n",
+                                                  i);
                         }
                 } else {
                         if (mlx4_GEN_EQE(dev, slave, eqe))
@@ -203,13 +201,11 @@ static void mlx4_slave_event(struct mlx4_dev *dev, int slave,
                              struct mlx4_eqe *eqe)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
-        struct mlx4_slave_state *s_slave =
-                &priv->mfunc.master.slave_state[slave];
 
-        if (!s_slave->active) {
-                /*mlx4_warn(dev, "Trying to pass event to inactive slave\n");*/
+        if (slave < 0 || slave > dev->persist->num_vfs ||
+            slave == dev->caps.function ||
+            !priv->mfunc.master.slave_state[slave].active)
                 return;
-        }
 
         slave_event(dev, slave, eqe);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 2a8268e6be15..ebbe244e80dd 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -453,7 +453,7 @@ struct mlx4_en_port_stats {
         unsigned long rx_chksum_none;
         unsigned long rx_chksum_complete;
         unsigned long tx_chksum_offload;
-#define NUM_PORT_STATS          9
+#define NUM_PORT_STATS          10
 };
 
 struct mlx4_en_perf_stats {
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index d97ca88c55b5..6e413ac4e940 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -3095,6 +3095,12 @@ int mlx4_GEN_EQE(struct mlx4_dev *dev, int slave, struct mlx4_eqe *eqe)
         if (!priv->mfunc.master.slave_state)
                 return -EINVAL;
 
+        /* check for slave valid, slave not PF, and slave active */
+        if (slave < 0 || slave > dev->persist->num_vfs ||
+            slave == dev->caps.function ||
+            !priv->mfunc.master.slave_state[slave].active)
+                return 0;
+
         event_eq = &priv->mfunc.master.slave_state[slave].event_eq[eqe->type];
 
         /* Create the event only if the slave is registered */
diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
index 9fb6948e14c6..5cecec282aba 100644
--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -4468,10 +4468,16 @@ static int rocker_port_master_changed(struct net_device *dev)
         struct net_device *master = netdev_master_upper_dev_get(dev);
         int err = 0;
 
+        /* There are currently three cases handled here:
+         * 1. Joining a bridge
+         * 2. Leaving a previously joined bridge
+         * 3. Other, e.g. being added to or removed from a bond or openvswitch,
+         *    in which case nothing is done
+         */
         if (master && master->rtnl_link_ops &&
             !strcmp(master->rtnl_link_ops->kind, "bridge"))
                 err = rocker_port_bridge_join(rocker_port, master);
-        else
+        else if (rocker_port_is_bridged(rocker_port))
                 err = rocker_port_bridge_leave(rocker_port);
 
         return err;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5d093dc0f5f5..8678e39aba08 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2248,10 +2248,9 @@ static int smc_drv_probe(struct platform_device *pdev)
         const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
-        struct resource *res;
+        struct resource *res, *ires;
         unsigned int __iomem *addr;
         unsigned long irq_flags = SMC_IRQ_FLAGS;
-        unsigned long irq_resflags;
         int ret;
 
         ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2343,19 +2342,16 @@ static int smc_drv_probe(struct platform_device *pdev)
                 goto out_free_netdev;
         }
 
-        ndev->irq = platform_get_irq(pdev, 0);
-        if (ndev->irq <= 0) {
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!ires) {
                 ret = -ENODEV;
                 goto out_release_io;
         }
-        /*
-         * If this platform does not specify any special irqflags, or if
-         * the resource supplies a trigger, override the irqflags with
-         * the trigger flags from the resource.
-         */
-        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
-        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
-                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
+
+        ndev->irq = ires->start;
+
+        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
+                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index a495931a66a1..0e0fbb5842b3 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -498,9 +498,9 @@ static int w5100_napi_poll(struct napi_struct *napi, int budget)
         }
 
         if (rx_count < budget) {
+                napi_complete(napi);
                 w5100_write(priv, W5100_IMR, IR_S0);
                 mmiowb();
-                napi_complete(napi);
         }
 
         return rx_count;
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index 09322d9db578..4b310002258d 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -418,9 +418,9 @@ static int w5300_napi_poll(struct napi_struct *napi, int budget)
         }
 
         if (rx_count < budget) {
+                napi_complete(napi);
                 w5300_write(priv, W5300_IMR, IR_S0);
                 mmiowb();
-                napi_complete(napi);
         }
 
         return rx_count;
diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h
index 924ea98bd531..54549a6223dd 100644
--- a/drivers/net/ipvlan/ipvlan.h
+++ b/drivers/net/ipvlan/ipvlan.h
@@ -114,7 +114,9 @@ unsigned int ipvlan_mac_hash(const unsigned char *addr);
 rx_handler_result_t ipvlan_handle_frame(struct sk_buff **pskb);
 int ipvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev);
 void ipvlan_ht_addr_add(struct ipvl_dev *ipvlan, struct ipvl_addr *addr);
-bool ipvlan_addr_busy(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6);
+struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
+                                   const void *iaddr, bool is_v6);
+bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6);
 struct ipvl_addr *ipvlan_ht_addr_lookup(const struct ipvl_port *port,
                                         const void *iaddr, bool is_v6);
 void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync);
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 2a175006028b..b7877a194cfe 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -81,19 +81,20 @@ void ipvlan_ht_addr_add(struct ipvl_dev *ipvlan, struct ipvl_addr *addr)
         hash = (addr->atype == IPVL_IPV6) ?
                ipvlan_get_v6_hash(&addr->ip6addr) :
                ipvlan_get_v4_hash(&addr->ip4addr);
-        hlist_add_head_rcu(&addr->hlnode, &port->hlhead[hash]);
+        if (hlist_unhashed(&addr->hlnode))
+                hlist_add_head_rcu(&addr->hlnode, &port->hlhead[hash]);
 }
 
 void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync)
 {
-        hlist_del_rcu(&addr->hlnode);
+        hlist_del_init_rcu(&addr->hlnode);
         if (sync)
                 synchronize_rcu();
 }
 
-bool ipvlan_addr_busy(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
+struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
+                                   const void *iaddr, bool is_v6)
 {
-        struct ipvl_port *port = ipvlan->port;
         struct ipvl_addr *addr;
 
         list_for_each_entry(addr, &ipvlan->addrs, anode) {
@@ -101,12 +102,21 @@ bool ipvlan_addr_busy(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
                     ipv6_addr_equal(&addr->ip6addr, iaddr)) ||
                     (!is_v6 && addr->atype == IPVL_IPV4 &&
                     addr->ip4addr.s_addr == ((struct in_addr *)iaddr)->s_addr))
-                        return true;
+                        return addr;
         }
+        return NULL;
+}
+
+bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6)
+{
+        struct ipvl_dev *ipvlan;
 
-        if (ipvlan_ht_addr_lookup(port, iaddr, is_v6))
-                return true;
+        ASSERT_RTNL();
 
+        list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+                if (ipvlan_find_addr(ipvlan, iaddr, is_v6))
+                        return true;
+        }
         return false;
 }
 
@@ -192,7 +202,8 @@ static void ipvlan_multicast_frame(struct ipvl_port *port, struct sk_buff *skb,
         if (skb->protocol == htons(ETH_P_PAUSE))
                 return;
 
-        list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(ipvlan, &port->ipvlans, pnode) {
                 if (local && (ipvlan == in_dev))
                         continue;
 
@@ -219,6 +230,7 @@ static void ipvlan_multicast_frame(struct ipvl_port *port, struct sk_buff *skb,
 mcast_acct:
                 ipvlan_count_rx(ipvlan, len, ret == NET_RX_SUCCESS, true);
         }
+        rcu_read_unlock();
 
         /* Locally generated? ...Forward a copy to the main-device as
          * well. On the RX side we'll ignore it (wont give it to any
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 4f4099d5603d..4fa14208d799 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -505,7 +505,7 @@ static void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
         if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
                 list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
                         ipvlan_ht_addr_del(addr, !dev->dismantle);
-                        list_del_rcu(&addr->anode);
+                        list_del(&addr->anode);
                 }
         }
         list_del_rcu(&ipvlan->pnode);
@@ -607,7 +607,7 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
 {
         struct ipvl_addr *addr;
 
-        if (ipvlan_addr_busy(ipvlan, ip6_addr, true)) {
+        if (ipvlan_addr_busy(ipvlan->port, ip6_addr, true)) {
                 netif_err(ipvlan, ifup, ipvlan->dev,
                           "Failed to add IPv6=%pI6c addr for %s intf\n",
                           ip6_addr, ipvlan->dev->name);
@@ -620,9 +620,13 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
         addr->master = ipvlan;
         memcpy(&addr->ip6addr, ip6_addr, sizeof(struct in6_addr));
         addr->atype = IPVL_IPV6;
-        list_add_tail_rcu(&addr->anode, &ipvlan->addrs);
+        list_add_tail(&addr->anode, &ipvlan->addrs);
         ipvlan->ipv6cnt++;
-        ipvlan_ht_addr_add(ipvlan, addr);
+        /* If the interface is not up, the address will be added to the hash
+         * list by ipvlan_open.
+         */
+        if (netif_running(ipvlan->dev))
+                ipvlan_ht_addr_add(ipvlan, addr);
 
         return 0;
 }
@@ -631,12 +635,12 @@ static void ipvlan_del_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
 {
         struct ipvl_addr *addr;
 
-        addr = ipvlan_ht_addr_lookup(ipvlan->port, ip6_addr, true);
+        addr = ipvlan_find_addr(ipvlan, ip6_addr, true);
         if (!addr)
                 return;
 
         ipvlan_ht_addr_del(addr, true);
-        list_del_rcu(&addr->anode);
+        list_del(&addr->anode);
         ipvlan->ipv6cnt--;
         WARN_ON(ipvlan->ipv6cnt < 0);
         kfree_rcu(addr, rcu);
@@ -675,7 +679,7 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
 {
         struct ipvl_addr *addr;
 
-        if (ipvlan_addr_busy(ipvlan, ip4_addr, false)) {
+        if (ipvlan_addr_busy(ipvlan->port, ip4_addr, false)) {
                 netif_err(ipvlan, ifup, ipvlan->dev,
                           "Failed to add IPv4=%pI4 on %s intf.\n",
                           ip4_addr, ipvlan->dev->name);
@@ -688,9 +692,13 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
         addr->master = ipvlan;
         memcpy(&addr->ip4addr, ip4_addr, sizeof(struct in_addr));
         addr->atype = IPVL_IPV4;
-        list_add_tail_rcu(&addr->anode, &ipvlan->addrs);
+        list_add_tail(&addr->anode, &ipvlan->addrs);
         ipvlan->ipv4cnt++;
-        ipvlan_ht_addr_add(ipvlan, addr);
+        /* If the interface is not up, the address will be added to the hash
+         * list by ipvlan_open.
+         */
+        if (netif_running(ipvlan->dev))
+                ipvlan_ht_addr_add(ipvlan, addr);
         ipvlan_set_broadcast_mac_filter(ipvlan, true);
 
         return 0;
@@ -700,12 +708,12 @@ static void ipvlan_del_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
 {
         struct ipvl_addr *addr;
 
-        addr = ipvlan_ht_addr_lookup(ipvlan->port, ip4_addr, false);
+        addr = ipvlan_find_addr(ipvlan, ip4_addr, false);
         if (!addr)
                 return;
 
         ipvlan_ht_addr_del(addr, true);
-        list_del_rcu(&addr->anode);
+        list_del(&addr->anode);
         ipvlan->ipv4cnt--;
         WARN_ON(ipvlan->ipv4cnt < 0);
         if (!ipvlan->ipv4cnt)
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 5c55f11572ba..75d6f26729a3 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -188,6 +188,8 @@ struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                 memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
                 skb_put(skb, sizeof(padbytes));
         }
+
+        usbnet_set_skb_tx_stats(skb, 1, 0);
         return skb;
 }
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 9311a08565be..4545e78840b0 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -522,6 +522,7 @@ static const struct driver_info wwan_info = {
 #define DELL_VENDOR_ID          0x413C
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
+#define LENOVO_VENDOR_ID        0x17ef
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -702,6 +703,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* Lenovo Thinkpad USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x7205, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 80a844e0ae03..c3e4da9e79ca 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1172,17 +1172,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
 
         /* return skb */
         ctx->tx_curr_skb = NULL;
-        dev->net->stats.tx_packets += ctx->tx_curr_frame_num;
 
         /* keep private stats: framing overhead and number of NTBs */
         ctx->tx_overhead += skb_out->len - ctx->tx_curr_frame_payload;
         ctx->tx_ntbs++;
 
-        /* usbnet has already counted all the framing overhead.
+        /* usbnet will count all the framing overhead by default.
          * Adjust the stats so that the tx_bytes counter show real
          * payload data instead.
          */
-        dev->net->stats.tx_bytes -= skb_out->len - ctx->tx_curr_frame_payload;
+        usbnet_set_skb_tx_stats(skb_out, n,
+                                ctx->tx_curr_frame_payload - skb_out->len);
 
         return skb_out;
 
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 3eed708a6182..1762ad3910b2 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -46,8 +46,7 @@ enum cx82310_status {
 };
 
 #define CMD_PACKET_SIZE 64
-/* first command after power on can take around 8 seconds */
-#define CMD_TIMEOUT     15000
+#define CMD_TIMEOUT     100
 #define CMD_REPLY_RETRY 5
 
 #define CX82310_MTU     1514
@@ -78,8 +77,9 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
         ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, CMD_EP), buf,
                            CMD_PACKET_SIZE, &actual_len, CMD_TIMEOUT);
         if (ret < 0) {
-                dev_err(&dev->udev->dev, "send command %#x: error %d\n",
-                        cmd, ret);
+                if (cmd != CMD_GET_LINK_STATUS)
+                        dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                                cmd, ret);
                 goto end;
         }
 
@@ -90,8 +90,10 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
                                            buf, CMD_PACKET_SIZE, &actual_len,
                                            CMD_TIMEOUT);
                         if (ret < 0) {
-                                dev_err(&dev->udev->dev,
-                                        "reply receive error %d\n", ret);
+                                if (cmd != CMD_GET_LINK_STATUS)
+                                        dev_err(&dev->udev->dev,
+                                                "reply receive error %d\n",
+                                                ret);
                                 goto end;
                         }
                         if (actual_len > 0)
@@ -134,6 +136,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
         int ret;
         char buf[15];
         struct usb_device *udev = dev->udev;
+        u8 link[3];
+        int timeout = 50;
 
         /* avoid ADSL modems - continue only if iProduct is "USB NET CARD" */
         if (usb_string(udev, udev->descriptor.iProduct, buf, sizeof(buf)) > 0
@@ -160,6 +164,20 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
         if (!dev->partial_data)
                 return -ENOMEM;
 
+        /* wait for firmware to become ready (indicated by the link being up) */
+        while (--timeout) {
+                ret = cx82310_cmd(dev, CMD_GET_LINK_STATUS, true, NULL, 0,
+                                  link, sizeof(link));
+                /* the command can time out during boot - it's not an error */
+                if (!ret && link[0] == 1 && link[2] == 1)
+                        break;
+                msleep(500);
+        };
+        if (!timeout) {
+                dev_err(&udev->dev, "firmware not ready in time\n");
+                return -ETIMEDOUT;
+        }
+
         /* enable ethernet mode (?) */
         ret = cx82310_cmd(dev, CMD_ETHERNET_MODE, true, "\x01", 1, NULL, 0);
         if (ret) {
@@ -300,9 +318,18 @@ static const struct driver_info	cx82310_info = {
         .tx_fixup       = cx82310_tx_fixup,
 };
 
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+                       USB_DEVICE_ID_MATCH_DEV_INFO, \
+        .idVendor = (vend), \
+        .idProduct = (prod), \
+        .bDeviceClass = (cl), \
+        .bDeviceSubClass = (sc), \
+        .bDeviceProtocol = (pr)
+
 static const struct usb_device_id products[] = {
         {
-                USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
+                USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
                 .driver_info = (unsigned long) &cx82310_info
         },
         { },
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 438fc6bcaef1..9f7c0ab3b349 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -492,6 +492,7 @@ enum rtl8152_flags {
 /* Define these values to match your device */
 #define VENDOR_ID_REALTEK               0x0bda
 #define VENDOR_ID_SAMSUNG               0x04e8
+#define VENDOR_ID_LENOVO                0x17ef
 
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
@@ -4037,6 +4038,7 @@ static struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8152)},
         {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8153)},
         {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
         {}
 };
 
diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
index b94a0fbb8b3b..953de13267df 100644
--- a/drivers/net/usb/sr9800.c
+++ b/drivers/net/usb/sr9800.c
@@ -144,6 +144,7 @@ static struct sk_buff *sr_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                 skb_put(skb, sizeof(padbytes));
         }
 
+        usbnet_set_skb_tx_stats(skb, 1, 0);
         return skb;
 }
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 449835f4331e..777757ae1973 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1188,8 +1188,7 @@ static void tx_complete (struct urb *urb)
         struct usbnet           *dev = entry->dev;
 
         if (urb->status == 0) {
-                if (!(dev->driver_info->flags & FLAG_MULTI_PACKET))
-                        dev->net->stats.tx_packets++;
+                dev->net->stats.tx_packets += entry->packets;
                 dev->net->stats.tx_bytes += entry->length;
         } else {
                 dev->net->stats.tx_errors++;
@@ -1347,7 +1346,19 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                 } else
                         urb->transfer_flags |= URB_ZERO_PACKET;
         }
-        entry->length = urb->transfer_buffer_length = length;
+        urb->transfer_buffer_length = length;
+
+        if (info->flags & FLAG_MULTI_PACKET) {
+                /* Driver has set number of packets and a length delta.
+                 * Calculate the complete length and ensure that it's
+                 * positive.
+                 */
+                entry->length += length;
+                if (WARN_ON_ONCE(entry->length <= 0))
+                        entry->length = length;
+        } else {
+                usbnet_set_skb_tx_stats(skb, 1, length);
+        }
 
         spin_lock_irqsave(&dev->txq.lock, flags);
         retval = usb_autopm_get_interface_async(dev->intf);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f1ff3666f090..59b0e9754ae3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1448,8 +1448,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
 {
         int i;
 
-        for (i = 0; i < vi->max_queue_pairs; i++)
+        for (i = 0; i < vi->max_queue_pairs; i++) {
+                napi_hash_del(&vi->rq[i].napi);
                 netif_napi_del(&vi->rq[i].napi);
+        }
 
         kfree(vi->rq);
         kfree(vi->sq);
@@ -1948,11 +1950,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
         cancel_delayed_work_sync(&vi->refill);
 
         if (netif_running(vi->dev)) {
-                for (i = 0; i < vi->max_queue_pairs; i++) {
+                for (i = 0; i < vi->max_queue_pairs; i++)
                         napi_disable(&vi->rq[i].napi);
-                        napi_hash_del(&vi->rq[i].napi);
-                        netif_napi_del(&vi->rq[i].napi);
-                }
         }
 
         remove_vq_common(vi);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 1e0a775ea882..f8528a4cf54f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1218,7 +1218,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                         goto drop;
 
                 flags &= ~VXLAN_HF_RCO;
-                vni &= VXLAN_VID_MASK;
+                vni &= VXLAN_VNI_MASK;
         }
 
         /* For backwards compatibility, only allow reserved fields to be
@@ -1239,7 +1239,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                 flags &= ~VXLAN_GBP_USED_BITS;
         }
 
-        if (flags || (vni & ~VXLAN_VID_MASK)) {
+        if (flags || vni & ~VXLAN_VNI_MASK) {
                 /* If there are any unprocessed flags remaining treat
                  * this as a malformed packet. This behavior diverges from
                  * VXLAN RFC (RFC7348) which stipulates that bits in reserved
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index cb366adc820b..f50a6bc5d06e 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -219,12 +219,15 @@ void ath9k_beacon_remove_slot(struct ath_softc *sc, struct ieee80211_vif *vif)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
         struct ath_buf *bf = avp->av_bcbuf;
+        struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
 
         ath_dbg(common, CONFIG, "Removing interface at beacon slot: %d\n",
                 avp->av_bslot);
 
         tasklet_disable(&sc->bcon_tasklet);
 
+        cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
+
         if (bf && bf->bf_mpdu) {
                 struct sk_buff *skb = bf->bf_mpdu;
                 dma_unmap_single(sc->dev, bf->bf_buf_addr,
@@ -521,8 +524,7 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
         }
 
         if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
-                if ((vif->type != NL80211_IFTYPE_AP) ||
-                    (sc->nbcnvifs > 1)) {
+                if (vif->type != NL80211_IFTYPE_AP) {
                         ath_dbg(common, CONFIG,
                                 "An AP interface is already present !\n");
                         return false;
@@ -616,12 +618,14 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
          * enabling/disabling SWBA.
          */
         if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (!bss_conf->enable_beacon &&
-                    (sc->nbcnvifs <= 1)) {
-                        cur_conf->enable_beacon = false;
-                } else if (bss_conf->enable_beacon) {
-                        cur_conf->enable_beacon = true;
-                        ath9k_cache_beacon_config(sc, ctx, bss_conf);
+                bool enabled = cur_conf->enable_beacon;
+
+                if (!bss_conf->enable_beacon) {
+                        cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
+                } else {
+                        cur_conf->enable_beacon |= BIT(avp->av_bslot);
+                        if (!enabled)
+                                ath9k_cache_beacon_config(sc, ctx, bss_conf);
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 2b79a568e803..d23737342f4f 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -54,7 +54,7 @@ struct ath_beacon_config {
         u16 dtim_period;
         u16 bmiss_timeout;
         u8 dtim_count;
-        bool enable_beacon;
+        u8 enable_beacon;
         bool ibss_creator;
         u32 nexttbtt;
         u32 intval;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 60aa8d71e753..8529014e1a5e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -424,7 +424,7 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->power_mode = ATH9K_PM_UNDEFINED;
         ah->htc_reset_init = true;
 
-        ah->tpc_enabled = true;
+        ah->tpc_enabled = false;
 
         ah->ani_function = ATH9K_ANI_ALL;
         if (!AR_SREV_9300_20_OR_LATER(ah))
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index ccbdb05b28cd..75345c1e8c34 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5370,6 +5370,7 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
         case 0x432a: /* BCM4321 */
         case 0x432d: /* BCM4322 */
         case 0x4352: /* BCM43222 */
+        case 0x435a: /* BCM43228 */
         case 0x4333: /* BCM4331 */
         case 0x43a2: /* BCM4360 */
         case 0x43b3: /* BCM4352 */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
index defb7a44e0bc..7748a1ccf14f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
@@ -126,7 +126,8 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
         brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MCHAN, "mchan");
         if (drvr->bus_if->wowl_supported)
                 brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
-        brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
+        if (drvr->bus_if->chip != BRCM_CC_43362_CHIP_ID)
+                brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
 
         /* set chip related quirks */
         switch (drvr->bus_if->chip) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf7090198..8eff2753abad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
         void *dcmd_buf = NULL, *wr_pointer;
         u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
 
-        brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
-                  cmdhdr->len);
+        if (len < sizeof(*cmdhdr)) {
+                brcmf_err("vendor command too short: %d\n", len);
+                return -EINVAL;
+        }
 
         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
         ifp = vif->ifp;
 
-        len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+        brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+
+        if (cmdhdr->offset > len) {
+                brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+                return -EINVAL;
+        }
+
+        len -= cmdhdr->offset;
         ret_len = cmdhdr->len;
         if (ret_len > 0 || len > 0) {
                 if (len > BRCMF_DCMD_MAXLEN) {
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index a6f22c32a279..3811878ab9cd 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -708,7 +708,6 @@ struct iwl_priv {
         unsigned long reload_jiffies;
         int reload_count;
         bool ucode_loaded;
-        bool init_ucode_run;            /* Don't run init uCode again */
 
         u8 plcp_delta_threshold;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 47e64e8b9517..cceb026e0793 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1114,16 +1114,17 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) |
                         BIT(IWL_DEFAULT_CMD_QUEUE_NUM));
 
-        if (vif)
-                scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
-
-        IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues);
-        if (iwlagn_txfifo_flush(priv, scd_queues)) {
-                IWL_ERR(priv, "flush request fail\n");
-                goto done;
+        if (drop) {
+                IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n",
+                                    scd_queues);
+                if (iwlagn_txfifo_flush(priv, scd_queues)) {
+                        IWL_ERR(priv, "flush request fail\n");
+                        goto done;
+                }
         }
+
         IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n");
-        iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
+        iwl_trans_wait_tx_queue_empty(priv->trans, scd_queues);
 done:
         mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 4dbef7e58c2e..5244e43bfafb 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -418,9 +418,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
         if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
                 return 0;
 
-        if (priv->init_ucode_run)
-                return 0;
-
         iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
                                    calib_complete, ARRAY_SIZE(calib_complete),
                                    iwlagn_wait_calib, priv);
@@ -440,8 +437,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
          */
         ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
                                         UCODE_CALIB_TIMEOUT);
-        if (!ret)
-                priv->init_ucode_run = true;
 
         goto out;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index c3817fae16c0..06f6cc08f451 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iwl1000_eeprom_params = {
         .nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION,  \
         .base_params = &iwl1000_base_params,                    \
         .eeprom_params = &iwl1000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl1000_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
         .base_params = &iwl1000_base_params,                    \
         .eeprom_params = &iwl1000_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl100_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 21e5d0843a62..890b95f497d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,          \
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
 
 const struct iwl_cfg iwl2000_2bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
         .base_params = &iwl2030_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl2030_2bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl105_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
         .base_params = &iwl2030_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl135_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 332bbede39e5..724194e23414 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iwl5000_eeprom_params = {
         .nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION,  \
         .base_params = &iwl5000_base_params,                    \
         .eeprom_params = &iwl5000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl5300_agn_cfg = {
         .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .base_params = &iwl5000_base_params,                    \
         .eeprom_params = &iwl5000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl5150_agn_cfg = {
         .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8f2c3c8c6b84..21b2630763dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
         .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6005_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6030_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6035_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
         .nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION,  \
         .base_params = &iwl6000_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6000i_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
         .base_params = &iwl6050_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6050_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
         .base_params = &iwl6050_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6150_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 996e7f16adf9..c7154ac42c8c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1257,6 +1257,7 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
                                 op->name, err);
 #endif
         }
+        kfree(pieces);
         return;
 
  try_again:
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 1ec4d55155f7..7810c41cf9a7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+        if (mvmvif->phy_ctxt &&
+            IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
                                mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index d530ef3da107..542ee74f290a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+        if (mvmvif->phy_ctxt &&
+            data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
         IWL_DEBUG_COEX(data->mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 1ff7ec08532d..09654e73a533 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -405,7 +405,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 
-                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                if ((mvm->fw->ucode_capa.capa[0] &
+                     IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+                    (mvm->fw->ucode_capa.api[0] &
+                     IWL_UCODE_TLV_API_LQ_SS_PARAMS))
                         hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
         }
@@ -2215,7 +2218,19 @@ static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
-        iwl_mvm_cancel_scan(mvm);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a hw_scan when it's already stopped.  This can
+         * happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_scan_completed() and the userspace called
+         * cancel scan scan before ieee80211_scan_work() could run.
+         * To handle that, simply return if the scan is not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if ((mvm->scan_status == IWL_MVM_SCAN_OS) ||
+            (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+                iwl_mvm_cancel_scan(mvm);
 
         mutex_unlock(&mvm->mutex);
 }
@@ -2559,12 +2574,29 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         int ret;
 
         mutex_lock(&mvm->mutex);
+
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a sched_scan when it's already stopped.  This
+         * can happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_sched_scan_stopped() and the userspace called
+         * stop sched scan scan before ieee80211_sched_scan_stopped_work()
+         * could run.  To handle this, simply return if the scan is
+         * not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
+            !(mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
+                mutex_unlock(&mvm->mutex);
+                return 0;
+        }
+
         ret = iwl_mvm_scan_offload_stop(mvm, false);
         mutex_unlock(&mvm->mutex);
         iwl_mvm_wait_for_async_handlers(mvm);
 
         return ret;
-
 }
 
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 194bd1f939ca..078f24cf4af3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -134,9 +134,12 @@ enum rs_column_mode {
 #define MAX_NEXT_COLUMNS 7
 #define MAX_COLUMN_CHECKS 3
 
+struct rs_tx_column;
+
 typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
                                      struct ieee80211_sta *sta,
-                                     struct iwl_scale_tbl_info *tbl);
+                                     struct iwl_scale_tbl_info *tbl,
+                                     const struct rs_tx_column *next_col);
 
 struct rs_tx_column {
         enum rs_column_mode mode;
@@ -147,13 +150,15 @@ struct rs_tx_column {
 };
 
 static bool rs_ant_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                         struct iwl_scale_tbl_info *tbl)
+                         struct iwl_scale_tbl_info *tbl,
+                         const struct rs_tx_column *next_col)
 {
-        return iwl_mvm_bt_coex_is_ant_avail(mvm, tbl->rate.ant);
+        return iwl_mvm_bt_coex_is_ant_avail(mvm, next_col->ant);
 }
 
 static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          struct iwl_scale_tbl_info *tbl)
+                          struct iwl_scale_tbl_info *tbl,
+                          const struct rs_tx_column *next_col)
 {
         if (!sta->ht_cap.ht_supported)
                 return false;
@@ -171,7 +176,8 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 }
 
 static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          struct iwl_scale_tbl_info *tbl)
+                          struct iwl_scale_tbl_info *tbl,
+                          const struct rs_tx_column *next_col)
 {
         if (!sta->ht_cap.ht_supported)
                 return false;
@@ -180,7 +186,8 @@ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 }
 
 static bool rs_sgi_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                         struct iwl_scale_tbl_info *tbl)
+                         struct iwl_scale_tbl_info *tbl,
+                         const struct rs_tx_column *next_col)
 {
         struct rs_rate *rate = &tbl->rate;
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
@@ -1271,6 +1278,9 @@ static void rs_mac80211_tx_status(void *mvm_r,
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
+        if (!iwl_mvm_sta_from_mac80211(sta)->vif)
+                return;
+
         if (!ieee80211_is_data(hdr->frame_control) ||
             info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
@@ -1590,7 +1600,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
 
                 for (j = 0; j < MAX_COLUMN_CHECKS; j++) {
                         allow_func = next_col->checks[j];
-                        if (allow_func && !allow_func(mvm, sta, tbl))
+                        if (allow_func && !allow_func(mvm, sta, tbl, next_col))
                                 break;
                 }
 
@@ -2504,6 +2514,14 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct iwl_lq_sta *lq_sta = mvm_sta;
 
+        if (sta && !iwl_mvm_sta_from_mac80211(sta)->vif) {
+                /* if vif isn't initialized mvm doesn't know about
+                 * this station, so don't do anything with the it
+                 */
+                sta = NULL;
+                mvm_sta = NULL;
+        }
+
         /* TODO: handle rate_idx_mask and rate_idx_mcs_mask */
 
         /* Treat uninitialized rate scaling data same as non-existing. */
@@ -2820,6 +2838,9 @@ static void rs_rate_update(void *mvm_r,
                         (struct iwl_op_mode *)mvm_r;
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
 
+        if (!iwl_mvm_sta_from_mac80211(sta)->vif)
+                return;
+
         /* Stop any ongoing aggregations as rs starts off assuming no agg */
         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
                 ieee80211_stop_tx_ba_session(sta, tid);
@@ -3580,9 +3601,15 @@ static ssize_t iwl_dbgfs_ss_force_write(struct iwl_lq_sta *lq_sta, char *buf,
 
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(ss_force, 32);
 
-static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
+static void rs_add_debugfs(void *mvm, void *priv_sta, struct dentry *dir)
 {
-        struct iwl_lq_sta *lq_sta = mvm_sta;
+        struct iwl_lq_sta *lq_sta = priv_sta;
+        struct iwl_mvm_sta *mvmsta;
+
+        mvmsta = container_of(lq_sta, struct iwl_mvm_sta, lq_sta);
+
+        if (!mvmsta->vif)
+                return;
 
         debugfs_create_file("rate_scale_table", S_IRUSR | S_IWUSR, dir,
                             lq_sta, &rs_sta_dbgfs_scale_table_ops);
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 7e9aa3cb3254..c47c8051da77 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -1128,8 +1128,10 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                 return 0;
 
-        if (iwl_mvm_is_radio_killed(mvm))
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ret = 0;
                 goto out;
+        }
 
         if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
             (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN) ||
@@ -1148,16 +1150,14 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                 IWL_DEBUG_SCAN(mvm, "Send stop %sscan failed %d\n",
                                sched ? "offloaded " : "", ret);
                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
-                return ret;
+                goto out;
         }
 
         IWL_DEBUG_SCAN(mvm, "Successfully sent stop %sscan\n",
                        sched ? "offloaded " : "");
 
         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
-        if (ret)
-                return ret;
-
+out:
         /*
          * Clear the scan status so the next scan requests will succeed. This
          * also ensures the Rx handler doesn't do anything, as the scan was
@@ -1167,7 +1167,6 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_OS)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 
-out:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
@@ -1177,7 +1176,7 @@ out:
                         ieee80211_scan_completed(mvm->hw, true);
         }
 
-        return 0;
+        return ret;
 }
 
 static void iwl_mvm_unified_scan_fill_tx_cmd(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 54fafbf9a711..4b81c0bf63b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -197,6 +197,8 @@ iwl_mvm_te_handle_notify_csa(struct iwl_mvm *mvm,
                              struct iwl_time_event_notif *notif)
 {
         if (!le32_to_cpu(notif->status)) {
+                if (te_data->vif->type == NL80211_IFTYPE_STATION)
+                        ieee80211_connection_loss(te_data->vif);
                 IWL_DEBUG_TE(mvm, "CSA time event failed to start\n");
                 iwl_mvm_te_clear_data(mvm, te_data);
                 return;
@@ -750,8 +752,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->time_event_list, list) {
-                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
-                    te_data->running) {
+                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                         mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
                         is_p2p = true;
                         goto remove_te;
@@ -766,10 +767,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
-                if (te_data->running) {
-                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
-                        goto remove_te;
-                }
+                mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+                goto remove_te;
         }
 
 remove_te:
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 07304e1fd64a..96a05406babf 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -949,8 +949,10 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         mvmsta = iwl_mvm_sta_from_mac80211(sta);
         tid_data = &mvmsta->tid_data[tid];
 
-        if (WARN_ONCE(tid_data->txq_id != scd_flow, "Q %d, tid %d, flow %d",
-                      tid_data->txq_id, tid, scd_flow)) {
+        if (tid_data->txq_id != scd_flow) {
+                IWL_ERR(mvm,
+                        "invalid BA notification: Q %d, tid %d, flow %d\n",
+                        tid_data->txq_id, tid, scd_flow);
                 rcu_read_unlock();
                 return 0;
         }
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index dbd6bcf52205..686dd301cd53 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -368,10 +368,12 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 3165 Series */
         {IWL_PCI_DEVICE(0x3165, 0x4010, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x4012, iwl3165_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x3165, 0x4210, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x4410, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x4510, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3166, 0x4310, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3166, 0x4210, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x8010, iwl3165_2ac_cfg)},
 
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 1d4677460711..074f716020aa 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1386,8 +1386,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
 
                 return true;
-        } else if (0x86DD == ether_type) {
-                return true;
+        } else if (ETH_P_IPV6 == ether_type) {
+                /* TODO: Handle any IPv6 cases that need special handling.
+                 * For now, always return false
+                 */
+                goto end;
         }
 
 end:
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index a62170ea0481..8c45cf44ce24 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1124,12 +1124,22 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
         /*This is for new trx flow*/
         struct rtl_tx_buffer_desc *pbuffer_desc = NULL;
         u8 temp_one = 1;
+        u8 *entry;
 
         memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
         ring = &rtlpci->tx_ring[BEACON_QUEUE];
         pskb = __skb_dequeue(&ring->queue);
-        if (pskb)
+        if (rtlpriv->use_new_trx_flow)
+                entry = (u8 *)(&ring->buffer_desc[ring->idx]);
+        else
+                entry = (u8 *)(&ring->desc[ring->idx]);
+        if (pskb) {
+                pci_unmap_single(rtlpci->pdev,
+                                 rtlpriv->cfg->ops->get_desc(
+                                 (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+                                 pskb->len, PCI_DMA_TODEVICE);
                 kfree_skb(pskb);
+        }
 
         /*NB: the beacon data buffer must be 32-bit aligned. */
         pskb = ieee80211_beacon_get(hw, mac->vif);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index cab9f5257f57..997cf0901ac2 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -96,6 +96,7 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 static void make_tx_response(struct xenvif_queue *queue,
                              struct xen_netif_tx_request *txp,
                              s8       st);
+static void push_tx_responses(struct xenvif_queue *queue);
 
 static inline int tx_work_todo(struct xenvif_queue *queue);
 
@@ -655,15 +656,10 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
         unsigned long flags;
 
         do {
-                int notify;
-
                 spin_lock_irqsave(&queue->response_lock, flags);
                 make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
-                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+                push_tx_responses(queue);
                 spin_unlock_irqrestore(&queue->response_lock, flags);
-                if (notify)
-                        notify_remote_via_irq(queue->tx_irq);
-
                 if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1657,7 +1653,6 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
         struct pending_tx_info *pending_tx_info;
         pending_ring_idx_t index;
-        int notify;
         unsigned long flags;
 
         pending_tx_info = &queue->pending_tx_info[pending_idx];
@@ -1673,12 +1668,9 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
         index = pending_index(queue->pending_prod++);
         queue->pending_ring[index] = pending_idx;
 
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        push_tx_responses(queue);
 
         spin_unlock_irqrestore(&queue->response_lock, flags);
-
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
 
 
@@ -1699,6 +1691,15 @@ static void make_tx_response(struct xenvif_queue *queue,
         queue->tx.rsp_prod_pvt = ++i;
 }
 
+static void push_tx_responses(struct xenvif_queue *queue)
+{
+        int notify;
+
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
+}
+
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                              u16      id,
                                              s8       st,
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index e9b960f0ff32..720aaf6313d2 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1008,8 +1008,7 @@ err:
 
 static int xennet_change_mtu(struct net_device *dev, int mtu)
 {
-        int max = xennet_can_sg(dev) ?
-                XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
+        int max = xennet_can_sg(dev) ? XEN_NETIF_MAX_TX_SIZE : ETH_DATA_LEN;
 
         if (mtu > max)
                 return -EINVAL;
@@ -1279,8 +1278,6 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netdev->ethtool_ops = &xennet_ethtool_ops;
         SET_NETDEV_DEV(netdev, &dev->dev);
 
-        netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
-
         np->netdev = netdev;
 
         netif_carrier_off(netdev);
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 38d1c51f58b1..7bcaeec876c0 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -84,8 +84,7 @@ config OF_RESOLVE
         bool
 
 config OF_OVERLAY
-        bool
-        depends on OF
+        bool "Device Tree overlays"
         select OF_DYNAMIC
         select OF_RESOLVE
 
diff --git a/drivers/of/address.c b/drivers/of/address.c
index ad2906919d45..78a7dcbec7d8 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -450,12 +450,17 @@ static struct of_bus *of_match_bus(struct device_node *np)
         return NULL;
 }
 
-static int of_empty_ranges_quirk(void)
+static int of_empty_ranges_quirk(struct device_node *np)
 {
         if (IS_ENABLED(CONFIG_PPC)) {
-                /* To save cycles, we cache the result */
+                /* To save cycles, we cache the result for global "Mac" setting */
                 static int quirk_state = -1;
 
+                /* PA-SEMI sdc DT bug */
+                if (of_device_is_compatible(np, "1682m-sdc"))
+                        return true;
+
+                /* Make quirk cached */
                 if (quirk_state < 0)
                         quirk_state =
                                 of_machine_is_compatible("Power Macintosh") ||
@@ -490,7 +495,7 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
          * This code is only enabled on powerpc. --gcl
          */
         ranges = of_get_property(parent, rprop, &rlen);
-        if (ranges == NULL && !of_empty_ranges_quirk()) {
+        if (ranges == NULL && !of_empty_ranges_quirk(parent)) {
                 pr_debug("OF: no ranges; cannot translate\n");
                 return 1;
         }
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 0a8aeb8523fe..8f165b112e03 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -714,16 +714,12 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
                                                 const char *path)
 {
         struct device_node *child;
-        int len = strchrnul(path, '/') - path;
-        int term;
+        int len;
 
+        len = strcspn(path, "/:");
         if (!len)
                 return NULL;
 
-        term = strchrnul(path, ':') - path;
-        if (term < len)
-                len = term;
-
         __for_each_child_of_node(parent, child) {
                 const char *name = strrchr(child->full_name, '/');
                 if (WARN(!name, "malformed device_node %s\n", child->full_name))
@@ -768,8 +764,12 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
 
         /* The path could begin with an alias */
         if (*path != '/') {
-                char *p = strchrnul(path, '/');
-                int len = separator ? separator - path : p - path;
+                int len;
+                const char *p = separator;
+
+                if (!p)
+                        p = strchrnul(path, '/');
+                len = p - path;
 
                 /* of_aliases must not be NULL */
                 if (!of_aliases)
@@ -794,6 +794,8 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
                 path++; /* Increment past '/' delimiter */
                 np = __of_find_node_by_path(np, path);
                 path = strchrnul(path, '/');
+                if (separator && separator < path)
+                        break;
         }
         raw_spin_unlock_irqrestore(&devtree_lock, flags);
         return np;
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 0d7765807f49..1a7980692f25 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
         struct device_node *p;
         const __be32 *intspec, *tmp, *addr;
         u32 intsize, intlen;
-        int i, res = -EINVAL;
+        int i, res;
 
         pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
 
@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
 
         /* Get size of interrupt specifier */
         tmp = of_get_property(p, "#interrupt-cells", NULL);
-        if (tmp == NULL)
+        if (tmp == NULL) {
+                res = -EINVAL;
                 goto out;
+        }
         intsize = be32_to_cpu(*tmp);
 
         pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
 
         /* Check index */
-        if ((index + 1) * intsize > intlen)
+        if ((index + 1) * intsize > intlen) {
+                res = -EINVAL;
                 goto out;
+        }
 
         /* Copy intspec into irq structure */
         intspec += index * intsize;
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 352b4f28f82c..dee9270ba547 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -19,6 +19,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/idr.h>
 
 #include "of_private.h"
 
@@ -85,7 +86,7 @@ static int of_overlay_apply_single_device_node(struct of_overlay *ov,
                 struct device_node *target, struct device_node *child)
 {
         const char *cname;
-        struct device_node *tchild, *grandchild;
+        struct device_node *tchild;
         int ret = 0;
 
         cname = kbasename(child->full_name);
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 0cf9a236d438..52c45c7df07f 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -92,6 +92,16 @@ static void __init of_selftest_find_node_by_name(void)
                  "option path test failed\n");
         of_node_put(np);
 
+        np = of_find_node_opts_by_path("/testcase-data:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #1 failed\n");
+        of_node_put(np);
+
+        np = of_find_node_opts_by_path("/testcase-data/testcase-device1:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #2 failed\n");
+        of_node_put(np);
+
         np = of_find_node_opts_by_path("/testcase-data:testoption", NULL);
         selftest(np, "NULL option path test failed\n");
         of_node_put(np);
@@ -102,6 +112,12 @@ static void __init of_selftest_find_node_by_name(void)
                  "option alias path test failed\n");
         of_node_put(np);
 
+        np = of_find_node_opts_by_path("testcase-alias:test/alias/option",
+                                       &options);
+        selftest(np && !strcmp("test/alias/option", options),
+                 "option alias path test, subcase #1 failed\n");
+        of_node_put(np);
+
         np = of_find_node_opts_by_path("testcase-alias:testaliasoption", NULL);
         selftest(np, "NULL option alias path test failed\n");
         of_node_put(np);
@@ -378,9 +394,9 @@ static void __init of_selftest_property_string(void)
         rc = of_property_match_string(np, "phandle-list-names", "first");
         selftest(rc == 0, "first expected:0 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "second");
-        selftest(rc == 1, "second expected:0 got:%i\n", rc);
+        selftest(rc == 1, "second expected:1 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "third");
-        selftest(rc == 2, "third expected:0 got:%i\n", rc);
+        selftest(rc == 2, "third expected:2 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "fourth");
         selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
         rc = of_property_match_string(np, "missing-property", "blah");
@@ -478,7 +494,6 @@ static void __init of_selftest_changeset(void)
         struct device_node *n1, *n2, *n21, *nremove, *parent, *np;
         struct of_changeset chgset;
 
-        of_changeset_init(&chgset);
         n1 = __of_node_dup(NULL, "/testcase-data/changeset/n1");
         selftest(n1, "testcase setup failure\n");
         n2 = __of_node_dup(NULL, "/testcase-data/changeset/n2");
@@ -979,7 +994,7 @@ static int of_path_platform_device_exists(const char *path)
         return pdev != NULL;
 }
 
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
 
 /* get the i2c client device instantiated at the path */
 static struct i2c_client *of_path_to_i2c_client(const char *path)
@@ -1445,7 +1460,7 @@ static void of_selftest_overlay_11(void)
                 return;
 }
 
-#if IS_ENABLED(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
+#if IS_BUILTIN(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
 
 struct selftest_i2c_bus_data {
         struct platform_device  *pdev;
@@ -1584,7 +1599,7 @@ static struct i2c_driver selftest_i2c_dev_driver = {
         .id_table = selftest_i2c_dev_id,
 };
 
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
 
 struct selftest_i2c_mux_data {
         int nchans;
@@ -1695,7 +1710,7 @@ static int of_selftest_overlay_i2c_init(void)
                         "could not register selftest i2c bus driver\n"))
                 return ret;
 
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
         ret = i2c_add_driver(&selftest_i2c_mux_driver);
         if (selftest(ret == 0,
                         "could not register selftest i2c mux driver\n"))
@@ -1707,7 +1722,7 @@ static int of_selftest_overlay_i2c_init(void)
 
 static void of_selftest_overlay_i2c_cleanup(void)
 {
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
         i2c_del_driver(&selftest_i2c_mux_driver);
 #endif
         platform_driver_unregister(&selftest_i2c_bus_driver);
@@ -1814,7 +1829,7 @@ static void __init of_selftest_overlay(void)
         of_selftest_overlay_10();
         of_selftest_overlay_11();
 
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
         if (selftest(of_selftest_overlay_i2c_init() == 0, "i2c init failed\n"))
                 goto out;
 
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index aab55474dd0d..ee082c0366ec 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -127,7 +127,7 @@ static bool xgene_pcie_hide_rc_bars(struct pci_bus *bus, int offset)
         return false;
 }
 
-static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
+static void __iomem *xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                               int offset)
 {
         struct xgene_pcie_port *port = bus->sysdata;
@@ -137,7 +137,7 @@ static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                 return NULL;
 
         xgene_pcie_set_rtdid_reg(bus, devfn);
-        return xgene_pcie_get_cfg_base(bus);
+        return xgene_pcie_get_cfg_base(bus) + offset;
 }
 
 static struct pci_ops xgene_pcie_ops = {
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index 1f4ea6f2d910..2e9f84fdd9ce 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -342,7 +342,7 @@ static const struct irq_domain_ops msi_domain_ops = {
         .map = dw_pcie_msi_map,
 };
 
-int __init dw_pcie_host_init(struct pcie_port *pp)
+int dw_pcie_host_init(struct pcie_port *pp)
 {
         struct device_node *np = pp->dev->of_node;
         struct platform_device *pdev = to_platform_device(pp->dev);
diff --git a/drivers/pci/host/pcie-spear13xx.c b/drivers/pci/host/pcie-spear13xx.c
index 866465fd3dbf..020d78890719 100644
--- a/drivers/pci/host/pcie-spear13xx.c
+++ b/drivers/pci/host/pcie-spear13xx.c
@@ -269,7 +269,7 @@ static struct pcie_host_ops spear13xx_pcie_host_ops = {
         .host_init = spear13xx_pcie_host_init,
 };
 
-static int __init spear13xx_add_pcie_port(struct pcie_port *pp,
+static int spear13xx_add_pcie_port(struct pcie_port *pp,
                                          struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -299,7 +299,7 @@ static int __init spear13xx_add_pcie_port(struct pcie_port *pp,
         return 0;
 }
 
-static int __init spear13xx_pcie_probe(struct platform_device *pdev)
+static int spear13xx_pcie_probe(struct platform_device *pdev)
 {
         struct spear13xx_pcie *spear13xx_pcie;
         struct pcie_port *pp;
@@ -370,7 +370,7 @@ static const struct of_device_id spear13xx_pcie_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, spear13xx_pcie_of_match);
 
-static struct platform_driver spear13xx_pcie_driver __initdata = {
+static struct platform_driver spear13xx_pcie_driver = {
         .probe          = spear13xx_pcie_probe,
         .driver = {
                 .name   = "spear-pcie",
diff --git a/drivers/pci/hotplug/cpci_hotplug_pci.c b/drivers/pci/hotplug/cpci_hotplug_pci.c
index 7d48ecae6695..788db48dbbad 100644
--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
@@ -286,11 +286,12 @@ int cpci_configure_slot(struct slot *slot)
         }
         parent = slot->dev->bus;
 
-        list_for_each_entry(dev, &parent->devices, bus_list)
+        list_for_each_entry(dev, &parent->devices, bus_list) {
                 if (PCI_SLOT(dev->devfn) != PCI_SLOT(slot->devfn))
                         continue;
                 if (pci_is_bridge(dev))
                         pci_hp_add_bridge(dev);
+        }
 
 
         pci_assign_unassigned_bridge_resources(parent->self);
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 489063987325..c93fbe76d281 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -248,6 +248,9 @@ int pci_get_hp_params(struct pci_dev *dev, struct hotplug_params *hpp)
         acpi_handle handle, phandle;
         struct pci_bus *pbus;
 
+        if (acpi_pci_disabled)
+                return -ENODEV;
+
         handle = NULL;
         for (pbus = dev->bus; pbus; pbus = pbus->parent) {
                 handle = acpi_pci_get_bridge_handle(pbus);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index aa012fb3834b..312f23a8429c 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -521,7 +521,8 @@ static ssize_t driver_override_store(struct device *dev,
         struct pci_dev *pdev = to_pci_dev(dev);
         char *driver_override, *old = pdev->driver_override, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -549,7 +550,7 @@ static ssize_t driver_override_show(struct device *dev,
 {
         struct pci_dev *pdev = to_pci_dev(dev);
 
-        return sprintf(buf, "%s\n", pdev->driver_override);
+        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff --git a/drivers/pci/pcie/aer/aerdrv_errprint.c b/drivers/pci/pcie/aer/aerdrv_errprint.c
index c6849d9e86ce..167fe411ce2e 100644
--- a/drivers/pci/pcie/aer/aerdrv_errprint.c
+++ b/drivers/pci/pcie/aer/aerdrv_errprint.c
@@ -132,16 +132,8 @@ static const char *aer_agent_string[] = {
 static void __print_tlp_header(struct pci_dev *dev,
                                struct aer_header_log_regs *t)
 {
-        unsigned char *tlp = (unsigned char *)&t;
-
-        dev_err(&dev->dev, "  TLP Header:"
-                " %02x%02x%02x%02x %02x%02x%02x%02x"
-                " %02x%02x%02x%02x %02x%02x%02x%02x\n",
-                *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
-                *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4),
-                *(tlp + 11), *(tlp + 10), *(tlp + 9),
-                *(tlp + 8), *(tlp + 15), *(tlp + 14),
-                *(tlp + 13), *(tlp + 12));
+        dev_err(&dev->dev, "  TLP Header: %08x %08x %08x %08x\n",
+                t->dw0, t->dw1, t->dw2, t->dw3);
 }
 
 static void __aer_print_error(struct pci_dev *dev,
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index 3bb49252a098..45f67c63d385 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -69,8 +69,7 @@ config YENTA
         tristate "CardBus yenta-compatible bridge support"
         depends on PCI
         select CARDBUS if !EXPERT
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
-        select PCCARD_PCI if PCMCIA !=n && !ISA
+        select PCCARD_NONSTATIC if PCMCIA != n
         ---help---
           This option enables support for CardBus host bridges.  Virtually
           all modern PCMCIA bridges are CardBus compatible.  A "bridge" is
@@ -110,8 +109,7 @@ config YENTA_TOSHIBA
 config PD6729
         tristate "Cirrus PD6729 compatible bridge support"
         depends on PCMCIA && PCI
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
-        select PCCARD_PCI if PCMCIA !=n && !ISA
+        select PCCARD_NONSTATIC
         help
           This provides support for the Cirrus PD6729 PCI-to-PCMCIA bridge
           device, found in some older laptops and PCMCIA card readers.
@@ -119,8 +117,7 @@ config PD6729
 config I82092
         tristate "i82092 compatible bridge support"
         depends on PCMCIA && PCI
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
-        select PCCARD_PCI if PCMCIA !=n && !ISA
+        select PCCARD_NONSTATIC
         help
           This provides support for the Intel I82092AA PCI-to-PCMCIA bridge device,
           found in some older laptops and more commonly in evaluation boards for the
@@ -291,9 +288,6 @@ config ELECTRA_CF
           Say Y here to support the CompactFlash controller on the
           PA Semi Electra eval board.
 
-config PCCARD_PCI
-        bool
-
 config PCCARD_NONSTATIC
         bool
 
diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile
index f1a7ca04d89e..27e94b30cf96 100644
--- a/drivers/pcmcia/Makefile
+++ b/drivers/pcmcia/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_PCMCIA)				+= pcmcia.o
 pcmcia_rsrc-y                                   += rsrc_mgr.o
 pcmcia_rsrc-$(CONFIG_PCCARD_NONSTATIC)          += rsrc_nonstatic.o
 pcmcia_rsrc-$(CONFIG_PCCARD_IODYN)              += rsrc_iodyn.o
-pcmcia_rsrc-$(CONFIG_PCCARD_PCI)                += rsrc_pci.o
 obj-$(CONFIG_PCCARD)                            += pcmcia_rsrc.o
 
 
diff --git a/drivers/pcmcia/rsrc_pci.c b/drivers/pcmcia/rsrc_pci.c
deleted file mode 100644
index 1f67b3ba70fb..000000000000
--- a/drivers/pcmcia/rsrc_pci.c
+++ /dev/null
@@ -1,173 +0,0 @@
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/pci.h>
-
-#include <pcmcia/ss.h>
-#include <pcmcia/cistpl.h>
-#include "cs_internal.h"
-
-
-struct pcmcia_align_data {
-        unsigned long   mask;
-        unsigned long   offset;
-};
-
-static resource_size_t pcmcia_align(void *align_data,
-                                const struct resource *res,
-                                resource_size_t size, resource_size_t align)
-{
-        struct pcmcia_align_data *data = align_data;
-        resource_size_t start;
-
-        start = (res->start & ~data->mask) + data->offset;
-        if (start < res->start)
-                start += data->mask + 1;
-        return start;
-}
-
-static struct resource *find_io_region(struct pcmcia_socket *s,
-                                        unsigned long base, int num,
-                                        unsigned long align)
-{
-        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_IO,
-                                                dev_name(&s->dev));
-        struct pcmcia_align_data data;
-        int ret;
-
-        data.mask = align - 1;
-        data.offset = base & data.mask;
-
-        ret = pci_bus_alloc_resource(s->cb_dev->bus, res, num, 1,
-                                             base, 0, pcmcia_align, &data);
-        if (ret != 0) {
-                kfree(res);
-                res = NULL;
-        }
-        return res;
-}
-
-static int res_pci_find_io(struct pcmcia_socket *s, unsigned int attr,
-                        unsigned int *base, unsigned int num,
-                        unsigned int align, struct resource **parent)
-{
-        int i, ret = 0;
-
-        /* Check for an already-allocated window that must conflict with
-         * what was asked for.  It is a hack because it does not catch all
-         * potential conflicts, just the most obvious ones.
-         */
-        for (i = 0; i < MAX_IO_WIN; i++) {
-                if (!s->io[i].res)
-                        continue;
-
-                if (!*base)
-                        continue;
-
-                if ((s->io[i].res->start & (align-1)) == *base)
-                        return -EBUSY;
-        }
-
-        for (i = 0; i < MAX_IO_WIN; i++) {
-                struct resource *res = s->io[i].res;
-                unsigned int try;
-
-                if (res && (res->flags & IORESOURCE_BITS) !=
-                        (attr & IORESOURCE_BITS))
-                        continue;
-
-                if (!res) {
-                        if (align == 0)
-                                align = 0x10000;
-
-                        res = s->io[i].res = find_io_region(s, *base, num,
-                                                                align);
-                        if (!res)
-                                return -EINVAL;
-
-                        *base = res->start;
-                        s->io[i].res->flags =
-                                ((res->flags & ~IORESOURCE_BITS) |
-                                        (attr & IORESOURCE_BITS));
-                        s->io[i].InUse = num;
-                        *parent = res;
-                        return 0;
-                }
-
-                /* Try to extend top of window */
-                try = res->end + 1;
-                if ((*base == 0) || (*base == try)) {
-                        ret = adjust_resource(s->io[i].res, res->start,
-                                              resource_size(res) + num);
-                        if (ret)
-                                continue;
-                        *base = try;
-                        s->io[i].InUse += num;
-                        *parent = res;
-                        return 0;
-                }
-
-                /* Try to extend bottom of window */
-                try = res->start - num;
-                if ((*base == 0) || (*base == try)) {
-                        ret = adjust_resource(s->io[i].res,
-                                              res->start - num,
-                                              resource_size(res) + num);
-                        if (ret)
-                                continue;
-                        *base = try;
-                        s->io[i].InUse += num;
-                        *parent = res;
-                        return 0;
-                }
-        }
-        return -EINVAL;
-}
-
-static struct resource *res_pci_find_mem(u_long base, u_long num,
-                u_long align, int low, struct pcmcia_socket *s)
-{
-        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_MEM,
-                                                dev_name(&s->dev));
-        struct pcmcia_align_data data;
-        unsigned long min;
-        int ret;
-
-        if (align < 0x20000)
-                align = 0x20000;
-        data.mask = align - 1;
-        data.offset = base & data.mask;
-
-        min = 0;
-        if (!low)
-                min = 0x100000UL;
-
-        ret = pci_bus_alloc_resource(s->cb_dev->bus,
-                        res, num, 1, min, 0,
-                        pcmcia_align, &data);
-
-        if (ret != 0) {
-                kfree(res);
-                res = NULL;
-        }
-        return res;
-}
-
-
-static int res_pci_init(struct pcmcia_socket *s)
-{
-        if (!s->cb_dev || !(s->features & SS_CAP_PAGE_REGS)) {
-                dev_err(&s->dev, "not supported by res_pci\n");
-                return -EOPNOTSUPP;
-        }
-        return 0;
-}
-
-struct pccard_resource_ops pccard_nonstatic_ops = {
-        .validate_mem = NULL,
-        .find_io = res_pci_find_io,
-        .find_mem = res_pci_find_mem,
-        .init = res_pci_init,
-        .exit = NULL,
-};
-EXPORT_SYMBOL(pccard_nonstatic_ops);
diff --git a/drivers/phy/phy-armada375-usb2.c b/drivers/phy/phy-armada375-usb2.c
index 7c99ca256f05..8ccc3952c13d 100644
--- a/drivers/phy/phy-armada375-usb2.c
+++ b/drivers/phy/phy-armada375-usb2.c
@@ -37,7 +37,7 @@ static int armada375_usb_phy_init(struct phy *phy)
         struct armada375_cluster_phy *cluster_phy;
         u32 reg;
 
-        cluster_phy = dev_get_drvdata(phy->dev.parent);
+        cluster_phy = phy_get_drvdata(phy);
         if (!cluster_phy)
                 return -ENODEV;
 
@@ -131,6 +131,7 @@ static int armada375_usb_phy_probe(struct platform_device *pdev)
         cluster_phy->reg = usb_cluster_base;
 
         dev_set_drvdata(dev, cluster_phy);
+        phy_set_drvdata(phy, cluster_phy);
 
         phy_provider = devm_of_phy_provider_register(&pdev->dev,
                                                      armada375_usb_phy_xlate);
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index a12d35338313..3791838f4bd4 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -52,7 +52,9 @@ static void devm_phy_consume(struct device *dev, void *res)
 
 static int devm_phy_match(struct device *dev, void *res, void *match_data)
 {
-        return res == match_data;
+        struct phy **phy = res;
+
+        return *phy == match_data;
 }
 
 /**
@@ -223,6 +225,7 @@ int phy_init(struct phy *phy)
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
                 return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
 
         mutex_lock(&phy->mutex);
         if (phy->init_count == 0 && phy->ops->init) {
@@ -231,8 +234,6 @@ int phy_init(struct phy *phy)
                         dev_err(&phy->dev, "phy init failed --> %d\n", ret);
                         goto out;
                 }
-        } else {
-                ret = 0; /* Override possible ret == -ENOTSUPP */
         }
         ++phy->init_count;
 
@@ -253,6 +254,7 @@ int phy_exit(struct phy *phy)
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
                 return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
 
         mutex_lock(&phy->mutex);
         if (phy->init_count == 1 && phy->ops->exit) {
@@ -287,6 +289,7 @@ int phy_power_on(struct phy *phy)
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
                 return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
 
         mutex_lock(&phy->mutex);
         if (phy->power_count == 0 && phy->ops->power_on) {
@@ -295,8 +298,6 @@ int phy_power_on(struct phy *phy)
                         dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
                         goto out;
                 }
-        } else {
-                ret = 0; /* Override possible ret == -ENOTSUPP */
         }
         ++phy->power_count;
         mutex_unlock(&phy->mutex);
diff --git a/drivers/phy/phy-exynos-dp-video.c b/drivers/phy/phy-exynos-dp-video.c
index f86cbe68ddaf..179cbf9451aa 100644
--- a/drivers/phy/phy-exynos-dp-video.c
+++ b/drivers/phy/phy-exynos-dp-video.c
@@ -30,28 +30,13 @@ struct exynos_dp_video_phy {
         const struct exynos_dp_video_phy_drvdata *drvdata;
 };
 
-static void exynos_dp_video_phy_pwr_isol(struct exynos_dp_video_phy *state,
-                                                        unsigned int on)
-{
-        unsigned int val;
-
-        if (IS_ERR(state->regs))
-                return;
-
-        val = on ? 0 : EXYNOS5_PHY_ENABLE;
-
-        regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
-                           EXYNOS5_PHY_ENABLE, val);
-}
-
 static int exynos_dp_video_phy_power_on(struct phy *phy)
 {
         struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
 
         /* Disable power isolation on DP-PHY */
-        exynos_dp_video_phy_pwr_isol(state, 0);
-
-        return 0;
+        return regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
+                                  EXYNOS5_PHY_ENABLE, EXYNOS5_PHY_ENABLE);
 }
 
 static int exynos_dp_video_phy_power_off(struct phy *phy)
@@ -59,9 +44,8 @@ static int exynos_dp_video_phy_power_off(struct phy *phy)
         struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
 
         /* Enable power isolation on DP-PHY */
-        exynos_dp_video_phy_pwr_isol(state, 1);
-
-        return 0;
+        return regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
+                                  EXYNOS5_PHY_ENABLE, 0);
 }
 
 static struct phy_ops exynos_dp_video_phy_ops = {
diff --git a/drivers/phy/phy-exynos-mipi-video.c b/drivers/phy/phy-exynos-mipi-video.c
index f017b2f2a54e..df7519a39ba0 100644
--- a/drivers/phy/phy-exynos-mipi-video.c
+++ b/drivers/phy/phy-exynos-mipi-video.c
@@ -43,7 +43,6 @@ struct exynos_mipi_video_phy {
         } phys[EXYNOS_MIPI_PHYS_NUM];
         spinlock_t slock;
         void __iomem *regs;
-        struct mutex mutex;
         struct regmap *regmap;
 };
 
@@ -59,8 +58,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
         else
                 reset = EXYNOS4_MIPI_PHY_SRESETN;
 
-        if (state->regmap) {
-                mutex_lock(&state->mutex);
+        spin_lock(&state->slock);
+
+        if (!IS_ERR(state->regmap)) {
                 regmap_read(state->regmap, offset, &val);
                 if (on)
                         val |= reset;
@@ -72,11 +72,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
                 else if (!(val & EXYNOS4_MIPI_PHY_RESET_MASK))
                         val &= ~EXYNOS4_MIPI_PHY_ENABLE;
                 regmap_write(state->regmap, offset, val);
-                mutex_unlock(&state->mutex);
         } else {
                 addr = state->regs + EXYNOS_MIPI_PHY_CONTROL(id / 2);
 
-                spin_lock(&state->slock);
                 val = readl(addr);
                 if (on)
                         val |= reset;
@@ -90,9 +88,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
                         val &= ~EXYNOS4_MIPI_PHY_ENABLE;
 
                 writel(val, addr);
-                spin_unlock(&state->slock);
         }
 
+        spin_unlock(&state->slock);
         return 0;
 }
 
@@ -158,7 +156,6 @@ static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
 
         dev_set_drvdata(dev, state);
         spin_lock_init(&state->slock);
-        mutex_init(&state->mutex);
 
         for (i = 0; i < EXYNOS_MIPI_PHYS_NUM; i++) {
                 struct phy *phy = devm_phy_create(dev, NULL,
diff --git a/drivers/phy/phy-exynos4210-usb2.c b/drivers/phy/phy-exynos4210-usb2.c
index 236a52ad94eb..f30bbb0fb3b2 100644
--- a/drivers/phy/phy-exynos4210-usb2.c
+++ b/drivers/phy/phy-exynos4210-usb2.c
@@ -250,7 +250,6 @@ static const struct samsung_usb2_common_phy exynos4210_phys[] = {
                 .power_on       = exynos4210_power_on,
                 .power_off      = exynos4210_power_off,
         },
-        {},
 };
 
 const struct samsung_usb2_phy_config exynos4210_usb2_phy_config = {
diff --git a/drivers/phy/phy-exynos4x12-usb2.c b/drivers/phy/phy-exynos4x12-usb2.c
index 0b9de88579b1..765da90a536f 100644
--- a/drivers/phy/phy-exynos4x12-usb2.c
+++ b/drivers/phy/phy-exynos4x12-usb2.c
@@ -361,7 +361,6 @@ static const struct samsung_usb2_common_phy exynos4x12_phys[] = {
                 .power_on       = exynos4x12_power_on,
                 .power_off      = exynos4x12_power_off,
         },
-        {},
 };
 
 const struct samsung_usb2_phy_config exynos3250_usb2_phy_config = {
diff --git a/drivers/phy/phy-exynos5-usbdrd.c b/drivers/phy/phy-exynos5-usbdrd.c
index 04374018425f..e2a0be750ad9 100644
--- a/drivers/phy/phy-exynos5-usbdrd.c
+++ b/drivers/phy/phy-exynos5-usbdrd.c
@@ -531,7 +531,7 @@ static struct phy *exynos5_usbdrd_phy_xlate(struct device *dev,
 {
         struct exynos5_usbdrd_phy *phy_drd = dev_get_drvdata(dev);
 
-        if (WARN_ON(args->args[0] > EXYNOS5_DRDPHYS_NUM))
+        if (WARN_ON(args->args[0] >= EXYNOS5_DRDPHYS_NUM))
                 return ERR_PTR(-ENODEV);
 
         return phy_drd->phys[args->args[0]].phy;
diff --git a/drivers/phy/phy-exynos5250-usb2.c b/drivers/phy/phy-exynos5250-usb2.c
index 1c139aa0d074..2ed1735a076a 100644
--- a/drivers/phy/phy-exynos5250-usb2.c
+++ b/drivers/phy/phy-exynos5250-usb2.c
@@ -391,7 +391,6 @@ static const struct samsung_usb2_common_phy exynos5250_phys[] = {
                 .power_on       = exynos5250_power_on,
                 .power_off      = exynos5250_power_off,
         },
-        {},
 };
 
 const struct samsung_usb2_phy_config exynos5250_usb2_phy_config = {
diff --git a/drivers/phy/phy-hix5hd2-sata.c b/drivers/phy/phy-hix5hd2-sata.c
index 34915b4202f1..d6b22659cac1 100644
--- a/drivers/phy/phy-hix5hd2-sata.c
+++ b/drivers/phy/phy-hix5hd2-sata.c
@@ -147,6 +147,9 @@ static int hix5hd2_sata_phy_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
+
         priv->base = devm_ioremap(dev, res->start, resource_size(res));
         if (!priv->base)
                 return -ENOMEM;
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index 9b2848e6115d..933435214acc 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -228,6 +228,7 @@ struct miphy28lp_dev {
         struct regmap *regmap;
         struct mutex miphy_mutex;
         struct miphy28lp_phy **phys;
+        int nphys;
 };
 
 struct miphy_initval {
@@ -1116,7 +1117,7 @@ static struct phy *miphy28lp_xlate(struct device *dev,
                 return ERR_PTR(-EINVAL);
         }
 
-        for (index = 0; index < of_get_child_count(dev->of_node); index++)
+        for (index = 0; index < miphy_dev->nphys; index++)
                 if (phynode == miphy_dev->phys[index]->phy->dev.of_node) {
                         miphy_phy = miphy_dev->phys[index];
                         break;
@@ -1138,6 +1139,7 @@ static struct phy *miphy28lp_xlate(struct device *dev,
 
 static struct phy_ops miphy28lp_ops = {
         .init = miphy28lp_init,
+        .owner = THIS_MODULE,
 };
 
 static int miphy28lp_probe_resets(struct device_node *node,
@@ -1200,16 +1202,15 @@ static int miphy28lp_probe(struct platform_device *pdev)
         struct miphy28lp_dev *miphy_dev;
         struct phy_provider *provider;
         struct phy *phy;
-        int chancount, port = 0;
-        int ret;
+        int ret, port = 0;
 
         miphy_dev = devm_kzalloc(&pdev->dev, sizeof(*miphy_dev), GFP_KERNEL);
         if (!miphy_dev)
                 return -ENOMEM;
 
-        chancount = of_get_child_count(np);
-        miphy_dev->phys = devm_kzalloc(&pdev->dev, sizeof(phy) * chancount,
-                                       GFP_KERNEL);
+        miphy_dev->nphys = of_get_child_count(np);
+        miphy_dev->phys = devm_kcalloc(&pdev->dev, miphy_dev->nphys,
+                                       sizeof(*miphy_dev->phys), GFP_KERNEL);
         if (!miphy_dev->phys)
                 return -ENOMEM;
 
diff --git a/drivers/phy/phy-miphy365x.c b/drivers/phy/phy-miphy365x.c
index 6c80154e8bff..51b459db9137 100644
--- a/drivers/phy/phy-miphy365x.c
+++ b/drivers/phy/phy-miphy365x.c
@@ -150,6 +150,7 @@ struct miphy365x_dev {
         struct regmap *regmap;
         struct mutex miphy_mutex;
         struct miphy365x_phy **phys;
+        int nphys;
 };
 
 /*
@@ -485,7 +486,7 @@ static struct phy *miphy365x_xlate(struct device *dev,
                 return ERR_PTR(-EINVAL);
         }
 
-        for (index = 0; index < of_get_child_count(dev->of_node); index++)
+        for (index = 0; index < miphy_dev->nphys; index++)
                 if (phynode == miphy_dev->phys[index]->phy->dev.of_node) {
                         miphy_phy = miphy_dev->phys[index];
                         break;
@@ -541,16 +542,15 @@ static int miphy365x_probe(struct platform_device *pdev)
         struct miphy365x_dev *miphy_dev;
         struct phy_provider *provider;
         struct phy *phy;
-        int chancount, port = 0;
-        int ret;
+        int ret, port = 0;
 
         miphy_dev = devm_kzalloc(&pdev->dev, sizeof(*miphy_dev), GFP_KERNEL);
         if (!miphy_dev)
                 return -ENOMEM;
 
-        chancount = of_get_child_count(np);
-        miphy_dev->phys = devm_kzalloc(&pdev->dev, sizeof(phy) * chancount,
-                                       GFP_KERNEL);
+        miphy_dev->nphys = of_get_child_count(np);
+        miphy_dev->phys = devm_kcalloc(&pdev->dev, miphy_dev->nphys,
+                                       sizeof(*miphy_dev->phys), GFP_KERNEL);
         if (!miphy_dev->phys)
                 return -ENOMEM;
 
diff --git a/drivers/phy/phy-omap-control.c b/drivers/phy/phy-omap-control.c
index efe724f97e02..93252e053a31 100644
--- a/drivers/phy/phy-omap-control.c
+++ b/drivers/phy/phy-omap-control.c
@@ -360,7 +360,7 @@ static void __exit omap_control_phy_exit(void)
 }
 module_exit(omap_control_phy_exit);
 
-MODULE_ALIAS("platform: omap_control_phy");
+MODULE_ALIAS("platform:omap_control_phy");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP Control Module PHY Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 6f4aef3db248..4757e765696a 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -296,10 +296,11 @@ static int omap_usb2_probe(struct platform_device *pdev)
                         dev_warn(&pdev->dev,
                                  "found usb_otg_ss_refclk960m, please fix DTS\n");
                 }
-        } else {
-                clk_prepare(phy->optclk);
         }
 
+        if (!IS_ERR(phy->optclk))
+                clk_prepare(phy->optclk);
+
         usb_add_phy_dev(&phy->phy);
 
         return 0;
@@ -383,7 +384,7 @@ static struct platform_driver omap_usb2_driver = {
 
 module_platform_driver(omap_usb2_driver);
 
-MODULE_ALIAS("platform: omap_usb2");
+MODULE_ALIAS("platform:omap_usb2");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP USB2 phy driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-rockchip-usb.c b/drivers/phy/phy-rockchip-usb.c
index 22011c3b6a4b..7d4c33643768 100644
--- a/drivers/phy/phy-rockchip-usb.c
+++ b/drivers/phy/phy-rockchip-usb.c
@@ -61,8 +61,6 @@ static int rockchip_usb_phy_power_off(struct phy *_phy)
                 return ret;
 
         clk_disable_unprepare(phy->clk);
-        if (ret)
-                return ret;
 
         return 0;
 }
@@ -78,8 +76,10 @@ static int rockchip_usb_phy_power_on(struct phy *_phy)
 
         /* Power up usb phy analog blocks by set siddq 0 */
         ret = rockchip_usb_phy_power(phy, 0);
-        if (ret)
+        if (ret) {
+                clk_disable_unprepare(phy->clk);
                 return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 95c88f929f27..2ba610b72ca2 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -165,15 +165,11 @@ static int ti_pipe3_dpll_wait_lock(struct ti_pipe3 *phy)
                 cpu_relax();
                 val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
                 if (val & PLL_LOCK)
-                        break;
+                        return 0;
         } while (!time_after(jiffies, timeout));
 
-        if (!(val & PLL_LOCK)) {
-                dev_err(phy->dev, "DPLL failed to lock\n");
-                return -EBUSY;
-        }
-
-        return 0;
+        dev_err(phy->dev, "DPLL failed to lock\n");
+        return -EBUSY;
 }
 
 static int ti_pipe3_dpll_program(struct ti_pipe3 *phy)
@@ -608,7 +604,7 @@ static struct platform_driver ti_pipe3_driver = {
 
 module_platform_driver(ti_pipe3_driver);
 
-MODULE_ALIAS("platform: ti_pipe3");
+MODULE_ALIAS("platform:ti_pipe3");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("TI PIPE3 phy driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 8e87f54671f3..bc42d6a8939f 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -666,7 +666,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
         twl->dev                = &pdev->dev;
         twl->irq                = platform_get_irq(pdev, 0);
         twl->vbus_supplied      = false;
-        twl->linkstat           = -EINVAL;
         twl->linkstat           = OMAP_MUSB_UNKNOWN;
 
         twl->phy.dev            = twl->dev;
diff --git a/drivers/phy/phy-xgene.c b/drivers/phy/phy-xgene.c
index 29214a36ea28..2263cd010032 100644
--- a/drivers/phy/phy-xgene.c
+++ b/drivers/phy/phy-xgene.c
@@ -1704,7 +1704,6 @@ static int xgene_phy_probe(struct platform_device *pdev)
         for (i = 0; i < MAX_LANE; i++)
                 ctx->sata_param.speed[i] = 2; /* Default to Gen3 */
 
-        ctx->dev = &pdev->dev;
         platform_set_drvdata(pdev, ctx);
 
         ctx->phy = devm_phy_create(ctx->dev, NULL, &xgene_phy_ops);
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5afe03e28b91..2062c224e32f 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -66,6 +66,10 @@
 #define BYT_DIR_MASK            (BIT(1) | BIT(2))
 #define BYT_TRIG_MASK           (BIT(26) | BIT(25) | BIT(24))
 
+#define BYT_CONF0_RESTORE_MASK  (BYT_DIRECT_IRQ_EN | BYT_TRIG_MASK | \
+                                 BYT_PIN_MUX)
+#define BYT_VAL_RESTORE_MASK    (BYT_DIR_MASK | BYT_LEVEL)
+
 #define BYT_NGPIO_SCORE         102
 #define BYT_NGPIO_NCORE         28
 #define BYT_NGPIO_SUS           44
@@ -134,12 +138,18 @@ static struct pinctrl_gpio_range byt_ranges[] = {
         },
 };
 
+struct byt_gpio_pin_context {
+        u32 conf0;
+        u32 val;
+};
+
 struct byt_gpio {
         struct gpio_chip                chip;
         struct platform_device          *pdev;
         spinlock_t                      lock;
         void __iomem                    *reg_base;
         struct pinctrl_gpio_range       *range;
+        struct byt_gpio_pin_context     *saved_context;
 };
 
 #define to_byt_gpio(c)  container_of(c, struct byt_gpio, chip)
@@ -158,40 +168,62 @@ static void __iomem *byt_gpio_reg(struct gpio_chip *chip, unsigned offset,
         return vg->reg_base + reg_offset + reg;
 }
 
-static bool is_special_pin(struct byt_gpio *vg, unsigned offset)
+static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned offset)
+{
+        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        unsigned long flags;
+        u32 value;
+
+        spin_lock_irqsave(&vg->lock, flags);
+        value = readl(reg);
+        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        writel(value, reg);
+        spin_unlock_irqrestore(&vg->lock, flags);
+}
+
+static u32 byt_get_gpio_mux(struct byt_gpio *vg, unsigned offset)
 {
         /* SCORE pin 92-93 */
         if (!strcmp(vg->range->name, BYT_SCORE_ACPI_UID) &&
                 offset >= 92 && offset <= 93)
-                return true;
+                return 1;
 
         /* SUS pin 11-21 */
         if (!strcmp(vg->range->name, BYT_SUS_ACPI_UID) &&
                 offset >= 11 && offset <= 21)
-                return true;
+                return 1;
 
-        return false;
+        return 0;
 }
 
 static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 {
         struct byt_gpio *vg = to_byt_gpio(chip);
         void __iomem *reg = byt_gpio_reg(chip, offset, BYT_CONF0_REG);
-        u32 value;
-        bool special;
+        u32 value, gpio_mux;
 
         /*
          * In most cases, func pin mux 000 means GPIO function.
          * But, some pins may have func pin mux 001 represents
-         * GPIO function. Only allow user to export pin with
-         * func pin mux preset as GPIO function by BIOS/FW.
+         * GPIO function.
+         *
+         * Because there are devices out there where some pins were not
+         * configured correctly we allow changing the mux value from
+         * request (but print out warning about that).
          */
         value = readl(reg) & BYT_PIN_MUX;
-        special = is_special_pin(vg, offset);
-        if ((special && value != 1) || (!special && value)) {
-                dev_err(&vg->pdev->dev,
-                        "pin %u cannot be used as GPIO.\n", offset);
-                return -EINVAL;
+        gpio_mux = byt_get_gpio_mux(vg, offset);
+        if (WARN_ON(gpio_mux != value)) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&vg->lock, flags);
+                value = readl(reg) & ~BYT_PIN_MUX;
+                value |= gpio_mux;
+                writel(value, reg);
+                spin_unlock_irqrestore(&vg->lock, flags);
+
+                dev_warn(&vg->pdev->dev,
+                         "pin %u forcibly re-configured as GPIO\n", offset);
         }
 
         pm_runtime_get(&vg->pdev->dev);
@@ -202,14 +234,8 @@ static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void byt_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
         struct byt_gpio *vg = to_byt_gpio(chip);
-        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
-        u32 value;
-
-        /* clear interrupt triggering */
-        value = readl(reg);
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
-        writel(value, reg);
 
+        byt_gpio_clear_triggering(vg, offset);
         pm_runtime_put(&vg->pdev->dev);
 }
 
@@ -236,23 +262,13 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
         value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
                    BYT_TRIG_LVL);
 
-        switch (type) {
-        case IRQ_TYPE_LEVEL_HIGH:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_RISING:
-                value |= BYT_TRIG_POS;
-                break;
-        case IRQ_TYPE_LEVEL_LOW:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_FALLING:
-                value |= BYT_TRIG_NEG;
-                break;
-        case IRQ_TYPE_EDGE_BOTH:
-                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
-                break;
-        }
         writel(value, reg);
 
+        if (type & IRQ_TYPE_EDGE_BOTH)
+                __irq_set_handler_locked(d->irq, handle_edge_irq);
+        else if (type & IRQ_TYPE_LEVEL_MASK)
+                __irq_set_handler_locked(d->irq, handle_level_irq);
+
         spin_unlock_irqrestore(&vg->lock, flags);
 
         return 0;
@@ -410,58 +426,80 @@ static void byt_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct byt_gpio *vg = to_byt_gpio(irq_desc_get_handler_data(desc));
         struct irq_chip *chip = irq_data_get_irq_chip(data);
-        u32 base, pin, mask;
+        u32 base, pin;
         void __iomem *reg;
-        u32 pending;
+        unsigned long pending;
         unsigned virq;
-        int looplimit = 0;
 
         /* check from GPIO controller which pin triggered the interrupt */
         for (base = 0; base < vg->chip.ngpio; base += 32) {
-
                 reg = byt_gpio_reg(&vg->chip, base, BYT_INT_STAT_REG);
-
-                while ((pending = readl(reg))) {
-                        pin = __ffs(pending);
-                        mask = BIT(pin);
-                        /* Clear before handling so we can't lose an edge */
-                        writel(mask, reg);
-
+                pending = readl(reg);
+                for_each_set_bit(pin, &pending, 32) {
                         virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
                         generic_handle_irq(virq);
-
-                        /* In case bios or user sets triggering incorretly a pin
-                         * might remain in "interrupt triggered" state.
-                         */
-                        if (looplimit++ > 32) {
-                                dev_err(&vg->pdev->dev,
-                                        "Gpio %d interrupt flood, disabling\n",
-                                        base + pin);
-
-                                reg = byt_gpio_reg(&vg->chip, base + pin,
-                                                   BYT_CONF0_REG);
-                                mask = readl(reg);
-                                mask &= ~(BYT_TRIG_NEG | BYT_TRIG_POS |
-                                          BYT_TRIG_LVL);
-                                writel(mask, reg);
-                                mask = readl(reg); /* flush */
-                                break;
-                        }
                 }
         }
         chip->irq_eoi(data);
 }
 
+static void byt_irq_ack(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        void __iomem *reg;
+
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_INT_STAT_REG);
+        writel(BIT(offset % 32), reg);
+}
+
 static void byt_irq_unmask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        unsigned long flags;
+        void __iomem *reg;
+        u32 value;
+
+        spin_lock_irqsave(&vg->lock, flags);
+
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        value = readl(reg);
+
+        switch (irqd_get_trigger_type(d)) {
+        case IRQ_TYPE_LEVEL_HIGH:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_RISING:
+                value |= BYT_TRIG_POS;
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_FALLING:
+                value |= BYT_TRIG_NEG;
+                break;
+        case IRQ_TYPE_EDGE_BOTH:
+                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
+                break;
+        }
+
+        writel(value, reg);
+
+        spin_unlock_irqrestore(&vg->lock, flags);
 }
 
 static void byt_irq_mask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+
+        byt_gpio_clear_triggering(vg, irqd_to_hwirq(d));
 }
 
 static struct irq_chip byt_irqchip = {
         .name = "BYT-GPIO",
+        .irq_ack = byt_irq_ack,
         .irq_mask = byt_irq_mask,
         .irq_unmask = byt_irq_unmask,
         .irq_set_type = byt_irq_type,
@@ -472,6 +510,21 @@ static void byt_gpio_irq_init_hw(struct byt_gpio *vg)
 {
         void __iomem *reg;
         u32 base, value;
+        int i;
+
+        /*
+         * Clear interrupt triggers for all pins that are GPIOs and
+         * do not use direct IRQ mode. This will prevent spurious
+         * interrupts from misconfigured pins.
+         */
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                value = readl(byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG));
+                if ((value & BYT_PIN_MUX) == byt_get_gpio_mux(vg, i) &&
+                    !(value & BYT_DIRECT_IRQ_EN)) {
+                        byt_gpio_clear_triggering(vg, i);
+                        dev_dbg(&vg->pdev->dev, "disabling GPIO %d\n", i);
+                }
+        }
 
         /* clear interrupt status trigger registers */
         for (base = 0; base < vg->chip.ngpio; base += 32) {
@@ -541,6 +594,11 @@ static int byt_gpio_probe(struct platform_device *pdev)
         gc->can_sleep = false;
         gc->dev = dev;
 
+#ifdef CONFIG_PM_SLEEP
+        vg->saved_context = devm_kcalloc(&pdev->dev, gc->ngpio,
+                                       sizeof(*vg->saved_context), GFP_KERNEL);
+#endif
+
         ret = gpiochip_add(gc);
         if (ret) {
                 dev_err(&pdev->dev, "failed adding byt-gpio chip\n");
@@ -569,6 +627,69 @@ static int byt_gpio_probe(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int byt_gpio_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg) & BYT_CONF0_RESTORE_MASK;
+                vg->saved_context[i].conf0 = value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg) & BYT_VAL_RESTORE_MASK;
+                vg->saved_context[i].val = value;
+        }
+
+        return 0;
+}
+
+static int byt_gpio_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg);
+                if ((value & BYT_CONF0_RESTORE_MASK) !=
+                     vg->saved_context[i].conf0) {
+                        value &= ~BYT_CONF0_RESTORE_MASK;
+                        value |= vg->saved_context[i].conf0;
+                        writel(value, reg);
+                        dev_info(dev, "restored pin %d conf0 %#08x", i, value);
+                }
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg);
+                if ((value & BYT_VAL_RESTORE_MASK) !=
+                     vg->saved_context[i].val) {
+                        u32 v;
+
+                        v = value & ~BYT_VAL_RESTORE_MASK;
+                        v |= vg->saved_context[i].val;
+                        if (v != value) {
+                                writel(v, reg);
+                                dev_dbg(dev, "restored pin %d val %#08x\n",
+                                        i, v);
+                        }
+                }
+        }
+
+        return 0;
+}
+#endif
+
 static int byt_gpio_runtime_suspend(struct device *dev)
 {
         return 0;
@@ -580,8 +701,9 @@ static int byt_gpio_runtime_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops byt_gpio_pm_ops = {
-        .runtime_suspend = byt_gpio_runtime_suspend,
-        .runtime_resume = byt_gpio_runtime_resume,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(byt_gpio_suspend, byt_gpio_resume)
+        SET_RUNTIME_PM_OPS(byt_gpio_runtime_suspend, byt_gpio_runtime_resume,
+                           NULL)
 };
 
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 3034fd03bced..82f691eeeec4 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1226,6 +1226,7 @@ static int chv_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 static int chv_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                                      int value)
 {
+        chv_gpio_set(chip, offset, value);
         return pinctrl_gpio_direction_output(chip->base + offset);
 }
 
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index f4cd0b9b2438..a4814066ea08 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1477,28 +1477,25 @@ static void gpio_irq_ack(struct irq_data *d)
         /* the interrupt is already cleared before by reading ISR */
 }
 
-static unsigned int gpio_irq_startup(struct irq_data *d)
+static int gpio_irq_request_res(struct irq_data *d)
 {
         struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
         unsigned        pin = d->hwirq;
         int ret;
 
         ret = gpiochip_lock_as_irq(&at91_gpio->chip, pin);
-        if (ret) {
+        if (ret)
                 dev_err(at91_gpio->chip.dev, "unable to lock pind %lu IRQ\n",
                         d->hwirq);
-                return ret;
-        }
-        gpio_irq_unmask(d);
-        return 0;
+
+        return ret;
 }
 
-static void gpio_irq_shutdown(struct irq_data *d)
+static void gpio_irq_release_res(struct irq_data *d)
 {
         struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
         unsigned        pin = d->hwirq;
 
-        gpio_irq_mask(d);
         gpiochip_unlock_as_irq(&at91_gpio->chip, pin);
 }
 
@@ -1577,8 +1574,8 @@ void at91_pinctrl_gpio_resume(void)
 static struct irq_chip gpio_irqchip = {
         .name           = "GPIO",
         .irq_ack        = gpio_irq_ack,
-        .irq_startup    = gpio_irq_startup,
-        .irq_shutdown   = gpio_irq_shutdown,
+        .irq_request_resources = gpio_irq_request_res,
+        .irq_release_resources = gpio_irq_release_res,
         .irq_disable    = gpio_irq_mask,
         .irq_mask       = gpio_irq_mask,
         .irq_unmask     = gpio_irq_unmask,
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
index 24c5d88f943f..3c68a8e5e0dd 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
@@ -1011,6 +1011,7 @@ static const struct sunxi_pinctrl_desc sun4i_a10_pinctrl_data = {
         .pins = sun4i_a10_pins,
         .npins = ARRAY_SIZE(sun4i_a10_pins),
         .irq_banks = 1,
+        .irq_read_needs_mux = true,
 };
 
 static int sun4i_a10_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 3d0744337736..f8e171b76693 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -29,6 +29,7 @@
 #include <linux/slab.h>
 
 #include "../core.h"
+#include "../../gpio/gpiolib.h"
 #include "pinctrl-sunxi.h"
 
 static struct irq_chip sunxi_pinctrl_edge_irq_chip;
@@ -464,10 +465,19 @@ static int sunxi_pinctrl_gpio_direction_input(struct gpio_chip *chip,
 static int sunxi_pinctrl_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
-
         u32 reg = sunxi_data_reg(offset);
         u8 index = sunxi_data_offset(offset);
-        u32 val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+        u32 set_mux = pctl->desc->irq_read_needs_mux &&
+                        test_bit(FLAG_USED_AS_IRQ, &chip->desc[offset].flags);
+        u32 val;
+
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_INPUT);
+
+        val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_IRQ);
 
         return val;
 }
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index 5a51523a3459..e248e81a0f9e 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -77,6 +77,9 @@
 #define IRQ_LEVEL_LOW           0x03
 #define IRQ_EDGE_BOTH           0x04
 
+#define SUN4I_FUNC_INPUT        0
+#define SUN4I_FUNC_IRQ          6
+
 struct sunxi_desc_function {
         const char      *name;
         u8              muxval;
@@ -94,6 +97,7 @@ struct sunxi_pinctrl_desc {
         int                             npins;
         unsigned                        pin_base;
         unsigned                        irq_banks;
+        bool                            irq_read_needs_mux;
 };
 
 struct sunxi_pinctrl_function {
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 97b5e4ee1ca4..63d4033eb683 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -73,7 +73,7 @@
 
 #define TIME_WINDOW_MAX_MSEC 40000
 #define TIME_WINDOW_MIN_MSEC 250
-
+#define ENERGY_UNIT_SCALE    1000 /* scale from driver unit to powercap unit */
 enum unit_type {
         ARBITRARY_UNIT, /* no translation */
         POWER_UNIT,
@@ -158,6 +158,7 @@ struct rapl_domain {
         struct rapl_power_limit rpl[NR_POWER_LIMITS];
         u64 attr_map; /* track capabilities */
         unsigned int state;
+        unsigned int domain_energy_unit;
         int package_id;
 };
 #define power_zone_to_rapl_domain(_zone) \
@@ -190,6 +191,7 @@ struct rapl_defaults {
         void (*set_floor_freq)(struct rapl_domain *rd, bool mode);
         u64 (*compute_time_window)(struct rapl_package *rp, u64 val,
                                 bool to_raw);
+        unsigned int dram_domain_energy_unit;
 };
 static struct rapl_defaults *rapl_defaults;
 
@@ -227,7 +229,8 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
 static int rapl_write_data_raw(struct rapl_domain *rd,
                         enum rapl_primitives prim,
                         unsigned long long value);
-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
+                        enum unit_type type, u64 value,
                         int to_raw);
 static void package_power_limit_irq_save(int package_id);
 
@@ -305,7 +308,9 @@ static int get_energy_counter(struct powercap_zone *power_zone, u64 *energy_raw)
 
 static int get_max_energy_counter(struct powercap_zone *pcd_dev, u64 *energy)
 {
-        *energy = rapl_unit_xlate(0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
+        struct rapl_domain *rd = power_zone_to_rapl_domain(pcd_dev);
+
+        *energy = rapl_unit_xlate(rd, 0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
         return 0;
 }
 
@@ -639,6 +644,11 @@ static void rapl_init_domains(struct rapl_package *rp)
                         rd->msrs[4] = MSR_DRAM_POWER_INFO;
                         rd->rpl[0].prim_id = PL1_ENABLE;
                         rd->rpl[0].name = pl1_name;
+                        rd->domain_energy_unit =
+                                rapl_defaults->dram_domain_energy_unit;
+                        if (rd->domain_energy_unit)
+                                pr_info("DRAM domain energy unit %dpj\n",
+                                        rd->domain_energy_unit);
                         break;
                 }
                 if (mask) {
@@ -648,11 +658,13 @@ static void rapl_init_domains(struct rapl_package *rp)
         }
 }
 
-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
+                        enum unit_type type, u64 value,
                         int to_raw)
 {
         u64 units = 1;
         struct rapl_package *rp;
+        u64 scale = 1;
 
         rp = find_package_by_id(package);
         if (!rp)
@@ -663,7 +675,12 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
                 units = rp->power_unit;
                 break;
         case ENERGY_UNIT:
-                units = rp->energy_unit;
+                scale = ENERGY_UNIT_SCALE;
+                /* per domain unit takes precedence */
+                if (rd && rd->domain_energy_unit)
+                        units = rd->domain_energy_unit;
+                else
+                        units = rp->energy_unit;
                 break;
         case TIME_UNIT:
                 return rapl_defaults->compute_time_window(rp, value, to_raw);
@@ -673,11 +690,11 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
         };
 
         if (to_raw)
-                return div64_u64(value, units);
+                return div64_u64(value, units) * scale;
 
         value *= units;
 
-        return value;
+        return div64_u64(value, scale);
 }
 
 /* in the order of enum rapl_primitives */
@@ -773,7 +790,7 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
         final = value & rp->mask;
         final = final >> rp->shift;
         if (xlate)
-                *data = rapl_unit_xlate(rd->package_id, rp->unit, final, 0);
+                *data = rapl_unit_xlate(rd, rd->package_id, rp->unit, final, 0);
         else
                 *data = final;
 
@@ -799,7 +816,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
                         "failed to read msr 0x%x on cpu %d\n", msr, cpu);
                 return -EIO;
         }
-        value = rapl_unit_xlate(rd->package_id, rp->unit, value, 1);
+        value = rapl_unit_xlate(rd, rd->package_id, rp->unit, value, 1);
         msr_val &= ~rp->mask;
         msr_val |= value << rp->shift;
         if (wrmsrl_safe_on_cpu(cpu, msr, msr_val)) {
@@ -818,7 +835,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
  * calculate units differ on different CPUs.
  * We convert the units to below format based on CPUs.
  * i.e.
- * energy unit: microJoules : Represented in microJoules by default
+ * energy unit: picoJoules  : Represented in picoJoules by default
  * power unit : microWatts  : Represented in milliWatts by default
  * time unit  : microseconds: Represented in seconds by default
  */
@@ -834,7 +851,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
         }
 
         value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit = 1000000 / (1 << value);
+        rp->energy_unit = ENERGY_UNIT_SCALE * 1000000 / (1 << value);
 
         value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
         rp->power_unit = 1000000 / (1 << value);
@@ -842,7 +859,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
         value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
         rp->time_unit = 1000000 / (1 << value);
 
-        pr_debug("Core CPU package %d energy=%duJ, time=%dus, power=%duW\n",
+        pr_debug("Core CPU package %d energy=%dpJ, time=%dus, power=%duW\n",
                 rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
 
         return 0;
@@ -859,7 +876,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
                 return -ENODEV;
         }
         value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit = 1 << value;
+        rp->energy_unit = ENERGY_UNIT_SCALE * 1 << value;
 
         value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
         rp->power_unit = (1 << value) * 1000;
@@ -867,7 +884,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
         value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
         rp->time_unit = 1000000 / (1 << value);
 
-        pr_debug("Atom package %d energy=%duJ, time=%dus, power=%duW\n",
+        pr_debug("Atom package %d energy=%dpJ, time=%dus, power=%duW\n",
                 rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
 
         return 0;
@@ -1017,6 +1034,13 @@ static const struct rapl_defaults rapl_defaults_core = {
         .compute_time_window = rapl_compute_time_window_core,
 };
 
+static const struct rapl_defaults rapl_defaults_hsw_server = {
+        .check_unit = rapl_check_unit_core,
+        .set_floor_freq = set_floor_freq_default,
+        .compute_time_window = rapl_compute_time_window_core,
+        .dram_domain_energy_unit = 15300,
+};
+
 static const struct rapl_defaults rapl_defaults_atom = {
         .check_unit = rapl_check_unit_atom,
         .set_floor_freq = set_floor_freq_atom,
@@ -1037,7 +1061,7 @@ static const struct x86_cpu_id rapl_ids[] = {
         RAPL_CPU(0x3a, rapl_defaults_core),/* Ivy Bridge */
         RAPL_CPU(0x3c, rapl_defaults_core),/* Haswell */
         RAPL_CPU(0x3d, rapl_defaults_core),/* Broadwell */
-        RAPL_CPU(0x3f, rapl_defaults_core),/* Haswell */
+        RAPL_CPU(0x3f, rapl_defaults_hsw_server),/* Haswell servers */
         RAPL_CPU(0x45, rapl_defaults_core),/* Haswell ULT */
         RAPL_CPU(0x4C, rapl_defaults_atom),/* Braswell */
         RAPL_CPU(0x4A, rapl_defaults_atom),/* Tangier */
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 1245dca79009..a4a8a6dc60c4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1839,10 +1839,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
         }
 
         if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, true);
-                if (ret < 0)
-                        return ret;
-                rdev->ena_gpio_state = 1;
+                if (!rdev->ena_gpio_state) {
+                        ret = regulator_ena_gpio_ctrl(rdev, true);
+                        if (ret < 0)
+                                return ret;
+                        rdev->ena_gpio_state = 1;
+                }
         } else if (rdev->desc->ops->enable) {
                 ret = rdev->desc->ops->enable(rdev);
                 if (ret < 0)
@@ -1939,10 +1941,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
         trace_regulator_disable(rdev_get_name(rdev));
 
         if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, false);
-                if (ret < 0)
-                        return ret;
-                rdev->ena_gpio_state = 0;
+                if (rdev->ena_gpio_state) {
+                        ret = regulator_ena_gpio_ctrl(rdev, false);
+                        if (ret < 0)
+                                return ret;
+                        rdev->ena_gpio_state = 0;
+                }
 
         } else if (rdev->desc->ops->disable) {
                 ret = rdev->desc->ops->disable(rdev);
@@ -3626,12 +3630,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
                                  config->ena_gpio, ret);
                         goto wash;
                 }
-
-                if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-                        rdev->ena_gpio_state = 1;
-
-                if (config->ena_gpio_invert)
-                        rdev->ena_gpio_state = !rdev->ena_gpio_state;
         }
 
         /* set regulator constraints */
@@ -3800,9 +3798,11 @@ int regulator_suspend_finish(void)
         list_for_each_entry(rdev, &regulator_list, list) {
                 mutex_lock(&rdev->mutex);
                 if (rdev->use_count > 0  || rdev->constraints->always_on) {
-                        error = _regulator_do_enable(rdev);
-                        if (error)
-                                ret = error;
+                        if (!_regulator_is_enabled(rdev)) {
+                                error = _regulator_do_enable(rdev);
+                                if (error)
+                                        ret = error;
+                        }
                 } else {
                         if (!have_full_constraints())
                                 goto unlock;
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 9205f433573c..18198316b6cf 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -1572,6 +1572,10 @@ static int palmas_regulators_probe(struct platform_device *pdev)
         if (!pmic)
                 return -ENOMEM;
 
+        if (of_device_is_compatible(node, "ti,tps659038-pmic"))
+                palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
+                                                        TPS659038_REGEN2_CTRL;
+
         pmic->dev = &pdev->dev;
         pmic->palmas = palmas;
         palmas->pmic = pmic;
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index e2cffe01b807..fb991ec76423 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 92f6af6da699..73354ee27877 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -951,6 +951,7 @@ static int rpmsg_probe(struct virtio_device *vdev)
         void *bufs_va;
         int err = 0, i;
         size_t total_buf_space;
+        bool notify;
 
         vrp = kzalloc(sizeof(*vrp), GFP_KERNEL);
         if (!vrp)
@@ -1030,8 +1031,22 @@ static int rpmsg_probe(struct virtio_device *vdev)
                 }
         }
 
+        /*
+         * Prepare to kick but don't notify yet - we can't do this before
+         * device is ready.
+         */
+        notify = virtqueue_kick_prepare(vrp->rvq);
+
+        /* From this point on, we can notify and get callbacks. */
+        virtio_device_ready(vdev);
+
         /* tell the remote processor it can start sending messages */
-        virtqueue_kick(vrp->rvq);
+        /*
+         * this might be concurrent with callbacks, but we are only
+         * doing notify, not a full kick here, so that's ok.
+         */
+        if (notify)
+                virtqueue_notify(vrp->rvq);
 
         dev_info(&vdev->dev, "rpmsg host is online\n");
 
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index b4f7744f6751..b283a1a573b3 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -324,7 +324,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
 
                 ret = IRQ_HANDLED;
         }
-        spin_lock(&suspended_lock);
+        spin_unlock(&suspended_lock);
 
         return ret;
 }
diff --git a/drivers/rtc/rtc-mrst.c b/drivers/rtc/rtc-mrst.c
index e2436d140175..3a6fd3a8a2ec 100644
--- a/drivers/rtc/rtc-mrst.c
+++ b/drivers/rtc/rtc-mrst.c
@@ -413,8 +413,8 @@ static void rtc_mrst_do_remove(struct device *dev)
         mrst->dev = NULL;
 }
 
-#ifdef  CONFIG_PM
-static int mrst_suspend(struct device *dev, pm_message_t mesg)
+#ifdef CONFIG_PM_SLEEP
+static int mrst_suspend(struct device *dev)
 {
         struct mrst_rtc *mrst = dev_get_drvdata(dev);
         unsigned char   tmp;
@@ -453,7 +453,7 @@ static int mrst_suspend(struct device *dev, pm_message_t mesg)
  */
 static inline int mrst_poweroff(struct device *dev)
 {
-        return mrst_suspend(dev, PMSG_HIBERNATE);
+        return mrst_suspend(dev);
 }
 
 static int mrst_resume(struct device *dev)
@@ -490,9 +490,11 @@ static int mrst_resume(struct device *dev)
         return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(mrst_pm_ops, mrst_suspend, mrst_resume);
+#define MRST_PM_OPS (&mrst_pm_ops)
+
 #else
-#define mrst_suspend    NULL
-#define mrst_resume     NULL
+#define MRST_PM_OPS NULL
 
 static inline int mrst_poweroff(struct device *dev)
 {
@@ -529,9 +531,8 @@ static struct platform_driver vrtc_mrst_platform_driver = {
         .remove         = vrtc_mrst_platform_remove,
         .shutdown       = vrtc_mrst_platform_shutdown,
         .driver = {
-                .name           = (char *) driver_name,
-                .suspend        = mrst_suspend,
-                .resume         = mrst_resume,
+                .name   = driver_name,
+                .pm     = MRST_PM_OPS,
         }
 };
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 4241eeab3386..f4cf6851fae9 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
 
 static struct s3c_rtc_data const s3c6410_rtc_data = {
         .max_user_freq          = 32768,
+        .needs_src_clk          = true,
         .irq_handler            = s3c6410_rtc_irq,
         .set_freq               = s3c6410_rtc_setfreq,
         .enable_tick            = s3c6410_rtc_enable_tick,
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index a7cc61837818..923a2b5a2439 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -5734,9 +5734,9 @@ free_port:
 hba_free:
         if (phba->msix_enabled)
                 pci_disable_msix(phba->pcidev);
-        iscsi_host_remove(phba->shost);
         pci_dev_put(phba->pcidev);
         iscsi_host_free(phba->shost);
+        pci_set_drvdata(pcidev, NULL);
 disable_pci:
         pci_disable_device(pcidev);
         return ret;
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 9219953ee949..d9afc51af7d3 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6815,7 +6815,8 @@ static struct ata_port_operations ipr_sata_ops = {
 };
 
 static struct ata_port_info sata_port_info = {
-        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA,
+        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
+                          ATA_FLAG_SAS_HOST,
         .pio_mask       = ATA_PIO4_ONLY,
         .mwdma_mask     = ATA_MWDMA2,
         .udma_mask      = ATA_UDMA6,
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 932d9cc98d2f..9c706d8c1441 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -547,7 +547,8 @@ static struct ata_port_operations sas_sata_ops = {
 };
 
 static struct ata_port_info sata_port_info = {
-        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ,
+        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ |
+                 ATA_FLAG_SAS_HOST,
         .pio_mask = ATA_PIO4,
         .mwdma_mask = ATA_MWDMA2,
         .udma_mask = ATA_UDMA6,
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index 62b58d38ce2e..60de66252fa2 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
         struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
         struct sas_ha_struct *ha = port->ha;
+        struct domain_device *ddev = port->port_dev;
 
         /* prevent revalidation from finding sata links in recovery */
         mutex_lock(&ha->disco_mutex);
@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
         SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
                     task_pid_nr(current));
 
-        if (port->port_dev)
-                res = sas_ex_revalidate_domain(port->port_dev);
+        if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
+                     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
+                res = sas_ex_revalidate_domain(ddev);
 
         SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
                     port->id, task_pid_nr(current), res);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 99f43b7fc9ab..ab4879e12ea7 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -1596,7 +1596,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
         /*
          * Finally register the new FC Nexus with TCM
          */
-        __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+        transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
 
         return 0;
 }
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 54d7a6cbb98a..b1a263137a23 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1311,9 +1311,11 @@ scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
                                     "rejecting I/O to dead device\n");
                         ret = BLKPREP_KILL;
                         break;
-                case SDEV_QUIESCE:
                 case SDEV_BLOCK:
                 case SDEV_CREATED_BLOCK:
+                        ret = BLKPREP_DEFER;
+                        break;
+                case SDEV_QUIESCE:
                         /*
                          * If the devices is blocked we defer normal commands.
                          */
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index 3ce39d10fafb..4f8c798e0633 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -108,7 +108,8 @@ static void dw_spi_dma_tx_done(void *arg)
 {
         struct dw_spi *dws = arg;
 
-        if (test_and_clear_bit(TX_BUSY, &dws->dma_chan_busy) & BIT(RX_BUSY))
+        clear_bit(TX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(RX_BUSY, &dws->dma_chan_busy))
                 return;
         dw_spi_xfer_done(dws);
 }
@@ -156,7 +157,8 @@ static void dw_spi_dma_rx_done(void *arg)
 {
         struct dw_spi *dws = arg;
 
-        if (test_and_clear_bit(RX_BUSY, &dws->dma_chan_busy) & BIT(TX_BUSY))
+        clear_bit(RX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(TX_BUSY, &dws->dma_chan_busy))
                 return;
         dw_spi_xfer_done(dws);
 }
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index ff9cdbdb6672..2b2c359f5a50 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -498,7 +498,7 @@ static int spi_qup_probe(struct platform_device *pdev)
         struct resource *res;
         struct device *dev;
         void __iomem *base;
-        u32 max_freq, iomode;
+        u32 max_freq, iomode, num_cs;
         int ret, irq, size;
 
         dev = &pdev->dev;
@@ -550,10 +550,11 @@ static int spi_qup_probe(struct platform_device *pdev)
         }
 
         /* use num-cs unless not present or out of range */
-        if (of_property_read_u16(dev->of_node, "num-cs",
-                        &master->num_chipselect) ||
-                        (master->num_chipselect > SPI_NUM_CHIPSELECTS))
+        if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
+            num_cs > SPI_NUM_CHIPSELECTS)
                 master->num_chipselect = SPI_NUM_CHIPSELECTS;
+        else
+                master->num_chipselect = num_cs;
 
         master->bus_num = pdev->id;
         master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index c64a3e59fce3..57a195041dc7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1105,13 +1105,14 @@ void spi_finalize_current_message(struct spi_master *master)
                                 "failed to unprepare message: %d\n", ret);
                 }
         }
+
+        trace_spi_message_done(mesg);
+
         master->cur_msg_prepared = false;
 
         mesg->state = NULL;
         if (mesg->complete)
                 mesg->complete(mesg->context);
-
-        trace_spi_message_done(mesg);
 }
 EXPORT_SYMBOL_GPL(spi_finalize_current_message);
 
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index 24183028bd71..6d5b38d69578 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -38,6 +38,7 @@ config IIO_SIMPLE_DUMMY_EVENTS
 config IIO_SIMPLE_DUMMY_BUFFER
         bool "Buffered capture support"
         select IIO_BUFFER
+        select IIO_TRIGGER
         select IIO_KFIFO_BUF
         help
           Add buffered data capture to the simple dummy driver.
diff --git a/drivers/staging/iio/magnetometer/hmc5843_core.c b/drivers/staging/iio/magnetometer/hmc5843_core.c
index fd171d8b38fb..90cc18b703cf 100644
--- a/drivers/staging/iio/magnetometer/hmc5843_core.c
+++ b/drivers/staging/iio/magnetometer/hmc5843_core.c
@@ -592,6 +592,7 @@ int hmc5843_common_probe(struct device *dev, struct regmap *regmap,
         mutex_init(&data->lock);
 
         indio_dev->dev.parent = dev;
+        indio_dev->name = dev->driver->name;
         indio_dev->info = &hmc5843_info;
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->channels = data->variant->channels;
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 4324282afe49..03b2a90b9ac0 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -330,16 +330,6 @@ static void device_init_registers(struct vnt_private *pDevice)
         /* zonetype initial */
         pDevice->byOriginalZonetype = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
 
-        /* Get RFType */
-        pDevice->byRFType = SROMbyReadEmbedded(pDevice->PortOffset, EEP_OFS_RFTYPE);
-
-        /* force change RevID for VT3253 emu */
-        if ((pDevice->byRFType & RF_EMU) != 0)
-                        pDevice->byRevId = 0x80;
-
-        pDevice->byRFType &= RF_MASK;
-        pr_debug("pDevice->byRFType = %x\n", pDevice->byRFType);
-
         if (!pDevice->bZoneRegExist)
                 pDevice->byZoneType = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
 
@@ -1187,12 +1177,14 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         PSTxDesc head_td;
-        u32 dma_idx = TYPE_AC0DMA;
+        u32 dma_idx;
         unsigned long flags;
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        if (!ieee80211_is_data(hdr->frame_control))
+        if (ieee80211_is_data(hdr->frame_control))
+                dma_idx = TYPE_AC0DMA;
+        else
                 dma_idx = TYPE_TXDMA0;
 
         if (AVAIL_TD(priv, dma_idx) < 1) {
@@ -1206,6 +1198,9 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
 
         head_td->pTDInfo->skb = skb;
 
+        if (dma_idx == TYPE_AC0DMA)
+                head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
+
         priv->iTDUsed[dma_idx]++;
 
         /* Take ownership */
@@ -1234,13 +1229,10 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
 
         head_td->buff_addr = cpu_to_le32(head_td->pTDInfo->skb_dma);
 
-        if (dma_idx == TYPE_AC0DMA) {
-                head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
-
+        if (head_td->pTDInfo->byFlags & TD_FLAGS_NETIF_SKB)
                 MACvTransmitAC0(priv->PortOffset);
-        } else {
+        else
                 MACvTransmit0(priv->PortOffset);
-        }
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -1778,6 +1770,12 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent)
         MACvInitialize(priv->PortOffset);
         MACvReadEtherAddress(priv->PortOffset, priv->abyCurrentNetAddr);
 
+        /* Get RFType */
+        priv->byRFType = SROMbyReadEmbedded(priv->PortOffset, EEP_OFS_RFTYPE);
+        priv->byRFType &= RF_MASK;
+
+        dev_dbg(&pcid->dev, "RF Type = %x\n", priv->byRFType);
+
         device_get_options(priv);
         device_set_options(priv);
         /* Mask out the options cannot be set to the chip */
diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
index 941b2adca95a..7626f635f160 100644
--- a/drivers/staging/vt6655/rf.c
+++ b/drivers/staging/vt6655/rf.c
@@ -794,6 +794,7 @@ bool RFbSetPower(
                 break;
         case RATE_6M:
         case RATE_9M:
+        case RATE_12M:
         case RATE_18M:
                 byPwr = priv->abyOFDMPwrTbl[uCH];
                 if (priv->byRFType == RF_UW2452)
diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
index c42cde59f598..c4286ccac320 100644
--- a/drivers/staging/vt6656/rf.c
+++ b/drivers/staging/vt6656/rf.c
@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
                 break;
         case RATE_6M:
         case RATE_9M:
+        case RATE_12M:
         case RATE_18M:
         case RATE_24M:
         case RATE_36M:
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 50bad55a0c42..77d64251af40 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1181,7 +1181,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
          * traditional iSCSI block I/O.
          */
         if (iscsit_allocate_iovecs(cmd) < 0) {
-                return iscsit_add_reject_cmd(cmd,
+                return iscsit_reject_cmd(cmd,
                                 ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
         }
         immed_data = cmd->immediate_data;
@@ -3468,6 +3468,7 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                                                 tpg_np_list) {
                                 struct iscsi_np *np = tpg_np->tpg_np;
                                 bool inaddr_any = iscsit_check_inaddr_any(np);
+                                char *fmt_str;
 
                                 if (np->np_network_transport != network_transport)
                                         continue;
@@ -3495,8 +3496,12 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                                         }
                                 }
 
-                                len = sprintf(buf, "TargetAddress="
-                                        "%s:%hu,%hu",
+                                if (np->np_sockaddr.ss_family == AF_INET6)
+                                        fmt_str = "TargetAddress=[%s]:%hu,%hu";
+                                else
+                                        fmt_str = "TargetAddress=%s:%hu,%hu";
+
+                                len = sprintf(buf, fmt_str,
                                         inaddr_any ? conn->local_ip : np->np_ip,
                                         np->np_port,
                                         tpg->tpgt);
@@ -4256,11 +4261,17 @@ int iscsit_close_connection(
         pr_debug("Closing iSCSI connection CID %hu on SID:"
                 " %u\n", conn->cid, sess->sid);
         /*
-         * Always up conn_logout_comp just in case the RX Thread is sleeping
-         * and the logout response never got sent because the connection
-         * failed.
+         * Always up conn_logout_comp for the traditional TCP case just in case
+         * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
+         * response never got sent because the connection failed.
+         *
+         * However for iser-target, isert_wait4logout() is using conn_logout_comp
+         * to signal logout response TX interrupt completion.  Go ahead and skip
+         * this for iser since isert_rx_opcode() does not wait on logout failure,
+         * and to avoid iscsi_conn pointer dereference in iser-target code.
          */
-        complete(&conn->conn_logout_comp);
+        if (conn->conn_transport->transport_type == ISCSI_TCP)
+                complete(&conn->conn_logout_comp);
 
         iscsi_release_thread_set(conn);
 
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 1c197bad6132..bdd8731a4daa 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -22,7 +22,6 @@
 #include <target/target_core_fabric.h>
 
 #include <target/iscsi/iscsi_target_core.h>
-#include <target/iscsi/iscsi_transport.h>
 #include "iscsi_target_seq_pdu_list.h"
 #include "iscsi_target_tq.h"
 #include "iscsi_target_erl0.h"
@@ -940,8 +939,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
 
         if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
                 spin_unlock_bh(&conn->state_lock);
-                if (conn->conn_transport->transport_type == ISCSI_TCP)
-                        iscsit_close_connection(conn);
+                iscsit_close_connection(conn);
                 return;
         }
 
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 6b3c32954689..c36bd7c29136 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -953,11 +953,8 @@ static int tcm_loop_make_nexus(
                 transport_free_session(tl_nexus->se_sess);
                 goto out;
         }
-        /*
-         * Now, register the SAS I_T Nexus as active with the call to
-         * transport_register_session()
-         */
-        __transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
+        /* Now, register the SAS I_T Nexus as active. */
+        transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
                         tl_nexus->se_sess, tl_nexus);
         tl_tpg->tl_nexus = tl_nexus;
         pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated"
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 58f49ff69b14..7faa6aef9a4d 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -650,6 +650,18 @@ static u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
         return aligned_max_sectors;
 }
 
+bool se_dev_check_wce(struct se_device *dev)
+{
+        bool wce = false;
+
+        if (dev->transport->get_write_cache)
+                wce = dev->transport->get_write_cache(dev);
+        else if (dev->dev_attrib.emulate_write_cache > 0)
+                wce = true;
+
+        return wce;
+}
+
 int se_dev_set_max_unmap_lba_count(
         struct se_device *dev,
         u32 max_unmap_lba_count)
@@ -767,6 +779,16 @@ int se_dev_set_emulate_fua_write(struct se_device *dev, int flag)
                 pr_err("Illegal value %d\n", flag);
                 return -EINVAL;
         }
+        if (flag &&
+            dev->transport->get_write_cache) {
+                pr_warn("emulate_fua_write not supported for this device, ignoring\n");
+                return 0;
+        }
+        if (dev->export_count) {
+                pr_err("emulate_fua_write cannot be changed with active"
+                       " exports: %d\n", dev->export_count);
+                return -EINVAL;
+        }
         dev->dev_attrib.emulate_fua_write = flag;
         pr_debug("dev[%p]: SE Device Forced Unit Access WRITEs: %d\n",
                         dev, dev->dev_attrib.emulate_fua_write);
@@ -801,7 +823,11 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
                 pr_err("emulate_write_cache not supported for this device\n");
                 return -EINVAL;
         }
-
+        if (dev->export_count) {
+                pr_err("emulate_write_cache cannot be changed with active"
+                       " exports: %d\n", dev->export_count);
+                return -EINVAL;
+        }
         dev->dev_attrib.emulate_write_cache = flag;
         pr_debug("dev[%p]: SE Device WRITE_CACHE_EMULATION flag: %d\n",
                         dev, dev->dev_attrib.emulate_write_cache);
@@ -1534,8 +1560,6 @@ int target_configure_device(struct se_device *dev)
         ret = dev->transport->configure_device(dev);
         if (ret)
                 goto out;
-        dev->dev_flags |= DF_CONFIGURED;
-
         /*
          * XXX: there is not much point to have two different values here..
          */
@@ -1597,6 +1621,8 @@ int target_configure_device(struct se_device *dev)
         list_add_tail(&dev->g_dev_node, &g_device_list);
         mutex_unlock(&g_device_mutex);
 
+        dev->dev_flags |= DF_CONFIGURED;
+
         return 0;
 
 out_free_alua:
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 1045dcd7bf65..f6c954c4635f 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -1121,7 +1121,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
         struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
         struct scsi_device *sd = pdv->pdv_sd;
 
-        return sd->type;
+        return (sd) ? sd->type : TYPE_NO_LUN;
 }
 
 static sector_t pscsi_get_blocks(struct se_device *dev)
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 9a2f9d3a6e70..3e7297411110 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -708,8 +708,7 @@ sbc_check_dpofua(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb)
                 }
         }
         if (cdb[1] & 0x8) {
-                if (!dev->dev_attrib.emulate_fua_write ||
-                    !dev->dev_attrib.emulate_write_cache) {
+                if (!dev->dev_attrib.emulate_fua_write || !se_dev_check_wce(dev)) {
                         pr_err("Got CDB: 0x%02x with FUA bit set, but device"
                                " does not advertise support for FUA write\n",
                                cdb[0]);
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 460e93109473..6c8bd6bc175c 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -454,19 +454,6 @@ check_scsi_name:
 }
 EXPORT_SYMBOL(spc_emulate_evpd_83);
 
-static bool
-spc_check_dev_wce(struct se_device *dev)
-{
-        bool wce = false;
-
-        if (dev->transport->get_write_cache)
-                wce = dev->transport->get_write_cache(dev);
-        else if (dev->dev_attrib.emulate_write_cache > 0)
-                wce = true;
-
-        return wce;
-}
-
 /* Extended INQUIRY Data VPD Page */
 static sense_reason_t
 spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
@@ -490,7 +477,7 @@ spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
         buf[5] = 0x07;
 
         /* If WriteCache emulation is enabled, set V_SUP */
-        if (spc_check_dev_wce(dev))
+        if (se_dev_check_wce(dev))
                 buf[6] = 0x01;
         /* If an LBA map is present set R_SUP */
         spin_lock(&cmd->se_dev->t10_alua.lba_map_lock);
@@ -897,7 +884,7 @@ static int spc_modesense_caching(struct se_cmd *cmd, u8 pc, u8 *p)
         if (pc == 1)
                 goto out;
 
-        if (spc_check_dev_wce(dev))
+        if (se_dev_check_wce(dev))
                 p[2] = 0x04; /* Write Cache Enable */
         p[12] = 0x20; /* Disabled Read Ahead */
 
@@ -1009,7 +996,7 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
              (cmd->se_deve->lun_flags & TRANSPORT_LUNFLAGS_READ_ONLY)))
                 spc_modesense_write_protect(&buf[length], type);
 
-        if ((spc_check_dev_wce(dev)) &&
+        if ((se_dev_check_wce(dev)) &&
             (dev->dev_attrib.emulate_fua_write > 0))
                 spc_modesense_dpofua(&buf[length], type);
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 0adc0f650213..ac3cbabdbdf0 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2389,6 +2389,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
         list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
 out:
         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+        if (ret && ack_kref)
+                target_put_sess_cmd(se_sess, se_cmd);
+
         return ret;
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index 97b486c3dda1..583e755d8091 100644
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -359,7 +359,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
                 ep = fc_seq_exch(seq);
                 if (ep) {
                         lport = ep->lp;
-                        if (lport && (ep->xid <= lport->lro_xid))
+                        if (lport && (ep->xid <= lport->lro_xid)) {
                                 /*
                                  * "ddp_done" trigger invalidation of HW
                                  * specific DDP context
@@ -374,6 +374,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
                                  * identified using ep->xid)
                                  */
                                 cmd->was_ddp_setup = 0;
+                        }
                 }
         }
 }
diff --git a/drivers/thermal/st/st_thermal.c b/drivers/thermal/st/st_thermal.c
index d1ec5804c0bb..76c515dd802b 100644
--- a/drivers/thermal/st/st_thermal.c
+++ b/drivers/thermal/st/st_thermal.c
@@ -25,7 +25,7 @@
  * Function to allocate regfields which are common
  * between syscfg and memory mapped based sensors
  */
-int st_thermal_alloc_regfields(struct st_thermal_sensor *sensor)
+static int st_thermal_alloc_regfields(struct st_thermal_sensor *sensor)
 {
         struct device *dev = sensor->dev;
         struct regmap *regmap = sensor->regmap;
diff --git a/drivers/thermal/st/st_thermal_memmap.c b/drivers/thermal/st/st_thermal_memmap.c
index 067bfcdb91d6..fc0c9e198710 100644
--- a/drivers/thermal/st/st_thermal_memmap.c
+++ b/drivers/thermal/st/st_thermal_memmap.c
@@ -157,7 +157,7 @@ static const struct st_thermal_sensor_ops st_mmap_sensor_ops = {
 };
 
 /* Compatible device data stih416 mpe thermal sensor */
-const struct st_thermal_compat_data st_416mpe_cdata = {
+static const struct st_thermal_compat_data st_416mpe_cdata = {
         .reg_fields             = st_mmap_thermal_regfields,
         .ops                    = &st_mmap_sensor_ops,
         .calibration_val        = 14,
@@ -166,7 +166,7 @@ const struct st_thermal_compat_data st_416mpe_cdata = {
 };
 
 /* Compatible device data stih407 thermal sensor */
-const struct st_thermal_compat_data st_407_cdata = {
+static const struct st_thermal_compat_data st_407_cdata = {
         .reg_fields             = st_mmap_thermal_regfields,
         .ops                    = &st_mmap_sensor_ops,
         .calibration_val        = 16,
@@ -174,19 +174,19 @@ const struct st_thermal_compat_data st_407_cdata = {
         .crit_temp              = 120,
 };
 
-static struct of_device_id st_mmap_thermal_of_match[] = {
+static const struct of_device_id st_mmap_thermal_of_match[] = {
         { .compatible = "st,stih416-mpe-thermal", .data = &st_416mpe_cdata },
         { .compatible = "st,stih407-thermal",     .data = &st_407_cdata },
         { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, st_mmap_thermal_of_match);
 
-int st_mmap_probe(struct platform_device *pdev)
+static int st_mmap_probe(struct platform_device *pdev)
 {
         return st_thermal_register(pdev,  st_mmap_thermal_of_match);
 }
 
-int st_mmap_remove(struct platform_device *pdev)
+static int st_mmap_remove(struct platform_device *pdev)
 {
         return st_thermal_unregister(pdev);
 }
diff --git a/drivers/thermal/st/st_thermal_syscfg.c b/drivers/thermal/st/st_thermal_syscfg.c
index 26d36a242bb8..3df5b7890703 100644
--- a/drivers/thermal/st/st_thermal_syscfg.c
+++ b/drivers/thermal/st/st_thermal_syscfg.c
@@ -104,7 +104,7 @@ static const struct st_thermal_sensor_ops st_syscfg_sensor_ops = {
 };
 
 /* Compatible device data for stih415 sas thermal sensor */
-const struct st_thermal_compat_data st_415sas_cdata = {
+static const struct st_thermal_compat_data st_415sas_cdata = {
         .sys_compat             = "st,stih415-front-syscfg",
         .reg_fields             = st_415sas_regfields,
         .ops                    = &st_syscfg_sensor_ops,
@@ -114,7 +114,7 @@ const struct st_thermal_compat_data st_415sas_cdata = {
 };
 
 /* Compatible device data for stih415 mpe thermal sensor */
-const struct st_thermal_compat_data st_415mpe_cdata = {
+static const struct st_thermal_compat_data st_415mpe_cdata = {
         .sys_compat             = "st,stih415-system-syscfg",
         .reg_fields             = st_415mpe_regfields,
         .ops                    = &st_syscfg_sensor_ops,
@@ -124,7 +124,7 @@ const struct st_thermal_compat_data st_415mpe_cdata = {
 };
 
 /* Compatible device data for stih416 sas thermal sensor */
-const struct st_thermal_compat_data st_416sas_cdata = {
+static const struct st_thermal_compat_data st_416sas_cdata = {
         .sys_compat             = "st,stih416-front-syscfg",
         .reg_fields             = st_416sas_regfields,
         .ops                    = &st_syscfg_sensor_ops,
@@ -134,7 +134,7 @@ const struct st_thermal_compat_data st_416sas_cdata = {
 };
 
 /* Compatible device data for stid127 thermal sensor */
-const struct st_thermal_compat_data st_127_cdata = {
+static const struct st_thermal_compat_data st_127_cdata = {
         .sys_compat             = "st,stid127-cpu-syscfg",
         .reg_fields             = st_127_regfields,
         .ops                    = &st_syscfg_sensor_ops,
@@ -143,7 +143,7 @@ const struct st_thermal_compat_data st_127_cdata = {
         .crit_temp              = 120,
 };
 
-static struct of_device_id st_syscfg_thermal_of_match[] = {
+static const struct of_device_id st_syscfg_thermal_of_match[] = {
         { .compatible = "st,stih415-sas-thermal", .data = &st_415sas_cdata },
         { .compatible = "st,stih415-mpe-thermal", .data = &st_415mpe_cdata },
         { .compatible = "st,stih416-sas-thermal", .data = &st_416sas_cdata },
@@ -152,12 +152,12 @@ static struct of_device_id st_syscfg_thermal_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, st_syscfg_thermal_of_match);
 
-int st_syscfg_probe(struct platform_device *pdev)
+static int st_syscfg_probe(struct platform_device *pdev)
 {
         return st_thermal_register(pdev, st_syscfg_thermal_of_match);
 }
 
-int st_syscfg_remove(struct platform_device *pdev)
+static int st_syscfg_remove(struct platform_device *pdev)
 {
         return st_thermal_unregister(pdev);
 }
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 174d3bcf8bd7..4108db7e10c1 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -458,8 +458,10 @@ static void update_temperature(struct thermal_zone_device *tz)
 
         ret = thermal_zone_get_temp(tz, &temp);
         if (ret) {
-                dev_warn(&tz->device, "failed to read out thermal zone %d\n",
-                         tz->id);
+                if (ret != -EAGAIN)
+                        dev_warn(&tz->device,
+                                 "failed to read out thermal zone (%d)\n",
+                                 ret);
                 return;
         }
 
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 2ab229ddee38..6ae5b8560e4d 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -119,7 +119,10 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
                         dw8250_force_idle(p);
                         writeb(value, p->membase + (UART_LCR << p->regshift));
                 }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
         }
 }
 
@@ -163,7 +166,10 @@ static void dw8250_serial_outq(struct uart_port *p, int offset, int value)
                         __raw_writeq(value & 0xff,
                                      p->membase + (UART_LCR << p->regshift));
                 }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
         }
 }
 #endif /* CONFIG_64BIT */
@@ -187,7 +193,10 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
                         dw8250_force_idle(p);
                         writel(value, p->membase + (UART_LCR << p->regshift));
                 }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
         }
 }
 
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index b1893f3f88f1..3ad1458bfeb0 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -921,6 +921,9 @@ static void lpuart_setup_watermark(struct lpuart_port *sport)
         writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE,
                         sport->port.membase + UARTPFIFO);
 
+        /* explicitly clear RDRF */
+        readb(sport->port.membase + UARTSR1);
+
         /* flush Tx and Rx FIFO */
         writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH,
                         sport->port.membase + UARTCFIFO);
@@ -1076,6 +1079,8 @@ static int lpuart_startup(struct uart_port *port)
         sport->txfifo_size = 0x1 << (((temp >> UARTPFIFO_TXSIZE_OFF) &
                 UARTPFIFO_FIFOSIZE_MASK) + 1);
 
+        sport->port.fifosize = sport->txfifo_size;
+
         sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
                 UARTPFIFO_FIFOSIZE_MASK) + 1);
 
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index af821a908720..cf08876922f1 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -963,6 +963,7 @@ static void s3c24xx_serial_shutdown(struct uart_port *port)
                         free_irq(ourport->tx_irq, ourport);
                 tx_enabled(port) = 0;
                 ourport->tx_claimed = 0;
+                ourport->tx_mode = 0;
         }
 
         if (ourport->rx_claimed) {
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index ff451048c1ac..4bfb7ac0239f 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -929,6 +929,13 @@ __acquires(hwep->lock)
         return retval;
 }
 
+static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
+{
+        dev_warn(&ci->gadget.dev,
+                "connect the device to an alternate port if you want HNP\n");
+        return isr_setup_status_phase(ci);
+}
+
 /**
  * isr_setup_packet_handler: setup packet handler
  * @ci: UDC descriptor
@@ -1061,6 +1068,10 @@ __acquires(ci->lock)
                                                         ci);
                                 }
                                 break;
+                        case USB_DEVICE_A_ALT_HNP_SUPPORT:
+                                if (ci_otg_is_fsm_mode(ci))
+                                        err = otg_a_alt_hnp_support(ci);
+                                break;
                         default:
                                 goto delegate;
                         }
diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
index c6b35b77dab7..61d538aa2346 100644
--- a/drivers/usb/common/usb-otg-fsm.c
+++ b/drivers/usb/common/usb-otg-fsm.c
@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                 break;
         case OTG_STATE_B_PERIPHERAL:
                 otg_chrg_vbus(fsm, 0);
-                otg_loc_conn(fsm, 1);
                 otg_loc_sof(fsm, 0);
                 otg_set_protocol(fsm, PROTO_GADGET);
+                otg_loc_conn(fsm, 1);
                 break;
         case OTG_STATE_B_WAIT_ACON:
                 otg_chrg_vbus(fsm, 0);
@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
 
                 break;
         case OTG_STATE_A_PERIPHERAL:
-                otg_loc_conn(fsm, 1);
                 otg_loc_sof(fsm, 0);
                 otg_set_protocol(fsm, PROTO_GADGET);
                 otg_drv_vbus(fsm, 1);
+                otg_loc_conn(fsm, 1);
                 otg_add_timer(fsm, A_BIDL_ADIS);
                 break;
         case OTG_STATE_A_WAIT_VFALL:
diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
index 02e3e2d4ea56..6cf047878dba 100644
--- a/drivers/usb/dwc2/core_intr.c
+++ b/drivers/usb/dwc2/core_intr.c
@@ -377,6 +377,9 @@ static void dwc2_handle_disconnect_intr(struct dwc2_hsotg *hsotg)
                 dwc2_is_host_mode(hsotg) ? "Host" : "Device",
                 dwc2_op_state_str(hsotg));
 
+        if (hsotg->op_state == OTG_STATE_A_HOST)
+                dwc2_hcd_disconnect(hsotg);
+
         /* Change to L3 (OFF) state */
         hsotg->lx_state = DWC2_L3;
 
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index af98b096af2f..175c9956cbe3 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -144,10 +144,9 @@ struct ffs_io_data {
         bool read;
 
         struct kiocb *kiocb;
-        const struct iovec *iovec;
-        unsigned long nr_segs;
-        char __user *buf;
-        size_t len;
+        struct iov_iter data;
+        const void *to_free;
+        char *buf;
 
         struct mm_struct *mm;
         struct work_struct work;
@@ -649,29 +648,10 @@ static void ffs_user_copy_worker(struct work_struct *work)
                                          io_data->req->actual;
 
         if (io_data->read && ret > 0) {
-                int i;
-                size_t pos = 0;
-
-                /*
-                 * Since req->length may be bigger than io_data->len (after
-                 * being rounded up to maxpacketsize), we may end up with more
-                 * data then user space has space for.
-                 */
-                ret = min_t(int, ret, io_data->len);
-
                 use_mm(io_data->mm);
-                for (i = 0; i < io_data->nr_segs; i++) {
-                        size_t len = min_t(size_t, ret - pos,
-                                        io_data->iovec[i].iov_len);
-                        if (!len)
-                                break;
-                        if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos], len))) {
-                                ret = -EFAULT;
-                                break;
-                        }
-                        pos += len;
-                }
+                ret = copy_to_iter(io_data->buf, ret, &io_data->data);
+                if (iov_iter_count(&io_data->data))
+                        ret = -EFAULT;
                 unuse_mm(io_data->mm);
         }
 
@@ -684,7 +664,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
 
         io_data->kiocb->private = NULL;
         if (io_data->read)
-                kfree(io_data->iovec);
+                kfree(io_data->to_free);
         kfree(io_data->buf);
         kfree(io_data);
 }
@@ -743,6 +723,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                  * before the waiting completes, so do not assign to 'gadget' earlier
                  */
                 struct usb_gadget *gadget = epfile->ffs->gadget;
+                size_t copied;
 
                 spin_lock_irq(&epfile->ffs->eps_lock);
                 /* In the meantime, endpoint got disabled or changed. */
@@ -750,34 +731,21 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                         spin_unlock_irq(&epfile->ffs->eps_lock);
                         return -ESHUTDOWN;
                 }
+                data_len = iov_iter_count(&io_data->data);
                 /*
                  * Controller may require buffer size to be aligned to
                  * maxpacketsize of an out endpoint.
                  */
-                data_len = io_data->read ?
-                           usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
-                           io_data->len;
+                if (io_data->read)
+                        data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
                 spin_unlock_irq(&epfile->ffs->eps_lock);
 
                 data = kmalloc(data_len, GFP_KERNEL);
                 if (unlikely(!data))
                         return -ENOMEM;
-                if (io_data->aio && !io_data->read) {
-                        int i;
-                        size_t pos = 0;
-                        for (i = 0; i < io_data->nr_segs; i++) {
-                                if (unlikely(copy_from_user(&data[pos],
-                                             io_data->iovec[i].iov_base,
-                                             io_data->iovec[i].iov_len))) {
-                                        ret = -EFAULT;
-                                        goto error;
-                                }
-                                pos += io_data->iovec[i].iov_len;
-                        }
-                } else {
-                        if (!io_data->read &&
-                            unlikely(__copy_from_user(data, io_data->buf,
-                                                      io_data->len))) {
+                if (!io_data->read) {
+                        copied = copy_from_iter(data, data_len, &io_data->data);
+                        if (copied != data_len) {
                                 ret = -EFAULT;
                                 goto error;
                         }
@@ -876,10 +844,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                                  */
                                 ret = ep->status;
                                 if (io_data->read && ret > 0) {
-                                        ret = min_t(size_t, ret, io_data->len);
-
-                                        if (unlikely(copy_to_user(io_data->buf,
-                                                data, ret)))
+                                        ret = copy_to_iter(data, ret, &io_data->data);
+                                        if (unlikely(iov_iter_count(&io_data->data)))
                                                 ret = -EFAULT;
                                 }
                         }
@@ -898,37 +864,6 @@ error:
         return ret;
 }
 
-static ssize_t
-ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
-                 loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-
-        ENTER();
-
-        io_data.aio = false;
-        io_data.read = false;
-        io_data.buf = (char * __user)buf;
-        io_data.len = len;
-
-        return ffs_epfile_io(file, &io_data);
-}
-
-static ssize_t
-ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-
-        ENTER();
-
-        io_data.aio = false;
-        io_data.read = true;
-        io_data.buf = buf;
-        io_data.len = len;
-
-        return ffs_epfile_io(file, &io_data);
-}
-
 static int
 ffs_epfile_open(struct inode *inode, struct file *file)
 {
@@ -965,67 +900,86 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
         return value;
 }
 
-static ssize_t ffs_epfile_aio_write(struct kiocb *kiocb,
-                                    const struct iovec *iovec,
-                                    unsigned long nr_segs, loff_t loff)
+static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
 {
-        struct ffs_io_data *io_data;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
 
         ENTER();
 
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
-        if (unlikely(!io_data))
-                return -ENOMEM;
+        if (!is_sync_kiocb(kiocb)) {
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
+        }
 
-        io_data->aio = true;
-        io_data->read = false;
-        io_data->kiocb = kiocb;
-        io_data->iovec = iovec;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
+        p->read = false;
+        p->kiocb = kiocb;
+        p->data = *from;
+        p->mm = current->mm;
 
-        kiocb->private = io_data;
+        kiocb->private = p;
 
         kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+        if (p->aio)
+                kfree(p);
+        else
+                *from = p->data;
+        return res;
 }
 
-static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb,
-                                   const struct iovec *iovec,
-                                   unsigned long nr_segs, loff_t loff)
+static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
 {
-        struct ffs_io_data *io_data;
-        struct iovec *iovec_copy;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
 
         ENTER();
 
-        iovec_copy = kmalloc_array(nr_segs, sizeof(*iovec_copy), GFP_KERNEL);
-        if (unlikely(!iovec_copy))
-                return -ENOMEM;
-
-        memcpy(iovec_copy, iovec, sizeof(struct iovec)*nr_segs);
-
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
-        if (unlikely(!io_data)) {
-                kfree(iovec_copy);
-                return -ENOMEM;
+        if (!is_sync_kiocb(kiocb)) {
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
         }
 
-        io_data->aio = true;
-        io_data->read = true;
-        io_data->kiocb = kiocb;
-        io_data->iovec = iovec_copy;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
+        p->read = true;
+        p->kiocb = kiocb;
+        if (p->aio) {
+                p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
+                if (!p->to_free) {
+                        kfree(p);
+                        return -ENOMEM;
+                }
+        } else {
+                p->data = *to;
+                p->to_free = NULL;
+        }
+        p->mm = current->mm;
 
-        kiocb->private = io_data;
+        kiocb->private = p;
 
         kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+
+        if (p->aio) {
+                kfree(p->to_free);
+                kfree(p);
+        } else {
+                *to = p->data;
+        }
+        return res;
 }
 
 static int
@@ -1105,10 +1059,10 @@ static const struct file_operations ffs_epfile_operations = {
         .llseek =       no_llseek,
 
         .open =         ffs_epfile_open,
-        .write =        ffs_epfile_write,
-        .read =         ffs_epfile_read,
-        .aio_write =    ffs_epfile_aio_write,
-        .aio_read =     ffs_epfile_aio_read,
+        .write =        new_sync_write,
+        .read =         new_sync_read,
+        .write_iter =   ffs_epfile_write_iter,
+        .read_iter =    ffs_epfile_read_iter,
         .release =      ffs_epfile_release,
         .unlocked_ioctl =       ffs_epfile_ioctl,
 };
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index 298b46112b1a..39f49f1ad22f 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -289,8 +289,7 @@ static void disable_loopback(struct f_loopback *loop)
         struct usb_composite_dev        *cdev;
 
         cdev = loop->function.config->cdev;
-        disable_endpoints(cdev, loop->in_ep, loop->out_ep, NULL, NULL, NULL,
-                        NULL);
+        disable_endpoints(cdev, loop->in_ep, loop->out_ep, NULL, NULL);
         VDBG(cdev, "%s disabled\n", loop->function.name);
 }
 
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index e3dae47baef3..3a5ae9900b1e 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -23,15 +23,6 @@
 #include "gadget_chips.h"
 #include "u_f.h"
 
-#define USB_MS_TO_SS_INTERVAL(x) USB_MS_TO_HS_INTERVAL(x)
-
-enum eptype {
-        EP_CONTROL = 0,
-        EP_BULK,
-        EP_ISOC,
-        EP_INTERRUPT,
-};
-
 /*
  * SOURCE/SINK FUNCTION ... a primary testing vehicle for USB peripheral
  * controller drivers.
@@ -64,8 +55,6 @@ struct f_sourcesink {
         struct usb_ep           *out_ep;
         struct usb_ep           *iso_in_ep;
         struct usb_ep           *iso_out_ep;
-        struct usb_ep           *int_in_ep;
-        struct usb_ep           *int_out_ep;
         int                     cur_alt;
 };
 
@@ -79,10 +68,6 @@ static unsigned isoc_interval;
 static unsigned isoc_maxpacket;
 static unsigned isoc_mult;
 static unsigned isoc_maxburst;
-static unsigned int_interval; /* In ms */
-static unsigned int_maxpacket;
-static unsigned int_mult;
-static unsigned int_maxburst;
 static unsigned buflen;
 
 /*-------------------------------------------------------------------------*/
@@ -107,16 +92,6 @@ static struct usb_interface_descriptor source_sink_intf_alt1 = {
         /* .iInterface          = DYNAMIC */
 };
 
-static struct usb_interface_descriptor source_sink_intf_alt2 = {
-        .bLength =              USB_DT_INTERFACE_SIZE,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bAlternateSetting =    2,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
-        /* .iInterface          = DYNAMIC */
-};
-
 /* full speed support: */
 
 static struct usb_endpoint_descriptor fs_source_desc = {
@@ -155,26 +130,6 @@ static struct usb_endpoint_descriptor fs_iso_sink_desc = {
         .bInterval =            4,
 };
 
-static struct usb_endpoint_descriptor fs_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(64),
-        .bInterval =            GZERO_INT_INTERVAL,
-};
-
-static struct usb_endpoint_descriptor fs_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_OUT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(64),
-        .bInterval =            GZERO_INT_INTERVAL,
-};
-
 static struct usb_descriptor_header *fs_source_sink_descs[] = {
         (struct usb_descriptor_header *) &source_sink_intf_alt0,
         (struct usb_descriptor_header *) &fs_sink_desc,
@@ -185,10 +140,6 @@ static struct usb_descriptor_header *fs_source_sink_descs[] = {
         (struct usb_descriptor_header *) &fs_source_desc,
         (struct usb_descriptor_header *) &fs_iso_sink_desc,
         (struct usb_descriptor_header *) &fs_iso_source_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define FS_ALT_IFC_2_OFFSET     8
-        (struct usb_descriptor_header *) &fs_int_sink_desc,
-        (struct usb_descriptor_header *) &fs_int_source_desc,
         NULL,
 };
 
@@ -228,24 +179,6 @@ static struct usb_endpoint_descriptor hs_iso_sink_desc = {
         .bInterval =            4,
 };
 
-static struct usb_endpoint_descriptor hs_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_HS_INTERVAL(GZERO_INT_INTERVAL),
-};
-
-static struct usb_endpoint_descriptor hs_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_HS_INTERVAL(GZERO_INT_INTERVAL),
-};
-
 static struct usb_descriptor_header *hs_source_sink_descs[] = {
         (struct usb_descriptor_header *) &source_sink_intf_alt0,
         (struct usb_descriptor_header *) &hs_source_desc,
@@ -256,10 +189,6 @@ static struct usb_descriptor_header *hs_source_sink_descs[] = {
         (struct usb_descriptor_header *) &hs_sink_desc,
         (struct usb_descriptor_header *) &hs_iso_source_desc,
         (struct usb_descriptor_header *) &hs_iso_sink_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define HS_ALT_IFC_2_OFFSET     8
-        (struct usb_descriptor_header *) &hs_int_source_desc,
-        (struct usb_descriptor_header *) &hs_int_sink_desc,
         NULL,
 };
 
@@ -335,42 +264,6 @@ static struct usb_ss_ep_comp_descriptor ss_iso_sink_comp_desc = {
         .wBytesPerInterval =    cpu_to_le16(1024),
 };
 
-static struct usb_endpoint_descriptor ss_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
-};
-
-static struct usb_ss_ep_comp_descriptor ss_int_source_comp_desc = {
-        .bLength =              USB_DT_SS_EP_COMP_SIZE,
-        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
-
-        .bMaxBurst =            0,
-        .bmAttributes =         0,
-        .wBytesPerInterval =    cpu_to_le16(1024),
-};
-
-static struct usb_endpoint_descriptor ss_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
-};
-
-static struct usb_ss_ep_comp_descriptor ss_int_sink_comp_desc = {
-        .bLength =              USB_DT_SS_EP_COMP_SIZE,
-        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
-
-        .bMaxBurst =            0,
-        .bmAttributes =         0,
-        .wBytesPerInterval =    cpu_to_le16(1024),
-};
-
 static struct usb_descriptor_header *ss_source_sink_descs[] = {
         (struct usb_descriptor_header *) &source_sink_intf_alt0,
         (struct usb_descriptor_header *) &ss_source_desc,
@@ -387,12 +280,6 @@ static struct usb_descriptor_header *ss_source_sink_descs[] = {
         (struct usb_descriptor_header *) &ss_iso_source_comp_desc,
         (struct usb_descriptor_header *) &ss_iso_sink_desc,
         (struct usb_descriptor_header *) &ss_iso_sink_comp_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define SS_ALT_IFC_2_OFFSET     14
-        (struct usb_descriptor_header *) &ss_int_source_desc,
-        (struct usb_descriptor_header *) &ss_int_source_comp_desc,
-        (struct usb_descriptor_header *) &ss_int_sink_desc,
-        (struct usb_descriptor_header *) &ss_int_sink_comp_desc,
         NULL,
 };
 
@@ -414,21 +301,6 @@ static struct usb_gadget_strings *sourcesink_strings[] = {
 };
 
 /*-------------------------------------------------------------------------*/
-static const char *get_ep_string(enum eptype ep_type)
-{
-        switch (ep_type) {
-        case EP_ISOC:
-                return "ISOC-";
-        case EP_INTERRUPT:
-                return "INTERRUPT-";
-        case EP_CONTROL:
-                return "CTRL-";
-        case EP_BULK:
-                return "BULK-";
-        default:
-                return "UNKNOWN-";
-        }
-}
 
 static inline struct usb_request *ss_alloc_ep_req(struct usb_ep *ep, int len)
 {
@@ -456,8 +328,7 @@ static void disable_ep(struct usb_composite_dev *cdev, struct usb_ep *ep)
 
 void disable_endpoints(struct usb_composite_dev *cdev,
                 struct usb_ep *in, struct usb_ep *out,
-                struct usb_ep *iso_in, struct usb_ep *iso_out,
-                struct usb_ep *int_in, struct usb_ep *int_out)
+                struct usb_ep *iso_in, struct usb_ep *iso_out)
 {
         disable_ep(cdev, in);
         disable_ep(cdev, out);
@@ -465,10 +336,6 @@ void disable_endpoints(struct usb_composite_dev *cdev,
                 disable_ep(cdev, iso_in);
         if (iso_out)
                 disable_ep(cdev, iso_out);
-        if (int_in)
-                disable_ep(cdev, int_in);
-        if (int_out)
-                disable_ep(cdev, int_out);
 }
 
 static int
@@ -485,7 +352,6 @@ sourcesink_bind(struct usb_configuration *c, struct usb_function *f)
                 return id;
         source_sink_intf_alt0.bInterfaceNumber = id;
         source_sink_intf_alt1.bInterfaceNumber = id;
-        source_sink_intf_alt2.bInterfaceNumber = id;
 
         /* allocate bulk endpoints */
         ss->in_ep = usb_ep_autoconfig(cdev->gadget, &fs_source_desc);
@@ -546,55 +412,14 @@ no_iso:
         if (isoc_maxpacket > 1024)
                 isoc_maxpacket = 1024;
 
-        /* sanity check the interrupt module parameters */
-        if (int_interval < 1)
-                int_interval = 1;
-        if (int_interval > 4096)
-                int_interval = 4096;
-        if (int_mult > 2)
-                int_mult = 2;
-        if (int_maxburst > 15)
-                int_maxburst = 15;
-
-        /* fill in the FS interrupt descriptors from the module parameters */
-        fs_int_source_desc.wMaxPacketSize = int_maxpacket > 64 ?
-                                                64 : int_maxpacket;
-        fs_int_source_desc.bInterval = int_interval > 255 ?
-                                                255 : int_interval;
-        fs_int_sink_desc.wMaxPacketSize = int_maxpacket > 64 ?
-                                                64 : int_maxpacket;
-        fs_int_sink_desc.bInterval = int_interval > 255 ?
-                                                255 : int_interval;
-
-        /* allocate int endpoints */
-        ss->int_in_ep = usb_ep_autoconfig(cdev->gadget, &fs_int_source_desc);
-        if (!ss->int_in_ep)
-                goto no_int;
-        ss->int_in_ep->driver_data = cdev;      /* claim */
-
-        ss->int_out_ep = usb_ep_autoconfig(cdev->gadget, &fs_int_sink_desc);
-        if (ss->int_out_ep) {
-                ss->int_out_ep->driver_data = cdev;     /* claim */
-        } else {
-                ss->int_in_ep->driver_data = NULL;
-                ss->int_in_ep = NULL;
-no_int:
-                fs_source_sink_descs[FS_ALT_IFC_2_OFFSET] = NULL;
-                hs_source_sink_descs[HS_ALT_IFC_2_OFFSET] = NULL;
-                ss_source_sink_descs[SS_ALT_IFC_2_OFFSET] = NULL;
-        }
-
-        if (int_maxpacket > 1024)
-                int_maxpacket = 1024;
-
         /* support high speed hardware */
         hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
         hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
 
         /*
-         * Fill in the HS isoc and interrupt descriptors from the module
-         * parameters. We assume that the user knows what they are doing and
-         * won't give parameters that their UDC doesn't support.
+         * Fill in the HS isoc descriptors from the module parameters.
+         * We assume that the user knows what they are doing and won't
+         * give parameters that their UDC doesn't support.
          */
         hs_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
         hs_iso_source_desc.wMaxPacketSize |= isoc_mult << 11;
@@ -607,17 +432,6 @@ no_int:
         hs_iso_sink_desc.bInterval = isoc_interval;
         hs_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
 
-        hs_int_source_desc.wMaxPacketSize = int_maxpacket;
-        hs_int_source_desc.wMaxPacketSize |= int_mult << 11;
-        hs_int_source_desc.bInterval = USB_MS_TO_HS_INTERVAL(int_interval);
-        hs_int_source_desc.bEndpointAddress =
-                fs_int_source_desc.bEndpointAddress;
-
-        hs_int_sink_desc.wMaxPacketSize = int_maxpacket;
-        hs_int_sink_desc.wMaxPacketSize |= int_mult << 11;
-        hs_int_sink_desc.bInterval = USB_MS_TO_HS_INTERVAL(int_interval);
-        hs_int_sink_desc.bEndpointAddress = fs_int_sink_desc.bEndpointAddress;
-
         /* support super speed hardware */
         ss_source_desc.bEndpointAddress =
                 fs_source_desc.bEndpointAddress;
@@ -625,9 +439,9 @@ no_int:
                 fs_sink_desc.bEndpointAddress;
 
         /*
-         * Fill in the SS isoc and interrupt descriptors from the module
-         * parameters. We assume that the user knows what they are doing and
-         * won't give parameters that their UDC doesn't support.
+         * Fill in the SS isoc descriptors from the module parameters.
+         * We assume that the user knows what they are doing and won't
+         * give parameters that their UDC doesn't support.
          */
         ss_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
         ss_iso_source_desc.bInterval = isoc_interval;
@@ -646,37 +460,17 @@ no_int:
                 isoc_maxpacket * (isoc_mult + 1) * (isoc_maxburst + 1);
         ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
 
-        ss_int_source_desc.wMaxPacketSize = int_maxpacket;
-        ss_int_source_desc.bInterval = USB_MS_TO_SS_INTERVAL(int_interval);
-        ss_int_source_comp_desc.bmAttributes = int_mult;
-        ss_int_source_comp_desc.bMaxBurst = int_maxburst;
-        ss_int_source_comp_desc.wBytesPerInterval =
-                int_maxpacket * (int_mult + 1) * (int_maxburst + 1);
-        ss_int_source_desc.bEndpointAddress =
-                fs_int_source_desc.bEndpointAddress;
-
-        ss_int_sink_desc.wMaxPacketSize = int_maxpacket;
-        ss_int_sink_desc.bInterval = USB_MS_TO_SS_INTERVAL(int_interval);
-        ss_int_sink_comp_desc.bmAttributes = int_mult;
-        ss_int_sink_comp_desc.bMaxBurst = int_maxburst;
-        ss_int_sink_comp_desc.wBytesPerInterval =
-                int_maxpacket * (int_mult + 1) * (int_maxburst + 1);
-        ss_int_sink_desc.bEndpointAddress = fs_int_sink_desc.bEndpointAddress;
-
         ret = usb_assign_descriptors(f, fs_source_sink_descs,
                         hs_source_sink_descs, ss_source_sink_descs);
         if (ret)
                 return ret;
 
-        DBG(cdev, "%s speed %s: IN/%s, OUT/%s, ISO-IN/%s, ISO-OUT/%s, "
-                        "INT-IN/%s, INT-OUT/%s\n",
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s, ISO-IN/%s, ISO-OUT/%s\n",
             (gadget_is_superspeed(c->cdev->gadget) ? "super" :
              (gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full")),
                         f->name, ss->in_ep->name, ss->out_ep->name,
                         ss->iso_in_ep ? ss->iso_in_ep->name : "<none>",
-                        ss->iso_out_ep ? ss->iso_out_ep->name : "<none>",
-                        ss->int_in_ep ? ss->int_in_ep->name : "<none>",
-                        ss->int_out_ep ? ss->int_out_ep->name : "<none>");
+                        ss->iso_out_ep ? ss->iso_out_ep->name : "<none>");
         return 0;
 }
 
@@ -807,15 +601,14 @@ static void source_sink_complete(struct usb_ep *ep, struct usb_request *req)
 }
 
 static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
-                enum eptype ep_type, int speed)
+                bool is_iso, int speed)
 {
         struct usb_ep           *ep;
         struct usb_request      *req;
         int                     i, size, status;
 
         for (i = 0; i < 8; i++) {
-                switch (ep_type) {
-                case EP_ISOC:
+                if (is_iso) {
                         switch (speed) {
                         case USB_SPEED_SUPER:
                                 size = isoc_maxpacket * (isoc_mult + 1) *
@@ -831,28 +624,9 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
                         }
                         ep = is_in ? ss->iso_in_ep : ss->iso_out_ep;
                         req = ss_alloc_ep_req(ep, size);
-                        break;
-                case EP_INTERRUPT:
-                        switch (speed) {
-                        case USB_SPEED_SUPER:
-                                size = int_maxpacket * (int_mult + 1) *
-                                                (int_maxburst + 1);
-                                break;
-                        case USB_SPEED_HIGH:
-                                size = int_maxpacket * (int_mult + 1);
-                                break;
-                        default:
-                                size = int_maxpacket > 1023 ?
-                                                1023 : int_maxpacket;
-                                break;
-                        }
-                        ep = is_in ? ss->int_in_ep : ss->int_out_ep;
-                        req = ss_alloc_ep_req(ep, size);
-                        break;
-                default:
+                } else {
                         ep = is_in ? ss->in_ep : ss->out_ep;
                         req = ss_alloc_ep_req(ep, 0);
-                        break;
                 }
 
                 if (!req)
@@ -870,12 +644,12 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
 
                         cdev = ss->function.config->cdev;
                         ERROR(cdev, "start %s%s %s --> %d\n",
-                                get_ep_string(ep_type), is_in ? "IN" : "OUT",
-                                ep->name, status);
+                              is_iso ? "ISO-" : "", is_in ? "IN" : "OUT",
+                              ep->name, status);
                         free_ep_req(ep, req);
                 }
 
-                if (!(ep_type == EP_ISOC))
+                if (!is_iso)
                         break;
         }
 
@@ -888,7 +662,7 @@ static void disable_source_sink(struct f_sourcesink *ss)
 
         cdev = ss->function.config->cdev;
         disable_endpoints(cdev, ss->in_ep, ss->out_ep, ss->iso_in_ep,
-                        ss->iso_out_ep, ss->int_in_ep, ss->int_out_ep);
+                        ss->iso_out_ep);
         VDBG(cdev, "%s disabled\n", ss->function.name);
 }
 
@@ -900,62 +674,6 @@ enable_source_sink(struct usb_composite_dev *cdev, struct f_sourcesink *ss,
         int                                     speed = cdev->gadget->speed;
         struct usb_ep                           *ep;
 
-        if (alt == 2) {
-                /* Configure for periodic interrupt endpoint */
-                ep = ss->int_in_ep;
-                if (ep) {
-                        result = config_ep_by_speed(cdev->gadget,
-                                        &(ss->function), ep);
-                        if (result)
-                                return result;
-
-                        result = usb_ep_enable(ep);
-                        if (result < 0)
-                                return result;
-
-                        ep->driver_data = ss;
-                        result = source_sink_start_ep(ss, true, EP_INTERRUPT,
-                                        speed);
-                        if (result < 0) {
-fail1:
-                                ep = ss->int_in_ep;
-                                if (ep) {
-                                        usb_ep_disable(ep);
-                                        ep->driver_data = NULL;
-                                }
-                                return result;
-                        }
-                }
-
-                /*
-                 * one interrupt endpoint reads (sinks) anything OUT (from the
-                 * host)
-                 */
-                ep = ss->int_out_ep;
-                if (ep) {
-                        result = config_ep_by_speed(cdev->gadget,
-                                        &(ss->function), ep);
-                        if (result)
-                                goto fail1;
-
-                        result = usb_ep_enable(ep);
-                        if (result < 0)
-                                goto fail1;
-
-                        ep->driver_data = ss;
-                        result = source_sink_start_ep(ss, false, EP_INTERRUPT,
-                                        speed);
-                        if (result < 0) {
-                                ep = ss->int_out_ep;
-                                usb_ep_disable(ep);
-                                ep->driver_data = NULL;
-                                goto fail1;
-                        }
-                }
-
-                goto out;
-        }
-
         /* one bulk endpoint writes (sources) zeroes IN (to the host) */
         ep = ss->in_ep;
         result = config_ep_by_speed(cdev->gadget, &(ss->function), ep);
@@ -966,7 +684,7 @@ fail1:
                 return result;
         ep->driver_data = ss;
 
-        result = source_sink_start_ep(ss, true, EP_BULK, speed);
+        result = source_sink_start_ep(ss, true, false, speed);
         if (result < 0) {
 fail:
                 ep = ss->in_ep;
@@ -985,7 +703,7 @@ fail:
                 goto fail;
         ep->driver_data = ss;
 
-        result = source_sink_start_ep(ss, false, EP_BULK, speed);
+        result = source_sink_start_ep(ss, false, false, speed);
         if (result < 0) {
 fail2:
                 ep = ss->out_ep;
@@ -1008,7 +726,7 @@ fail2:
                         goto fail2;
                 ep->driver_data = ss;
 
-                result = source_sink_start_ep(ss, true, EP_ISOC, speed);
+                result = source_sink_start_ep(ss, true, true, speed);
                 if (result < 0) {
 fail3:
                         ep = ss->iso_in_ep;
@@ -1031,14 +749,13 @@ fail3:
                         goto fail3;
                 ep->driver_data = ss;
 
-                result = source_sink_start_ep(ss, false, EP_ISOC, speed);
+                result = source_sink_start_ep(ss, false, true, speed);
                 if (result < 0) {
                         usb_ep_disable(ep);
                         ep->driver_data = NULL;
                         goto fail3;
                 }
         }
-
 out:
         ss->cur_alt = alt;
 
@@ -1054,8 +771,6 @@ static int sourcesink_set_alt(struct usb_function *f,
 
         if (ss->in_ep->driver_data)
                 disable_source_sink(ss);
-        else if (alt == 2 && ss->int_in_ep->driver_data)
-                disable_source_sink(ss);
         return enable_source_sink(cdev, ss, alt);
 }
 
@@ -1168,10 +883,6 @@ static struct usb_function *source_sink_alloc_func(
         isoc_maxpacket = ss_opts->isoc_maxpacket;
         isoc_mult = ss_opts->isoc_mult;
         isoc_maxburst = ss_opts->isoc_maxburst;
-        int_interval = ss_opts->int_interval;
-        int_maxpacket = ss_opts->int_maxpacket;
-        int_mult = ss_opts->int_mult;
-        int_maxburst = ss_opts->int_maxburst;
         buflen = ss_opts->bulk_buflen;
 
         ss->function.name = "source/sink";
@@ -1468,182 +1179,6 @@ static struct f_ss_opts_attribute f_ss_opts_bulk_buflen =
                         f_ss_opts_bulk_buflen_show,
                         f_ss_opts_bulk_buflen_store);
 
-static ssize_t f_ss_opts_int_interval_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_interval);
-        mutex_unlock(&opts->lock);
-
-        return result;
-}
-
-static ssize_t f_ss_opts_int_interval_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u32 num;
-
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-
-        ret = kstrtou32(page, 0, &num);
-        if (ret)
-                goto end;
-
-        if (num > 4096) {
-                ret = -EINVAL;
-                goto end;
-        }
-
-        opts->int_interval = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-
-static struct f_ss_opts_attribute f_ss_opts_int_interval =
-        __CONFIGFS_ATTR(int_interval, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_interval_show,
-                        f_ss_opts_int_interval_store);
-
-static ssize_t f_ss_opts_int_maxpacket_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_maxpacket);
-        mutex_unlock(&opts->lock);
-
-        return result;
-}
-
-static ssize_t f_ss_opts_int_maxpacket_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u16 num;
-
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-
-        ret = kstrtou16(page, 0, &num);
-        if (ret)
-                goto end;
-
-        if (num > 1024) {
-                ret = -EINVAL;
-                goto end;
-        }
-
-        opts->int_maxpacket = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-
-static struct f_ss_opts_attribute f_ss_opts_int_maxpacket =
-        __CONFIGFS_ATTR(int_maxpacket, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_maxpacket_show,
-                        f_ss_opts_int_maxpacket_store);
-
-static ssize_t f_ss_opts_int_mult_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_mult);
-        mutex_unlock(&opts->lock);
-
-        return result;
-}
-
-static ssize_t f_ss_opts_int_mult_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u8 num;
-
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-
-        ret = kstrtou8(page, 0, &num);
-        if (ret)
-                goto end;
-
-        if (num > 2) {
-                ret = -EINVAL;
-                goto end;
-        }
-
-        opts->int_mult = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-
-static struct f_ss_opts_attribute f_ss_opts_int_mult =
-        __CONFIGFS_ATTR(int_mult, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_mult_show,
-                        f_ss_opts_int_mult_store);
-
-static ssize_t f_ss_opts_int_maxburst_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_maxburst);
-        mutex_unlock(&opts->lock);
-
-        return result;
-}
-
-static ssize_t f_ss_opts_int_maxburst_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u8 num;
-
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-
-        ret = kstrtou8(page, 0, &num);
-        if (ret)
-                goto end;
-
-        if (num > 15) {
-                ret = -EINVAL;
-                goto end;
-        }
-
-        opts->int_maxburst = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-
-static struct f_ss_opts_attribute f_ss_opts_int_maxburst =
-        __CONFIGFS_ATTR(int_maxburst, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_maxburst_show,
-                        f_ss_opts_int_maxburst_store);
-
 static struct configfs_attribute *ss_attrs[] = {
         &f_ss_opts_pattern.attr,
         &f_ss_opts_isoc_interval.attr,
@@ -1651,10 +1186,6 @@ static struct configfs_attribute *ss_attrs[] = {
         &f_ss_opts_isoc_mult.attr,
         &f_ss_opts_isoc_maxburst.attr,
         &f_ss_opts_bulk_buflen.attr,
-        &f_ss_opts_int_interval.attr,
-        &f_ss_opts_int_maxpacket.attr,
-        &f_ss_opts_int_mult.attr,
-        &f_ss_opts_int_maxburst.attr,
         NULL,
 };
 
@@ -1684,8 +1215,6 @@ static struct usb_function_instance *source_sink_alloc_inst(void)
         ss_opts->isoc_interval = GZERO_ISOC_INTERVAL;
         ss_opts->isoc_maxpacket = GZERO_ISOC_MAXPACKET;
         ss_opts->bulk_buflen = GZERO_BULK_BUFLEN;
-        ss_opts->int_interval = GZERO_INT_INTERVAL;
-        ss_opts->int_maxpacket = GZERO_INT_MAXPACKET;
 
         config_group_init_type_name(&ss_opts->func_inst.group, "",
                                     &ss_func_type);
diff --git a/drivers/usb/gadget/function/g_zero.h b/drivers/usb/gadget/function/g_zero.h
index 2ce28b9d97cc..15f180904f8a 100644
--- a/drivers/usb/gadget/function/g_zero.h
+++ b/drivers/usb/gadget/function/g_zero.h
@@ -10,8 +10,6 @@
 #define GZERO_QLEN              32
 #define GZERO_ISOC_INTERVAL     4
 #define GZERO_ISOC_MAXPACKET    1024
-#define GZERO_INT_INTERVAL      1 /* Default interrupt interval = 1 ms */
-#define GZERO_INT_MAXPACKET     1024
 
 struct usb_zero_options {
         unsigned pattern;
@@ -19,10 +17,6 @@ struct usb_zero_options {
         unsigned isoc_maxpacket;
         unsigned isoc_mult;
         unsigned isoc_maxburst;
-        unsigned int_interval; /* In ms */
-        unsigned int_maxpacket;
-        unsigned int_mult;
-        unsigned int_maxburst;
         unsigned bulk_buflen;
         unsigned qlen;
 };
@@ -34,10 +28,6 @@ struct f_ss_opts {
         unsigned isoc_maxpacket;
         unsigned isoc_mult;
         unsigned isoc_maxburst;
-        unsigned int_interval; /* In ms */
-        unsigned int_maxpacket;
-        unsigned int_mult;
-        unsigned int_maxburst;
         unsigned bulk_buflen;
 
         /*
@@ -72,7 +62,6 @@ int lb_modinit(void);
 void free_ep_req(struct usb_ep *ep, struct usb_request *req);
 void disable_endpoints(struct usb_composite_dev *cdev,
                 struct usb_ep *in, struct usb_ep *out,
-                struct usb_ep *iso_in, struct usb_ep *iso_out,
-                struct usb_ep *int_in, struct usb_ep *int_out);
+                struct usb_ep *iso_in, struct usb_ep *iso_out);
 
 #endif /* __G_ZERO_H */
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index db49ec4c748e..200f9a584064 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -74,6 +74,8 @@ MODULE_DESCRIPTION (DRIVER_DESC);
 MODULE_AUTHOR ("David Brownell");
 MODULE_LICENSE ("GPL");
 
+static int ep_open(struct inode *, struct file *);
+
 
 /*----------------------------------------------------------------------*/
 
@@ -283,14 +285,15 @@ static void epio_complete (struct usb_ep *ep, struct usb_request *req)
  * still need dev->lock to use epdata->ep.
  */
 static int
-get_ready_ep (unsigned f_flags, struct ep_data *epdata)
+get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write)
 {
         int     val;
 
         if (f_flags & O_NONBLOCK) {
                 if (!mutex_trylock(&epdata->lock))
                         goto nonblock;
-                if (epdata->state != STATE_EP_ENABLED) {
+                if (epdata->state != STATE_EP_ENABLED &&
+                    (!is_write || epdata->state != STATE_EP_READY)) {
                         mutex_unlock(&epdata->lock);
 nonblock:
                         val = -EAGAIN;
@@ -305,18 +308,20 @@ nonblock:
 
         switch (epdata->state) {
         case STATE_EP_ENABLED:
+                return 0;
+        case STATE_EP_READY:                    /* not configured yet */
+                if (is_write)
+                        return 0;
+                // FALLTHRU
+        case STATE_EP_UNBOUND:                  /* clean disconnect */
                 break;
         // case STATE_EP_DISABLED:              /* "can't happen" */
-        // case STATE_EP_READY:                 /* "can't happen" */
         default:                                /* error! */
                 pr_debug ("%s: ep %p not available, state %d\n",
                                 shortname, epdata, epdata->state);
-                // FALLTHROUGH
-        case STATE_EP_UNBOUND:                  /* clean disconnect */
-                val = -ENODEV;
-                mutex_unlock(&epdata->lock);
         }
-        return val;
+        mutex_unlock(&epdata->lock);
+        return -ENODEV;
 }
 
 static ssize_t
@@ -363,97 +368,6 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
         return value;
 }
 
-
-/* handle a synchronous OUT bulk/intr/iso transfer */
-static ssize_t
-ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-
-        /* FIXME readahead for O_NONBLOCK and poll(); careful with ZLPs */
-
-        value = -ENOMEM;
-        kbuf = kmalloc (len, GFP_KERNEL);
-        if (unlikely (!kbuf))
-                goto free1;
-
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s read %zu OUT, status %d\n",
-                data->name, len, (int) value);
-        if (value >= 0 && copy_to_user (buf, kbuf, value))
-                value = -EFAULT;
-
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-
-/* handle a synchronous IN bulk/intr/iso transfer */
-static ssize_t
-ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (!usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-
-        /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
-
-        value = -ENOMEM;
-        kbuf = memdup_user(buf, len);
-        if (IS_ERR(kbuf)) {
-                value = PTR_ERR(kbuf);
-                kbuf = NULL;
-                goto free1;
-        }
-
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s write %zu IN, status %d\n",
-                data->name, len, (int) value);
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-
 static int
 ep_release (struct inode *inode, struct file *fd)
 {
@@ -481,7 +395,7 @@ static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
         struct ep_data          *data = fd->private_data;
         int                     status;
 
-        if ((status = get_ready_ep (fd->f_flags, data)) < 0)
+        if ((status = get_ready_ep (fd->f_flags, data, false)) < 0)
                 return status;
 
         spin_lock_irq (&data->dev->lock);
@@ -517,8 +431,8 @@ struct kiocb_priv {
         struct mm_struct        *mm;
         struct work_struct      work;
         void                    *buf;
-        const struct iovec      *iv;
-        unsigned long           nr_segs;
+        struct iov_iter         to;
+        const void              *to_free;
         unsigned                actual;
 };
 
@@ -541,35 +455,6 @@ static int ep_aio_cancel(struct kiocb *iocb)
         return value;
 }
 
-static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
-{
-        ssize_t                 len, total;
-        void                    *to_copy;
-        int                     i;
-
-        /* copy stuff into user buffers */
-        total = priv->actual;
-        len = 0;
-        to_copy = priv->buf;
-        for (i=0; i < priv->nr_segs; i++) {
-                ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);
-
-                if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
-                        if (len == 0)
-                                len = -EFAULT;
-                        break;
-                }
-
-                total -= this;
-                len += this;
-                to_copy += this;
-                if (total == 0)
-                        break;
-        }
-
-        return len;
-}
-
 static void ep_user_copy_worker(struct work_struct *work)
 {
         struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
@@ -578,13 +463,16 @@ static void ep_user_copy_worker(struct work_struct *work)
         size_t ret;
 
         use_mm(mm);
-        ret = ep_copy_to_user(priv);
+        ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
         unuse_mm(mm);
+        if (!ret)
+                ret = -EFAULT;
 
         /* completing the iocb can drop the ctx and mm, don't touch mm after */
         aio_complete(iocb, ret, ret);
 
         kfree(priv->buf);
+        kfree(priv->to_free);
         kfree(priv);
 }
 
@@ -603,8 +491,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
          * don't need to copy anything to userspace, so we can
          * complete the aio request immediately.
          */
-        if (priv->iv == NULL || unlikely(req->actual == 0)) {
+        if (priv->to_free == NULL || unlikely(req->actual == 0)) {
                 kfree(req->buf);
+                kfree(priv->to_free);
                 kfree(priv);
                 iocb->private = NULL;
                 /* aio_complete() reports bytes-transferred _and_ faults */
@@ -618,6 +507,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
 
                 priv->buf = req->buf;
                 priv->actual = req->actual;
+                INIT_WORK(&priv->work, ep_user_copy_worker);
                 schedule_work(&priv->work);
         }
         spin_unlock(&epdata->dev->lock);
@@ -626,38 +516,17 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
         put_ep(epdata);
 }
 
-static ssize_t
-ep_aio_rwtail(
-        struct kiocb    *iocb,
-        char            *buf,
-        size_t          len,
-        struct ep_data  *epdata,
-        const struct iovec *iv,
-        unsigned long   nr_segs
-)
+static ssize_t ep_aio(struct kiocb *iocb,
+                      struct kiocb_priv *priv,
+                      struct ep_data *epdata,
+                      char *buf,
+                      size_t len)
 {
-        struct kiocb_priv       *priv;
-        struct usb_request      *req;
-        ssize_t                 value;
+        struct usb_request *req;
+        ssize_t value;
 
-        priv = kmalloc(sizeof *priv, GFP_KERNEL);
-        if (!priv) {
-                value = -ENOMEM;
-fail:
-                kfree(buf);
-                return value;
-        }
         iocb->private = priv;
         priv->iocb = iocb;
-        priv->iv = iv;
-        priv->nr_segs = nr_segs;
-        INIT_WORK(&priv->work, ep_user_copy_worker);
-
-        value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
-        if (unlikely(value < 0)) {
-                kfree(priv);
-                goto fail;
-        }
 
         kiocb_set_cancel_fn(iocb, ep_aio_cancel);
         get_ep(epdata);
@@ -669,75 +538,154 @@ fail:
          * allocate or submit those if the host disconnected.
          */
         spin_lock_irq(&epdata->dev->lock);
-        if (likely(epdata->ep)) {
-                req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
-                if (likely(req)) {
-                        priv->req = req;
-                        req->buf = buf;
-                        req->length = len;
-                        req->complete = ep_aio_complete;
-                        req->context = iocb;
-                        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
-                        if (unlikely(0 != value))
-                                usb_ep_free_request(epdata->ep, req);
-                } else
-                        value = -EAGAIN;
-        } else
-                value = -ENODEV;
-        spin_unlock_irq(&epdata->dev->lock);
+        value = -ENODEV;
+        if (unlikely(epdata->ep))
+                goto fail;
 
-        mutex_unlock(&epdata->lock);
+        req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
+        value = -ENOMEM;
+        if (unlikely(!req))
+                goto fail;
 
-        if (unlikely(value)) {
-                kfree(priv);
-                put_ep(epdata);
-        } else
-                value = -EIOCBQUEUED;
+        priv->req = req;
+        req->buf = buf;
+        req->length = len;
+        req->complete = ep_aio_complete;
+        req->context = iocb;
+        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
+        if (unlikely(0 != value)) {
+                usb_ep_free_request(epdata->ep, req);
+                goto fail;
+        }
+        spin_unlock_irq(&epdata->dev->lock);
+        return -EIOCBQUEUED;
+
+fail:
+        spin_unlock_irq(&epdata->dev->lock);
+        kfree(priv->to_free);
+        kfree(priv);
+        put_ep(epdata);
         return value;
 }
 
 static ssize_t
-ep_aio_read(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long nr_segs, loff_t o)
+ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
-        char                    *buf;
+        struct file *file = iocb->ki_filp;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(to);
+        ssize_t value;
+        char *buf;
 
-        if (unlikely(usb_endpoint_dir_in(&epdata->desc)))
-                return -EINVAL;
+        if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0)
+                return value;
 
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
-        if (unlikely(!buf))
-                return -ENOMEM;
+        /* halt any endpoint by doing a "wrong direction" i/o call */
+        if (usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
 
-        return ep_aio_rwtail(iocb, buf, iocb->ki_nbytes, epdata, iov, nr_segs);
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
+                return -ENOMEM;
+        }
+        if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+                if (value >= 0 && copy_to_iter(buf, value, to))
+                        value = -EFAULT;
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (!priv)
+                        goto fail;
+                priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL);
+                if (!priv->to_free) {
+                        kfree(priv);
+                        goto fail;
+                }
+                value = ep_aio(iocb, priv, epdata, buf, len);
+                if (value == -EIOCBQUEUED)
+                        buf = NULL;
+        }
+fail:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 
+static ssize_t ep_config(struct ep_data *, const char *, size_t);
+
 static ssize_t
-ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long nr_segs, loff_t o)
+ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
-        char                    *buf;
-        size_t                  len = 0;
-        int                     i = 0;
+        struct file *file = iocb->ki_filp;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(from);
+        bool configured;
+        ssize_t value;
+        char *buf;
+
+        if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0)
+                return value;
 
-        if (unlikely(!usb_endpoint_dir_in(&epdata->desc)))
-                return -EINVAL;
+        configured = epdata->state == STATE_EP_ENABLED;
 
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
-        if (unlikely(!buf))
+        /* halt any endpoint by doing a "wrong direction" i/o call */
+        if (configured && !usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
+
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
                 return -ENOMEM;
+        }
 
-        for (i=0; i < nr_segs; i++) {
-                if (unlikely(copy_from_user(&buf[len], iov[i].iov_base,
-                                iov[i].iov_len) != 0)) {
-                        kfree(buf);
-                        return -EFAULT;
+        if (unlikely(copy_from_iter(buf, len, from) != len)) {
+                value = -EFAULT;
+                goto out;
+        }
+
+        if (unlikely(!configured)) {
+                value = ep_config(epdata, buf, len);
+        } else if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (priv) {
+                        value = ep_aio(iocb, priv, epdata, buf, len);
+                        if (value == -EIOCBQUEUED)
+                                buf = NULL;
                 }
-                len += iov[i].iov_len;
         }
-        return ep_aio_rwtail(iocb, buf, len, epdata, NULL, 0);
+out:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 
 /*----------------------------------------------------------------------*/
@@ -745,15 +693,15 @@ ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
 /* used after endpoint configuration */
 static const struct file_operations ep_io_operations = {
         .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
 
-        .read =         ep_read,
-        .write =        ep_write,
-        .unlocked_ioctl = ep_ioctl,
+        .open =         ep_open,
         .release =      ep_release,
-
-        .aio_read =     ep_aio_read,
-        .aio_write =    ep_aio_write,
+        .llseek =       no_llseek,
+        .read =         new_sync_read,
+        .write =        new_sync_write,
+        .unlocked_ioctl = ep_ioctl,
+        .read_iter =    ep_read_iter,
+        .write_iter =   ep_write_iter,
 };
 
 /* ENDPOINT INITIALIZATION
@@ -770,17 +718,12 @@ static const struct file_operations ep_io_operations = {
  * speed descriptor, then optional high speed descriptor.
  */
 static ssize_t
-ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ep_config (struct ep_data *data, const char *buf, size_t len)
 {
-        struct ep_data          *data = fd->private_data;
         struct usb_ep           *ep;
         u32                     tag;
         int                     value, length = len;
 
-        value = mutex_lock_interruptible(&data->lock);
-        if (value < 0)
-                return value;
-
         if (data->state != STATE_EP_READY) {
                 value = -EL2HLT;
                 goto fail;
@@ -791,9 +734,7 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 goto fail0;
 
         /* we might need to change message format someday */
-        if (copy_from_user (&tag, buf, 4)) {
-                goto fail1;
-        }
+        memcpy(&tag, buf, 4);
         if (tag != 1) {
                 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
                 goto fail0;
@@ -806,19 +747,15 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
          */
 
         /* full/low speed descriptor, then high speed */
-        if (copy_from_user (&data->desc, buf, USB_DT_ENDPOINT_SIZE)) {
-                goto fail1;
-        }
+        memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE);
         if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
                         || data->desc.bDescriptorType != USB_DT_ENDPOINT)
                 goto fail0;
         if (len != USB_DT_ENDPOINT_SIZE) {
                 if (len != 2 * USB_DT_ENDPOINT_SIZE)
                         goto fail0;
-                if (copy_from_user (&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
-                                        USB_DT_ENDPOINT_SIZE)) {
-                        goto fail1;
-                }
+                memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
+                        USB_DT_ENDPOINT_SIZE);
                 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
                                 || data->hs_desc.bDescriptorType
                                         != USB_DT_ENDPOINT) {
@@ -840,24 +777,20 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         case USB_SPEED_LOW:
         case USB_SPEED_FULL:
                 ep->desc = &data->desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                 break;
         case USB_SPEED_HIGH:
                 /* fails if caller didn't provide that descriptor... */
                 ep->desc = &data->hs_desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                 break;
         default:
                 DBG(data->dev, "unconnected, %s init abandoned\n",
                                 data->name);
                 value = -EINVAL;
+                goto gone;
         }
+        value = usb_ep_enable(ep);
         if (value == 0) {
-                fd->f_op = &ep_io_operations;
+                data->state = STATE_EP_ENABLED;
                 value = length;
         }
 gone:
@@ -867,14 +800,10 @@ fail:
                 data->desc.bDescriptorType = 0;
                 data->hs_desc.bDescriptorType = 0;
         }
-        mutex_unlock(&data->lock);
         return value;
 fail0:
         value = -EINVAL;
         goto fail;
-fail1:
-        value = -EFAULT;
-        goto fail;
 }
 
 static int
@@ -902,15 +831,6 @@ ep_open (struct inode *inode, struct file *fd)
         return value;
 }
 
-/* used before endpoint configuration */
-static const struct file_operations ep_config_operations = {
-        .llseek =       no_llseek,
-
-        .open =         ep_open,
-        .write =        ep_config,
-        .release =      ep_release,
-};
-
 /*----------------------------------------------------------------------*/
 
 /* EP0 IMPLEMENTATION can be partly in userspace.
@@ -989,6 +909,10 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
         enum ep0_state                  state;
 
         spin_lock_irq (&dev->lock);
+        if (dev->state <= STATE_DEV_OPENED) {
+                retval = -EINVAL;
+                goto done;
+        }
 
         /* report fd mode change before acting on it */
         if (dev->setup_abort) {
@@ -1187,8 +1111,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         struct dev_data         *dev = fd->private_data;
         ssize_t                 retval = -ESRCH;
 
-        spin_lock_irq (&dev->lock);
-
         /* report fd mode change before acting on it */
         if (dev->setup_abort) {
                 dev->setup_abort = 0;
@@ -1234,7 +1156,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         } else
                 DBG (dev, "fail %s, state %d\n", __func__, dev->state);
 
-        spin_unlock_irq (&dev->lock);
         return retval;
 }
 
@@ -1281,6 +1202,9 @@ ep0_poll (struct file *fd, poll_table *wait)
        struct dev_data         *dev = fd->private_data;
        int                     mask = 0;
 
+        if (dev->state <= STATE_DEV_OPENED)
+                return DEFAULT_POLLMASK;
+
        poll_wait(fd, &dev->wait, wait);
 
        spin_lock_irq (&dev->lock);
@@ -1316,19 +1240,6 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
         return ret;
 }
 
-/* used after device configuration */
-static const struct file_operations ep0_io_operations = {
-        .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
-
-        .read =         ep0_read,
-        .write =        ep0_write,
-        .fasync =       ep0_fasync,
-        .poll =         ep0_poll,
-        .unlocked_ioctl =       dev_ioctl,
-        .release =      dev_release,
-};
-
 /*----------------------------------------------------------------------*/
 
 /* The in-kernel gadget driver handles most ep0 issues, in particular
@@ -1650,7 +1561,7 @@ static int activate_ep_files (struct dev_data *dev)
                         goto enomem1;
 
                 data->dentry = gadgetfs_create_file (dev->sb, data->name,
-                                data, &ep_config_operations);
+                                data, &ep_io_operations);
                 if (!data->dentry)
                         goto enomem2;
                 list_add_tail (&data->epfiles, &dev->epfiles);
@@ -1852,6 +1763,14 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         u32                     tag;
         char                    *kbuf;
 
+        spin_lock_irq(&dev->lock);
+        if (dev->state > STATE_DEV_OPENED) {
+                value = ep0_write(fd, buf, len, ptr);
+                spin_unlock_irq(&dev->lock);
+                return value;
+        }
+        spin_unlock_irq(&dev->lock);
+
         if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
                 return -EINVAL;
 
@@ -1925,7 +1844,6 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                  * on, they can work ... except in cleanup paths that
                  * kick in after the ep0 descriptor is closed.
                  */
-                fd->f_op = &ep0_io_operations;
                 value = len;
         }
         return value;
@@ -1956,12 +1874,14 @@ dev_open (struct inode *inode, struct file *fd)
         return value;
 }
 
-static const struct file_operations dev_init_operations = {
+static const struct file_operations ep0_operations = {
         .llseek =       no_llseek,
 
         .open =         dev_open,
+        .read =         ep0_read,
         .write =        dev_config,
         .fasync =       ep0_fasync,
+        .poll =         ep0_poll,
         .unlocked_ioctl = dev_ioctl,
         .release =      dev_release,
 };
@@ -2077,7 +1997,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                 goto Enomem;
 
         dev->sb = sb;
-        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &dev_init_operations);
+        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
         if (!dev->dentry) {
                 put_dev(dev);
                 goto Enomem;
diff --git a/drivers/usb/gadget/legacy/tcm_usb_gadget.c b/drivers/usb/gadget/legacy/tcm_usb_gadget.c
index 3a494168661e..6e0a019aad54 100644
--- a/drivers/usb/gadget/legacy/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/legacy/tcm_usb_gadget.c
@@ -1740,10 +1740,9 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
                 goto err_session;
         }
         /*
-         * Now register the TCM vHost virtual I_T Nexus as active with the
-         * call to __transport_register_session()
+         * Now register the TCM vHost virtual I_T Nexus as active.
          */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                         tv_nexus->tvn_se_sess, tv_nexus);
         tpg->tpg_nexus = tv_nexus;
         mutex_unlock(&tpg->tpg_mutex);
diff --git a/drivers/usb/gadget/legacy/zero.c b/drivers/usb/gadget/legacy/zero.c
index ff97ac93ac03..5ee95152493c 100644
--- a/drivers/usb/gadget/legacy/zero.c
+++ b/drivers/usb/gadget/legacy/zero.c
@@ -68,8 +68,6 @@ static struct usb_zero_options gzero_options = {
         .isoc_maxpacket = GZERO_ISOC_MAXPACKET,
         .bulk_buflen = GZERO_BULK_BUFLEN,
         .qlen = GZERO_QLEN,
-        .int_interval = GZERO_INT_INTERVAL,
-        .int_maxpacket = GZERO_INT_MAXPACKET,
 };
 
 /*-------------------------------------------------------------------------*/
@@ -268,21 +266,6 @@ module_param_named(isoc_maxburst, gzero_options.isoc_maxburst, uint,
                 S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(isoc_maxburst, "0 - 15 (ss only)");
 
-module_param_named(int_interval, gzero_options.int_interval, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_interval, "1 - 16");
-
-module_param_named(int_maxpacket, gzero_options.int_maxpacket, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_maxpacket, "0 - 1023 (fs), 0 - 1024 (hs/ss)");
-
-module_param_named(int_mult, gzero_options.int_mult, uint, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_mult, "0 - 2 (hs/ss only)");
-
-module_param_named(int_maxburst, gzero_options.int_maxburst, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_maxburst, "0 - 15 (ss only)");
-
 static struct usb_function *func_lb;
 static struct usb_function_instance *func_inst_lb;
 
@@ -318,10 +301,6 @@ static int __init zero_bind(struct usb_composite_dev *cdev)
         ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket;
         ss_opts->isoc_mult = gzero_options.isoc_mult;
         ss_opts->isoc_maxburst = gzero_options.isoc_maxburst;
-        ss_opts->int_interval = gzero_options.int_interval;
-        ss_opts->int_maxpacket = gzero_options.int_maxpacket;
-        ss_opts->int_mult = gzero_options.int_mult;
-        ss_opts->int_maxburst = gzero_options.int_maxburst;
         ss_opts->bulk_buflen = gzero_options.bulk_buflen;
 
         func_ss = usb_get_function(func_inst_ss);
diff --git a/drivers/usb/host/ehci-atmel.c b/drivers/usb/host/ehci-atmel.c
index 663f7908b15c..be0964a801e8 100644
--- a/drivers/usb/host/ehci-atmel.c
+++ b/drivers/usb/host/ehci-atmel.c
@@ -34,7 +34,6 @@ static const char hcd_name[] = "ehci-atmel";
 
 struct atmel_ehci_priv {
         struct clk *iclk;
-        struct clk *fclk;
         struct clk *uclk;
         bool clocked;
 };
@@ -51,12 +50,9 @@ static void atmel_start_clock(struct atmel_ehci_priv *atmel_ehci)
 {
         if (atmel_ehci->clocked)
                 return;
-        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
-                clk_set_rate(atmel_ehci->uclk, 48000000);
-                clk_prepare_enable(atmel_ehci->uclk);
-        }
+
+        clk_prepare_enable(atmel_ehci->uclk);
         clk_prepare_enable(atmel_ehci->iclk);
-        clk_prepare_enable(atmel_ehci->fclk);
         atmel_ehci->clocked = true;
 }
 
@@ -64,10 +60,9 @@ static void atmel_stop_clock(struct atmel_ehci_priv *atmel_ehci)
 {
         if (!atmel_ehci->clocked)
                 return;
-        clk_disable_unprepare(atmel_ehci->fclk);
+
         clk_disable_unprepare(atmel_ehci->iclk);
-        if (IS_ENABLED(CONFIG_COMMON_CLK))
-                clk_disable_unprepare(atmel_ehci->uclk);
+        clk_disable_unprepare(atmel_ehci->uclk);
         atmel_ehci->clocked = false;
 }
 
@@ -146,20 +141,13 @@ static int ehci_atmel_drv_probe(struct platform_device *pdev)
                 retval = -ENOENT;
                 goto fail_request_resource;
         }
-        atmel_ehci->fclk = devm_clk_get(&pdev->dev, "uhpck");
-        if (IS_ERR(atmel_ehci->fclk)) {
-                dev_err(&pdev->dev, "Error getting function clock\n");
-                retval = -ENOENT;
+
+        atmel_ehci->uclk = devm_clk_get(&pdev->dev, "usb_clk");
+        if (IS_ERR(atmel_ehci->uclk)) {
+                dev_err(&pdev->dev, "failed to get uclk\n");
+                retval = PTR_ERR(atmel_ehci->uclk);
                 goto fail_request_resource;
         }
-        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
-                atmel_ehci->uclk = devm_clk_get(&pdev->dev, "usb_clk");
-                if (IS_ERR(atmel_ehci->uclk)) {
-                        dev_err(&pdev->dev, "failed to get uclk\n");
-                        retval = PTR_ERR(atmel_ehci->uclk);
-                        goto fail_request_resource;
-                }
-        }
 
         ehci = hcd_to_ehci(hcd);
         /* registers start at offset 0x0 */
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index a7865c4b0498..0827d7c96527 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -387,6 +387,10 @@ static void xhci_clear_port_change_bit(struct xhci_hcd *xhci, u16 wValue,
                 status = PORT_PLC;
                 port_change_bit = "link state";
                 break;
+        case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
+                status = PORT_CEC;
+                port_change_bit = "config error";
+                break;
         default:
                 /* Should never happen */
                 return;
@@ -588,6 +592,8 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         status |= USB_PORT_STAT_C_LINK_STATE << 16;
                 if ((raw_port_status & PORT_WRC))
                         status |= USB_PORT_STAT_C_BH_RESET << 16;
+                if ((raw_port_status & PORT_CEC))
+                        status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
         }
 
         if (hcd->speed != HCD_USB3) {
@@ -1005,6 +1011,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 case USB_PORT_FEAT_C_OVER_CURRENT:
                 case USB_PORT_FEAT_C_ENABLE:
                 case USB_PORT_FEAT_C_PORT_LINK_STATE:
+                case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
                         xhci_clear_port_change_bit(xhci, wValue, wIndex,
                                         port_array[wIndex], temp);
                         break;
@@ -1069,7 +1076,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
          */
         status = bus_state->resuming_ports;
 
-        mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
+        mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
 
         spin_lock_irqsave(&xhci->lock, flags);
         /* For each port, did anything change?  If so, set that bit in buf. */
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index fd53c9ebd662..2af32e26fafc 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -115,6 +115,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
+                xhci->quirks |= XHCI_AVOID_BEI;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                         pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
@@ -130,7 +131,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  * PPT chipsets.
                  */
                 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
-                xhci->quirks |= XHCI_AVOID_BEI;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                 pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5fb66db89e05..73485fa4372f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1729,7 +1729,7 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
         if (!command)
                 return;
 
-        ep->ep_state |= EP_HALTED | EP_RECENTLY_HALTED;
+        ep->ep_state |= EP_HALTED;
         ep->stopped_stream = stream_id;
 
         xhci_queue_reset_ep(xhci, command, slot_id, ep_index);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b06d1a53652d..ec8ac1674854 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1338,12 +1338,6 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                 goto exit;
         }
 
-        /* Reject urb if endpoint is in soft reset, queue must stay empty */
-        if (xhci->devs[slot_id]->eps[ep_index].ep_state & EP_CONFIG_PENDING) {
-                xhci_warn(xhci, "Can't enqueue URB while ep is in soft reset\n");
-                ret = -EINVAL;
-        }
-
         if (usb_endpoint_xfer_isoc(&urb->ep->desc))
                 size = urb->number_of_packets;
         else
@@ -2954,36 +2948,23 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
         }
 }
 
-/* Called after clearing a halted device. USB core should have sent the control
+/* Called when clearing halted device. The core should have sent the control
  * message to clear the device halt condition. The host side of the halt should
- * already be cleared with a reset endpoint command issued immediately when the
- * STALL tx event was received.
+ * already be cleared with a reset endpoint command issued when the STALL tx
+ * event was received.
+ *
+ * Context: in_interrupt
  */
 
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                 struct usb_host_endpoint *ep)
 {
         struct xhci_hcd *xhci;
-        struct usb_device *udev;
-        struct xhci_virt_device *virt_dev;
-        struct xhci_virt_ep *virt_ep;
-        struct xhci_input_control_ctx *ctrl_ctx;
-        struct xhci_command *command;
-        unsigned int ep_index, ep_state;
-        unsigned long flags;
-        u32 ep_flag;
 
         xhci = hcd_to_xhci(hcd);
-        udev = (struct usb_device *) ep->hcpriv;
-        if (!ep->hcpriv)
-                return;
-        virt_dev = xhci->devs[udev->slot_id];
-        ep_index = xhci_get_endpoint_index(&ep->desc);
-        virt_ep = &virt_dev->eps[ep_index];
-        ep_state = virt_ep->ep_state;
 
         /*
-         * Implement the config ep command in xhci 4.6.8 additional note:
+         * We might need to implement the config ep cmd in xhci 4.8.1 note:
          * The Reset Endpoint Command may only be issued to endpoints in the
          * Halted state. If software wishes reset the Data Toggle or Sequence
          * Number of an endpoint that isn't in the Halted state, then software
@@ -2991,72 +2972,9 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
          * for the target endpoint. that is in the Stopped state.
          */
 
-        if (ep_state & SET_DEQ_PENDING || ep_state & EP_RECENTLY_HALTED) {
-                virt_ep->ep_state &= ~EP_RECENTLY_HALTED;
-                xhci_dbg(xhci, "ep recently halted, no toggle reset needed\n");
-                return;
-        }
-
-        /* Only interrupt and bulk ep's use Data toggle, USB2 spec 5.5.4-> */
-        if (usb_endpoint_xfer_control(&ep->desc) ||
-            usb_endpoint_xfer_isoc(&ep->desc))
-                return;
-
-        ep_flag = xhci_get_endpoint_flag(&ep->desc);
-
-        if (ep_flag == SLOT_FLAG || ep_flag == EP0_FLAG)
-                return;
-
-        command = xhci_alloc_command(xhci, true, true, GFP_NOWAIT);
-        if (!command) {
-                xhci_err(xhci, "Could not allocate xHCI command structure.\n");
-                return;
-        }
-
-        spin_lock_irqsave(&xhci->lock, flags);
-
-        /* block ringing ep doorbell */
-        virt_ep->ep_state |= EP_CONFIG_PENDING;
-
-        /*
-         * Make sure endpoint ring is empty before resetting the toggle/seq.
-         * Driver is required to synchronously cancel all transfer request.
-         *
-         * xhci 4.6.6 says we can issue a configure endpoint command on a
-         * running endpoint ring as long as it's idle (queue empty)
-         */
-
-        if (!list_empty(&virt_ep->ring->td_list)) {
-                dev_err(&udev->dev, "EP not empty, refuse reset\n");
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                goto cleanup;
-        }
-
-        xhci_dbg(xhci, "Reset toggle/seq for slot %d, ep_index: %d\n",
-                 udev->slot_id, ep_index);
-
-        ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
-        if (!ctrl_ctx) {
-                xhci_err(xhci, "Could not get input context, bad type. virt_dev: %p, in_ctx %p\n",
-                         virt_dev, virt_dev->in_ctx);
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                goto cleanup;
-        }
-        xhci_setup_input_ctx_for_config_ep(xhci, command->in_ctx,
-                                           virt_dev->out_ctx, ctrl_ctx,
-                                           ep_flag, ep_flag);
-        xhci_endpoint_copy(xhci, command->in_ctx, virt_dev->out_ctx, ep_index);
-
-        xhci_queue_configure_endpoint(xhci, command, command->in_ctx->dma,
-                                     udev->slot_id, false);
-        xhci_ring_cmd_db(xhci);
-        spin_unlock_irqrestore(&xhci->lock, flags);
-
-        wait_for_completion(command->completion);
-
-cleanup:
-        virt_ep->ep_state &= ~EP_CONFIG_PENDING;
-        xhci_free_command(xhci, command);
+        /* For now just print debug to follow the situation */
+        xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
+                 ep->desc.bEndpointAddress);
 }
 
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 265ab1771d24..8e421b89632d 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -865,8 +865,6 @@ struct xhci_virt_ep {
 #define EP_HAS_STREAMS          (1 << 4)
 /* Transitioning the endpoint to not using streams, don't enqueue URBs */
 #define EP_GETTING_NO_STREAMS   (1 << 5)
-#define EP_RECENTLY_HALTED      (1 << 6)
-#define EP_CONFIG_PENDING       (1 << 7)
         /* ----  Related to URB cancellation ---- */
         struct list_head        cancelled_td_list;
         struct xhci_td          *stopped_td;
diff --git a/drivers/usb/isp1760/isp1760-core.c b/drivers/usb/isp1760/isp1760-core.c
index b9827556455f..bfa402cf3a27 100644
--- a/drivers/usb/isp1760/isp1760-core.c
+++ b/drivers/usb/isp1760/isp1760-core.c
@@ -151,8 +151,7 @@ int isp1760_register(struct resource *mem, int irq, unsigned long irqflags,
         }
 
         if (IS_ENABLED(CONFIG_USB_ISP1761_UDC) && !udc_disabled) {
-                ret = isp1760_udc_register(isp, irq, irqflags | IRQF_SHARED |
-                                           IRQF_DISABLED);
+                ret = isp1760_udc_register(isp, irq, irqflags);
                 if (ret < 0) {
                         isp1760_hcd_unregister(&isp->hcd);
                         return ret;
diff --git a/drivers/usb/isp1760/isp1760-udc.c b/drivers/usb/isp1760/isp1760-udc.c
index 9612d7990565..3fc4fe770253 100644
--- a/drivers/usb/isp1760/isp1760-udc.c
+++ b/drivers/usb/isp1760/isp1760-udc.c
@@ -1191,6 +1191,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
                              struct usb_gadget_driver *driver)
 {
         struct isp1760_udc *udc = gadget_to_udc(gadget);
+        unsigned long flags;
 
         /* The hardware doesn't support low speed. */
         if (driver->max_speed < USB_SPEED_FULL) {
@@ -1198,17 +1199,17 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
                 return -EINVAL;
         }
 
-        spin_lock(&udc->lock);
+        spin_lock_irqsave(&udc->lock, flags);
 
         if (udc->driver) {
                 dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
-                spin_unlock(&udc->lock);
+                spin_unlock_irqrestore(&udc->lock, flags);
                 return -EBUSY;
         }
 
         udc->driver = driver;
 
-        spin_unlock(&udc->lock);
+        spin_unlock_irqrestore(&udc->lock, flags);
 
         dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
                 driver->function);
@@ -1232,6 +1233,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
 static int isp1760_udc_stop(struct usb_gadget *gadget)
 {
         struct isp1760_udc *udc = gadget_to_udc(gadget);
+        unsigned long flags;
 
         dev_dbg(udc->isp->dev, "%s\n", __func__);
 
@@ -1239,9 +1241,9 @@ static int isp1760_udc_stop(struct usb_gadget *gadget)
 
         isp1760_udc_write(udc, DC_MODE, 0);
 
-        spin_lock(&udc->lock);
+        spin_lock_irqsave(&udc->lock, flags);
         udc->driver = NULL;
-        spin_unlock(&udc->lock);
+        spin_unlock_irqrestore(&udc->lock, flags);
 
         return 0;
 }
@@ -1411,7 +1413,7 @@ static int isp1760_udc_init(struct isp1760_udc *udc)
                 return -ENODEV;
         }
 
-        if (chipid != 0x00011582) {
+        if (chipid != 0x00011582 && chipid != 0x00158210) {
                 dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
                 return -ENODEV;
         }
@@ -1451,8 +1453,8 @@ int isp1760_udc_register(struct isp1760_device *isp, int irq,
 
         sprintf(udc->irqname, "%s (udc)", devname);
 
-        ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | IRQF_DISABLED |
-                          irqflags, udc->irqname, udc);
+        ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
+                          udc->irqname, udc);
         if (ret < 0)
                 goto error;
 
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 14e1628483d9..39db8b603627 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -79,7 +79,8 @@ config USB_MUSB_TUSB6010
 
 config USB_MUSB_OMAP2PLUS
         tristate "OMAP2430 and onwards"
-        depends on ARCH_OMAP2PLUS && USB && OMAP_CONTROL_PHY
+        depends on ARCH_OMAP2PLUS && USB
+        depends on OMAP_CONTROL_PHY || !OMAP_CONTROL_PHY
         select GENERIC_PHY
 
 config USB_MUSB_AM35X
diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
index 403fab772724..7b3035ff9434 100644
--- a/drivers/usb/phy/phy-am335x-control.c
+++ b/drivers/usb/phy/phy-am335x-control.c
@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_control(struct device *dev)
                 return NULL;
 
         dev = bus_find_device(&platform_bus_type, NULL, node, match);
+        if (!dev)
+                return NULL;
+
         ctrl_usb = dev_get_drvdata(dev);
         if (!ctrl_usb)
                 return NULL;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 3086dec0ef53..8eb68a31cab6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -604,6 +604,7 @@ static const struct usb_device_id id_table_combined[] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
         /*
          * ELV devices:
          */
@@ -1883,8 +1884,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
 {
         struct usb_device *udev = serial->dev;
 
-        if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
-            (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
+        if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
+                return ftdi_jtag_probe(serial);
+
+        if (udev->product &&
+                (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
+                 !strcmp(udev->product, "SNAP Connect E10")))
                 return ftdi_jtag_probe(serial);
 
         return 0;
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 56b1b55c4751..4e4f46f3c89c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -561,6 +561,12 @@
  */
 #define FTDI_NT_ORIONLXM_PID    0x7c90  /* OrionLXm Substation Automation Platform */
 
+/*
+ * Synapse Wireless product ids (FTDI_VID)
+ * http://www.synapse-wireless.com
+ */
+#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
+
 
 /********************************/
 /** third-party VID/PID combos **/
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index dd97d8b572c3..4f7e072e4e00 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -61,6 +61,7 @@ struct keyspan_pda_private {
 /* For Xircom PGSDB9 and older Entrega version of the same device */
 #define XIRCOM_VENDOR_ID                0x085a
 #define XIRCOM_FAKE_ID                  0x8027
+#define XIRCOM_FAKE_ID_2                0x8025 /* "PGMFHUB" serial */
 #define ENTREGA_VENDOR_ID               0x1645
 #define ENTREGA_FAKE_ID                 0x8093
 
@@ -70,6 +71,7 @@ static const struct usb_device_id id_table_combined[] = {
 #endif
 #ifdef XIRCOM
         { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+        { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
         { USB_DEVICE(ENTREGA_VENDOR_ID, ENTREGA_FAKE_ID) },
 #endif
         { USB_DEVICE(KEYSPAN_VENDOR_ID, KEYSPAN_PDA_ID) },
@@ -93,6 +95,7 @@ static const struct usb_device_id id_table_fake[] = {
 #ifdef XIRCOM
 static const struct usb_device_id id_table_fake_xircom[] = {
         { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+        { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
         { USB_DEVICE(ENTREGA_VENDOR_ID, ENTREGA_FAKE_ID) },
         { }
 };
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 82570425fdfe..c85ea530085f 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+                "Initio Corporation",
+                "",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
                 "JMicron",
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index f88bfdf5b6a0..2027a27546ef 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -868,12 +868,14 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
                                 func = vfio_pci_set_err_trigger;
                         break;
                 }
+                break;
         case VFIO_PCI_REQ_IRQ_INDEX:
                 switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
                 case VFIO_IRQ_SET_ACTION_TRIGGER:
                         func = vfio_pci_set_req_trigger;
                         break;
                 }
+                break;
         }
 
         if (!func)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 8d4f3f1ff799..71df240a467a 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1956,10 +1956,9 @@ static int vhost_scsi_make_nexus(struct vhost_scsi_tpg *tpg,
                 goto out;
         }
         /*
-         * Now register the TCM vhost virtual I_T Nexus as active with the
-         * call to __transport_register_session()
+         * Now register the TCM vhost virtual I_T Nexus as active.
          */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                         tv_nexus->tvn_se_sess, tv_nexus);
         tpg->tpg_nexus = tv_nexus;
 
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 0413157f3b49..6a356e344f82 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/balloon_compaction.h>
 #include <linux/oom.h>
+#include <linux/wait.h>
 
 /*
  * Balloon device works in 4K page units.  So each page is pointed to by
@@ -334,17 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self,
 static int balloon(void *_vballoon)
 {
         struct virtio_balloon *vb = _vballoon;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
         set_freezable();
         while (!kthread_should_stop()) {
                 s64 diff;
 
                 try_to_freeze();
-                wait_event_interruptible(vb->config_change,
-                                         (diff = towards_target(vb)) != 0
-                                         || vb->need_stats_update
-                                         || kthread_should_stop()
-                                         || freezing(current));
+
+                add_wait_queue(&vb->config_change, &wait);
+                for (;;) {
+                        if ((diff = towards_target(vb)) != 0 ||
+                            vb->need_stats_update ||
+                            kthread_should_stop() ||
+                            freezing(current))
+                                break;
+                        wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+                }
+                remove_wait_queue(&vb->config_change, &wait);
+
                 if (vb->need_stats_update)
                         stats_handle_request(vb);
                 if (diff > 0)
@@ -499,6 +508,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
         if (err < 0)
                 goto out_oom_notify;
 
+        virtio_device_ready(vdev);
+
         vb->thread = kthread_run(balloon, vb, "vballoon");
         if (IS_ERR(vb->thread)) {
                 err = PTR_ERR(vb->thread);
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index cad569890908..6010d7ec0a0f 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -156,22 +156,95 @@ static void vm_get(struct virtio_device *vdev, unsigned offset,
                    void *buf, unsigned len)
 {
         struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        u8 *ptr = buf;
-        int i;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
+        u8 b;
+        __le16 w;
+        __le32 l;
 
-        for (i = 0; i < len; i++)
-                ptr[i] = readb(vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+        if (vm_dev->version == 1) {
+                u8 *ptr = buf;
+                int i;
+
+                for (i = 0; i < len; i++)
+                        ptr[i] = readb(base + offset + i);
+                return;
+        }
+
+        switch (len) {
+        case 1:
+                b = readb(base + offset);
+                memcpy(buf, &b, sizeof b);
+                break;
+        case 2:
+                w = cpu_to_le16(readw(base + offset));
+                memcpy(buf, &w, sizeof w);
+                break;
+        case 4:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                break;
+        case 8:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                l = cpu_to_le32(ioread32(base + offset + sizeof l));
+                memcpy(buf + sizeof l, &l, sizeof l);
+                break;
+        default:
+                BUG();
+        }
 }
 
 static void vm_set(struct virtio_device *vdev, unsigned offset,
                    const void *buf, unsigned len)
 {
         struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        const u8 *ptr = buf;
-        int i;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
+        u8 b;
+        __le16 w;
+        __le32 l;
 
-        for (i = 0; i < len; i++)
-                writeb(ptr[i], vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+        if (vm_dev->version == 1) {
+                const u8 *ptr = buf;
+                int i;
+
+                for (i = 0; i < len; i++)
+                        writeb(ptr[i], base + offset + i);
+
+                return;
+        }
+
+        switch (len) {
+        case 1:
+                memcpy(&b, buf, sizeof b);
+                writeb(b, base + offset);
+                break;
+        case 2:
+                memcpy(&w, buf, sizeof w);
+                writew(le16_to_cpu(w), base + offset);
+                break;
+        case 4:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                break;
+        case 8:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                memcpy(&l, buf + sizeof l, sizeof l);
+                writel(le32_to_cpu(l), base + offset + sizeof l);
+                break;
+        default:
+                BUG();
+        }
+}
+
+static u32 vm_generation(struct virtio_device *vdev)
+{
+        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
+
+        if (vm_dev->version == 1)
+                return 0;
+        else
+                return readl(vm_dev->base + VIRTIO_MMIO_CONFIG_GENERATION);
 }
 
 static u8 vm_get_status(struct virtio_device *vdev)
@@ -440,6 +513,7 @@ static const char *vm_bus_name(struct virtio_device *vdev)
 static const struct virtio_config_ops virtio_mmio_config_ops = {
         .get            = vm_get,
         .set            = vm_set,
+        .generation     = vm_generation,
         .get_status     = vm_get_status,
         .set_status     = vm_set_status,
         .reset          = vm_reset,
diff --git a/drivers/watchdog/imgpdc_wdt.c b/drivers/watchdog/imgpdc_wdt.c
index c8def68d9e4c..0deaa4f971f5 100644
--- a/drivers/watchdog/imgpdc_wdt.c
+++ b/drivers/watchdog/imgpdc_wdt.c
@@ -42,10 +42,10 @@
 #define PDC_WDT_MIN_TIMEOUT             1
 #define PDC_WDT_DEF_TIMEOUT             64
 
-static int heartbeat;
+static int heartbeat = PDC_WDT_DEF_TIMEOUT;
 module_param(heartbeat, int, 0);
-MODULE_PARM_DESC(heartbeat, "Watchdog heartbeats in seconds. "
-        "(default = " __MODULE_STRING(PDC_WDT_DEF_TIMEOUT) ")");
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeats in seconds "
+        "(default=" __MODULE_STRING(PDC_WDT_DEF_TIMEOUT) ")");
 
 static bool nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, bool, 0);
@@ -191,6 +191,7 @@ static int pdc_wdt_probe(struct platform_device *pdev)
         pdc_wdt->wdt_dev.ops = &pdc_wdt_ops;
         pdc_wdt->wdt_dev.max_timeout = 1 << PDC_WDT_CONFIG_DELAY_MASK;
         pdc_wdt->wdt_dev.parent = &pdev->dev;
+        watchdog_set_drvdata(&pdc_wdt->wdt_dev, pdc_wdt);
 
         ret = watchdog_init_timeout(&pdc_wdt->wdt_dev, heartbeat, &pdev->dev);
         if (ret < 0) {
@@ -232,7 +233,6 @@ static int pdc_wdt_probe(struct platform_device *pdev)
         watchdog_set_nowayout(&pdc_wdt->wdt_dev, nowayout);
 
         platform_set_drvdata(pdev, pdc_wdt);
-        watchdog_set_drvdata(&pdc_wdt->wdt_dev, pdc_wdt);
 
         ret = watchdog_register_device(&pdc_wdt->wdt_dev);
         if (ret)
diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c
index a87f6df6e85f..938b987de551 100644
--- a/drivers/watchdog/mtk_wdt.c
+++ b/drivers/watchdog/mtk_wdt.c
@@ -133,7 +133,7 @@ static int mtk_wdt_start(struct watchdog_device *wdt_dev)
         u32 reg;
         struct mtk_wdt_dev *mtk_wdt = watchdog_get_drvdata(wdt_dev);
         void __iomem *wdt_base = mtk_wdt->wdt_base;
-        u32 ret;
+        int ret;
 
         ret = mtk_wdt_set_timeout(wdt_dev, wdt_dev->timeout);
         if (ret < 0)
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index b812462083fc..94d96809e686 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -55,6 +55,23 @@ config XEN_BALLOON_MEMORY_HOTPLUG
 
           In that case step 3 should be omitted.
 
+config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+        int "Hotplugged memory limit (in GiB) for a PV guest"
+        default 512 if X86_64
+        default 4 if X86_32
+        range 0 64 if X86_32
+        depends on XEN_HAVE_PVMMU
+        depends on XEN_BALLOON_MEMORY_HOTPLUG
+        help
+          Maxmium amount of memory (in GiB) that a PV guest can be
+          expanded to when using memory hotplug.
+
+          A PV guest can have more memory than this limit if is
+          started with a larger maximum.
+
+          This value is used to allocate enough space in internal
+          tables needed for physical memory administration.
+
 config XEN_SCRUB_PAGES
         bool "Scrub pages before returning them to system"
         depends on XEN_BALLOON
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 0b52d92cb2e5..fd933695f232 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -229,6 +229,29 @@ static enum bp_state reserve_additional_memory(long credit)
         balloon_hotplug = round_up(balloon_hotplug, PAGES_PER_SECTION);
         nid = memory_add_physaddr_to_nid(hotplug_start_paddr);
 
+#ifdef CONFIG_XEN_HAVE_PVMMU
+        /*
+         * add_memory() will build page tables for the new memory so
+         * the p2m must contain invalid entries so the correct
+         * non-present PTEs will be written.
+         *
+         * If a failure occurs, the original (identity) p2m entries
+         * are not restored since this region is now known not to
+         * conflict with any devices.
+         */ 
+        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                unsigned long pfn, i;
+
+                pfn = PFN_DOWN(hotplug_start_paddr);
+                for (i = 0; i < balloon_hotplug; i++) {
+                        if (!set_phys_to_machine(pfn + i, INVALID_P2M_ENTRY)) {
+                                pr_warn("set_phys_to_machine() failed, no memory added\n");
+                                return BP_ECANCELED;
+                        }
+                }
+        }
+#endif
+
         rc = add_memory(nid, hotplug_start_paddr, balloon_hotplug << PAGE_SHIFT);
 
         if (rc) {
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b4bca2d4a7e5..70fba973a107 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
         pirq_query_unmask(irq);
 
         rc = set_evtchn_to_irq(evtchn, irq);
-        if (rc != 0) {
-                pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
-                       irq, rc);
-                xen_evtchn_close(evtchn);
-                return 0;
-        }
+        if (rc)
+                goto err;
+
         bind_evtchn_to_cpu(evtchn, 0);
         info->evtchn = evtchn;
 
+        rc = xen_evtchn_port_setup(info);
+        if (rc)
+                goto err;
+
 out:
         unmask_evtchn(evtchn);
         eoi_pirq(irq_get_irq_data(irq));
 
         return 0;
+
+err:
+        pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
+        xen_evtchn_close(evtchn);
+        return 0;
 }
 
 static unsigned int startup_pirq(struct irq_data *data)
diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 46ae0f9f02ad..75fe3d466515 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -16,7 +16,7 @@
 #include "conf_space.h"
 #include "conf_space_quirks.h"
 
-static bool permissive;
+bool permissive;
 module_param(permissive, bool, 0644);
 
 /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
index e56c934ad137..2e1d73d1d5d0 100644
--- a/drivers/xen/xen-pciback/conf_space.h
+++ b/drivers/xen/xen-pciback/conf_space.h
@@ -64,6 +64,8 @@ struct config_field_entry {
         void *data;
 };
 
+extern bool permissive;
+
 #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
 
 /* Add fields to a device - the add_fields macro expects to get a pointer to
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index c5ee82587e8c..2d7369391472 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -11,6 +11,10 @@
 #include "pciback.h"
 #include "conf_space.h"
 
+struct pci_cmd_info {
+        u16 val;
+};
+
 struct pci_bar_info {
         u32 val;
         u32 len_val;
@@ -20,22 +24,36 @@ struct pci_bar_info {
 #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
 #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
 
-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+/* Bits guests are allowed to control in permissive mode. */
+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
+                           PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
+                           PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
+
+static void *command_init(struct pci_dev *dev, int offset)
 {
-        int i;
-        int ret;
-
-        ret = xen_pcibk_read_config_word(dev, offset, value, data);
-        if (!pci_is_enabled(dev))
-                return ret;
-
-        for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-                if (dev->resource[i].flags & IORESOURCE_IO)
-                        *value |= PCI_COMMAND_IO;
-                if (dev->resource[i].flags & IORESOURCE_MEM)
-                        *value |= PCI_COMMAND_MEMORY;
+        struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
+        int err;
+
+        if (!cmd)
+                return ERR_PTR(-ENOMEM);
+
+        err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
+        if (err) {
+                kfree(cmd);
+                return ERR_PTR(err);
         }
 
+        return cmd;
+}
+
+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+{
+        int ret = pci_read_config_word(dev, offset, value);
+        const struct pci_cmd_info *cmd = data;
+
+        *value &= PCI_COMMAND_GUEST;
+        *value |= cmd->val & ~PCI_COMMAND_GUEST;
+
         return ret;
 }
 
@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
 {
         struct xen_pcibk_dev_data *dev_data;
         int err;
+        u16 val;
+        struct pci_cmd_info *cmd = data;
 
         dev_data = pci_get_drvdata(dev);
         if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
                 }
         }
 
+        cmd->val = value;
+
+        if (!permissive && (!dev_data || !dev_data->permissive))
+                return 0;
+
+        /* Only allow the guest to control certain bits. */
+        err = pci_read_config_word(dev, offset, &val);
+        if (err || val == value)
+                return err;
+
+        value &= PCI_COMMAND_GUEST;
+        value |= val & ~PCI_COMMAND_GUEST;
+
         return pci_write_config_word(dev, offset, value);
 }
 
@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
         {
          .offset    = PCI_COMMAND,
          .size      = 2,
+         .init      = command_init,
+         .release   = bar_release,
          .u.w.read  = command_read,
          .u.w.write = command_write,
         },
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 9faca6a60bb0..42bd55a6c237 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1659,11 +1659,8 @@ static int scsiback_make_nexus(struct scsiback_tpg *tpg,
                          name);
                 goto out;
         }
-        /*
-         * Now register the TCM pvscsi virtual I_T Nexus as active with the
-         * call to __transport_register_session()
-         */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
+        /* Now register the TCM pvscsi virtual I_T Nexus as active. */
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                         tv_nexus->tvn_se_sess, tv_nexus);
         tpg->tpg_nexus = tv_nexus;
 
diff --git a/fs/affs/file.c b/fs/affs/file.c
index d2468bf95669..a91795e01a7f 100644
--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -699,8 +699,10 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
         boff = tmp % bsize;
         if (boff) {
                 bh = affs_bread_ino(inode, bidx, 0);
-                if (IS_ERR(bh))
-                        return PTR_ERR(bh);
+                if (IS_ERR(bh)) {
+                        written = PTR_ERR(bh);
+                        goto err_first_bh;
+                }
                 tmp = min(bsize - boff, to - from);
                 BUG_ON(boff + tmp > bsize || tmp > bsize);
                 memcpy(AFFS_DATA(bh) + boff, data + from, tmp);
@@ -712,14 +714,16 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
                 bidx++;
         } else if (bidx) {
                 bh = affs_bread_ino(inode, bidx - 1, 0);
-                if (IS_ERR(bh))
-                        return PTR_ERR(bh);
+                if (IS_ERR(bh)) {
+                        written = PTR_ERR(bh);
+                        goto err_first_bh;
+                }
         }
         while (from + bsize <= to) {
                 prev_bh = bh;
                 bh = affs_getemptyblk_ino(inode, bidx);
                 if (IS_ERR(bh))
-                        goto out;
+                        goto err_bh;
                 memcpy(AFFS_DATA(bh), data + from, bsize);
                 if (buffer_new(bh)) {
                         AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA);
@@ -751,7 +755,7 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
                 prev_bh = bh;
                 bh = affs_bread_ino(inode, bidx, 1);
                 if (IS_ERR(bh))
-                        goto out;
+                        goto err_bh;
                 tmp = min(bsize, to - from);
                 BUG_ON(tmp > bsize);
                 memcpy(AFFS_DATA(bh), data + from, tmp);
@@ -790,12 +794,13 @@ done:
         if (tmp > inode->i_size)
                 inode->i_size = AFFS_I(inode)->mmu_private = tmp;
 
+err_first_bh:
         unlock_page(page);
         page_cache_release(page);
 
         return written;
 
-out:
+err_bh:
         bh = prev_bh;
         if (!written)
                 written = PTR_ERR(bh);
diff --git a/fs/aio.c b/fs/aio.c
index f8e52a1854c1..a793f7023755 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -278,11 +278,11 @@ static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
         return 0;
 }
 
-static void aio_ring_remap(struct file *file, struct vm_area_struct *vma)
+static int aio_ring_remap(struct file *file, struct vm_area_struct *vma)
 {
         struct mm_struct *mm = vma->vm_mm;
         struct kioctx_table *table;
-        int i;
+        int i, res = -EINVAL;
 
         spin_lock(&mm->ioctx_lock);
         rcu_read_lock();
@@ -292,13 +292,17 @@ static void aio_ring_remap(struct file *file, struct vm_area_struct *vma)
 
                 ctx = table->table[i];
                 if (ctx && ctx->aio_ring_file == file) {
-                        ctx->user_id = ctx->mmap_base = vma->vm_start;
+                        if (!atomic_read(&ctx->dead)) {
+                                ctx->user_id = ctx->mmap_base = vma->vm_start;
+                                res = 0;
+                        }
                         break;
                 }
         }
 
         rcu_read_unlock();
         spin_unlock(&mm->ioctx_lock);
+        return res;
 }
 
 static const struct file_operations aio_ring_fops = {
@@ -727,6 +731,9 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 err_cleanup:
         aio_nr_sub(ctx->max_reqs);
 err_ctx:
+        atomic_set(&ctx->dead, 1);
+        if (ctx->mmap_size)
+                vm_munmap(ctx->mmap_base, ctx->mmap_size);
         aio_free_ring(ctx);
 err:
         mutex_unlock(&ctx->ring_lock);
@@ -748,11 +755,12 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
 {
         struct kioctx_table *table;
 
-        if (atomic_xchg(&ctx->dead, 1))
+        spin_lock(&mm->ioctx_lock);
+        if (atomic_xchg(&ctx->dead, 1)) {
+                spin_unlock(&mm->ioctx_lock);
                 return -EINVAL;
+        }
 
-
-        spin_lock(&mm->ioctx_lock);
         table = rcu_dereference_raw(mm->ioctx_table);
         WARN_ON(ctx != table->table[ctx->id]);
         table->table[ctx->id] = NULL;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 84c3b00f3de8..f9c89cae39ee 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3387,6 +3387,8 @@ int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
 
 int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                                     struct btrfs_root *root);
+int btrfs_setup_space_cache(struct btrfs_trans_handle *trans,
+                            struct btrfs_root *root);
 int btrfs_extent_readonly(struct btrfs_root *root, u64 bytenr);
 int btrfs_free_block_groups(struct btrfs_fs_info *info);
 int btrfs_read_block_groups(struct btrfs_root *root);
@@ -3909,6 +3911,9 @@ int btrfs_prealloc_file_range_trans(struct inode *inode,
                                     loff_t actual_len, u64 *alloc_hint);
 int btrfs_inode_check_errors(struct inode *inode);
 extern const struct dentry_operations btrfs_dentry_operations;
+#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+void btrfs_test_inode_set_ops(struct inode *inode);
+#endif
 
 /* ioctl.c */
 long btrfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index f79f38542a73..639f2663ed3f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3921,7 +3921,7 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
         }
         if (btrfs_super_sys_array_size(sb) < sizeof(struct btrfs_disk_key)
                         + sizeof(struct btrfs_chunk)) {
-                printk(KERN_ERR "BTRFS: system chunk array too small %u < %lu\n",
+                printk(KERN_ERR "BTRFS: system chunk array too small %u < %zu\n",
                                 btrfs_super_sys_array_size(sb),
                                 sizeof(struct btrfs_disk_key)
                                 + sizeof(struct btrfs_chunk));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 6f080451fcb1..8b353ad02f03 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3325,6 +3325,32 @@ out:
         return ret;
 }
 
+int btrfs_setup_space_cache(struct btrfs_trans_handle *trans,
+                            struct btrfs_root *root)
+{
+        struct btrfs_block_group_cache *cache, *tmp;
+        struct btrfs_transaction *cur_trans = trans->transaction;
+        struct btrfs_path *path;
+
+        if (list_empty(&cur_trans->dirty_bgs) ||
+            !btrfs_test_opt(root, SPACE_CACHE))
+                return 0;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        /* Could add new block groups, use _safe just in case */
+        list_for_each_entry_safe(cache, tmp, &cur_trans->dirty_bgs,
+                                 dirty_list) {
+                if (cache->disk_cache_state == BTRFS_DC_CLEAR)
+                        cache_save_setup(cache, trans, path);
+        }
+
+        btrfs_free_path(path);
+        return 0;
+}
+
 int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root)
 {
@@ -5110,7 +5136,11 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
         num_bytes = ALIGN(num_bytes, root->sectorsize);
 
         spin_lock(&BTRFS_I(inode)->lock);
-        BTRFS_I(inode)->outstanding_extents++;
+        nr_extents = (unsigned)div64_u64(num_bytes +
+                                         BTRFS_MAX_EXTENT_SIZE - 1,
+                                         BTRFS_MAX_EXTENT_SIZE);
+        BTRFS_I(inode)->outstanding_extents += nr_extents;
+        nr_extents = 0;
 
         if (BTRFS_I(inode)->outstanding_extents >
             BTRFS_I(inode)->reserved_extents)
@@ -5255,6 +5285,9 @@ void btrfs_delalloc_release_metadata(struct inode *inode, u64 num_bytes)
         if (dropped > 0)
                 to_free += btrfs_calc_trans_metadata_size(root, dropped);
 
+        if (btrfs_test_is_dummy_root(root))
+                return;
+
         trace_btrfs_space_reservation(root->fs_info, "delalloc",
                                       btrfs_ino(inode), to_free, 0);
         if (root->fs_info->quota_enabled) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index c7233ff1d533..d688cfe5d496 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4968,6 +4968,12 @@ static int release_extent_buffer(struct extent_buffer *eb)
 
                 /* Should be safe to release our pages at this point */
                 btrfs_release_extent_buffer_page(eb);
+#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+                if (unlikely(test_bit(EXTENT_BUFFER_DUMMY, &eb->bflags))) {
+                        __free_extent_buffer(eb);
+                        return 1;
+                }
+#endif
                 call_rcu(&eb->rcu_head, btrfs_release_extent_buffer_rcu);
                 return 1;
         }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index da828cf5e8f8..d2e732d7af52 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -108,6 +108,13 @@ static struct extent_map *create_pinned_em(struct inode *inode, u64 start,
 
 static int btrfs_dirty_inode(struct inode *inode);
 
+#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+void btrfs_test_inode_set_ops(struct inode *inode)
+{
+        BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
+}
+#endif
+
 static int btrfs_init_inode_security(struct btrfs_trans_handle *trans,
                                      struct inode *inode,  struct inode *dir,
                                      const struct qstr *qstr)
@@ -1542,30 +1549,17 @@ static void btrfs_split_extent_hook(struct inode *inode,
                 u64 new_size;
 
                 /*
-                 * We need the largest size of the remaining extent to see if we
-                 * need to add a new outstanding extent.  Think of the following
-                 * case
-                 *
-                 * [MEAX_EXTENT_SIZEx2 - 4k][4k]
-                 *
-                 * The new_size would just be 4k and we'd think we had enough
-                 * outstanding extents for this if we only took one side of the
-                 * split, same goes for the other direction.  We need to see if
-                 * the larger size still is the same amount of extents as the
-                 * original size, because if it is we need to add a new
-                 * outstanding extent.  But if we split up and the larger size
-                 * is less than the original then we are good to go since we've
-                 * already accounted for the extra extent in our original
-                 * accounting.
+                 * See the explanation in btrfs_merge_extent_hook, the same
+                 * applies here, just in reverse.
                  */
                 new_size = orig->end - split + 1;
-                if ((split - orig->start) > new_size)
-                        new_size = split - orig->start;
-
-                num_extents = div64_u64(size + BTRFS_MAX_EXTENT_SIZE - 1,
+                num_extents = div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
                                         BTRFS_MAX_EXTENT_SIZE);
-                if (div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
-                              BTRFS_MAX_EXTENT_SIZE) < num_extents)
+                new_size = split - orig->start;
+                num_extents += div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
+                                        BTRFS_MAX_EXTENT_SIZE);
+                if (div64_u64(size + BTRFS_MAX_EXTENT_SIZE - 1,
+                              BTRFS_MAX_EXTENT_SIZE) >= num_extents)
                         return;
         }
 
@@ -1591,8 +1585,10 @@ static void btrfs_merge_extent_hook(struct inode *inode,
         if (!(other->state & EXTENT_DELALLOC))
                 return;
 
-        old_size = other->end - other->start + 1;
-        new_size = old_size + (new->end - new->start + 1);
+        if (new->start > other->start)
+                new_size = new->end - other->start + 1;
+        else
+                new_size = other->end - new->start + 1;
 
         /* we're not bigger than the max, unreserve the space and go */
         if (new_size <= BTRFS_MAX_EXTENT_SIZE) {
@@ -1603,13 +1599,32 @@ static void btrfs_merge_extent_hook(struct inode *inode,
         }
 
         /*
-         * If we grew by another max_extent, just return, we want to keep that
-         * reserved amount.
+         * We have to add up either side to figure out how many extents were
+         * accounted for before we merged into one big extent.  If the number of
+         * extents we accounted for is <= the amount we need for the new range
+         * then we can return, otherwise drop.  Think of it like this
+         *
+         * [ 4k][MAX_SIZE]
+         *
+         * So we've grown the extent by a MAX_SIZE extent, this would mean we
+         * need 2 outstanding extents, on one side we have 1 and the other side
+         * we have 1 so they are == and we can return.  But in this case
+         *
+         * [MAX_SIZE+4k][MAX_SIZE+4k]
+         *
+         * Each range on their own accounts for 2 extents, but merged together
+         * they are only 3 extents worth of accounting, so we need to drop in
+         * this case.
          */
+        old_size = other->end - other->start + 1;
         num_extents = div64_u64(old_size + BTRFS_MAX_EXTENT_SIZE - 1,
                                 BTRFS_MAX_EXTENT_SIZE);
+        old_size = new->end - new->start + 1;
+        num_extents += div64_u64(old_size + BTRFS_MAX_EXTENT_SIZE - 1,
+                                 BTRFS_MAX_EXTENT_SIZE);
+
         if (div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
-                      BTRFS_MAX_EXTENT_SIZE) > num_extents)
+                      BTRFS_MAX_EXTENT_SIZE) >= num_extents)
                 return;
 
         spin_lock(&BTRFS_I(inode)->lock);
@@ -1686,6 +1701,10 @@ static void btrfs_set_bit_hook(struct inode *inode,
                         spin_unlock(&BTRFS_I(inode)->lock);
                 }
 
+                /* For sanity tests */
+                if (btrfs_test_is_dummy_root(root))
+                        return;
+
                 __percpu_counter_add(&root->fs_info->delalloc_bytes, len,
                                      root->fs_info->delalloc_batch);
                 spin_lock(&BTRFS_I(inode)->lock);
@@ -1741,6 +1760,10 @@ static void btrfs_clear_bit_hook(struct inode *inode,
                     root != root->fs_info->tree_root)
                         btrfs_delalloc_release_metadata(inode, len);
 
+                /* For sanity tests. */
+                if (btrfs_test_is_dummy_root(root))
+                        return;
+
                 if (root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID
                     && do_list && !(state->state & EXTENT_NORESERVE))
                         btrfs_free_reserved_data_space(inode, len);
@@ -7213,7 +7236,7 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
         u64 start = iblock << inode->i_blkbits;
         u64 lockstart, lockend;
         u64 len = bh_result->b_size;
-        u64 orig_len = len;
+        u64 *outstanding_extents = NULL;
         int unlock_bits = EXTENT_LOCKED;
         int ret = 0;
 
@@ -7225,6 +7248,16 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
         lockstart = start;
         lockend = start + len - 1;
 
+        if (current->journal_info) {
+                /*
+                 * Need to pull our outstanding extents and set journal_info to NULL so
+                 * that anything that needs to check if there's a transction doesn't get
+                 * confused.
+                 */
+                outstanding_extents = current->journal_info;
+                current->journal_info = NULL;
+        }
+
         /*
          * If this errors out it's because we couldn't invalidate pagecache for
          * this range and we need to fallback to buffered.
@@ -7348,11 +7381,20 @@ unlock:
                 if (start + len > i_size_read(inode))
                         i_size_write(inode, start + len);
 
-                if (len < orig_len) {
+                /*
+                 * If we have an outstanding_extents count still set then we're
+                 * within our reservation, otherwise we need to adjust our inode
+                 * counter appropriately.
+                 */
+                if (*outstanding_extents) {
+                        (*outstanding_extents)--;
+                } else {
                         spin_lock(&BTRFS_I(inode)->lock);
                         BTRFS_I(inode)->outstanding_extents++;
                         spin_unlock(&BTRFS_I(inode)->lock);
                 }
+
+                current->journal_info = outstanding_extents;
                 btrfs_free_reserved_data_space(inode, len);
         }
 
@@ -7376,6 +7418,8 @@ unlock:
 unlock_err:
         clear_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, lockend,
                          unlock_bits, 1, 0, &cached_state, GFP_NOFS);
+        if (outstanding_extents)
+                current->journal_info = outstanding_extents;
         return ret;
 }
 
@@ -8075,6 +8119,7 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
 {
         struct file *file = iocb->ki_filp;
         struct inode *inode = file->f_mapping->host;
+        u64 outstanding_extents = 0;
         size_t count = 0;
         int flags = 0;
         bool wakeup = true;
@@ -8112,6 +8157,16 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
                 ret = btrfs_delalloc_reserve_space(inode, count);
                 if (ret)
                         goto out;
+                outstanding_extents = div64_u64(count +
+                                                BTRFS_MAX_EXTENT_SIZE - 1,
+                                                BTRFS_MAX_EXTENT_SIZE);
+
+                /*
+                 * We need to know how many extents we reserved so that we can
+                 * do the accounting properly if we go over the number we
+                 * originally calculated.  Abuse current->journal_info for this.
+                 */
+                current->journal_info = &outstanding_extents;
         } else if (test_bit(BTRFS_INODE_READDIO_NEED_LOCK,
                                      &BTRFS_I(inode)->runtime_flags)) {
                 inode_dio_done(inode);
@@ -8124,6 +8179,7 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
                         iter, offset, btrfs_get_blocks_direct, NULL,
                         btrfs_submit_direct, flags);
         if (rw & WRITE) {
+                current->journal_info = NULL;
                 if (ret < 0 && ret != -EIOCBQUEUED)
                         btrfs_delalloc_release_space(inode, count);
                 else if (ret >= 0 && (size_t)ret < count)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 97159a8e91d4..058c79eecbfb 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1259,7 +1259,7 @@ static int comp_oper(struct btrfs_qgroup_operation *oper1,
         if (oper1->seq < oper2->seq)
                 return -1;
         if (oper1->seq > oper2->seq)
-                return -1;
+                return 1;
         if (oper1->ref_root < oper2->ref_root)
                 return -1;
         if (oper1->ref_root > oper2->ref_root)
diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
index a116b55ce788..054fc0d97131 100644
--- a/fs/btrfs/tests/inode-tests.c
+++ b/fs/btrfs/tests/inode-tests.c
@@ -911,6 +911,197 @@ out:
         return ret;
 }
 
+static int test_extent_accounting(void)
+{
+        struct inode *inode = NULL;
+        struct btrfs_root *root = NULL;
+        int ret = -ENOMEM;
+
+        inode = btrfs_new_test_inode();
+        if (!inode) {
+                test_msg("Couldn't allocate inode\n");
+                return ret;
+        }
+
+        root = btrfs_alloc_dummy_root();
+        if (IS_ERR(root)) {
+                test_msg("Couldn't allocate root\n");
+                goto out;
+        }
+
+        root->fs_info = btrfs_alloc_dummy_fs_info();
+        if (!root->fs_info) {
+                test_msg("Couldn't allocate dummy fs info\n");
+                goto out;
+        }
+
+        BTRFS_I(inode)->root = root;
+        btrfs_test_inode_set_ops(inode);
+
+        /* [BTRFS_MAX_EXTENT_SIZE] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, 0, BTRFS_MAX_EXTENT_SIZE - 1,
+                                        NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 1) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 1, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /* [BTRFS_MAX_EXTENT_SIZE][4k] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE,
+                                        BTRFS_MAX_EXTENT_SIZE + 4095, NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 2) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 2, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /* [BTRFS_MAX_EXTENT_SIZE/2][4K HOLE][the rest] */
+        ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
+                               BTRFS_MAX_EXTENT_SIZE >> 1,
+                               (BTRFS_MAX_EXTENT_SIZE >> 1) + 4095,
+                               EXTENT_DELALLOC | EXTENT_DIRTY |
+                               EXTENT_UPTODATE | EXTENT_DO_ACCOUNTING, 0, 0,
+                               NULL, GFP_NOFS);
+        if (ret) {
+                test_msg("clear_extent_bit returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 2) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 2, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /* [BTRFS_MAX_EXTENT_SIZE][4K] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE >> 1,
+                                        (BTRFS_MAX_EXTENT_SIZE >> 1) + 4095,
+                                        NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 2) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 2, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /*
+         * [BTRFS_MAX_EXTENT_SIZE+4K][4K HOLE][BTRFS_MAX_EXTENT_SIZE+4K]
+         *
+         * I'm artificially adding 2 to outstanding_extents because in the
+         * buffered IO case we'd add things up as we go, but I don't feel like
+         * doing that here, this isn't the interesting case we want to test.
+         */
+        BTRFS_I(inode)->outstanding_extents += 2;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE + 8192,
+                                        (BTRFS_MAX_EXTENT_SIZE << 1) + 12287,
+                                        NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 4) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 4, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /* [BTRFS_MAX_EXTENT_SIZE+4k][4k][BTRFS_MAX_EXTENT_SIZE+4k] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE+4096,
+                                        BTRFS_MAX_EXTENT_SIZE+8191, NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 3) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 3, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /* [BTRFS_MAX_EXTENT_SIZE+4k][4K HOLE][BTRFS_MAX_EXTENT_SIZE+4k] */
+        ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
+                               BTRFS_MAX_EXTENT_SIZE+4096,
+                               BTRFS_MAX_EXTENT_SIZE+8191,
+                               EXTENT_DIRTY | EXTENT_DELALLOC |
+                               EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
+                               NULL, GFP_NOFS);
+        if (ret) {
+                test_msg("clear_extent_bit returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 4) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 4, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /*
+         * Refill the hole again just for good measure, because I thought it
+         * might fail and I'd rather satisfy my paranoia at this point.
+         */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE+4096,
+                                        BTRFS_MAX_EXTENT_SIZE+8191, NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 3) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 3, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+
+        /* Empty */
+        ret = clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
+                               EXTENT_DIRTY | EXTENT_DELALLOC |
+                               EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
+                               NULL, GFP_NOFS);
+        if (ret) {
+                test_msg("clear_extent_bit returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 0, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        ret = 0;
+out:
+        if (ret)
+                clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
+                                 EXTENT_DIRTY | EXTENT_DELALLOC |
+                                 EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
+                                 NULL, GFP_NOFS);
+        iput(inode);
+        btrfs_free_dummy_root(root);
+        return ret;
+}
+
 int btrfs_test_inodes(void)
 {
         int ret;
@@ -924,5 +1115,9 @@ int btrfs_test_inodes(void)
         if (ret)
                 return ret;
         test_msg("Running hole first btrfs_get_extent test\n");
-        return test_hole_first();
+        ret = test_hole_first();
+        if (ret)
+                return ret;
+        test_msg("Running outstanding_extents tests\n");
+        return test_extent_accounting();
 }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 88e51aded6bd..8be4278e25e8 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1023,17 +1023,13 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
         u64 old_root_bytenr;
         u64 old_root_used;
         struct btrfs_root *tree_root = root->fs_info->tree_root;
-        bool extent_root = (root->objectid == BTRFS_EXTENT_TREE_OBJECTID);
 
         old_root_used = btrfs_root_used(&root->root_item);
-        btrfs_write_dirty_block_groups(trans, root);
 
         while (1) {
                 old_root_bytenr = btrfs_root_bytenr(&root->root_item);
                 if (old_root_bytenr == root->node->start &&
-                    old_root_used == btrfs_root_used(&root->root_item) &&
-                    (!extent_root ||
-                     list_empty(&trans->transaction->dirty_bgs)))
+                    old_root_used == btrfs_root_used(&root->root_item))
                         break;
 
                 btrfs_set_root_node(&root->root_item, root->node);
@@ -1044,14 +1040,6 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
                         return ret;
 
                 old_root_used = btrfs_root_used(&root->root_item);
-                if (extent_root) {
-                        ret = btrfs_write_dirty_block_groups(trans, root);
-                        if (ret)
-                                return ret;
-                }
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-                if (ret)
-                        return ret;
         }
 
         return 0;
@@ -1068,6 +1056,7 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
                                          struct btrfs_root *root)
 {
         struct btrfs_fs_info *fs_info = root->fs_info;
+        struct list_head *dirty_bgs = &trans->transaction->dirty_bgs;
         struct list_head *next;
         struct extent_buffer *eb;
         int ret;
@@ -1095,11 +1084,15 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
         if (ret)
                 return ret;
 
+        ret = btrfs_setup_space_cache(trans, root);
+        if (ret)
+                return ret;
+
         /* run_qgroups might have added some more refs */
         ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
         if (ret)
                 return ret;
-
+again:
         while (!list_empty(&fs_info->dirty_cowonly_roots)) {
                 next = fs_info->dirty_cowonly_roots.next;
                 list_del_init(next);
@@ -1112,8 +1105,23 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
                 ret = update_cowonly_root(trans, root);
                 if (ret)
                         return ret;
+                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
+                if (ret)
+                        return ret;
         }
 
+        while (!list_empty(dirty_bgs)) {
+                ret = btrfs_write_dirty_block_groups(trans, root);
+                if (ret)
+                        return ret;
+                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
+                if (ret)
+                        return ret;
+        }
+
+        if (!list_empty(&fs_info->dirty_cowonly_roots))
+                goto again;
+
         list_add_tail(&fs_info->extent_root->dirty_list,
                       &trans->transaction->switch_commits);
         btrfs_after_dev_replace_commit(fs_info);
@@ -1811,6 +1819,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
                 wait_for_commit(root, cur_trans);
 
+                if (unlikely(cur_trans->aborted))
+                        ret = cur_trans->aborted;
+
                 btrfs_put_transaction(cur_trans);
 
                 return ret;
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 4ac7445e6ec7..aa0dc2573374 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -1,6 +1,9 @@
 /*
  *   fs/cifs/cifsencrypt.c
  *
+ *   Encryption and hashing operations relating to NTLM, NTLMv2.  See MS-NLMP
+ *   for more detailed information
+ *
  *   Copyright (C) International Business Machines  Corp., 2005,2013
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
@@ -515,7 +518,8 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
                                  __func__);
                         return rc;
                 }
-        } else if (ses->serverName) {
+        } else {
+                /* We use ses->serverName if no domain name available */
                 len = strlen(ses->serverName);
 
                 server = kmalloc(2 + (len * 2), GFP_KERNEL);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index d3aa999ab785..480cf9c81d50 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1599,6 +1599,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                 pr_warn("CIFS: username too long\n");
                                 goto cifs_parse_mount_err;
                         }
+
+                        kfree(vol->username);
                         vol->username = kstrdup(string, GFP_KERNEL);
                         if (!vol->username)
                                 goto cifs_parse_mount_err;
@@ -1700,6 +1702,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                 goto cifs_parse_mount_err;
                         }
 
+                        kfree(vol->domainname);
                         vol->domainname = kstrdup(string, GFP_KERNEL);
                         if (!vol->domainname) {
                                 pr_warn("CIFS: no memory for domainname\n");
@@ -1731,6 +1734,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         }
 
                          if (strncasecmp(string, "default", 7) != 0) {
+                                kfree(vol->iocharset);
                                 vol->iocharset = kstrdup(string,
                                                          GFP_KERNEL);
                                 if (!vol->iocharset) {
@@ -2913,8 +2917,7 @@ ip_rfc1001_connect(struct TCP_Server_Info *server)
                  * calling name ends in null (byte 16) from old smb
                  * convention.
                  */
-                if (server->workstation_RFC1001_name &&
-                    server->workstation_RFC1001_name[0] != 0)
+                if (server->workstation_RFC1001_name[0] != 0)
                         rfc1002mangle(ses_init_buf->trailer.
                                       session_req.calling_name,
                                       server->workstation_RFC1001_name,
@@ -3692,6 +3695,12 @@ CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
 #endif /* CIFS_WEAK_PW_HASH */
                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
                                         bcc_ptr, nls_codepage);
+                if (rc) {
+                        cifs_dbg(FYI, "%s Can't generate NTLM rsp. Error: %d\n",
+                                 __func__, rc);
+                        cifs_buf_release(smb_buffer);
+                        return rc;
+                }
 
                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
                 if (ses->capabilities & CAP_UNICODE) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index a94b3e673182..ca30c391a894 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1823,6 +1823,7 @@ refind_writable:
                         cifsFileInfo_put(inv_file);
                         spin_lock(&cifs_file_list_lock);
                         ++refind;
+                        inv_file = NULL;
                         goto refind_writable;
                 }
         }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 2d4f37235ed0..3e126d7bb2ea 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -771,6 +771,8 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
                                 cifs_buf_release(srchinf->ntwrk_buf_start);
                         }
                         kfree(srchinf);
+                        if (rc)
+                                goto cgii_exit;
         } else
                 goto cgii_exit;
 
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 689f035915cf..22dfdf17d065 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -322,7 +322,7 @@ smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *hdr)
 
         /* return pointer to beginning of data area, ie offset from SMB start */
         if ((*off != 0) && (*len != 0))
-                return hdr->ProtocolId + *off;
+                return (char *)(&hdr->ProtocolId[0]) + *off;
         else
                 return NULL;
 }
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 96b5d40a2ece..eab05e1aa587 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -684,7 +684,8 @@ smb2_clone_range(const unsigned int xid,
 
                         /* No need to change MaxChunks since already set to 1 */
                         chunk_sizes_updated = true;
-                }
+                } else
+                        goto cchunk_out;
         }
 
 cchunk_out:
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 3417340bf89e..65cd7a84c8bc 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1218,7 +1218,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         struct smb2_ioctl_req *req;
         struct smb2_ioctl_rsp *rsp;
         struct TCP_Server_Info *server;
-        struct cifs_ses *ses = tcon->ses;
+        struct cifs_ses *ses;
         struct kvec iov[2];
         int resp_buftype;
         int num_iovecs;
@@ -1233,6 +1233,11 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         if (plen)
                 *plen = 0;
 
+        if (tcon)
+                ses = tcon->ses;
+        else
+                return -EIO;
+
         if (ses && (ses->server))
                 server = ses->server;
         else
@@ -1296,14 +1301,12 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base;
 
         if ((rc != 0) && (rc != -EINVAL)) {
-                if (tcon)
-                        cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
+                cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
                 goto ioctl_exit;
         } else if (rc == -EINVAL) {
                 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
                     (opcode != FSCTL_SRV_COPYCHUNK)) {
-                        if (tcon)
-                                cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
+                        cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
                         goto ioctl_exit;
                 }
         }
@@ -1629,7 +1632,7 @@ SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
 
         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
 
-        if ((rc != 0) && tcon)
+        if (rc != 0)
                 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
 
         free_rsp_buf(resp_buftype, iov[0].iov_base);
@@ -2114,7 +2117,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
         struct kvec iov[2];
         int rc = 0;
         int len;
-        int resp_buftype;
+        int resp_buftype = CIFS_NO_BUFFER;
         unsigned char *bufptr;
         struct TCP_Server_Info *server;
         struct cifs_ses *ses = tcon->ses;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e907052eeadb..32a8bbd7a9ad 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -53,6 +53,18 @@ struct wb_writeback_work {
         struct completion *done;        /* set if the caller waits */
 };
 
+/*
+ * If an inode is constantly having its pages dirtied, but then the
+ * updates stop dirtytime_expire_interval seconds in the past, it's
+ * possible for the worst case time between when an inode has its
+ * timestamps updated and when they finally get written out to be two
+ * dirtytime_expire_intervals.  We set the default to 12 hours (in
+ * seconds), which means most of the time inodes will have their
+ * timestamps written to disk after 12 hours, but in the worst case a
+ * few inodes might not their timestamps updated for 24 hours.
+ */
+unsigned int dirtytime_expire_interval = 12 * 60 * 60;
+
 /**
  * writeback_in_progress - determine whether there is writeback in progress
  * @bdi: the device's backing_dev_info structure.
@@ -275,8 +287,8 @@ static int move_expired_inodes(struct list_head *delaying_queue,
 
         if ((flags & EXPIRE_DIRTY_ATIME) == 0)
                 older_than_this = work->older_than_this;
-        else if ((work->reason == WB_REASON_SYNC) == 0) {
-                expire_time = jiffies - (HZ * 86400);
+        else if (!work->for_sync) {
+                expire_time = jiffies - (dirtytime_expire_interval * HZ);
                 older_than_this = &expire_time;
         }
         while (!list_empty(delaying_queue)) {
@@ -458,6 +470,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
                  */
                 redirty_tail(inode, wb);
         } else if (inode->i_state & I_DIRTY_TIME) {
+                inode->dirtied_when = jiffies;
                 list_move(&inode->i_wb_list, &wb->b_dirty_time);
         } else {
                 /* The inode is clean. Remove from writeback lists. */
@@ -505,12 +518,17 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
         spin_lock(&inode->i_lock);
 
         dirty = inode->i_state & I_DIRTY;
-        if (((dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) &&
-             (inode->i_state & I_DIRTY_TIME)) ||
-            (inode->i_state & I_DIRTY_TIME_EXPIRED)) {
-                dirty |= I_DIRTY_TIME | I_DIRTY_TIME_EXPIRED;
-                trace_writeback_lazytime(inode);
-        }
+        if (inode->i_state & I_DIRTY_TIME) {
+                if ((dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) ||
+                    unlikely(inode->i_state & I_DIRTY_TIME_EXPIRED) ||
+                    unlikely(time_after(jiffies,
+                                        (inode->dirtied_time_when +
+                                         dirtytime_expire_interval * HZ)))) {
+                        dirty |= I_DIRTY_TIME | I_DIRTY_TIME_EXPIRED;
+                        trace_writeback_lazytime(inode);
+                }
+        } else
+                inode->i_state &= ~I_DIRTY_TIME_EXPIRED;
         inode->i_state &= ~dirty;
 
         /*
@@ -1131,6 +1149,56 @@ void wakeup_flusher_threads(long nr_pages, enum wb_reason reason)
         rcu_read_unlock();
 }
 
+/*
+ * Wake up bdi's periodically to make sure dirtytime inodes gets
+ * written back periodically.  We deliberately do *not* check the
+ * b_dirtytime list in wb_has_dirty_io(), since this would cause the
+ * kernel to be constantly waking up once there are any dirtytime
+ * inodes on the system.  So instead we define a separate delayed work
+ * function which gets called much more rarely.  (By default, only
+ * once every 12 hours.)
+ *
+ * If there is any other write activity going on in the file system,
+ * this function won't be necessary.  But if the only thing that has
+ * happened on the file system is a dirtytime inode caused by an atime
+ * update, we need this infrastructure below to make sure that inode
+ * eventually gets pushed out to disk.
+ */
+static void wakeup_dirtytime_writeback(struct work_struct *w);
+static DECLARE_DELAYED_WORK(dirtytime_work, wakeup_dirtytime_writeback);
+
+static void wakeup_dirtytime_writeback(struct work_struct *w)
+{
+        struct backing_dev_info *bdi;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
+                if (list_empty(&bdi->wb.b_dirty_time))
+                        continue;
+                bdi_wakeup_thread(bdi);
+        }
+        rcu_read_unlock();
+        schedule_delayed_work(&dirtytime_work, dirtytime_expire_interval * HZ);
+}
+
+static int __init start_dirtytime_writeback(void)
+{
+        schedule_delayed_work(&dirtytime_work, dirtytime_expire_interval * HZ);
+        return 0;
+}
+__initcall(start_dirtytime_writeback);
+
+int dirtytime_interval_handler(struct ctl_table *table, int write,
+                               void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int ret;
+
+        ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        if (ret == 0 && write)
+                mod_delayed_work(system_wq, &dirtytime_work, 0);
+        return ret;
+}
+
 static noinline void block_dump___mark_inode_dirty(struct inode *inode)
 {
         if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev")) {
@@ -1269,8 +1337,13 @@ void __mark_inode_dirty(struct inode *inode, int flags)
                         }
 
                         inode->dirtied_when = jiffies;
-                        list_move(&inode->i_wb_list, dirtytime ?
-                                  &bdi->wb.b_dirty_time : &bdi->wb.b_dirty);
+                        if (dirtytime)
+                                inode->dirtied_time_when = jiffies;
+                        if (inode->i_state & (I_DIRTY_INODE | I_DIRTY_PAGES))
+                                list_move(&inode->i_wb_list, &bdi->wb.b_dirty);
+                        else
+                                list_move(&inode->i_wb_list,
+                                          &bdi->wb.b_dirty_time);
                         spin_unlock(&bdi->wb.list_lock);
                         trace_writeback_dirty_inode_enqueue(inode);
 
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index ed19a7d622fa..39706c57ad3c 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -890,8 +890,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
 
         newpage = buf->page;
 
-        if (WARN_ON(!PageUptodate(newpage)))
-                return -EIO;
+        if (!PageUptodate(newpage))
+                SetPageUptodate(newpage);
 
         ClearPageMappedToDisk(newpage);
 
@@ -1353,6 +1353,17 @@ static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file,
         return err;
 }
 
+static int fuse_dev_open(struct inode *inode, struct file *file)
+{
+        /*
+         * The fuse device's file's private_data is used to hold
+         * the fuse_conn(ection) when it is mounted, and is used to
+         * keep track of whether the file has been mounted already.
+         */
+        file->private_data = NULL;
+        return 0;
+}
+
 static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
                               unsigned long nr_segs, loff_t pos)
 {
@@ -1797,6 +1808,9 @@ copy_finish:
 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
                        unsigned int size, struct fuse_copy_state *cs)
 {
+        /* Don't try to move pages (yet) */
+        cs->move_pages = 0;
+
         switch (code) {
         case FUSE_NOTIFY_POLL:
                 return fuse_notify_poll(fc, size, cs);
@@ -2217,6 +2231,7 @@ static int fuse_dev_fasync(int fd, struct file *file, int on)
 
 const struct file_operations fuse_dev_operations = {
         .owner          = THIS_MODULE,
+        .open           = fuse_dev_open,
         .llseek         = no_llseek,
         .read           = do_sync_read,
         .aio_read       = fuse_dev_read,
diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
index 6e560d56094b..754fdf8c6356 100644
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -131,13 +131,16 @@ skip:
         hfs_bnode_write(node, entry, data_off + key_len, entry_len);
         hfs_bnode_dump(node);
 
-        if (new_node) {
-                /* update parent key if we inserted a key
-                 * at the start of the first node
-                 */
-                if (!rec && new_node != node)
-                        hfs_brec_update_parent(fd);
+        /*
+         * update parent key if we inserted a key
+         * at the start of the node and it is not the new node
+         */
+        if (!rec && new_node != node) {
+                hfs_bnode_read_key(node, fd->search_key, data_off + size);
+                hfs_brec_update_parent(fd);
+        }
 
+        if (new_node) {
                 hfs_bnode_put(fd->bnode);
                 if (!new_node->parent) {
                         hfs_btree_inc_height(tree);
@@ -168,9 +171,6 @@ skip:
                 goto again;
         }
 
-        if (!rec)
-                hfs_brec_update_parent(fd);
-
         return 0;
 }
 
@@ -370,6 +370,8 @@ again:
         if (IS_ERR(parent))
                 return PTR_ERR(parent);
         __hfs_brec_find(parent, fd, hfs_find_rec_by_key);
+        if (fd->record < 0)
+                return -ENOENT;
         hfs_bnode_dump(parent);
         rec = fd->record;
 
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index b684e8a132e6..2bacb9988566 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -207,6 +207,7 @@ static ssize_t kernfs_file_direct_read(struct kernfs_open_file *of,
                 goto out_free;
         }
 
+        of->event = atomic_read(&of->kn->attr.open->event);
         ops = kernfs_ops(of->kn);
         if (ops->read)
                 len = ops->read(of, buf, len, *ppos);
diff --git a/fs/locks.c b/fs/locks.c
index f1bad681fc1c..40bc384728c0 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1388,9 +1388,8 @@ any_leases_conflict(struct inode *inode, struct file_lock *breaker)
 int __break_lease(struct inode *inode, unsigned int mode, unsigned int type)
 {
         int error = 0;
-        struct file_lock *new_fl;
         struct file_lock_context *ctx = inode->i_flctx;
-        struct file_lock *fl;
+        struct file_lock *new_fl, *fl, *tmp;
         unsigned long break_time;
         int want_write = (mode & O_ACCMODE) != O_RDONLY;
         LIST_HEAD(dispose);
@@ -1420,7 +1419,7 @@ int __break_lease(struct inode *inode, unsigned int mode, unsigned int type)
                         break_time++;   /* so that 0 means no break time */
         }
 
-        list_for_each_entry(fl, &ctx->flc_lease, fl_list) {
+        list_for_each_entry_safe(fl, tmp, &ctx->flc_lease, fl_list) {
                 if (!leases_conflict(fl, new_fl))
                         continue;
                 if (want_write) {
@@ -1728,7 +1727,7 @@ static int generic_delete_lease(struct file *filp, void *owner)
                         break;
                 }
         }
-        trace_generic_delete_lease(inode, fl);
+        trace_generic_delete_lease(inode, victim);
         if (victim)
                 error = fl->fl_lmops->lm_change(victim, F_UNLCK, &dispose);
         spin_unlock(&ctx->flc_lock);
diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c
index cdbc78c72542..03d647bf195d 100644
--- a/fs/nfsd/blocklayout.c
+++ b/fs/nfsd/blocklayout.c
@@ -137,7 +137,7 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp,
         seg->offset = iomap.offset;
         seg->length = iomap.length;
 
-        dprintk("GET: %lld:%lld %d\n", bex->foff, bex->len, bex->es);
+        dprintk("GET: 0x%llx:0x%llx %d\n", bex->foff, bex->len, bex->es);
         return 0;
 
 out_error:
diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c
index 9da89fddab33..9aa2796da90d 100644
--- a/fs/nfsd/blocklayoutxdr.c
+++ b/fs/nfsd/blocklayoutxdr.c
@@ -122,19 +122,19 @@ nfsd4_block_decode_layoutupdate(__be32 *p, u32 len, struct iomap **iomapp,
 
                 p = xdr_decode_hyper(p, &bex.foff);
                 if (bex.foff & (block_size - 1)) {
-                        dprintk("%s: unaligned offset %lld\n",
+                        dprintk("%s: unaligned offset 0x%llx\n",
                                 __func__, bex.foff);
                         goto fail;
                 }
                 p = xdr_decode_hyper(p, &bex.len);
                 if (bex.len & (block_size - 1)) {
-                        dprintk("%s: unaligned length %lld\n",
+                        dprintk("%s: unaligned length 0x%llx\n",
                                 __func__, bex.foff);
                         goto fail;
                 }
                 p = xdr_decode_hyper(p, &bex.soff);
                 if (bex.soff & (block_size - 1)) {
-                        dprintk("%s: unaligned disk offset %lld\n",
+                        dprintk("%s: unaligned disk offset 0x%llx\n",
                                 __func__, bex.soff);
                         goto fail;
                 }
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 3c1bfa155571..6904213a4363 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -118,7 +118,7 @@ void nfsd4_setup_layout_type(struct svc_export *exp)
 {
         struct super_block *sb = exp->ex_path.mnt->mnt_sb;
 
-        if (exp->ex_flags & NFSEXP_NOPNFS)
+        if (!(exp->ex_flags & NFSEXP_PNFS))
                 return;
 
         if (sb->s_export_op->get_uuid &&
@@ -440,15 +440,14 @@ nfsd4_return_file_layout(struct nfs4_layout *lp, struct nfsd4_layout_seg *seg,
                         list_move_tail(&lp->lo_perstate, reaplist);
                         return;
                 }
-                end = seg->offset;
+                lo->offset = layout_end(seg);
         } else {
                 /* retain the whole layout segment on a split. */
                 if (layout_end(seg) < end) {
                         dprintk("%s: split not supported\n", __func__);
                         return;
                 }
-
-                lo->offset = layout_end(seg);
+                end = seg->offset;
         }
 
         layout_update_len(lo, end);
@@ -513,6 +512,9 @@ nfsd4_return_client_layouts(struct svc_rqst *rqstp,
 
         spin_lock(&clp->cl_lock);
         list_for_each_entry_safe(ls, n, &clp->cl_lo_states, ls_perclnt) {
+                if (ls->ls_layout_type != lrp->lr_layout_type)
+                        continue;
+
                 if (lrp->lr_return_type == RETURN_FSID &&
                     !fh_fsid_match(&ls->ls_stid.sc_file->fi_fhandle,
                                    &cstate->current_fh.fh_handle))
@@ -587,7 +589,7 @@ nfsd4_cb_layout_fail(struct nfs4_layout_stateid *ls)
 
         rpc_ntop((struct sockaddr *)&clp->cl_addr, addr_str, sizeof(addr_str));
 
-        nfsd4_cb_layout_fail(ls);
+        trace_layout_recall_fail(&ls->ls_stid.sc_stateid);
 
         printk(KERN_WARNING
                 "nfsd: client %s failed to respond to layout recall. "
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index d30bea8d0277..92b9d97aff4f 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1237,8 +1237,8 @@ nfsd4_getdeviceinfo(struct svc_rqst *rqstp,
                 nfserr = ops->proc_getdeviceinfo(exp->ex_path.mnt->mnt_sb, gdp);
 
         gdp->gd_notify_types &= ops->notify_types;
-        exp_put(exp);
 out:
+        exp_put(exp);
         return nfserr;
 }
 
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index d2f2c37dc2db..8ba1d888f1e6 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3221,7 +3221,7 @@ alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
         } else
                 nfs4_free_openowner(&oo->oo_owner);
         spin_unlock(&clp->cl_lock);
-        return oo;
+        return ret;
 }
 
 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
@@ -5062,7 +5062,7 @@ alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
         } else
                 nfs4_free_lockowner(&lo->lo_owner);
         spin_unlock(&clp->cl_lock);
-        return lo;
+        return ret;
 }
 
 static void
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index df5e66caf100..5fb7e78169a6 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1562,7 +1562,11 @@ nfsd4_decode_layoutget(struct nfsd4_compoundargs *argp,
         p = xdr_decode_hyper(p, &lgp->lg_seg.offset);
         p = xdr_decode_hyper(p, &lgp->lg_seg.length);
         p = xdr_decode_hyper(p, &lgp->lg_minlength);
-        nfsd4_decode_stateid(argp, &lgp->lg_sid);
+
+        status = nfsd4_decode_stateid(argp, &lgp->lg_sid);
+        if (status)
+                return status;
+
         READ_BUF(4);
         lgp->lg_maxcount = be32_to_cpup(p++);
 
@@ -1580,7 +1584,11 @@ nfsd4_decode_layoutcommit(struct nfsd4_compoundargs *argp,
         p = xdr_decode_hyper(p, &lcp->lc_seg.offset);
         p = xdr_decode_hyper(p, &lcp->lc_seg.length);
         lcp->lc_reclaim = be32_to_cpup(p++);
-        nfsd4_decode_stateid(argp, &lcp->lc_sid);
+
+        status = nfsd4_decode_stateid(argp, &lcp->lc_sid);
+        if (status)
+                return status;
+
         READ_BUF(4);
         lcp->lc_newoffset = be32_to_cpup(p++);
         if (lcp->lc_newoffset) {
@@ -1628,7 +1636,11 @@ nfsd4_decode_layoutreturn(struct nfsd4_compoundargs *argp,
                 READ_BUF(16);
                 p = xdr_decode_hyper(p, &lrp->lr_seg.offset);
                 p = xdr_decode_hyper(p, &lrp->lr_seg.length);
-                nfsd4_decode_stateid(argp, &lrp->lr_sid);
+
+                status = nfsd4_decode_stateid(argp, &lrp->lr_sid);
+                if (status)
+                        return status;
+
                 READ_BUF(4);
                 lrp->lrf_body_len = be32_to_cpup(p++);
                 if (lrp->lrf_body_len > 0) {
@@ -4123,7 +4135,7 @@ nfsd4_encode_layoutreturn(struct nfsd4_compoundres *resp, __be32 nfserr,
                 return nfserr_resource;
         *p++ = cpu_to_be32(lrp->lrs_present);
         if (lrp->lrs_present)
-                nfsd4_encode_stateid(xdr, &lrp->lr_sid);
+                return nfsd4_encode_stateid(xdr, &lrp->lr_sid);
         return nfs_ok;
 }
 #endif /* CONFIG_NFSD_PNFS */
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 83a9694ec485..46ec934f5dee 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -165,13 +165,17 @@ int nfsd_reply_cache_init(void)
 {
         unsigned int hashsize;
         unsigned int i;
+        int status = 0;
 
         max_drc_entries = nfsd_cache_size_limit();
         atomic_set(&num_drc_entries, 0);
         hashsize = nfsd_hashsize(max_drc_entries);
         maskbits = ilog2(hashsize);
 
-        register_shrinker(&nfsd_reply_cache_shrinker);
+        status = register_shrinker(&nfsd_reply_cache_shrinker);
+        if (status)
+                return status;
+
         drc_slab = kmem_cache_create("nfsd_drc", sizeof(struct svc_cacherep),
                                         0, 0, NULL);
         if (!drc_slab)
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 469086b9f99b..0c3f303baf32 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1907,6 +1907,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                                              struct the_nilfs *nilfs)
 {
         struct nilfs_inode_info *ii, *n;
+        int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
         int defer_iput = false;
 
         spin_lock(&nilfs->ns_inode_lock);
@@ -1919,10 +1920,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                 brelse(ii->i_bh);
                 ii->i_bh = NULL;
                 list_del_init(&ii->i_dirty);
-                if (!ii->vfs_inode.i_nlink) {
+                if (!ii->vfs_inode.i_nlink || during_mount) {
                         /*
-                         * Defer calling iput() to avoid a deadlock
-                         * over I_SYNC flag for inodes with i_nlink == 0
+                         * Defer calling iput() to avoid deadlocks if
+                         * i_nlink == 0 or mount is not yet finished.
                          */
                         list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
                         defer_iput = true;
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 9a66ff79ff27..d2f97ecca6a5 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -143,7 +143,8 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,
             !(marks_mask & FS_ISDIR & ~marks_ignored_mask))
                 return false;
 
-        if (event_mask & marks_mask & ~marks_ignored_mask)
+        if (event_mask & FAN_ALL_OUTGOING_EVENTS & marks_mask &
+                                 ~marks_ignored_mask)
                 return true;
 
         return false;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 46e0d4e857c7..ba1790e52ff2 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2394,7 +2394,6 @@ relock:
                 /*
                  * for completing the rest of the request.
                  */
-                *ppos += written;
                 count -= written;
                 written_buffered = generic_perform_write(file, from, *ppos);
                 /*
@@ -2409,7 +2408,6 @@ relock:
                         goto out_dio;
                 }
 
-                iocb->ki_pos = *ppos + written_buffered;
                 /* We need to ensure that the page cache pages are written to
                  * disk and invalidated to preserve the expected O_DIRECT
                  * semantics.
@@ -2418,6 +2416,7 @@ relock:
                 ret = filemap_write_and_wait_range(file->f_mapping, *ppos,
                                 endbyte);
                 if (ret == 0) {
+                        iocb->ki_pos = *ppos + written_buffered;
                         written += written_buffered;
                         invalidate_mapping_pages(mapping,
                                         *ppos >> PAGE_CACHE_SHIFT,
@@ -2440,10 +2439,14 @@ out_dio:
         /* buffered aio wouldn't have proper lock coverage today */
         BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
 
+        if (unlikely(written <= 0))
+                goto no_sync;
+
         if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
             ((file->f_flags & O_DIRECT) && !direct_io)) {
-                ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
-                                               *ppos + count - 1);
+                ret = filemap_fdatawrite_range(file->f_mapping,
+                                               iocb->ki_pos - written,
+                                               iocb->ki_pos - 1);
                 if (ret < 0)
                         written = ret;
 
@@ -2454,10 +2457,12 @@ out_dio:
                 }
 
                 if (!ret)
-                        ret = filemap_fdatawait_range(file->f_mapping, *ppos,
-                                                      *ppos + count - 1);
+                        ret = filemap_fdatawait_range(file->f_mapping,
+                                                      iocb->ki_pos - written,
+                                                      iocb->ki_pos - 1);
         }
 
+no_sync:
         /*
          * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
          * function pointer which is called when o_direct io completes so that
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 8490c64d34fe..460c6c37e683 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -502,7 +502,7 @@ static inline int ocfs2_writes_unwritten_extents(struct ocfs2_super *osb)
 
 static inline int ocfs2_supports_append_dio(struct ocfs2_super *osb)
 {
-        if (osb->s_feature_ro_compat & OCFS2_FEATURE_RO_COMPAT_APPEND_DIO)
+        if (osb->s_feature_incompat & OCFS2_FEATURE_INCOMPAT_APPEND_DIO)
                 return 1;
         return 0;
 }
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 20e37a3ed26f..db64ce2d4667 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -102,11 +102,11 @@
                                          | OCFS2_FEATURE_INCOMPAT_INDEXED_DIRS \
                                          | OCFS2_FEATURE_INCOMPAT_REFCOUNT_TREE \
                                          | OCFS2_FEATURE_INCOMPAT_DISCONTIG_BG  \
-                                         | OCFS2_FEATURE_INCOMPAT_CLUSTERINFO)
+                                         | OCFS2_FEATURE_INCOMPAT_CLUSTERINFO \
+                                         | OCFS2_FEATURE_INCOMPAT_APPEND_DIO)
 #define OCFS2_FEATURE_RO_COMPAT_SUPP    (OCFS2_FEATURE_RO_COMPAT_UNWRITTEN \
                                          | OCFS2_FEATURE_RO_COMPAT_USRQUOTA \
-                                         | OCFS2_FEATURE_RO_COMPAT_GRPQUOTA \
-                                         | OCFS2_FEATURE_RO_COMPAT_APPEND_DIO)
+                                         | OCFS2_FEATURE_RO_COMPAT_GRPQUOTA)
 
 /*
  * Heartbeat-only devices are missing journals and other files.  The
@@ -179,6 +179,11 @@
 #define OCFS2_FEATURE_INCOMPAT_CLUSTERINFO      0x4000
 
 /*
+ * Append Direct IO support
+ */
+#define OCFS2_FEATURE_INCOMPAT_APPEND_DIO       0x8000
+
+/*
  * backup superblock flag is used to indicate that this volume
  * has backup superblocks.
  */
@@ -200,10 +205,6 @@
 #define OCFS2_FEATURE_RO_COMPAT_USRQUOTA        0x0002
 #define OCFS2_FEATURE_RO_COMPAT_GRPQUOTA        0x0004
 
-/*
- * Append Direct IO support
- */
-#define OCFS2_FEATURE_RO_COMPAT_APPEND_DIO      0x0008
 
 /* The byte offset of the first backup block will be 1G.
  * The following will be 4G, 16G, 64G, 256G and 1T.
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index b90952f528b1..5f0d1993e6e3 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -529,8 +529,7 @@ static int ovl_remount(struct super_block *sb, int *flags, char *data)
 {
         struct ovl_fs *ufs = sb->s_fs_info;
 
-        if (!(*flags & MS_RDONLY) &&
-            (!ufs->upper_mnt || (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY)))
+        if (!(*flags & MS_RDONLY) && !ufs->upper_mnt)
                 return -EROFS;
 
         return 0;
@@ -615,9 +614,19 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
                         break;
 
                 default:
+                        pr_err("overlayfs: unrecognized mount option \"%s\" or missing value\n", p);
                         return -EINVAL;
                 }
         }
+
+        /* Workdir is useless in non-upper mount */
+        if (!config->upperdir && config->workdir) {
+                pr_info("overlayfs: option \"workdir=%s\" is useless in a non-upper mount, ignore\n",
+                        config->workdir);
+                kfree(config->workdir);
+                config->workdir = NULL;
+        }
+
         return 0;
 }
 
@@ -837,7 +846,6 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 
         sb->s_stack_depth = 0;
         if (ufs->config.upperdir) {
-                /* FIXME: workdir is not needed for a R/O mount */
                 if (!ufs->config.workdir) {
                         pr_err("overlayfs: missing 'workdir'\n");
                         goto out_free_config;
@@ -847,6 +855,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                 if (err)
                         goto out_free_config;
 
+                /* Upper fs should not be r/o */
+                if (upperpath.mnt->mnt_sb->s_flags & MS_RDONLY) {
+                        pr_err("overlayfs: upper fs is r/o, try multi-lower layers mount\n");
+                        err = -EINVAL;
+                        goto out_put_upperpath;
+                }
+
                 err = ovl_mount_dir(ufs->config.workdir, &workpath);
                 if (err)
                         goto out_put_upperpath;
@@ -869,8 +884,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 
         err = -EINVAL;
         stacklen = ovl_split_lowerdirs(lowertmp);
-        if (stacklen > OVL_MAX_STACK)
+        if (stacklen > OVL_MAX_STACK) {
+                pr_err("overlayfs: too many lower directries, limit is %d\n",
+                       OVL_MAX_STACK);
                 goto out_free_lowertmp;
+        } else if (!ufs->config.upperdir && stacklen == 1) {
+                pr_err("overlayfs: at least 2 lowerdir are needed while upperdir nonexistent\n");
+                goto out_free_lowertmp;
+        }
 
         stack = kcalloc(stacklen, sizeof(struct path), GFP_KERNEL);
         if (!stack)
@@ -932,8 +953,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                 ufs->numlower++;
         }
 
-        /* If the upper fs is r/o or nonexistent, we mark overlayfs r/o too */
-        if (!ufs->upper_mnt || (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY))
+        /* If the upper fs is nonexistent, we mark overlayfs r/o too */
+        if (!ufs->upper_mnt)
                 sb->s_flags |= MS_RDONLY;
 
         sb->s_d_op = &ovl_dentry_operations;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 956b75d61809..6dee68d013ff 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1325,6 +1325,9 @@ out:
 
 static int pagemap_open(struct inode *inode, struct file *file)
 {
+        /* do not disclose physical addresses: attack vector */
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
         pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
                         "to stop being page-shift some time soon. See the "
                         "linux/Documentation/vm/pagemap.txt for details.\n");
diff --git a/include/dt-bindings/pinctrl/am33xx.h b/include/dt-bindings/pinctrl/am33xx.h
index 2fbc804e1a45..226f77246a70 100644
--- a/include/dt-bindings/pinctrl/am33xx.h
+++ b/include/dt-bindings/pinctrl/am33xx.h
@@ -13,7 +13,8 @@
 
 #define PULL_DISABLE            (1 << 3)
 #define INPUT_EN                (1 << 5)
-#define SLEWCTRL_FAST           (1 << 6)
+#define SLEWCTRL_SLOW           (1 << 6)
+#define SLEWCTRL_FAST           0
 
 /* update macro depending on INPUT_EN and PULL_ENA */
 #undef PIN_OUTPUT
diff --git a/include/dt-bindings/pinctrl/am43xx.h b/include/dt-bindings/pinctrl/am43xx.h
index 9c2e4f82381e..5f4d01898c9c 100644
--- a/include/dt-bindings/pinctrl/am43xx.h
+++ b/include/dt-bindings/pinctrl/am43xx.h
@@ -18,7 +18,8 @@
 #define PULL_DISABLE            (1 << 16)
 #define PULL_UP                 (1 << 17)
 #define INPUT_EN                (1 << 18)
-#define SLEWCTRL_FAST           (1 << 19)
+#define SLEWCTRL_SLOW           (1 << 19)
+#define SLEWCTRL_FAST           0
 #define DS0_PULL_UP_DOWN_EN     (1 << 27)
 
 #define PIN_OUTPUT              (PULL_DISABLE)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index c294e3e25e37..a1b25e35ea5f 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -181,7 +181,9 @@ enum rq_flag_bits {
         __REQ_ELVPRIV,          /* elevator private data attached */
         __REQ_FAILED,           /* set if the request failed */
         __REQ_QUIET,            /* don't worry about errors */
-        __REQ_PREEMPT,          /* set for "ide_preempt" requests */
+        __REQ_PREEMPT,          /* set for "ide_preempt" requests and also
+                                   for requests for which the SCSI "quiesce"
+                                   state must be ignored. */
         __REQ_ALLOCED,          /* request came from our alloc pool */
         __REQ_COPY_USER,        /* contains copies of user pages */
         __REQ_FLUSH_SEQ,        /* request for flush sequence */
diff --git a/include/linux/clk.h b/include/linux/clk.h
index 8381bbfbc308..68c16a6bedb3 100644
--- a/include/linux/clk.h
+++ b/include/linux/clk.h
@@ -125,6 +125,19 @@ int clk_set_phase(struct clk *clk, int degrees);
  */
 int clk_get_phase(struct clk *clk);
 
+/**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q);
+
 #else
 
 static inline long clk_get_accuracy(struct clk *clk)
@@ -142,6 +155,11 @@ static inline long clk_get_phase(struct clk *clk)
         return -ENOTSUPP;
 }
 
+static inline bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        return p == q;
+}
+
 #endif
 
 /**
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 306178d7309f..9c5e89254796 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -77,7 +77,6 @@ struct cpuidle_device {
         unsigned int            cpu;
 
         int                     last_residency;
-        int                     state_count;
         struct cpuidle_state_usage      states_usage[CPUIDLE_STATE_MAX];
         struct cpuidle_state_kobj *kobjs[CPUIDLE_STATE_MAX];
         struct cpuidle_driver_kobj *kobj_driver;
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 2646aed1d3fe..fd23978d93fe 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -375,6 +375,7 @@ int dm_create(int minor, struct mapped_device **md);
  */
 struct mapped_device *dm_get_md(dev_t dev);
 void dm_get(struct mapped_device *md);
+int dm_hold(struct mapped_device *md);
 void dm_put(struct mapped_device *md);
 
 /*
diff --git a/include/linux/dmapool.h b/include/linux/dmapool.h
index 022e34fcbd1b..52456aa566a0 100644
--- a/include/linux/dmapool.h
+++ b/include/linux/dmapool.h
@@ -14,6 +14,8 @@
 #include <asm/io.h>
 #include <asm/scatterlist.h>
 
+struct device;
+
 struct dma_pool *dma_pool_create(const char *name, struct device *dev, 
                         size_t size, size_t align, size_t allocation);
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index b4d71b5e1ff2..52cc4492cb3a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -604,6 +604,7 @@ struct inode {
         struct mutex            i_mutex;
 
         unsigned long           dirtied_when;   /* jiffies of first dirtying */
+        unsigned long           dirtied_time_when;
 
         struct hlist_node       i_hash;
         struct list_head        i_wb_list;      /* backing dev IO list */
@@ -1548,7 +1549,7 @@ struct file_operations {
         long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
         long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
         int (*mmap) (struct file *, struct vm_area_struct *);
-        void (*mremap)(struct file *, struct vm_area_struct *);
+        int (*mremap)(struct file *, struct vm_area_struct *);
         int (*open) (struct inode *, struct file *);
         int (*flush) (struct file *, fl_owner_t id);
         int (*release) (struct inode *, struct file *);
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 800544bc7bfd..ffbc034c8810 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -126,8 +126,23 @@
 #define GICR_PROPBASER_WaWb             (5U << 7)
 #define GICR_PROPBASER_RaWaWt           (6U << 7)
 #define GICR_PROPBASER_RaWaWb           (7U << 7)
+#define GICR_PROPBASER_CACHEABILITY_MASK (7U << 7)
 #define GICR_PROPBASER_IDBITS_MASK      (0x1f)
 
+#define GICR_PENDBASER_NonShareable     (0U << 10)
+#define GICR_PENDBASER_InnerShareable   (1U << 10)
+#define GICR_PENDBASER_OuterShareable   (2U << 10)
+#define GICR_PENDBASER_SHAREABILITY_MASK (3UL << 10)
+#define GICR_PENDBASER_nCnB             (0U << 7)
+#define GICR_PENDBASER_nC               (1U << 7)
+#define GICR_PENDBASER_RaWt             (2U << 7)
+#define GICR_PENDBASER_RaWb             (3U << 7)
+#define GICR_PENDBASER_WaWt             (4U << 7)
+#define GICR_PENDBASER_WaWb             (5U << 7)
+#define GICR_PENDBASER_RaWaWt           (6U << 7)
+#define GICR_PENDBASER_RaWaWb           (7U << 7)
+#define GICR_PENDBASER_CACHEABILITY_MASK (7U << 7)
+
 /*
  * Re-Distributor registers, offsets from SGI_base
  */
@@ -166,6 +181,11 @@
 
 #define GITS_TRANSLATER                 0x10040
 
+#define GITS_CTLR_ENABLE                (1U << 0)
+#define GITS_CTLR_QUIESCENT             (1U << 31)
+
+#define GITS_TYPER_DEVBITS_SHIFT        13
+#define GITS_TYPER_DEVBITS(r)           ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
 #define GITS_TYPER_PTA                  (1UL << 19)
 
 #define GITS_CBASER_VALID               (1UL << 63)
@@ -177,6 +197,7 @@
 #define GITS_CBASER_WaWb                (5UL << 59)
 #define GITS_CBASER_RaWaWt              (6UL << 59)
 #define GITS_CBASER_RaWaWb              (7UL << 59)
+#define GITS_CBASER_CACHEABILITY_MASK   (7UL << 59)
 #define GITS_CBASER_NonShareable        (0UL << 10)
 #define GITS_CBASER_InnerShareable      (1UL << 10)
 #define GITS_CBASER_OuterShareable      (2UL << 10)
@@ -193,6 +214,7 @@
 #define GITS_BASER_WaWb                 (5UL << 59)
 #define GITS_BASER_RaWaWt               (6UL << 59)
 #define GITS_BASER_RaWaWb               (7UL << 59)
+#define GITS_BASER_CACHEABILITY_MASK    (7UL << 59)
 #define GITS_BASER_TYPE_SHIFT           (56)
 #define GITS_BASER_TYPE(r)              (((r) >> GITS_BASER_TYPE_SHIFT) & 7)
 #define GITS_BASER_ENTRY_SIZE_SHIFT     (48)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 72ba725ddf9c..5bb074431eb0 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -5,6 +5,7 @@
 
 struct kmem_cache;
 struct page;
+struct vm_struct;
 
 #ifdef CONFIG_KASAN
 
@@ -49,15 +50,11 @@ void kasan_krealloc(const void *object, size_t new_size);
 void kasan_slab_alloc(struct kmem_cache *s, void *object);
 void kasan_slab_free(struct kmem_cache *s, void *object);
 
-#define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
-
 int kasan_module_alloc(void *addr, size_t size);
-void kasan_module_free(void *addr);
+void kasan_free_shadow(const struct vm_struct *vm);
 
 #else /* CONFIG_KASAN */
 
-#define MODULE_ALIGN 1
-
 static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
 
 static inline void kasan_enable_current(void) {}
@@ -82,7 +79,7 @@ static inline void kasan_slab_alloc(struct kmem_cache *s, void *object) {}
 static inline void kasan_slab_free(struct kmem_cache *s, void *object) {}
 
 static inline int kasan_module_alloc(void *addr, size_t size) { return 0; }
-static inline void kasan_module_free(void *addr) {}
+static inline void kasan_free_shadow(const struct vm_struct *vm) {}
 
 #endif /* CONFIG_KASAN */
 
diff --git a/include/linux/lcm.h b/include/linux/lcm.h
index 7bf01d779b45..1ce79a7f1daa 100644
--- a/include/linux/lcm.h
+++ b/include/linux/lcm.h
@@ -4,5 +4,6 @@
 #include <linux/compiler.h>
 
 unsigned long lcm(unsigned long a, unsigned long b) __attribute_const__;
+unsigned long lcm_not_zero(unsigned long a, unsigned long b) __attribute_const__;
 
 #endif /* _LCM_H */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index fc03efa64ffe..6b08cc106c21 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -232,6 +232,7 @@ enum {
                                               * led */
         ATA_FLAG_NO_DIPM        = (1 << 23), /* host not happy with DIPM */
         ATA_FLAG_LOWTAG         = (1 << 24), /* host wants lowest available tag */
+        ATA_FLAG_SAS_HOST       = (1 << 25), /* SAS host */
 
         /* bits 24:31 of ap->flags are reserved for LLD specific flags */
 
diff --git a/include/linux/mfd/palmas.h b/include/linux/mfd/palmas.h
index fb0390a1a498..ee7b1ce7a6f8 100644
--- a/include/linux/mfd/palmas.h
+++ b/include/linux/mfd/palmas.h
@@ -2999,6 +2999,9 @@ enum usb_irq_events {
 #define PALMAS_GPADC_TRIM15                                     0x0E
 #define PALMAS_GPADC_TRIM16                                     0x0F
 
+/* TPS659038 regen2_ctrl offset iss different from palmas */
+#define TPS659038_REGEN2_CTRL                                   0x12
+
 /* TPS65917 Interrupt registers */
 
 /* Registers for function INTERRUPT */
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index f279d9c158cd..2782df47101e 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -474,16 +474,15 @@ struct zone {
         unsigned long           wait_table_bits;
 
         ZONE_PADDING(_pad1_)
-
-        /* Write-intensive fields used from the page allocator */
-        spinlock_t              lock;
-
         /* free areas of different sizes */
         struct free_area        free_area[MAX_ORDER];
 
         /* zone flags, see below */
         unsigned long           flags;
 
+        /* Write-intensive fields used from the page allocator */
+        spinlock_t              lock;
+
         ZONE_PADDING(_pad2_)
 
         /* Write-intensive fields used by page reclaim */
diff --git a/include/linux/module.h b/include/linux/module.h
index 42999fe2dbd0..b03485bcb82a 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -344,6 +344,10 @@ struct module {
         unsigned long *ftrace_callsites;
 #endif
 
+#ifdef CONFIG_LIVEPATCH
+        bool klp_alive;
+#endif
+
 #ifdef CONFIG_MODULE_UNLOAD
         /* What modules depend on me? */
         struct list_head source_list;
diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
index f7556261fe3c..4d0cb9bba93e 100644
--- a/include/linux/moduleloader.h
+++ b/include/linux/moduleloader.h
@@ -84,4 +84,12 @@ void module_arch_cleanup(struct module *mod);
 
 /* Any cleanup before freeing mod->module_init */
 void module_arch_freeing_init(struct module *mod);
+
+#ifdef CONFIG_KASAN
+#include <linux/kasan.h>
+#define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
+#else
+#define MODULE_ALIGN PAGE_SIZE
+#endif
+
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 429d1790a27e..278738873703 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -965,9 +965,12 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
  *      Used to add FDB entries to dump requests. Implementers should add
  *      entries to skb and update idx with the number of entries.
  *
- * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
+ * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh,
+ *                           u16 flags)
  * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
  *                           struct net_device *dev, u32 filter_mask)
+ * int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh,
+ *                           u16 flags);
  *
  * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
  *      Called to change device carrier. Soft-devices (like dummy, team, etc)
@@ -2182,6 +2185,12 @@ void netdev_freemem(struct net_device *dev);
 void synchronize_net(void);
 int init_dummy_netdev(struct net_device *dev);
 
+DECLARE_PER_CPU(int, xmit_recursion);
+static inline int dev_recursion_level(void)
+{
+        return this_cpu_read(xmit_recursion);
+}
+
 struct net_device *dev_get_by_index(struct net *net, int ifindex);
 struct net_device *__dev_get_by_index(struct net *net, int ifindex);
 struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h
index 8a860f096c35..611a691145c4 100644
--- a/include/linux/of_platform.h
+++ b/include/linux/of_platform.h
@@ -84,7 +84,7 @@ static inline int of_platform_populate(struct device_node *root,
 static inline void of_platform_depopulate(struct device *parent) { }
 #endif
 
-#ifdef CONFIG_OF_DYNAMIC
+#if defined(CONFIG_OF_DYNAMIC) && defined(CONFIG_OF_ADDRESS)
 extern void of_platform_register_reconfig_notifier(void);
 #else
 static inline void of_platform_register_reconfig_notifier(void) { }
diff --git a/include/linux/pinctrl/consumer.h b/include/linux/pinctrl/consumer.h
index 72c0415d6c21..18eccefea06e 100644
--- a/include/linux/pinctrl/consumer.h
+++ b/include/linux/pinctrl/consumer.h
@@ -82,7 +82,7 @@ static inline int pinctrl_gpio_direction_output(unsigned gpio)
 
 static inline struct pinctrl * __must_check pinctrl_get(struct device *dev)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 
 static inline void pinctrl_put(struct pinctrl *p)
@@ -93,7 +93,7 @@ static inline struct pinctrl_state * __must_check pinctrl_lookup_state(
                                                         struct pinctrl *p,
                                                         const char *name)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 
 static inline int pinctrl_select_state(struct pinctrl *p,
@@ -104,7 +104,7 @@ static inline int pinctrl_select_state(struct pinctrl *p,
 
 static inline struct pinctrl * __must_check devm_pinctrl_get(struct device *dev)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 
 static inline void devm_pinctrl_put(struct pinctrl *p)
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index d4ad5b5a02bb..045f709cb89b 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -316,7 +316,7 @@ struct regulator_desc {
  * @driver_data: private regulator data
  * @of_node: OpenFirmware node to parse for device tree bindings (may be
  *           NULL).
- * @regmap: regmap to use for core regmap helpers if dev_get_regulator() is
+ * @regmap: regmap to use for core regmap helpers if dev_get_regmap() is
  *          insufficient.
  * @ena_gpio_initialized: GPIO controlling regulator enable was properly
  *                        initialized, meaning that >= 0 is a valid gpio
diff --git a/include/linux/sched.h b/include/linux/sched.h
index be98910cc1e2..51348f77e431 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1633,11 +1633,11 @@ struct task_struct {
 
         /*
          * numa_faults_locality tracks if faults recorded during the last
-         * scan window were remote/local. The task scan period is adapted
-         * based on the locality of the faults with different weights
-         * depending on whether they were shared or private faults
+         * scan window were remote/local or failed to migrate. The task scan
+         * period is adapted based on the locality of the faults with different
+         * weights depending on whether they were shared or private faults
          */
-        unsigned long numa_faults_locality[2];
+        unsigned long numa_faults_locality[3];
 
         unsigned long numa_pages_migrated;
 #endif /* CONFIG_NUMA_BALANCING */
@@ -1727,6 +1727,7 @@ struct task_struct {
 #define TNF_NO_GROUP    0x02
 #define TNF_SHARED      0x04
 #define TNF_FAULT_LOCAL 0x08
+#define TNF_MIGRATE_FAIL 0x10
 
 #ifdef CONFIG_NUMA_BALANCING
 extern void task_numa_fault(int last_node, int node, int pages, int flags);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 30007afe70b3..f54d6659713a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -948,6 +948,13 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from)
         to->l4_hash = from->l4_hash;
 };
 
+static inline void skb_sender_cpu_clear(struct sk_buff *skb)
+{
+#ifdef CONFIG_XPS
+        skb->sender_cpu = 0;
+#endif
+}
+
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
 static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
 {
diff --git a/include/linux/sunrpc/debug.h b/include/linux/sunrpc/debug.h
index c57d8ea0716c..59a7889e15db 100644
--- a/include/linux/sunrpc/debug.h
+++ b/include/linux/sunrpc/debug.h
@@ -60,17 +60,17 @@ struct rpc_xprt;
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 void            rpc_register_sysctl(void);
 void            rpc_unregister_sysctl(void);
-int             sunrpc_debugfs_init(void);
+void            sunrpc_debugfs_init(void);
 void            sunrpc_debugfs_exit(void);
-int             rpc_clnt_debugfs_register(struct rpc_clnt *);
+void            rpc_clnt_debugfs_register(struct rpc_clnt *);
 void            rpc_clnt_debugfs_unregister(struct rpc_clnt *);
-int             rpc_xprt_debugfs_register(struct rpc_xprt *);
+void            rpc_xprt_debugfs_register(struct rpc_xprt *);
 void            rpc_xprt_debugfs_unregister(struct rpc_xprt *);
 #else
-static inline int
+static inline void
 sunrpc_debugfs_init(void)
 {
-        return 0;
+        return;
 }
 
 static inline void
@@ -79,10 +79,10 @@ sunrpc_debugfs_exit(void)
         return;
 }
 
-static inline int
+static inline void
 rpc_clnt_debugfs_register(struct rpc_clnt *clnt)
 {
-        return 0;
+        return;
 }
 
 static inline void
@@ -91,10 +91,10 @@ rpc_clnt_debugfs_unregister(struct rpc_clnt *clnt)
         return;
 }
 
-static inline int
+static inline void
 rpc_xprt_debugfs_register(struct rpc_xprt *xprt)
 {
-        return 0;
+        return;
 }
 
 static inline void
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 07a022641996..71880299ed48 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -98,6 +98,8 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, struct page ***pages,
                         size_t maxsize, size_t *start);
 int iov_iter_npages(const struct iov_iter *i, int maxpages);
 
+const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags);
+
 static inline size_t iov_iter_count(struct iov_iter *i)
 {
         return i->count;
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index d9a4905e01d0..6e0ce8c7b8cb 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -227,9 +227,23 @@ struct skb_data {	/* skb->cb is one of these */
         struct urb              *urb;
         struct usbnet           *dev;
         enum skb_state          state;
-        size_t                  length;
+        long                    length;
+        unsigned long           packets;
 };
 
+/* Drivers that set FLAG_MULTI_PACKET must call this in their
+ * tx_fixup method before returning an skb.
+ */
+static inline void
+usbnet_set_skb_tx_stats(struct sk_buff *skb,
+                        unsigned long packets, long bytes_delta)
+{
+        struct skb_data *entry = (struct skb_data *) skb->cb;
+
+        entry->packets = packets;
+        entry->length = bytes_delta;
+}
+
 extern int usbnet_open(struct net_device *net);
 extern int usbnet_stop(struct net_device *net);
 extern netdev_tx_t usbnet_start_xmit(struct sk_buff *skb,
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 7d7acb35603d..0ec598381f97 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -17,6 +17,7 @@ struct vm_area_struct;		/* vma defining user mapping in mm_types.h */
 #define VM_VPAGES               0x00000010      /* buffer for pages was vmalloc'ed */
 #define VM_UNINITIALIZED        0x00000020      /* vm_struct is not fully initialized */
 #define VM_NO_GUARD             0x00000040      /* don't add guard page */
+#define VM_KASAN                0x00000080      /* has allocated kasan shadow memory */
 /* bits [20..32] reserved for arch specific ioremap internals */
 
 /*
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index 00048339c23e..b2dd371ec0ca 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -130,6 +130,7 @@ extern int vm_dirty_ratio;
 extern unsigned long vm_dirty_bytes;
 extern unsigned int dirty_writeback_interval;
 extern unsigned int dirty_expire_interval;
+extern unsigned int dirtytime_expire_interval;
 extern int vm_highmem_is_dirtyable;
 extern int block_dump;
 extern int laptop_mode;
@@ -146,6 +147,8 @@ extern int dirty_ratio_handler(struct ctl_table *table, int write,
 extern int dirty_bytes_handler(struct ctl_table *table, int write,
                 void __user *buffer, size_t *lenp,
                 loff_t *ppos);
+int dirtytime_interval_handler(struct ctl_table *table, int write,
+                               void __user *buffer, size_t *lenp, loff_t *ppos);
 
 struct ctl_table;
 int dirty_writeback_centisecs_handler(struct ctl_table *, int,
diff --git a/include/media/atmel-isi.h b/include/media/atmel-isi.h
index c2e570336269..6008b0985b7b 100644
--- a/include/media/atmel-isi.h
+++ b/include/media/atmel-isi.h
@@ -59,6 +59,10 @@
 #define         ISI_CFG1_FRATE_DIV_MASK         (7 << 8)
 #define ISI_CFG1_DISCR                          (1 << 11)
 #define ISI_CFG1_FULL_MODE                      (1 << 12)
+/* Definition for THMASK(ISI_V2) */
+#define         ISI_CFG1_THMASK_BEATS_4         (0 << 13)
+#define         ISI_CFG1_THMASK_BEATS_8         (1 << 13)
+#define         ISI_CFG1_THMASK_BEATS_16        (2 << 13)
 
 /* Bitfields in CFG2 */
 #define ISI_CFG2_GRAYSCALE                      (1 << 13)
diff --git a/include/net/dst.h b/include/net/dst.h
index a8ae4e760778..0fb99a26e973 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -481,6 +481,7 @@ void dst_init(void);
 enum {
         XFRM_LOOKUP_ICMP = 1 << 0,
         XFRM_LOOKUP_QUEUE = 1 << 1,
+        XFRM_LOOKUP_KEEP_DST_REF = 1 << 2,
 };
 
 struct flowi;
diff --git a/include/net/ip.h b/include/net/ip.h
index 025c61c0dffb..6cc1eafb153a 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -453,22 +453,6 @@ static __inline__ void inet_reset_saddr(struct sock *sk)
 
 #endif
 
-static inline int sk_mc_loop(struct sock *sk)
-{
-        if (!sk)
-                return 1;
-        switch (sk->sk_family) {
-        case AF_INET:
-                return inet_sk(sk)->mc_loop;
-#if IS_ENABLED(CONFIG_IPV6)
-        case AF_INET6:
-                return inet6_sk(sk)->mc_loop;
-#endif
-        }
-        WARN_ON(1);
-        return 1;
-}
-
 bool ip_call_ra_chain(struct sk_buff *skb);
 
 /*
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 1d09b46c1e48..eda131d179d9 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -174,7 +174,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 
 static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
 {
-        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+        struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+                                inet6_sk(skb->sk) : NULL;
 
         return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ?
                skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index 534e1f2ac4fc..57639fca223a 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -79,6 +79,16 @@ void nf_log_packet(struct net *net,
                    const struct nf_loginfo *li,
                    const char *fmt, ...);
 
+__printf(8, 9)
+void nf_log_trace(struct net *net,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *li,
+                  const char *fmt, ...);
+
 struct nf_log_buf;
 
 struct nf_log_buf *nf_log_buf_open(void);
diff --git a/include/net/sock.h b/include/net/sock.h
index ab186b1d31ff..e4079c28e6b8 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1762,6 +1762,8 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie);
 
 struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie);
 
+bool sk_mc_loop(struct sock *sk);
+
 static inline bool sk_can_gso(const struct sock *sk)
 {
         return net_gso_ok(sk->sk_route_caps, sk->sk_gso_type);
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index eabd3a038674..c73e7abbbaa5 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -91,6 +91,7 @@ struct vxlanhdr {
 
 #define VXLAN_N_VID     (1u << 24)
 #define VXLAN_VID_MASK  (VXLAN_N_VID - 1)
+#define VXLAN_VNI_MASK  (VXLAN_VID_MASK << 8)
 #define VXLAN_HLEN (sizeof(struct udphdr) + sizeof(struct vxlanhdr))
 
 struct vxlan_metadata {
diff --git a/include/soc/at91/at91sam9_ddrsdr.h b/include/soc/at91/at91sam9_ddrsdr.h
index 0210797abf2e..dc10c52e0e91 100644
--- a/include/soc/at91/at91sam9_ddrsdr.h
+++ b/include/soc/at91/at91sam9_ddrsdr.h
@@ -92,7 +92,7 @@
 #define         AT91_DDRSDRC_UPD_MR     (3 << 20)        /* Update load mode register and extended mode register */
 
 #define AT91_DDRSDRC_MDR        0x20    /* Memory Device Register */
-#define         AT91_DDRSDRC_MD         (3 << 0)                /* Memory Device Type */
+#define         AT91_DDRSDRC_MD         (7 << 0)        /* Memory Device Type */
 #define                 AT91_DDRSDRC_MD_SDR             0
 #define                 AT91_DDRSDRC_MD_LOW_POWER_SDR   1
 #define                 AT91_DDRSDRC_MD_LOW_POWER_DDR   3
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index db81c65b8f48..d61be7297b2c 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -111,6 +111,7 @@ void	array_free(void *array, int n);
 void    target_core_setup_sub_cits(struct se_subsystem_api *);
 
 /* attribute helpers from target_core_device.c for backend drivers */
+bool    se_dev_check_wce(struct se_device *);
 int     se_dev_set_max_unmap_lba_count(struct se_device *, u32);
 int     se_dev_set_max_unmap_block_desc_count(struct se_device *, u32);
 int     se_dev_set_unmap_granularity(struct se_device *, u32);
diff --git a/include/trace/events/regmap.h b/include/trace/events/regmap.h
index 23d561512f64..22317d2b52ab 100644
--- a/include/trace/events/regmap.h
+++ b/include/trace/events/regmap.h
@@ -7,27 +7,26 @@
 #include <linux/ktime.h>
 #include <linux/tracepoint.h>
 
-struct device;
-struct regmap;
+#include "../../../drivers/base/regmap/internal.h"
 
 /*
  * Log register events
  */
 DECLARE_EVENT_CLASS(regmap_reg,
 
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                  unsigned int val),
 
-        TP_ARGS(dev, reg, val),
+        TP_ARGS(map, reg, val),
 
         TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
-                __field(        unsigned int,   reg             )
-                __field(        unsigned int,   val             )
+                __string(       name,           regmap_name(map)        )
+                __field(        unsigned int,   reg                     )
+                __field(        unsigned int,   val                     )
         ),
 
         TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                 __entry->reg = reg;
                 __entry->val = val;
         ),
@@ -39,45 +38,45 @@ DECLARE_EVENT_CLASS(regmap_reg,
 
 DEFINE_EVENT(regmap_reg, regmap_reg_write,
 
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                  unsigned int val),
 
-        TP_ARGS(dev, reg, val)
+        TP_ARGS(map, reg, val)
 
 );
 
 DEFINE_EVENT(regmap_reg, regmap_reg_read,
 
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                  unsigned int val),
 
-        TP_ARGS(dev, reg, val)
+        TP_ARGS(map, reg, val)
 
 );
 
 DEFINE_EVENT(regmap_reg, regmap_reg_read_cache,
 
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                  unsigned int val),
 
-        TP_ARGS(dev, reg, val)
+        TP_ARGS(map, reg, val)
 
 );
 
 DECLARE_EVENT_CLASS(regmap_block,
 
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-        TP_ARGS(dev, reg, count),
+        TP_ARGS(map, reg, count),
 
         TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
-                __field(        unsigned int,   reg             )
-                __field(        int,            count           )
+                __string(       name,           regmap_name(map)        )
+                __field(        unsigned int,   reg                     )
+                __field(        int,            count                   )
         ),
 
         TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                 __entry->reg = reg;
                 __entry->count = count;
         ),
@@ -89,48 +88,48 @@ DECLARE_EVENT_CLASS(regmap_block,
 
 DEFINE_EVENT(regmap_block, regmap_hw_read_start,
 
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_block, regmap_hw_read_done,
 
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_block, regmap_hw_write_start,
 
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_block, regmap_hw_write_done,
 
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 
 TRACE_EVENT(regcache_sync,
 
-        TP_PROTO(struct device *dev, const char *type,
+        TP_PROTO(struct regmap *map, const char *type,
                  const char *status),
 
-        TP_ARGS(dev, type, status),
+        TP_ARGS(map, type, status),
 
         TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
-                __string(       status,         status          )
-                __string(       type,           type            )
-                __field(        int,            type            )
+                __string(       name,           regmap_name(map)        )
+                __string(       status,         status                  )
+                __string(       type,           type                    )
+                __field(        int,            type                    )
         ),
 
         TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                 __assign_str(status, status);
                 __assign_str(type, type);
         ),
@@ -141,17 +140,17 @@ TRACE_EVENT(regcache_sync,
 
 DECLARE_EVENT_CLASS(regmap_bool,
 
-        TP_PROTO(struct device *dev, bool flag),
+        TP_PROTO(struct regmap *map, bool flag),
 
-        TP_ARGS(dev, flag),
+        TP_ARGS(map, flag),
 
         TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
-                __field(        int,            flag            )
+                __string(       name,           regmap_name(map)        )
+                __field(        int,            flag                    )
         ),
 
         TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                 __entry->flag = flag;
         ),
 
@@ -161,32 +160,32 @@ DECLARE_EVENT_CLASS(regmap_bool,
 
 DEFINE_EVENT(regmap_bool, regmap_cache_only,
 
-        TP_PROTO(struct device *dev, bool flag),
+        TP_PROTO(struct regmap *map, bool flag),
 
-        TP_ARGS(dev, flag)
+        TP_ARGS(map, flag)
 
 );
 
 DEFINE_EVENT(regmap_bool, regmap_cache_bypass,
 
-        TP_PROTO(struct device *dev, bool flag),
+        TP_PROTO(struct regmap *map, bool flag),
 
-        TP_ARGS(dev, flag)
+        TP_ARGS(map, flag)
 
 );
 
 DECLARE_EVENT_CLASS(regmap_async,
 
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
 
-        TP_ARGS(dev),
+        TP_ARGS(map),
 
         TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
+                __string(       name,           regmap_name(map)        )
         ),
 
         TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
         ),
 
         TP_printk("%s", __get_str(name))
@@ -194,50 +193,50 @@ DECLARE_EVENT_CLASS(regmap_async,
 
 DEFINE_EVENT(regmap_block, regmap_async_write_start,
 
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_async, regmap_async_io_complete,
 
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
 
-        TP_ARGS(dev)
+        TP_ARGS(map)
 
 );
 
 DEFINE_EVENT(regmap_async, regmap_async_complete_start,
 
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
 
-        TP_ARGS(dev)
+        TP_ARGS(map)
 
 );
 
 DEFINE_EVENT(regmap_async, regmap_async_complete_done,
 
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
 
-        TP_ARGS(dev)
+        TP_ARGS(map)
 
 );
 
 TRACE_EVENT(regcache_drop_region,
 
-        TP_PROTO(struct device *dev, unsigned int from,
+        TP_PROTO(struct regmap *map, unsigned int from,
                  unsigned int to),
 
-        TP_ARGS(dev, from, to),
+        TP_ARGS(map, from, to),
 
         TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
-                __field(        unsigned int,   from            )
-                __field(        unsigned int,   to              )
+                __string(       name,           regmap_name(map)        )
+                __field(        unsigned int,   from                    )
+                __field(        unsigned int,   to                      )
         ),
 
         TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                 __entry->from = from;
                 __entry->to = to;
         ),
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index b0a813079852..2f62ab2d7bf9 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -973,7 +973,8 @@ struct input_keymap_entry {
  */
 #define MT_TOOL_FINGER          0
 #define MT_TOOL_PEN             1
-#define MT_TOOL_MAX             1
+#define MT_TOOL_PALM            2
+#define MT_TOOL_MAX             2
 
 /*
  * Values describing the status of a force-feedback effect
diff --git a/include/uapi/linux/nfsd/export.h b/include/uapi/linux/nfsd/export.h
index 4742f2cb42f2..d3bd6ffec041 100644
--- a/include/uapi/linux/nfsd/export.h
+++ b/include/uapi/linux/nfsd/export.h
@@ -47,7 +47,7 @@
  * exported filesystem.
  */
 #define NFSEXP_V4ROOT           0x10000
-#define NFSEXP_NOPNFS           0x20000
+#define NFSEXP_PNFS             0x20000
 
 /* All flags that we claim to support.  (Note we don't support NOACL.) */
 #define NFSEXP_ALLFLAGS         0x3FE7F
diff --git a/include/uapi/linux/virtio_blk.h b/include/uapi/linux/virtio_blk.h
index 3c53eec4ae22..19c66fcbab8a 100644
--- a/include/uapi/linux/virtio_blk.h
+++ b/include/uapi/linux/virtio_blk.h
@@ -60,7 +60,7 @@ struct virtio_blk_config {
         __u32 size_max;
         /* The maximum number of segments (if VIRTIO_BLK_F_SEG_MAX) */
         __u32 seg_max;
-        /* geometry the device (if VIRTIO_BLK_F_GEOMETRY) */
+        /* geometry of the device (if VIRTIO_BLK_F_GEOMETRY) */
         struct virtio_blk_geometry {
                 __u16 cylinders;
                 __u8 heads;
@@ -119,7 +119,11 @@ struct virtio_blk_config {
 #define VIRTIO_BLK_T_BARRIER    0x80000000
 #endif /* !VIRTIO_BLK_NO_LEGACY */
 
-/* This is the first element of the read scatter-gather list. */
+/*
+ * This comes first in the read scatter-gather list.
+ * For legacy virtio, if VIRTIO_F_ANY_LAYOUT is not negotiated,
+ * this is the first element of the read scatter-gather list.
+ */
 struct virtio_blk_outhdr {
         /* VIRTIO_BLK_T* */
         __virtio32 type;
diff --git a/include/uapi/linux/virtio_scsi.h b/include/uapi/linux/virtio_scsi.h
index 42b9370771b0..cc18ef8825c0 100644
--- a/include/uapi/linux/virtio_scsi.h
+++ b/include/uapi/linux/virtio_scsi.h
@@ -29,8 +29,16 @@
 
 #include <linux/virtio_types.h>
 
-#define VIRTIO_SCSI_CDB_SIZE   32
-#define VIRTIO_SCSI_SENSE_SIZE 96
+/* Default values of the CDB and sense data size configuration fields */
+#define VIRTIO_SCSI_CDB_DEFAULT_SIZE   32
+#define VIRTIO_SCSI_SENSE_DEFAULT_SIZE 96
+
+#ifndef VIRTIO_SCSI_CDB_SIZE
+#define VIRTIO_SCSI_CDB_SIZE VIRTIO_SCSI_CDB_DEFAULT_SIZE
+#endif
+#ifndef VIRTIO_SCSI_SENSE_SIZE
+#define VIRTIO_SCSI_SENSE_SIZE VIRTIO_SCSI_SENSE_DEFAULT_SIZE
+#endif
 
 /* SCSI command request, followed by data-out */
 struct virtio_scsi_cmd_req {
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index b78f21caf55a..b0f1c9e5d687 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -114,9 +114,9 @@ int __must_check __xenbus_register_backend(struct xenbus_driver *drv,
                                            const char *mod_name);
 
 #define xenbus_register_frontend(drv) \
-        __xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME);
+        __xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME)
 #define xenbus_register_backend(drv) \
-        __xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME);
+        __xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME)
 
 void xenbus_unregister_driver(struct xenbus_driver *drv);
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index f04daabfd1cf..2fabc0627165 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3591,7 +3591,7 @@ static void put_event(struct perf_event *event)
         ctx = perf_event_ctx_lock_nested(event, SINGLE_DEPTH_NESTING);
         WARN_ON_ONCE(ctx->parent_ctx);
         perf_remove_from_context(event, true);
-        mutex_unlock(&ctx->mutex);
+        perf_event_ctx_unlock(event, ctx);
 
         _free_event(event);
 }
@@ -4574,6 +4574,13 @@ static void perf_pending_event(struct irq_work *entry)
 {
         struct perf_event *event = container_of(entry,
                         struct perf_event, pending);
+        int rctx;
+
+        rctx = perf_swevent_get_recursion_context();
+        /*
+         * If we 'fail' here, that's OK, it means recursion is already disabled
+         * and we won't recurse 'further'.
+         */
 
         if (event->pending_disable) {
                 event->pending_disable = 0;
@@ -4584,6 +4591,9 @@ static void perf_pending_event(struct irq_work *entry)
                 event->pending_wakeup = 0;
                 perf_event_wakeup(event);
         }
+
+        if (rctx >= 0)
+                perf_swevent_put_recursion_context(rctx);
 }
 
 /*
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 01ca08804f51..3f9f1d6b4c2e 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -89,16 +89,28 @@ static bool klp_is_object_loaded(struct klp_object *obj)
 /* sets obj->mod if object is not vmlinux and module is found */
 static void klp_find_object_module(struct klp_object *obj)
 {
+        struct module *mod;
+
         if (!klp_is_module(obj))
                 return;
 
         mutex_lock(&module_mutex);
         /*
-         * We don't need to take a reference on the module here because we have
-         * the klp_mutex, which is also taken by the module notifier.  This
-         * prevents any module from unloading until we release the klp_mutex.
+         * We do not want to block removal of patched modules and therefore
+         * we do not take a reference here. The patches are removed by
+         * a going module handler instead.
+         */
+        mod = find_module(obj->name);
+        /*
+         * Do not mess work of the module coming and going notifiers.
+         * Note that the patch might still be needed before the going handler
+         * is called. Module functions can be called even in the GOING state
+         * until mod->exit() finishes. This is especially important for
+         * patches that modify semantic of the functions.
          */
-        obj->mod = find_module(obj->name);
+        if (mod && mod->klp_alive)
+                obj->mod = mod;
+
         mutex_unlock(&module_mutex);
 }
 
@@ -767,6 +779,7 @@ static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
                 return -EINVAL;
 
         obj->state = KLP_DISABLED;
+        obj->mod = NULL;
 
         klp_find_object_module(obj);
 
@@ -961,6 +974,15 @@ static int klp_module_notify(struct notifier_block *nb, unsigned long action,
 
         mutex_lock(&klp_mutex);
 
+        /*
+         * Each module has to know that the notifier has been called.
+         * We never know what module will get patched by a new patch.
+         */
+        if (action == MODULE_STATE_COMING)
+                mod->klp_alive = true;
+        else /* MODULE_STATE_GOING */
+                mod->klp_alive = false;
+
         list_for_each_entry(patch, &klp_patches, list) {
                 for (obj = patch->objs; obj->funcs; obj++) {
                         if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 88d0d4420ad2..ba77ab5f64dd 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -633,7 +633,7 @@ static int count_matching_names(struct lock_class *new_class)
         if (!new_class->name)
                 return 0;
 
-        list_for_each_entry(class, &all_lock_classes, lock_entry) {
+        list_for_each_entry_rcu(class, &all_lock_classes, lock_entry) {
                 if (new_class->key - new_class->subclass == class->key)
                         return class->name_version;
                 if (class->name && !strcmp(class->name, new_class->name))
@@ -700,10 +700,12 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
         hash_head = classhashentry(key);
 
         /*
-         * We can walk the hash lockfree, because the hash only
-         * grows, and we are careful when adding entries to the end:
+         * We do an RCU walk of the hash, see lockdep_free_key_range().
          */
-        list_for_each_entry(class, hash_head, hash_entry) {
+        if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
+                return NULL;
+
+        list_for_each_entry_rcu(class, hash_head, hash_entry) {
                 if (class->key == key) {
                         /*
                          * Huh! same key, different name? Did someone trample
@@ -728,7 +730,8 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
         struct lockdep_subclass_key *key;
         struct list_head *hash_head;
         struct lock_class *class;
-        unsigned long flags;
+
+        DEBUG_LOCKS_WARN_ON(!irqs_disabled());
 
         class = look_up_lock_class(lock, subclass);
         if (likely(class))
@@ -750,28 +753,26 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
         key = lock->key->subkeys + subclass;
         hash_head = classhashentry(key);
 
-        raw_local_irq_save(flags);
         if (!graph_lock()) {
-                raw_local_irq_restore(flags);
                 return NULL;
         }
         /*
          * We have to do the hash-walk again, to avoid races
          * with another CPU:
          */
-        list_for_each_entry(class, hash_head, hash_entry)
+        list_for_each_entry_rcu(class, hash_head, hash_entry) {
                 if (class->key == key)
                         goto out_unlock_set;
+        }
+
         /*
          * Allocate a new key from the static array, and add it to
          * the hash:
          */
         if (nr_lock_classes >= MAX_LOCKDEP_KEYS) {
                 if (!debug_locks_off_graph_unlock()) {
-                        raw_local_irq_restore(flags);
                         return NULL;
                 }
-                raw_local_irq_restore(flags);
 
                 print_lockdep_off("BUG: MAX_LOCKDEP_KEYS too low!");
                 dump_stack();
@@ -798,7 +799,6 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 
         if (verbose(class)) {
                 graph_unlock();
-                raw_local_irq_restore(flags);
 
                 printk("\nnew class %p: %s", class->key, class->name);
                 if (class->name_version > 1)
@@ -806,15 +806,12 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
                 printk("\n");
                 dump_stack();
 
-                raw_local_irq_save(flags);
                 if (!graph_lock()) {
-                        raw_local_irq_restore(flags);
                         return NULL;
                 }
         }
 out_unlock_set:
         graph_unlock();
-        raw_local_irq_restore(flags);
 
 out_set_class_cache:
         if (!subclass || force)
@@ -870,11 +867,9 @@ static int add_lock_to_list(struct lock_class *class, struct lock_class *this,
         entry->distance = distance;
         entry->trace = *trace;
         /*
-         * Since we never remove from the dependency list, the list can
-         * be walked lockless by other CPUs, it's only allocation
-         * that must be protected by the spinlock. But this also means
-         * we must make new entries visible only once writes to the
-         * entry become visible - hence the RCU op:
+         * Both allocation and removal are done under the graph lock; but
+         * iteration is under RCU-sched; see look_up_lock_class() and
+         * lockdep_free_key_range().
          */
         list_add_tail_rcu(&entry->entry, head);
 
@@ -1025,7 +1020,9 @@ static int __bfs(struct lock_list *source_entry,
                 else
                         head = &lock->class->locks_before;
 
-                list_for_each_entry(entry, head, entry) {
+                DEBUG_LOCKS_WARN_ON(!irqs_disabled());
+
+                list_for_each_entry_rcu(entry, head, entry) {
                         if (!lock_accessed(entry)) {
                                 unsigned int cq_depth;
                                 mark_lock_accessed(entry, lock);
@@ -2022,7 +2019,7 @@ static inline int lookup_chain_cache(struct task_struct *curr,
          * We can walk it lock-free, because entries only get added
          * to the hash:
          */
-        list_for_each_entry(chain, hash_head, entry) {
+        list_for_each_entry_rcu(chain, hash_head, entry) {
                 if (chain->chain_key == chain_key) {
 cache_hit:
                         debug_atomic_inc(chain_lookup_hits);
@@ -2996,8 +2993,18 @@ void lockdep_init_map(struct lockdep_map *lock, const char *name,
         if (unlikely(!debug_locks))
                 return;
 
-        if (subclass)
+        if (subclass) {
+                unsigned long flags;
+
+                if (DEBUG_LOCKS_WARN_ON(current->lockdep_recursion))
+                        return;
+
+                raw_local_irq_save(flags);
+                current->lockdep_recursion = 1;
                 register_lock_class(lock, subclass, 1);
+                current->lockdep_recursion = 0;
+                raw_local_irq_restore(flags);
+        }
 }
 EXPORT_SYMBOL_GPL(lockdep_init_map);
 
@@ -3887,9 +3894,17 @@ static inline int within(const void *addr, void *start, unsigned long size)
         return addr >= start && addr < start + size;
 }
 
+/*
+ * Used in module.c to remove lock classes from memory that is going to be
+ * freed; and possibly re-used by other modules.
+ *
+ * We will have had one sync_sched() before getting here, so we're guaranteed
+ * nobody will look up these exact classes -- they're properly dead but still
+ * allocated.
+ */
 void lockdep_free_key_range(void *start, unsigned long size)
 {
-        struct lock_class *class, *next;
+        struct lock_class *class;
         struct list_head *head;
         unsigned long flags;
         int i;
@@ -3905,7 +3920,7 @@ void lockdep_free_key_range(void *start, unsigned long size)
                 head = classhash_table + i;
                 if (list_empty(head))
                         continue;
-                list_for_each_entry_safe(class, next, head, hash_entry) {
+                list_for_each_entry_rcu(class, head, hash_entry) {
                         if (within(class->key, start, size))
                                 zap_class(class);
                         else if (within(class->name, start, size))
@@ -3916,11 +3931,25 @@ void lockdep_free_key_range(void *start, unsigned long size)
         if (locked)
                 graph_unlock();
         raw_local_irq_restore(flags);
+
+        /*
+         * Wait for any possible iterators from look_up_lock_class() to pass
+         * before continuing to free the memory they refer to.
+         *
+         * sync_sched() is sufficient because the read-side is IRQ disable.
+         */
+        synchronize_sched();
+
+        /*
+         * XXX at this point we could return the resources to the pool;
+         * instead we leak them. We would need to change to bitmap allocators
+         * instead of the linear allocators we have now.
+         */
 }
 
 void lockdep_reset_lock(struct lockdep_map *lock)
 {
-        struct lock_class *class, *next;
+        struct lock_class *class;
         struct list_head *head;
         unsigned long flags;
         int i, j;
@@ -3948,7 +3977,7 @@ void lockdep_reset_lock(struct lockdep_map *lock)
                 head = classhash_table + i;
                 if (list_empty(head))
                         continue;
-                list_for_each_entry_safe(class, next, head, hash_entry) {
+                list_for_each_entry_rcu(class, head, hash_entry) {
                         int match = 0;
 
                         for (j = 0; j < NR_LOCKDEP_CACHING_CLASSES; j++)
diff --git a/kernel/module.c b/kernel/module.c
index cc93cf68653c..ec53f594e9c9 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -56,7 +56,6 @@
 #include <linux/async.h>
 #include <linux/percpu.h>
 #include <linux/kmemleak.h>
-#include <linux/kasan.h>
 #include <linux/jump_label.h>
 #include <linux/pfn.h>
 #include <linux/bsearch.h>
@@ -1814,7 +1813,6 @@ static void unset_module_init_ro_nx(struct module *mod) { }
 void __weak module_memfree(void *module_region)
 {
         vfree(module_region);
-        kasan_module_free(module_region);
 }
 
 void __weak module_arch_cleanup(struct module *mod)
@@ -1867,7 +1865,7 @@ static void free_module(struct module *mod)
         kfree(mod->args);
         percpu_modfree(mod);
 
-        /* Free lock-classes: */
+        /* Free lock-classes; relies on the preceding sync_rcu(). */
         lockdep_free_key_range(mod->module_core, mod->core_size);
 
         /* Finally, free the core (containing the module structure) */
@@ -2481,6 +2479,23 @@ static int elf_header_check(struct load_info *info)
         return 0;
 }
 
+#define COPY_CHUNK_SIZE (16*PAGE_SIZE)
+
+static int copy_chunked_from_user(void *dst, const void __user *usrc, unsigned long len)
+{
+        do {
+                unsigned long n = min(len, COPY_CHUNK_SIZE);
+
+                if (copy_from_user(dst, usrc, n) != 0)
+                        return -EFAULT;
+                cond_resched();
+                dst += n;
+                usrc += n;
+                len -= n;
+        } while (len);
+        return 0;
+}
+
 /* Sets info->hdr and info->len. */
 static int copy_module_from_user(const void __user *umod, unsigned long len,
                                   struct load_info *info)
@@ -2500,7 +2515,7 @@ static int copy_module_from_user(const void __user *umod, unsigned long len,
         if (!info->hdr)
                 return -ENOMEM;
 
-        if (copy_from_user(info->hdr, umod, info->len) != 0) {
+        if (copy_chunked_from_user(info->hdr, umod, info->len) != 0) {
                 vfree(info->hdr);
                 return -EFAULT;
         }
@@ -3351,9 +3366,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
         module_bug_cleanup(mod);
         mutex_unlock(&module_mutex);
 
-        /* Free lock-classes: */
-        lockdep_free_key_range(mod->module_core, mod->core_size);
-
         /* we can't deallocate the module until we clear memory protection */
         unset_module_init_ro_nx(mod);
         unset_module_core_ro_nx(mod);
@@ -3377,6 +3389,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
         synchronize_rcu();
         mutex_unlock(&module_mutex);
  free_module:
+        /* Free lock-classes; relies on the preceding sync_rcu() */
+        lockdep_free_key_range(mod->module_core, mod->core_size);
+
         module_deallocate(mod, info);
  free_copy:
         free_copy(info);
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index c24d5a23bf93..5235dd4e1e2f 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -955,25 +955,6 @@ static void mark_nosave_pages(struct memory_bitmap *bm)
         }
 }
 
-static bool is_nosave_page(unsigned long pfn)
-{
-        struct nosave_region *region;
-
-        list_for_each_entry(region, &nosave_regions, list) {
-                if (pfn >= region->start_pfn && pfn < region->end_pfn) {
-                        pr_err("PM: %#010llx in e820 nosave region: "
-                               "[mem %#010llx-%#010llx]\n",
-                               (unsigned long long) pfn << PAGE_SHIFT,
-                               (unsigned long long) region->start_pfn << PAGE_SHIFT,
-                               ((unsigned long long) region->end_pfn << PAGE_SHIFT)
-                                        - 1);
-                        return true;
-                }
-        }
-
-        return false;
-}
-
 /**
  *      create_basic_memory_bitmaps - create bitmaps needed for marking page
  *      frames that should not be saved and free page frames.  The pointers
@@ -2042,7 +2023,7 @@ static int mark_unsafe_pages(struct memory_bitmap *bm)
         do {
                 pfn = memory_bm_next_pfn(bm);
                 if (likely(pfn != BM_END_OF_MAP)) {
-                        if (likely(pfn_valid(pfn)) && !is_nosave_page(pfn))
+                        if (likely(pfn_valid(pfn)))
                                 swsusp_set_page_free(pfn_to_page(pfn));
                         else
                                 return -EFAULT;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d0c4209bb836..3d5f6f6d14c2 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3049,6 +3049,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
         } else {
                 if (dl_prio(oldprio))
                         p->dl.dl_boosted = 0;
+                if (rt_prio(oldprio))
+                        p->rt.timeout = 0;
                 p->sched_class = &fair_sched_class;
         }
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7ce18f3c097a..241213be507c 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1609,9 +1609,11 @@ static void update_task_scan_period(struct task_struct *p,
         /*
          * If there were no record hinting faults then either the task is
          * completely idle or all activity is areas that are not of interest
-         * to automatic numa balancing. Scan slower
+         * to automatic numa balancing. Related to that, if there were failed
+         * migration then it implies we are migrating too quickly or the local
+         * node is overloaded. In either case, scan slower
          */
-        if (local + shared == 0) {
+        if (local + shared == 0 || p->numa_faults_locality[2]) {
                 p->numa_scan_period = min(p->numa_scan_period_max,
                         p->numa_scan_period << 1);
 
@@ -2080,6 +2082,8 @@ void task_numa_fault(int last_cpupid, int mem_node, int pages, int flags)
 
         if (migrated)
                 p->numa_pages_migrated += pages;
+        if (flags & TNF_MIGRATE_FAIL)
+                p->numa_faults_locality[2] += pages;
 
         p->numa_faults[task_faults_idx(NUMA_MEMBUF, mem_node, priv)] += pages;
         p->numa_faults[task_faults_idx(NUMA_CPUBUF, cpu_node, priv)] += pages;
@@ -2161,8 +2165,10 @@ void task_numa_work(struct callback_head *work)
                 vma = mm->mmap;
         }
         for (; vma; vma = vma->vm_next) {
-                if (!vma_migratable(vma) || !vma_policy_mof(vma))
+                if (!vma_migratable(vma) || !vma_policy_mof(vma) ||
+                        is_vm_hugetlb_page(vma)) {
                         continue;
+                }
 
                 /*
                  * Shared library pages mapped by multiple processes are not
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 88ea2d6e0031..ce410bb9f2e1 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1228,6 +1228,14 @@ static struct ctl_table vm_table[] = {
                 .extra1         = &zero,
         },
         {
+                .procname       = "dirtytime_expire_seconds",
+                .data           = &dirtytime_expire_interval,
+                .maxlen         = sizeof(dirty_expire_interval),
+                .mode           = 0644,
+                .proc_handler   = dirtytime_interval_handler,
+                .extra1         = &zero,
+        },
+        {
                 .procname       = "nr_pdflush_threads",
                 .mode           = 0444 /* read-only */,
                 .proc_handler   = pdflush_proc_obsolete,
diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c
index eb682d5c697c..6aac4beedbbe 100644
--- a/kernel/time/tick-broadcast-hrtimer.c
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -49,6 +49,7 @@ static void bc_set_mode(enum clock_event_mode mode,
  */
 static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
 {
+        int bc_moved;
         /*
          * We try to cancel the timer first. If the callback is on
          * flight on some other cpu then we let it handle it. If we
@@ -60,9 +61,15 @@ static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
          * restart the timer because we are in the callback, but we
          * can set the expiry time and let the callback return
          * HRTIMER_RESTART.
+         *
+         * Since we are in the idle loop at this point and because
+         * hrtimer_{start/cancel} functions call into tracing,
+         * calls to these functions must be bound within RCU_NONIDLE.
          */
-        if (hrtimer_try_to_cancel(&bctimer) >= 0) {
-                hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
+        RCU_NONIDLE(bc_moved = (hrtimer_try_to_cancel(&bctimer) >= 0) ?
+                !hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED) :
+                        0);
+        if (bc_moved) {
                 /* Bind the "device" to the cpu */
                 bc->bound_on = smp_processor_id();
         } else if (bc->bound_on == smp_processor_id()) {
diff --git a/lib/Makefile b/lib/Makefile
index 87eb3bffc283..58f74d2dd396 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -24,7 +24,7 @@ obj-y	+= lockref.o
 
 obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o kasprintf.o bitmap.o scatterlist.o \
-         gcd.o lcm.o list_sort.o uuid.o flex_array.o clz_ctz.o \
+         gcd.o lcm.o list_sort.o uuid.o flex_array.o iov_iter.o clz_ctz.o \
          bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o kfifo.o \
          percpu-refcount.o percpu_ida.o rhashtable.o reciprocal_div.o
 obj-y += string_helpers.o
diff --git a/mm/iov_iter.c b/lib/iov_iter.c
index 827732047da1..9d96e283520c 100644
--- a/mm/iov_iter.c
+++ b/lib/iov_iter.c
@@ -751,3 +751,18 @@ int iov_iter_npages(const struct iov_iter *i, int maxpages)
         return npages;
 }
 EXPORT_SYMBOL(iov_iter_npages);
+
+const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags)
+{
+        *new = *old;
+        if (new->type & ITER_BVEC)
+                return new->bvec = kmemdup(new->bvec,
+                                    new->nr_segs * sizeof(struct bio_vec),
+                                    flags);
+        else
+                /* iovec and kvec have identical layout */
+                return new->iov = kmemdup(new->iov,
+                                   new->nr_segs * sizeof(struct iovec),
+                                   flags);
+}
+EXPORT_SYMBOL(dup_iter);
diff --git a/lib/lcm.c b/lib/lcm.c
index e97dbd51e756..03d7fcb420b5 100644
--- a/lib/lcm.c
+++ b/lib/lcm.c
@@ -12,3 +12,14 @@ unsigned long lcm(unsigned long a, unsigned long b)
                 return 0;
 }
 EXPORT_SYMBOL_GPL(lcm);
+
+unsigned long lcm_not_zero(unsigned long a, unsigned long b)
+{
+        unsigned long l = lcm(a, b);
+
+        if (l)
+                return l;
+
+        return (b ? : a);
+}
+EXPORT_SYMBOL_GPL(lcm_not_zero);
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 7a85967060a5..f0f5c5c3de12 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                         /* Error: request to write beyond destination buffer */
                         if (cpy > oend)
                                 goto _output_error;
+                        if ((ref + COPYLENGTH) > oend ||
+                                        (op + COPYLENGTH) > oend)
+                                goto _output_error;
                         LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
                         while (op < cpy)
                                 *op++ = *ref++;
diff --git a/lib/nlattr.c b/lib/nlattr.c
index 76a1b59523ab..f5907d23272d 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -279,6 +279,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count)
         int minlen = min_t(int, count, nla_len(src));
 
         memcpy(dest, nla_data(src), minlen);
+        if (count > minlen)
+                memset(dest + minlen, 0, count - minlen);
 
         return minlen;
 }
diff --git a/mm/Makefile b/mm/Makefile
index 3c1caa2693bd..15dbe9903c27 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -21,7 +21,7 @@ obj-y			:= filemap.o mempool.o oom_kill.o \
                            mm_init.o mmu_context.o percpu.o slab_common.o \
                            compaction.o vmacache.o \
                            interval_tree.o list_lru.o workingset.o \
-                           iov_iter.o debug.o $(mmu-y)
+                           debug.o $(mmu-y)
 
 obj-y += init-mm.o
 
diff --git a/mm/cma.c b/mm/cma.c
index 75016fd1de90..68ecb7a42983 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -64,15 +64,17 @@ static unsigned long cma_bitmap_aligned_mask(struct cma *cma, int align_order)
         return (1UL << (align_order - cma->order_per_bit)) - 1;
 }
 
+/*
+ * Find a PFN aligned to the specified order and return an offset represented in
+ * order_per_bits.
+ */
 static unsigned long cma_bitmap_aligned_offset(struct cma *cma, int align_order)
 {
-        unsigned int alignment;
-
         if (align_order <= cma->order_per_bit)
                 return 0;
-        alignment = 1UL << (align_order - cma->order_per_bit);
-        return ALIGN(cma->base_pfn, alignment) -
-                (cma->base_pfn >> cma->order_per_bit);
+
+        return (ALIGN(cma->base_pfn, (1UL << align_order))
+                - cma->base_pfn) >> cma->order_per_bit;
 }
 
 static unsigned long cma_bitmap_maxno(struct cma *cma)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index fc00c8cb5a82..6817b0350c71 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1260,6 +1260,7 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         int target_nid, last_cpupid = -1;
         bool page_locked;
         bool migrated = false;
+        bool was_writable;
         int flags = 0;
 
         /* A PROT_NONE fault should not end up here */
@@ -1291,12 +1292,8 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 flags |= TNF_FAULT_LOCAL;
         }
 
-        /*
-         * Avoid grouping on DSO/COW pages in specific and RO pages
-         * in general, RO pages shouldn't hurt as much anyway since
-         * they can be in shared cache state.
-         */
-        if (!pmd_write(pmd))
+        /* See similar comment in do_numa_page for explanation */
+        if (!(vma->vm_flags & VM_WRITE))
                 flags |= TNF_NO_GROUP;
 
         /*
@@ -1353,12 +1350,17 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         if (migrated) {
                 flags |= TNF_MIGRATED;
                 page_nid = target_nid;
-        }
+        } else
+                flags |= TNF_MIGRATE_FAIL;
 
         goto out;
 clear_pmdnuma:
         BUG_ON(!PageLocked(page));
+        was_writable = pmd_write(pmd);
         pmd = pmd_modify(pmd, vma->vm_page_prot);
+        pmd = pmd_mkyoung(pmd);
+        if (was_writable)
+                pmd = pmd_mkwrite(pmd);
         set_pmd_at(mm, haddr, pmdp, pmd);
         update_mmu_cache_pmd(vma, addr, pmdp);
         unlock_page(page);
@@ -1482,6 +1484,8 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 
         if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
                 pmd_t entry;
+                bool preserve_write = prot_numa && pmd_write(*pmd);
+                ret = 1;
 
                 /*
                  * Avoid trapping faults against the zero page. The read-only
@@ -1490,16 +1494,17 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                  */
                 if (prot_numa && is_huge_zero_pmd(*pmd)) {
                         spin_unlock(ptl);
-                        return 0;
+                        return ret;
                 }
 
                 if (!prot_numa || !pmd_protnone(*pmd)) {
-                        ret = 1;
                         entry = pmdp_get_and_clear_notify(mm, addr, pmd);
                         entry = pmd_modify(entry, newprot);
+                        if (preserve_write)
+                                entry = pmd_mkwrite(entry);
                         ret = HPAGE_PMD_NR;
                         set_pmd_at(mm, addr, pmd, entry);
-                        BUG_ON(pmd_write(entry));
+                        BUG_ON(!preserve_write && pmd_write(entry));
                 }
                 spin_unlock(ptl);
         }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 0a9ac6c26832..c41b2a0ee273 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -917,7 +917,6 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
         __SetPageHead(page);
         __ClearPageReserved(page);
         for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
-                __SetPageTail(p);
                 /*
                  * For gigantic hugepages allocated through bootmem at
                  * boot, it's safer to be consistent with the not-gigantic
@@ -933,6 +932,9 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
                 __ClearPageReserved(p);
                 set_page_count(p, 0);
                 p->first_page = page;
+                /* Make sure p->first_page is always valid for PageTail() */
+                smp_wmb();
+                __SetPageTail(p);
         }
 }
 
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 78fee632a7ee..936d81661c47 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -29,6 +29,7 @@
 #include <linux/stacktrace.h>
 #include <linux/string.h>
 #include <linux/types.h>
+#include <linux/vmalloc.h>
 #include <linux/kasan.h>
 
 #include "kasan.h"
@@ -414,12 +415,19 @@ int kasan_module_alloc(void *addr, size_t size)
                         GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
                         PAGE_KERNEL, VM_NO_GUARD, NUMA_NO_NODE,
                         __builtin_return_address(0));
-        return ret ? 0 : -ENOMEM;
+
+        if (ret) {
+                find_vm_area(addr)->flags |= VM_KASAN;
+                return 0;
+        }
+
+        return -ENOMEM;
 }
 
-void kasan_module_free(void *addr)
+void kasan_free_shadow(const struct vm_struct *vm)
 {
-        vfree(kasan_mem_to_shadow(addr));
+        if (vm->flags & VM_KASAN)
+                vfree(kasan_mem_to_shadow(vm->addr));
 }
 
 static void register_global(struct kasan_global *global)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9fe07692eaad..b34ef4a32a3b 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5232,7 +5232,9 @@ static void mem_cgroup_bind(struct cgroup_subsys_state *root_css)
          * on for the root memcg is enough.
          */
         if (cgroup_on_dfl(root_css->cgroup))
-                mem_cgroup_from_css(root_css)->use_hierarchy = true;
+                root_mem_cgroup->use_hierarchy = true;
+        else
+                root_mem_cgroup->use_hierarchy = false;
 }
 
 static u64 memory_current_read(struct cgroup_subsys_state *css,
diff --git a/mm/memory.c b/mm/memory.c
index 8068893697bb..97839f5c8c30 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3035,6 +3035,7 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         int last_cpupid;
         int target_nid;
         bool migrated = false;
+        bool was_writable = pte_write(pte);
         int flags = 0;
 
         /* A PROT_NONE fault should not end up here */
@@ -3059,6 +3060,8 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         /* Make it present again */
         pte = pte_modify(pte, vma->vm_page_prot);
         pte = pte_mkyoung(pte);
+        if (was_writable)
+                pte = pte_mkwrite(pte);
         set_pte_at(mm, addr, ptep, pte);
         update_mmu_cache(vma, addr, ptep);
 
@@ -3069,11 +3072,14 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         }
 
         /*
-         * Avoid grouping on DSO/COW pages in specific and RO pages
-         * in general, RO pages shouldn't hurt as much anyway since
-         * they can be in shared cache state.
+         * Avoid grouping on RO pages in general. RO pages shouldn't hurt as
+         * much anyway since they can be in shared cache state. This misses
+         * the case where a mapping is writable but the process never writes
+         * to it but pte_write gets cleared during protection updates and
+         * pte_dirty has unpredictable behaviour between PTE scan updates,
+         * background writeback, dirty balancing and application behaviour.
          */
-        if (!pte_write(pte))
+        if (!(vma->vm_flags & VM_WRITE))
                 flags |= TNF_NO_GROUP;
 
         /*
@@ -3097,7 +3103,8 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         if (migrated) {
                 page_nid = target_nid;
                 flags |= TNF_MIGRATED;
-        }
+        } else
+                flags |= TNF_MIGRATE_FAIL;
 
 out:
         if (page_nid != -1)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9fab10795bea..65842d688b7c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1092,6 +1092,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
                         return NULL;
 
                 arch_refresh_nodedata(nid, pgdat);
+        } else {
+                /* Reset the nr_zones and classzone_idx to 0 before reuse */
+                pgdat->nr_zones = 0;
+                pgdat->classzone_idx = 0;
         }
 
         /* we can use NODE_DATA(nid) from here */
@@ -1977,15 +1981,6 @@ void try_offline_node(int nid)
                 if (is_vmalloc_addr(zone->wait_table))
                         vfree(zone->wait_table);
         }
-
-        /*
-         * Since there is no way to guarentee the address of pgdat/zone is not
-         * on stack of any kernel threads or used by other kernel objects
-         * without reference counting or other symchronizing method, do not
-         * reset node_data and free pgdat here. Just reset it to 0 and reuse
-         * the memory when the node is online again.
-         */
-        memset(pgdat, 0, sizeof(*pgdat));
 }
 EXPORT_SYMBOL(try_offline_node);
 
diff --git a/mm/mlock.c b/mm/mlock.c
index 73cf0987088c..8a54cd214925 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -26,10 +26,10 @@
 
 int can_do_mlock(void)
 {
-        if (capable(CAP_IPC_LOCK))
-                return 1;
         if (rlimit(RLIMIT_MEMLOCK) != 0)
                 return 1;
+        if (capable(CAP_IPC_LOCK))
+                return 1;
         return 0;
 }
 EXPORT_SYMBOL(can_do_mlock);
diff --git a/mm/mmap.c b/mm/mmap.c
index da9990acc08b..9ec50a368634 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -774,10 +774,8 @@ again:			remove_next = 1 + (end > next->vm_end);
 
                         importer->anon_vma = exporter->anon_vma;
                         error = anon_vma_clone(importer, exporter);
-                        if (error) {
-                                importer->anon_vma = NULL;
+                        if (error)
                                 return error;
-                        }
                 }
         }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 44727811bf4c..88584838e704 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -75,6 +75,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                 oldpte = *pte;
                 if (pte_present(oldpte)) {
                         pte_t ptent;
+                        bool preserve_write = prot_numa && pte_write(oldpte);
 
                         /*
                          * Avoid trapping faults against the zero or KSM
@@ -94,6 +95,8 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
 
                         ptent = ptep_modify_prot_start(mm, addr, pte);
                         ptent = pte_modify(ptent, newprot);
+                        if (preserve_write)
+                                ptent = pte_mkwrite(ptent);
 
                         /* Avoid taking write faults for known dirty pages */
                         if (dirty_accountable && pte_dirty(ptent) &&
diff --git a/mm/mremap.c b/mm/mremap.c
index 57dadc025c64..2dc44b1cb1df 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -286,8 +286,14 @@ static unsigned long move_vma(struct vm_area_struct *vma,
                 old_len = new_len;
                 old_addr = new_addr;
                 new_addr = -ENOMEM;
-        } else if (vma->vm_file && vma->vm_file->f_op->mremap)
-                vma->vm_file->f_op->mremap(vma->vm_file, new_vma);
+        } else if (vma->vm_file && vma->vm_file->f_op->mremap) {
+                err = vma->vm_file->f_op->mremap(vma->vm_file, new_vma);
+                if (err < 0) {
+                        move_page_tables(new_vma, new_addr, vma, old_addr,
+                                         moved_len, true);
+                        return err;
+                }
+        }
 
         /* Conceal VM_ACCOUNT so old reservation is not undone */
         if (vm_flags & VM_ACCOUNT) {
diff --git a/mm/nommu.c b/mm/nommu.c
index 3e67e7538ecf..3fba2dc97c44 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -62,6 +62,7 @@ void *high_memory;
 EXPORT_SYMBOL(high_memory);
 struct page *mem_map;
 unsigned long max_mapnr;
+EXPORT_SYMBOL(max_mapnr);
 unsigned long highest_memmap_pfn;
 struct percpu_counter vm_committed_as;
 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 45e187b2d971..644bcb665773 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -857,8 +857,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi,
          *                   bw * elapsed + write_bandwidth * (period - elapsed)
          * write_bandwidth = ---------------------------------------------------
          *                                          period
+         *
+         * @written may have decreased due to account_page_redirty().
+         * Avoid underflowing @bw calculation.
          */
-        bw = written - bdi->written_stamp;
+        bw = written - min(written, bdi->written_stamp);
         bw *= HZ;
         if (unlikely(elapsed > period)) {
                 do_div(bw, elapsed);
@@ -922,7 +925,7 @@ static void global_update_bandwidth(unsigned long thresh,
                                     unsigned long now)
 {
         static DEFINE_SPINLOCK(dirty_lock);
-        static unsigned long update_time;
+        static unsigned long update_time = INITIAL_JIFFIES;
 
         /*
          * check locklessly first to optimize away locking for the most time
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 7abfa70cdc1a..40e29429e7b0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2373,7 +2373,8 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                         goto out;
         }
         /* Exhausted what can be done so it's blamo time */
-        if (out_of_memory(ac->zonelist, gfp_mask, order, ac->nodemask, false))
+        if (out_of_memory(ac->zonelist, gfp_mask, order, ac->nodemask, false)
+                        || WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL))
                 *did_some_progress = 1;
 out:
         oom_zonelist_unlock(ac->zonelist, gfp_mask);
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index 72f5ac381ab3..755a42c76eb4 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -103,6 +103,7 @@ void unset_migratetype_isolate(struct page *page, unsigned migratetype)
 
                         if (!is_migrate_isolate_page(buddy)) {
                                 __isolate_free_page(page, order);
+                                kernel_map_pages(page, (1 << order), 1);
                                 set_page_refcounted(page);
                                 isolated_page = page;
                         }
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 75c1f2878519..29f2f8b853ae 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -265,8 +265,15 @@ int walk_page_range(unsigned long start, unsigned long end,
                         vma = vma->vm_next;
 
                         err = walk_page_test(start, next, walk);
-                        if (err > 0)
+                        if (err > 0) {
+                                /*
+                                 * positive return values are purely for
+                                 * controlling the pagewalk, so should never
+                                 * be passed to the callers.
+                                 */
+                                err = 0;
                                 continue;
+                        }
                         if (err < 0)
                                 break;
                 }
diff --git a/mm/rmap.c b/mm/rmap.c
index 5e3e09081164..c161a14b6a8f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -287,6 +287,13 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
         return 0;
 
  enomem_failure:
+        /*
+         * dst->anon_vma is dropped here otherwise its degree can be incorrectly
+         * decremented in unlink_anon_vmas().
+         * We can safely do this because callers of anon_vma_clone() don't care
+         * about dst->anon_vma if anon_vma_clone() failed.
+         */
+        dst->anon_vma = NULL;
         unlink_anon_vmas(dst);
         return -ENOMEM;
 }
diff --git a/mm/slub.c b/mm/slub.c
index 6832c4eab104..82c473780c91 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2449,7 +2449,8 @@ redo:
         do {
                 tid = this_cpu_read(s->cpu_slab->tid);
                 c = raw_cpu_ptr(s->cpu_slab);
-        } while (IS_ENABLED(CONFIG_PREEMPT) && unlikely(tid != c->tid));
+        } while (IS_ENABLED(CONFIG_PREEMPT) &&
+                 unlikely(tid != READ_ONCE(c->tid)));
 
         /*
          * Irqless object alloc/free algorithm used here depends on sequence
@@ -2718,7 +2719,8 @@ redo:
         do {
                 tid = this_cpu_read(s->cpu_slab->tid);
                 c = raw_cpu_ptr(s->cpu_slab);
-        } while (IS_ENABLED(CONFIG_PREEMPT) && unlikely(tid != c->tid));
+        } while (IS_ENABLED(CONFIG_PREEMPT) &&
+                 unlikely(tid != READ_ONCE(c->tid)));
 
         /* Same with comment on barrier() in slab_alloc_node() */
         barrier();
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 35b25e1340ca..49abccf29a29 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1418,6 +1418,7 @@ struct vm_struct *remove_vm_area(const void *addr)
                 spin_unlock(&vmap_area_lock);
 
                 vmap_debug_free_range(va->va_start, va->va_end);
+                kasan_free_shadow(vm);
                 free_unmap_vmap_area(va);
                 vm->size -= PAGE_SIZE;
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index d8e376a5f0f1..36a1a739ad68 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -658,14 +658,30 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
 static void p9_virtio_remove(struct virtio_device *vdev)
 {
         struct virtio_chan *chan = vdev->priv;
-
-        if (chan->inuse)
-                p9_virtio_close(chan->client);
-        vdev->config->del_vqs(vdev);
+        unsigned long warning_time;
 
         mutex_lock(&virtio_9p_lock);
+
+        /* Remove self from list so we don't get new users. */
         list_del(&chan->chan_list);
+        warning_time = jiffies;
+
+        /* Wait for existing users to close. */
+        while (chan->inuse) {
+                mutex_unlock(&virtio_9p_lock);
+                msleep(250);
+                if (time_after(jiffies, warning_time + 10 * HZ)) {
+                        dev_emerg(&vdev->dev,
+                                  "p9_virtio_remove: waiting for device in use.\n");
+                        warning_time = jiffies;
+                }
+                mutex_lock(&virtio_9p_lock);
+        }
+
         mutex_unlock(&virtio_9p_lock);
+
+        vdev->config->del_vqs(vdev);
+
         sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
         kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
         kfree(chan->tag);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b087d278c679..1849d96b3c91 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -563,6 +563,8 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
          */
         del_nbp(p);
 
+        dev_set_mtu(br->dev, br_min_mtu(br));
+
         spin_lock_bh(&br->lock);
         changed_addr = br_stp_recalculate_bridge_id(br);
         spin_unlock_bh(&br->lock);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 769b185fefbd..a6e2da0bc718 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
         int copylen;
 
         ret = -EOPNOTSUPP;
-        if (m->msg_flags&MSG_OOB)
+        if (flags & MSG_OOB)
                 goto read_error;
 
         skb = skb_recv_datagram(sk, flags, 0 , &ret);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 6b3f54ed65ba..a9f4ae45b7fb 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -484,7 +484,7 @@ static int ceph_tcp_connect(struct ceph_connection *con)
                                IPPROTO_TCP, &sock);
         if (ret)
                 return ret;
-        sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC;
+        sock->sk->sk_allocation = GFP_NOFS;
 
 #ifdef CONFIG_LOCKDEP
         lockdep_set_class(&sock->sk->sk_lock, &socket_class);
@@ -520,8 +520,6 @@ static int ceph_tcp_connect(struct ceph_connection *con)
                                ret);
         }
 
-        sk_set_memalloc(sock->sk);
-
         con->sock = sock;
         return 0;
 }
@@ -2808,11 +2806,8 @@ static void con_work(struct work_struct *work)
 {
         struct ceph_connection *con = container_of(work, struct ceph_connection,
                                                    work.work);
-        unsigned long pflags = current->flags;
         bool fault;
 
-        current->flags |= PF_MEMALLOC;
-
         mutex_lock(&con->mutex);
         while (true) {
                 int ret;
@@ -2866,8 +2861,6 @@ static void con_work(struct work_struct *work)
                 con_fault_finish(con);
 
         con->ops->put(con);
-
-        tsk_restore_flags(current, pflags, PF_MEMALLOC);
 }
 
 /*
diff --git a/net/compat.c b/net/compat.c
index 94d3d5e97883..f7bd286a8280 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr *kmsg,
             __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
             __get_user(kmsg->msg_flags, &umsg->msg_flags))
                 return -EFAULT;
+
+        if (!uaddr)
+                kmsg->msg_namelen = 0;
+
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
+
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/dev.c b/net/core/dev.c
index 962ee9d71964..45109b70664e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2848,7 +2848,9 @@ static void skb_update_prio(struct sk_buff *skb)
 #define skb_update_prio(skb)
 #endif
 
-static DEFINE_PER_CPU(int, xmit_recursion);
+DEFINE_PER_CPU(int, xmit_recursion);
+EXPORT_SYMBOL(xmit_recursion);
+
 #define RECURSION_LIMIT 10
 
 /**
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 44706e81b2e0..e4fdc9dfb2c7 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -175,9 +175,9 @@ void fib_rules_unregister(struct fib_rules_ops *ops)
 
         spin_lock(&net->rules_mod_lock);
         list_del_rcu(&ops->list);
-        fib_rules_cleanup_ops(ops);
         spin_unlock(&net->rules_mod_lock);
 
+        fib_rules_cleanup_ops(ops);
         call_rcu(&ops->rcu, fib_rules_put_rcu);
 }
 EXPORT_SYMBOL_GPL(fib_rules_unregister);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index cb5290b8c428..70d3450588b2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -198,8 +198,10 @@ static int __peernet2id(struct net *net, struct net *peer, bool alloc)
  */
 int peernet2id(struct net *net, struct net *peer)
 {
-        int id = __peernet2id(net, peer, true);
+        bool alloc = atomic_read(&peer->count) == 0 ? false : true;
+        int id;
 
+        id = __peernet2id(net, peer, alloc);
         return id >= 0 ? id : NETNSA_NSID_NOT_ASSIGNED;
 }
 EXPORT_SYMBOL(peernet2id);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 25b4b5d23485..7ebed55b5f7d 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1932,10 +1932,10 @@ static int rtnl_group_changelink(const struct sk_buff *skb,
                 struct ifinfomsg *ifm,
                 struct nlattr **tb)
 {
-        struct net_device *dev;
+        struct net_device *dev, *aux;
         int err;
 
-        for_each_netdev(net, dev) {
+        for_each_netdev_safe(net, dev, aux) {
                 if (dev->group == group) {
                         err = do_setlink(skb, dev, ifm, tb, NULL, 0);
                         if (err < 0)
@@ -2166,28 +2166,28 @@ replay:
                         }
                 }
                 err = rtnl_configure_link(dev, ifm);
-                if (err < 0) {
-                        if (ops->newlink) {
-                                LIST_HEAD(list_kill);
-
-                                ops->dellink(dev, &list_kill);
-                                unregister_netdevice_many(&list_kill);
-                        } else {
-                                unregister_netdevice(dev);
-                        }
-                        goto out;
-                }
-
+                if (err < 0)
+                        goto out_unregister;
                 if (link_net) {
                         err = dev_change_net_namespace(dev, dest_net, ifname);
                         if (err < 0)
-                                unregister_netdevice(dev);
+                                goto out_unregister;
                 }
 out:
                 if (link_net)
                         put_net(link_net);
                 put_net(dest_net);
                 return err;
+out_unregister:
+                if (ops->newlink) {
+                        LIST_HEAD(list_kill);
+
+                        ops->dellink(dev, &list_kill);
+                        unregister_netdevice_many(&list_kill);
+                } else {
+                        unregister_netdevice(dev);
+                }
+                goto out;
         }
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f80507823531..8e4ac97c8477 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3733,9 +3733,13 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
                      struct sock *sk, int tstype)
 {
         struct sk_buff *skb;
-        bool tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        bool tsonly;
 
-        if (!sk || !skb_may_tx_timestamp(sk, tsonly))
+        if (!sk)
+                return;
+
+        tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        if (!skb_may_tx_timestamp(sk, tsonly))
                 return;
 
         if (tsonly)
@@ -4173,7 +4177,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         skb->ignore_df = 0;
         skb_dst_drop(skb);
         skb->mark = 0;
-        skb->sender_cpu = 0;
+        skb_sender_cpu_clear(skb);
         skb_init_secmark(skb);
         secpath_reset(skb);
         nf_reset(skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index 93c8b20c91e4..71e3e5f1eaa0 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -653,6 +653,25 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
                 sock_reset_flag(sk, bit);
 }
 
+bool sk_mc_loop(struct sock *sk)
+{
+        if (dev_recursion_level())
+                return false;
+        if (!sk)
+                return true;
+        switch (sk->sk_family) {
+        case AF_INET:
+                return inet_sk(sk)->mc_loop;
+#if IS_ENABLED(CONFIG_IPV6)
+        case AF_INET6:
+                return inet6_sk(sk)->mc_loop;
+#endif
+        }
+        WARN_ON(1);
+        return true;
+}
+EXPORT_SYMBOL(sk_mc_loop);
+
 /*
  *      This is meant for all protocols to use and covers goings on
  *      at the socket level. Everything here is generic.
@@ -1655,6 +1674,10 @@ void sock_rfree(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sock_rfree);
 
+/*
+ * Buffer destructor for skbs that are not used directly in read or write
+ * path, e.g. for error handler skbs. Automatically called from kfree_skb.
+ */
 void sock_efree(struct sk_buff *skb)
 {
         sock_put(skb->sk);
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 433424804284..8ce351ffceb1 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -25,6 +25,8 @@
 static int zero = 0;
 static int one = 1;
 static int ushort_max = USHRT_MAX;
+static int min_sndbuf = SOCK_MIN_SNDBUF;
+static int min_rcvbuf = SOCK_MIN_RCVBUF;
 
 static int net_msg_warn;        /* Unused, but still a sysctl */
 
@@ -237,7 +239,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
         },
         {
                 .procname       = "rmem_max",
@@ -245,7 +247,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
         },
         {
                 .procname       = "wmem_default",
@@ -253,7 +255,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
         },
         {
                 .procname       = "rmem_default",
@@ -261,7 +263,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
         },
         {
                 .procname       = "dev_weight",
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index faf7cc3483fe..9d66a0f72f90 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -248,7 +248,9 @@ void __init dn_fib_rules_init(void)
 
 void __exit dn_fib_rules_cleanup(void)
 {
+        rtnl_lock();
         fib_rules_unregister(dn_fib_rules_ops);
+        rtnl_unlock();
         rcu_barrier();
 }
 
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 2173402d87e0..4dea2e0681d1 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -501,12 +501,10 @@ static struct net_device *dev_to_net_device(struct device *dev)
 #ifdef CONFIG_OF
 static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
                                         struct dsa_chip_data *cd,
-                                        int chip_index,
+                                        int chip_index, int port_index,
                                         struct device_node *link)
 {
-        int ret;
         const __be32 *reg;
-        int link_port_addr;
         int link_sw_addr;
         struct device_node *parent_sw;
         int len;
@@ -519,6 +517,10 @@ static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
         if (!reg || (len != sizeof(*reg) * 2))
                 return -EINVAL;
 
+        /*
+         * Get the destination switch number from the second field of its 'reg'
+         * property, i.e. for "reg = <0x19 1>" sw_addr is '1'.
+         */
         link_sw_addr = be32_to_cpup(reg + 1);
 
         if (link_sw_addr >= pd->nr_chips)
@@ -535,20 +537,9 @@ static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
                 memset(cd->rtable, -1, pd->nr_chips * sizeof(s8));
         }
 
-        reg = of_get_property(link, "reg", NULL);
-        if (!reg) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        link_port_addr = be32_to_cpup(reg);
-
-        cd->rtable[link_sw_addr] = link_port_addr;
+        cd->rtable[link_sw_addr] = port_index;
 
         return 0;
-out:
-        kfree(cd->rtable);
-        return ret;
 }
 
 static void dsa_of_free_platform_data(struct dsa_platform_data *pd)
@@ -658,7 +649,7 @@ static int dsa_of_probe(struct platform_device *pdev)
                         if (!strcmp(port_name, "dsa") && link &&
                                         pd->nr_chips > 1) {
                                 ret = dsa_of_setup_routing_table(pd, cd,
-                                                chip_index, link);
+                                                chip_index, port_index, link);
                                 if (ret)
                                         goto out_free_chip;
                         }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 57be71dd6a9e..23b9b3e86f4c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1111,11 +1111,10 @@ static void ip_fib_net_exit(struct net *net)
 {
         unsigned int i;
 
+        rtnl_lock();
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         fib4_rules_exit(net);
 #endif
-
-        rtnl_lock();
         for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
                 struct fib_table *tb;
                 struct hlist_head *head;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 14d02ea905b6..3e44b9b0b78e 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -268,6 +268,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
                 release_sock(sk);
                 if (reqsk_queue_empty(&icsk->icsk_accept_queue))
                         timeo = schedule_timeout(timeo);
+                sched_annotate_sleep();
                 lock_sock(sk);
                 err = 0;
                 if (!reqsk_queue_empty(&icsk->icsk_accept_queue))
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 81751f12645f..592aff37366b 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
         mutex_unlock(&inet_diag_table_mutex);
 }
 
+static size_t inet_sk_attr_size(void)
+{
+        return    nla_total_size(sizeof(struct tcp_info))
+                + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+                + nla_total_size(1) /* INET_DIAG_TOS */
+                + nla_total_size(1) /* INET_DIAG_TCLASS */
+                + nla_total_size(sizeof(struct inet_diag_meminfo))
+                + nla_total_size(sizeof(struct inet_diag_msg))
+                + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+                + nla_total_size(TCP_CA_NAME_MAX)
+                + nla_total_size(sizeof(struct tcpvegas_info))
+                + 64;
+}
+
 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                               struct sk_buff *skb, struct inet_diag_req_v2 *req,
                               struct user_namespace *user_ns,                   
@@ -326,9 +340,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
         if (err)
                 goto out;
 
-        rep = nlmsg_new(sizeof(struct inet_diag_msg) +
-                        sizeof(struct inet_diag_meminfo) +
-                        sizeof(struct tcp_info) + 64, GFP_KERNEL);
+        rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
         if (!rep) {
                 err = -ENOMEM;
                 goto out;
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 787b3c294ce6..d9bc28ac5d1b 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -67,6 +67,7 @@ static int ip_forward_finish(struct sk_buff *skb)
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
 
+        skb_sender_cpu_clear(skb);
         return dst_output(skb);
 }
 
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9d78427652d2..fe54eba6d00d 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -268,7 +268,7 @@ static int __net_init ipmr_rules_init(struct net *net)
         return 0;
 
 err2:
-        kfree(mrt);
+        ipmr_free_table(mrt);
 err1:
         fib_rules_unregister(ops);
         return err;
@@ -278,11 +278,13 @@ static void __net_exit ipmr_rules_exit(struct net *net)
 {
         struct mr_table *mrt, *next;
 
+        rtnl_lock();
         list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
                 list_del(&mrt->list);
                 ipmr_free_table(mrt);
         }
         fib_rules_unregister(net->ipv4.mr_rules_ops);
+        rtnl_unlock();
 }
 #else
 #define ipmr_for_each_table(mrt, net) \
@@ -308,7 +310,10 @@ static int __net_init ipmr_rules_init(struct net *net)
 
 static void __net_exit ipmr_rules_exit(struct net *net)
 {
+        rtnl_lock();
         ipmr_free_table(net->ipv4.mrt);
+        net->ipv4.mrt = NULL;
+        rtnl_unlock();
 }
 #endif
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 99e810f84671..cf5e82f39d3b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -272,9 +272,9 @@ static void trace_packet(const struct sk_buff *skb,
                     &chainname, &comment, &rulenum) != 0)
                         break;
 
-        nf_log_packet(net, AF_INET, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+        nf_log_trace(net, AF_INET, hook, skb, in, out, &trace_loginfo,
+                     "TRACE: %s:%s:%s:%u ",
+                     tablename, chainname, comment, rulenum);
 }
 #endif
 
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index d694088214cd..62856e185a93 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -378,6 +378,12 @@ EXPORT_SYMBOL_GPL(tcp_slow_start);
  */
 void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
 {
+        /* If credits accumulated at a higher w, apply them gently now. */
+        if (tp->snd_cwnd_cnt >= w) {
+                tp->snd_cwnd_cnt = 0;
+                tp->snd_cwnd++;
+        }
+
         tp->snd_cwnd_cnt += acked;
         if (tp->snd_cwnd_cnt >= w) {
                 u32 delta = tp->snd_cwnd_cnt / w;
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 4b276d1ed980..06d3d665a9fd 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -306,8 +306,10 @@ tcp_friendliness:
                 }
         }
 
-        if (ca->cnt == 0)                       /* cannot be zero */
-                ca->cnt = 1;
+        /* The maximum rate of cwnd increase CUBIC allows is 1 packet per
+         * 2 packets ACKed, meaning cwnd grows at 1.5x per RTT.
+         */
+        ca->cnt = max(ca->cnt, 2U);
 }
 
 static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index fb4cf8b8e121..f501ac048366 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3105,10 +3105,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         if (!first_ackt.v64)
                                 first_ackt = last_ackt;
 
-                        if (!(sacked & TCPCB_SACKED_ACKED))
+                        if (!(sacked & TCPCB_SACKED_ACKED)) {
                                 reord = min(pkts_acked, reord);
-                        if (!after(scb->end_seq, tp->high_seq))
-                                flag |= FLAG_ORIG_SACK_ACKED;
+                                if (!after(scb->end_seq, tp->high_seq))
+                                        flag |= FLAG_ORIG_SACK_ACKED;
+                        }
                 }
 
                 if (sacked & TCPCB_SACKED_ACKED)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a2dfed4783b..f1756ee02207 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1518,7 +1518,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
                 skb->sk = sk;
                 skb->destructor = sock_edemux;
                 if (sk->sk_state != TCP_TIME_WAIT) {
-                        struct dst_entry *dst = sk->sk_rx_dst;
+                        struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
 
                         if (dst)
                                 dst = dst_check(dst, 0);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a2a796c5536b..1db253e36045 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2773,15 +2773,11 @@ void tcp_send_fin(struct sock *sk)
         } else {
                 /* Socket is locked, keep trying until memory is available. */
                 for (;;) {
-                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
-                                               sk->sk_allocation);
+                        skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
                         if (skb)
                                 break;
                         yield();
                 }
-
-                /* Reserve space for headers and prepare control bits. */
-                skb_reserve(skb, MAX_TCP_HEADER);
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                 tcp_init_nondata_skb(skb, tp->write_seq,
                                      TCPHDR_ACK | TCPHDR_FIN);
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index d5f6bd9a210a..dab73813cb92 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -63,6 +63,7 @@ int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                 return err;
 
         IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
+        skb->protocol = htons(ETH_P_IP);
 
         return x->outer_mode->output2(x, skb);
 }
@@ -71,7 +72,6 @@ EXPORT_SYMBOL(xfrm4_prepare_output);
 int xfrm4_output_finish(struct sk_buff *skb)
 {
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-        skb->protocol = htons(ETH_P_IP);
 
 #ifdef CONFIG_NETFILTER
         IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b4d5e1d97c1b..70bc6abc0639 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                                 goto again;
                         flp6->saddr = saddr;
                 }
+                err = rt->dst.error;
                 goto out;
         }
 again:
@@ -321,7 +322,9 @@ out_fib6_rules_ops:
 
 static void __net_exit fib6_rules_net_exit(struct net *net)
 {
+        rtnl_lock();
         fib_rules_unregister(net->ipv6.fib6_rules_ops);
+        rtnl_unlock();
 }
 
 static struct pernet_operations fib6_rules_net_ops = {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0a04a37305d5..36cf0ab685a0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -318,6 +318,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
 
 static inline int ip6_forward_finish(struct sk_buff *skb)
 {
+        skb_sender_cpu_clear(skb);
         return dst_output(skb);
 }
 
@@ -541,7 +542,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct sk_buff *frag;
         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
-        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+        struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+                                inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 266a264ec212..ddd94eca19b3 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -314,7 +314,7 @@ out:
  *   Create tunnel matching given parameters.
  *
  * Return:
- *   created tunnel or NULL
+ *   created tunnel or error pointer
  **/
 
 static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
@@ -322,7 +322,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
         struct net_device *dev;
         struct ip6_tnl *t;
         char name[IFNAMSIZ];
-        int err;
+        int err = -ENOMEM;
 
         if (p->name[0])
                 strlcpy(name, p->name, IFNAMSIZ);
@@ -348,7 +348,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 failed_free:
         ip6_dev_free(dev);
 failed:
-        return NULL;
+        return ERR_PTR(err);
 }
 
 /**
@@ -362,7 +362,7 @@ failed:
  *   tunnel device is created and registered for use.
  *
  * Return:
- *   matching tunnel or NULL
+ *   matching tunnel or error pointer
  **/
 
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
@@ -380,13 +380,13 @@ static struct ip6_tnl *ip6_tnl_locate(struct net *net,
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr)) {
                         if (create)
-                                return NULL;
+                                return ERR_PTR(-EEXIST);
 
                         return t;
                 }
         }
         if (!create)
-                return NULL;
+                return ERR_PTR(-ENODEV);
         return ip6_tnl_create(net, p);
 }
 
@@ -1420,7 +1420,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         }
                         ip6_tnl_parm_from_user(&p1, &p);
                         t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                 t = netdev_priv(dev);
                 } else {
                         memset(&p, 0, sizeof(p));
@@ -1445,7 +1445,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 ip6_tnl_parm_from_user(&p1, &p);
                 t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
                 if (cmd == SIOCCHGTUNNEL) {
-                        if (t != NULL) {
+                        if (!IS_ERR(t)) {
                                 if (t->dev != dev) {
                                         err = -EEXIST;
                                         break;
@@ -1457,14 +1457,15 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         else
                                 err = ip6_tnl_update(t, &p1);
                 }
-                if (t) {
+                if (!IS_ERR(t)) {
                         err = 0;
                         ip6_tnl_parm_to_user(&p, &t->parms);
                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
                                 err = -EFAULT;
 
-                } else
-                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
+                } else {
+                        err = PTR_ERR(t);
+                }
                 break;
         case SIOCDELTUNNEL:
                 err = -EPERM;
@@ -1478,7 +1479,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         err = -ENOENT;
                         ip6_tnl_parm_from_user(&p1, &p);
                         t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                 break;
                         err = -EPERM;
                         if (t->dev == ip6n->fb_tnl_dev)
@@ -1672,12 +1673,13 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
                            struct nlattr *tb[], struct nlattr *data[])
 {
         struct net *net = dev_net(dev);
-        struct ip6_tnl *nt;
+        struct ip6_tnl *nt, *t;
 
         nt = netdev_priv(dev);
         ip6_tnl_netlink_parms(data, &nt->parms);
 
-        if (ip6_tnl_locate(net, &nt->parms, 0))
+        t = ip6_tnl_locate(net, &nt->parms, 0);
+        if (!IS_ERR(t))
                 return -EEXIST;
 
         return ip6_tnl_create2(dev);
@@ -1697,8 +1699,7 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
         ip6_tnl_netlink_parms(data, &p);
 
         t = ip6_tnl_locate(net, &p, 0);
-
-        if (t) {
+        if (!IS_ERR(t)) {
                 if (t->dev != dev)
                         return -EEXIST;
         } else
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 34b682617f50..312e0ff47339 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -252,7 +252,7 @@ static int __net_init ip6mr_rules_init(struct net *net)
         return 0;
 
 err2:
-        kfree(mrt);
+        ip6mr_free_table(mrt);
 err1:
         fib_rules_unregister(ops);
         return err;
@@ -267,8 +267,8 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
                 list_del(&mrt->list);
                 ip6mr_free_table(mrt);
         }
-        rtnl_unlock();
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
+        rtnl_unlock();
 }
 #else
 #define ip6mr_for_each_table(mrt, net) \
@@ -336,7 +336,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
 
 static void ip6mr_free_table(struct mr6_table *mrt)
 {
-        del_timer(&mrt->ipmr_expire_timer);
+        del_timer_sync(&mrt->ipmr_expire_timer);
         mroute_clean_tables(mrt);
         kfree(mrt);
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 471ed24aabae..14ecdaf06bf7 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1218,7 +1218,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         if (rt)
                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
         if (ra_msg->icmph.icmp6_hop_limit) {
-                in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+                /* Only set hop_limit on the interface if it is higher than
+                 * the current hop_limit.
+                 */
+                if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+                        in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+                } else {
+                        ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+                }
                 if (rt)
                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
                                        ra_msg->icmph.icmp6_hop_limit);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e080fbbbc0e5..bb00c6f2a885 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -298,9 +298,9 @@ static void trace_packet(const struct sk_buff *skb,
                     &chainname, &comment, &rulenum) != 0)
                         break;
 
-        nf_log_packet(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+        nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
+                     "TRACE: %s:%s:%s:%u ",
+                     tablename, chainname, comment, rulenum);
 }
 #endif
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5d46832c6f72..1f5e62229aaa 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1411,6 +1411,15 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
         TCP_SKB_CB(skb)->sacked = 0;
 }
 
+static void tcp_v6_restore_cb(struct sk_buff *skb)
+{
+        /* We need to move header back to the beginning if xfrm6_policy_check()
+         * and tcp_v6_fill_cb() are going to be called again.
+         */
+        memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
+                sizeof(struct inet6_skb_parm));
+}
+
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         const struct tcphdr *th;
@@ -1543,6 +1552,7 @@ do_time_wait:
                         inet_twsk_deschedule(tw, &tcp_death_row);
                         inet_twsk_put(tw);
                         sk = sk2;
+                        tcp_v6_restore_cb(skb);
                         goto process;
                 }
                 /* Fall through to ACK */
@@ -1551,6 +1561,7 @@ do_time_wait:
                 tcp_v6_timewait_ack(sk, skb);
                 break;
         case TCP_TW_RST:
+                tcp_v6_restore_cb(skb);
                 goto no_tcp_socket;
         case TCP_TW_SUCCESS:
                 ;
@@ -1585,7 +1596,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
                 skb->sk = sk;
                 skb->destructor = sock_edemux;
                 if (sk->sk_state != TCP_TIME_WAIT) {
-                        struct dst_entry *dst = sk->sk_rx_dst;
+                        struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
 
                         if (dst)
                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ab889bb16b3c..be2c0ba82c85 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                 fptr->nexthdr = nexthdr;
                 fptr->reserved = 0;
-                if (skb_shinfo(skb)->ip6_frag_id)
-                        fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-                else
-                        ipv6_select_ident(fptr,
-                                          (struct rt6_info *)skb_dst(skb));
+                if (!skb_shinfo(skb)->ip6_frag_id)
+                        ipv6_proxy_select_ident(skb);
+                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
 
                 /* Fragment the skb. ipv6 header and the remaining fields of the
                  * fragment header are updated in ipv6_gso_segment()
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index ca3f29b98ae5..010f8bd2d577 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -114,6 +114,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                 return err;
 
         skb->ignore_df = 1;
+        skb->protocol = htons(ETH_P_IPV6);
 
         return x->outer_mode->output2(x, skb);
 }
@@ -122,7 +123,6 @@ EXPORT_SYMBOL(xfrm6_prepare_output);
 int xfrm6_output_finish(struct sk_buff *skb)
 {
         memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-        skb->protocol = htons(ETH_P_IPV6);
 
 #ifdef CONFIG_NETFILTER
         IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 48bf5a06847b..8d2d01b4800a 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -200,6 +200,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 #if IS_ENABLED(CONFIG_IPV6_MIP6)
                 case IPPROTO_MH:
+                        offset += ipv6_optlen(exthdr);
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 2e9953b2db84..53d931172088 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1114,10 +1114,8 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         noblock, &err);
         else
                 skb = sock_alloc_send_skb(sk, len, noblock, &err);
-        if (!skb) {
-                err = -ENOMEM;
+        if (!skb)
                 goto out;
-        }
         if (iucv->transport == AF_IUCV_TRANS_HIPER)
                 skb_reserve(skb, sizeof(struct af_iucv_trans_hdr) + ETH_HLEN);
         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 895348e44c7d..a29a504492af 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1871,6 +1871,7 @@ static int __init l2tp_init(void)
         l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
         if (!l2tp_wq) {
                 pr_err("alloc_workqueue failed\n");
+                unregister_pernet_device(&l2tp_net_ops);
                 rc = -ENOMEM;
                 goto out;
         }
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index a48bad468880..7702978a4c99 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
                 container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
-        del_timer_sync(&tid_rx->reorder_timer);
-
         for (i = 0; i < tid_rx->buf_size; i++)
                 __skb_queue_purge(&tid_rx->reorder_buf[i]);
         kfree(tid_rx->reorder_buf);
@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         del_timer_sync(&tid_rx->session_timer);
 
+        /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
+        spin_lock_bh(&tid_rx->reorder_lock);
+        tid_rx->removed = true;
+        spin_unlock_bh(&tid_rx->reorder_lock);
+        del_timer_sync(&tid_rx->reorder_timer);
+
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3afe36824703..8d53d65bd2ab 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -58,13 +58,24 @@ struct ieee80211_local;
 #define IEEE80211_UNSET_POWER_LEVEL     INT_MIN
 
 /*
- * Some APs experience problems when working with U-APSD. Decrease the
- * probability of that happening by using legacy mode for all ACs but VO.
- * The AP that caused us trouble was a Cisco 4410N. It ignores our
- * setting, and always treats non-VO ACs as legacy.
+ * Some APs experience problems when working with U-APSD. Decreasing the
+ * probability of that happening by using legacy mode for all ACs but VO isn't
+ * enough.
+ *
+ * Cisco 4410N originally forced us to enable VO by default only because it
+ * treated non-VO ACs as legacy.
+ *
+ * However some APs (notably Netgear R7000) silently reclassify packets to
+ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
+ * clients would never see some frames (e.g. ARP responses) or would fetch them
+ * accidentally after a long time.
+ *
+ * It makes little sense to enable u-APSD queues by default because it needs
+ * userspace applications to be aware of it to actually take advantage of the
+ * possible additional powersavings. Implicitly depending on driver autotrigger
+ * frame support doesn't make much sense.
  */
-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
-        IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
+#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
 
 #define IEEE80211_DEFAULT_MAX_SP_LEN            \
         IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
@@ -453,6 +464,7 @@ struct ieee80211_if_managed {
         unsigned int flags;
 
         bool csa_waiting_bcn;
+        bool csa_ignored_same_chan;
 
         bool beacon_crc_valid;
         u32 beacon_crc;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 10ac6324c1d0..142f66aece18 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1150,6 +1150,17 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 return;
         }
 
+        if (cfg80211_chandef_identical(&csa_ie.chandef,
+                                       &sdata->vif.bss_conf.chandef)) {
+                if (ifmgd->csa_ignored_same_chan)
+                        return;
+                sdata_info(sdata,
+                           "AP %pM tries to chanswitch to same channel, ignore\n",
+                           ifmgd->associated->bssid);
+                ifmgd->csa_ignored_same_chan = true;
+                return;
+        }
+
         mutex_lock(&local->mtx);
         mutex_lock(&local->chanctx_mtx);
         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
@@ -1210,6 +1221,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         sdata->vif.csa_active = true;
         sdata->csa_chandef = csa_ie.chandef;
         sdata->csa_block_tx = csa_ie.mode;
+        ifmgd->csa_ignored_same_chan = false;
 
         if (sdata->csa_block_tx)
                 ieee80211_stop_vif_queues(local, sdata,
@@ -2090,6 +2102,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         sdata->vif.csa_active = false;
         ifmgd->csa_waiting_bcn = false;
+        ifmgd->csa_ignored_same_chan = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3204,7 +3217,8 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
         (1ULL << WLAN_EID_HT_CAPABILITY) |
-        (1ULL << WLAN_EID_HT_OPERATION);
+        (1ULL << WLAN_EID_HT_OPERATION) |
+        (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
 
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt, size_t len,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1101563357ea..1eb730bf8752 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -873,9 +873,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
 
  set_release_timer:
 
-                mod_timer(&tid_agg_rx->reorder_timer,
-                          tid_agg_rx->reorder_time[j] + 1 +
-                          HT_RX_REORDER_BUF_TIMEOUT);
+                if (!tid_agg_rx->removed)
+                        mod_timer(&tid_agg_rx->reorder_timer,
+                                  tid_agg_rx->reorder_time[j] + 1 +
+                                  HT_RX_REORDER_BUF_TIMEOUT);
         } else {
                 del_timer(&tid_agg_rx->reorder_timer);
         }
@@ -2214,6 +2215,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         hdr = (struct ieee80211_hdr *) skb->data;
         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
 
+        if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+                return RX_DROP_MONITOR;
+
         /* frame is in RMC, don't forward */
         if (ieee80211_is_data(hdr->frame_control) &&
             is_multicast_ether_addr(hdr->addr1) &&
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 925e68fe64c7..fb0fc1302a58 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -175,6 +175,7 @@ struct tid_ampdu_tx {
  * @reorder_lock: serializes access to reorder buffer, see below.
  * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
  *      and ssn.
+ * @removed: this session is removed (but might have been found due to RCU)
  *
  * This structure's lifetime is managed by RCU, assignments to
  * the array holding it must hold the aggregation mutex.
@@ -199,6 +200,7 @@ struct tid_ampdu_rx {
         u16 timeout;
         u8 dialog_token;
         bool auto_seq;
+        bool removed;
 };
 
 /**
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8428f4a95479..747bdcf72e92 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3178,7 +3178,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
                 wdev_iter = &sdata_iter->wdev;
 
                 if (sdata_iter == sdata ||
-                    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
+                    !ieee80211_sdata_running(sdata_iter) ||
                     local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
                         continue;
 
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 0d8448f19dfe..675d12c69e32 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -212,6 +212,30 @@ void nf_log_packet(struct net *net,
 }
 EXPORT_SYMBOL(nf_log_packet);
 
+void nf_log_trace(struct net *net,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *loginfo, const char *fmt, ...)
+{
+        va_list args;
+        char prefix[NF_LOG_PREFIXLEN];
+        const struct nf_logger *logger;
+
+        rcu_read_lock();
+        logger = rcu_dereference(net->nf.nf_loggers[pf]);
+        if (logger) {
+                va_start(args, fmt);
+                vsnprintf(prefix, sizeof(prefix), fmt, args);
+                va_end(args);
+                logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(nf_log_trace);
+
 #define S_SIZE (1024 - (sizeof(unsigned int) + 1))
 
 struct nf_log_buf {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6ab777912237..ac1a9528dbf2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 
         if (nla[NFTA_CHAIN_POLICY]) {
                 if ((chain != NULL &&
-                    !(chain->flags & NFT_BASE_CHAIN)) ||
+                    !(chain->flags & NFT_BASE_CHAIN)))
+                        return -EOPNOTSUPP;
+
+                if (chain == NULL &&
                     nla[NFTA_CHAIN_HOOK] == NULL)
                         return -EOPNOTSUPP;
 
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 3b90eb2b2c55..2d298dccb6dd 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -94,10 +94,10 @@ static void nft_trace_packet(const struct nft_pktinfo *pkt,
 {
         struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-        nf_log_packet(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
-                      pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
-                      chain->table->name, chain->name, comments[type],
-                      rulenum);
+        nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
+                     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
+                     chain->table->name, chain->name, comments[type],
+                     rulenum);
 }
 
 unsigned int
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index a5599fc51a6f..54330fb5efaf 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
         if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
                 return -EINVAL;
 
+        /* Not all fields are initialized so first zero the tuple */
+        memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
+
         tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
         tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 213584cf04b3..65f3e2b6be44 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -133,6 +133,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                 break;
         case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
+
                 entry->e6.ipv6.proto = proto;
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
@@ -344,6 +347,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                 break;
         case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
+
                 entry->e6.ipv6.proto = proto;
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index c82df0a48fcd..37c15e674884 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -153,6 +153,8 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
                                 iter->err = err;
                                 goto out;
                         }
+
+                        continue;
                 }
 
                 if (iter->count < iter->skip)
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index ef8a926752a9..50e1e5aaf4ce 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -513,8 +513,8 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
 {
         const struct ip6t_ip6 *i = par->entryinfo;
 
-        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
-            && !(i->flags & IP6T_INV_PROTO))
+        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
+            !(i->invflags & IP6T_INV_PROTO))
                 return 0;
 
         pr_info("Can be used only in combination with "
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index ec2954ffc690..067a3fff1d2c 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -274,10 +274,8 @@ void ovs_vport_del(struct vport *vport)
         ASSERT_OVSL();
 
         hlist_del_rcu(&vport->hash_node);
-
-        vport->ops->destroy(vport);
-
         module_put(vport->ops->owner);
+        vport->ops->destroy(vport);
 }
 
 /**
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index a817705ce2d0..dba8d0864f18 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                         int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 
-static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
+                             struct rds_iw_device **rds_iwdev,
+                             struct rdma_cm_id **cm_id)
 {
         struct rds_iw_device *iwdev;
         struct rds_iw_cm_id *i_cm_id;
@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                                 src_addr->sin_port,
                                 dst_addr->sin_addr.s_addr,
                                 dst_addr->sin_port,
-                                rs->rs_bound_addr,
-                                rs->rs_bound_port,
-                                rs->rs_conn_addr,
-                                rs->rs_conn_port);
+                                src->sin_addr.s_addr,
+                                src->sin_port,
+                                dst->sin_addr.s_addr,
+                                dst->sin_port);
 #ifdef WORKING_TUPLE_DETECTION
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
-                            src_addr->sin_port == rs->rs_bound_port &&
-                            dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
-                            dst_addr->sin_port == rs->rs_conn_port) {
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
+                            src_addr->sin_port == src->sin_port &&
+                            dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
+                            dst_addr->sin_port == dst->sin_port) {
 #else
                         /* FIXME - needs to compare the local and remote
                          * ipaddr/port tuple, but the ipaddr is the only
@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                          * zero'ed.  It doesn't appear to be properly populated
                          * during connection setup...
                          */
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
 #endif
                                 spin_unlock_irq(&iwdev->spinlock);
                                 *rds_iwdev = iwdev;
@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
 {
         struct sockaddr_in *src_addr, *dst_addr;
         struct rds_iw_device *rds_iwdev_old;
-        struct rds_sock rs;
         struct rdma_cm_id *pcm_id;
         int rc;
 
         src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
         dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
 
-        rs.rs_bound_addr = src_addr->sin_addr.s_addr;
-        rs.rs_bound_port = src_addr->sin_port;
-        rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-        rs.rs_conn_port = dst_addr->sin_port;
-
-        rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
+        rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
         if (rc)
                 rds_iw_remove_cm_id(rds_iwdev, cm_id);
 
@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
         struct rds_iw_device *rds_iwdev;
         struct rds_iw_mr *ibmr = NULL;
         struct rdma_cm_id *cm_id;
+        struct sockaddr_in src = {
+                .sin_addr.s_addr = rs->rs_bound_addr,
+                .sin_port = rs->rs_bound_port,
+        };
+        struct sockaddr_in dst = {
+                .sin_addr.s_addr = rs->rs_conn_addr,
+                .sin_port = rs->rs_conn_port,
+        };
         int ret;
 
-        ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
+        ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
         if (ret || !cm_id) {
                 ret = -ENODEV;
                 goto out;
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 4575485ad1b4..19a560626dc4 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (!skb) {
                         /* nothing remains on the queue */
                         if (copied &&
-                            (msg->msg_flags & MSG_PEEK || timeo == 0))
+                            (flags & MSG_PEEK || timeo == 0))
                                 goto out;
 
                         /* wait for a message to turn up */
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 82c5d7fc1988..5f6288fa3f12 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -25,21 +25,41 @@ static int tcf_bpf(struct sk_buff *skb, const struct tc_action *a,
                    struct tcf_result *res)
 {
         struct tcf_bpf *b = a->priv;
-        int action;
-        int filter_res;
+        int action, filter_res;
 
         spin_lock(&b->tcf_lock);
+
         b->tcf_tm.lastuse = jiffies;
         bstats_update(&b->tcf_bstats, skb);
-        action = b->tcf_action;
 
         filter_res = BPF_PROG_RUN(b->filter, skb);
-        if (filter_res == 0) {
-                /* Return code 0 from the BPF program
-                 * is being interpreted as a drop here.
-                 */
-                action = TC_ACT_SHOT;
+
+        /* A BPF program may overwrite the default action opcode.
+         * Similarly as in cls_bpf, if filter_res == -1 we use the
+         * default action specified from tc.
+         *
+         * In case a different well-known TC_ACT opcode has been
+         * returned, it will overwrite the default one.
+         *
+         * For everything else that is unkown, TC_ACT_UNSPEC is
+         * returned.
+         */
+        switch (filter_res) {
+        case TC_ACT_PIPE:
+        case TC_ACT_RECLASSIFY:
+        case TC_ACT_OK:
+                action = filter_res;
+                break;
+        case TC_ACT_SHOT:
+                action = filter_res;
                 b->tcf_qstats.drops++;
+                break;
+        case TC_ACT_UNSPEC:
+                action = b->tcf_action;
+                break;
+        default:
+                action = TC_ACT_UNSPEC;
+                break;
         }
 
         spin_unlock(&b->tcf_lock);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 09487afbfd51..95fdf4e40051 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -78,8 +78,11 @@ struct tc_u_hnode {
         struct tc_u_common      *tp_c;
         int                     refcnt;
         unsigned int            divisor;
-        struct tc_u_knode __rcu *ht[1];
         struct rcu_head         rcu;
+        /* The 'ht' field MUST be the last field in structure to allow for
+         * more entries allocated at end of structure.
+         */
+        struct tc_u_knode __rcu *ht[1];
 };
 
 struct tc_u_common {
diff --git a/net/socket.c b/net/socket.c
index bbedbfcb42c2..245330ca0015 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 
         if (len > INT_MAX)
                 len = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 
         if (size > INT_MAX)
                 size = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 612aa73bbc60..e6ce1517367f 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -303,9 +303,7 @@ static int rpc_client_register(struct rpc_clnt *clnt,
         struct super_block *pipefs_sb;
         int err;
 
-        err = rpc_clnt_debugfs_register(clnt);
-        if (err)
-                return err;
+        rpc_clnt_debugfs_register(clnt);
 
         pipefs_sb = rpc_get_sb_net(net);
         if (pipefs_sb) {
diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c
index e811f390f9f6..82962f7e6e88 100644
--- a/net/sunrpc/debugfs.c
+++ b/net/sunrpc/debugfs.c
@@ -129,48 +129,52 @@ static const struct file_operations tasks_fops = {
         .release        = tasks_release,
 };
 
-int
+void
 rpc_clnt_debugfs_register(struct rpc_clnt *clnt)
 {
-        int len, err;
+        int len;
         char name[24]; /* enough for "../../rpc_xprt/ + 8 hex digits + NULL */
+        struct rpc_xprt *xprt;
 
         /* Already registered? */
-        if (clnt->cl_debugfs)
-                return 0;
+        if (clnt->cl_debugfs || !rpc_clnt_dir)
+                return;
 
         len = snprintf(name, sizeof(name), "%x", clnt->cl_clid);
         if (len >= sizeof(name))
-                return -EINVAL;
+                return;
 
         /* make the per-client dir */
         clnt->cl_debugfs = debugfs_create_dir(name, rpc_clnt_dir);
         if (!clnt->cl_debugfs)
-                return -ENOMEM;
+                return;
 
         /* make tasks file */
-        err = -ENOMEM;
         if (!debugfs_create_file("tasks", S_IFREG | S_IRUSR, clnt->cl_debugfs,
                                  clnt, &tasks_fops))
                 goto out_err;
 
-        err = -EINVAL;
         rcu_read_lock();
+        xprt = rcu_dereference(clnt->cl_xprt);
+        /* no "debugfs" dentry? Don't bother with the symlink. */
+        if (!xprt->debugfs) {
+                rcu_read_unlock();
+                return;
+        }
         len = snprintf(name, sizeof(name), "../../rpc_xprt/%s",
-                        rcu_dereference(clnt->cl_xprt)->debugfs->d_name.name);
+                        xprt->debugfs->d_name.name);
         rcu_read_unlock();
+
         if (len >= sizeof(name))
                 goto out_err;
 
-        err = -ENOMEM;
         if (!debugfs_create_symlink("xprt", clnt->cl_debugfs, name))
                 goto out_err;
 
-        return 0;
+        return;
 out_err:
         debugfs_remove_recursive(clnt->cl_debugfs);
         clnt->cl_debugfs = NULL;
-        return err;
 }
 
 void
@@ -226,33 +230,33 @@ static const struct file_operations xprt_info_fops = {
         .release        = xprt_info_release,
 };
 
-int
+void
 rpc_xprt_debugfs_register(struct rpc_xprt *xprt)
 {
         int len, id;
         static atomic_t cur_id;
         char            name[9]; /* 8 hex digits + NULL term */
 
+        if (!rpc_xprt_dir)
+                return;
+
         id = (unsigned int)atomic_inc_return(&cur_id);
 
         len = snprintf(name, sizeof(name), "%x", id);
         if (len >= sizeof(name))
-                return -EINVAL;
+                return;
 
         /* make the per-client dir */
         xprt->debugfs = debugfs_create_dir(name, rpc_xprt_dir);
         if (!xprt->debugfs)
-                return -ENOMEM;
+                return;
 
         /* make tasks file */
         if (!debugfs_create_file("info", S_IFREG | S_IRUSR, xprt->debugfs,
                                  xprt, &xprt_info_fops)) {
                 debugfs_remove_recursive(xprt->debugfs);
                 xprt->debugfs = NULL;
-                return -ENOMEM;
         }
-
-        return 0;
 }
 
 void
@@ -266,14 +270,17 @@ void __exit
 sunrpc_debugfs_exit(void)
 {
         debugfs_remove_recursive(topdir);
+        topdir = NULL;
+        rpc_clnt_dir = NULL;
+        rpc_xprt_dir = NULL;
 }
 
-int __init
+void __init
 sunrpc_debugfs_init(void)
 {
         topdir = debugfs_create_dir("sunrpc", NULL);
         if (!topdir)
-                goto out;
+                return;
 
         rpc_clnt_dir = debugfs_create_dir("rpc_clnt", topdir);
         if (!rpc_clnt_dir)
@@ -283,10 +290,9 @@ sunrpc_debugfs_init(void)
         if (!rpc_xprt_dir)
                 goto out_remove;
 
-        return 0;
+        return;
 out_remove:
         debugfs_remove_recursive(topdir);
         topdir = NULL;
-out:
-        return -ENOMEM;
+        rpc_clnt_dir = NULL;
 }
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index e37fbed87956..ee5d3d253102 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -98,10 +98,7 @@ init_sunrpc(void)
         if (err)
                 goto out4;
 
-        err = sunrpc_debugfs_init();
-        if (err)
-                goto out5;
-
+        sunrpc_debugfs_init();
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         rpc_register_sysctl();
 #endif
@@ -109,8 +106,6 @@ init_sunrpc(void)
         init_socket_xprt();     /* clnt sock transport */
         return 0;
 
-out5:
-        unregister_rpc_pipefs();
 out4:
         unregister_pernet_subsys(&sunrpc_net_ops);
 out3:
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index e3015aede0d9..9949722d99ce 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1331,7 +1331,6 @@ static void xprt_init(struct rpc_xprt *xprt, struct net *net)
  */
 struct rpc_xprt *xprt_create_transport(struct xprt_create *args)
 {
-        int err;
         struct rpc_xprt *xprt;
         struct xprt_class *t;
 
@@ -1372,11 +1371,7 @@ found:
                 return ERR_PTR(-ENOMEM);
         }
 
-        err = rpc_xprt_debugfs_register(xprt);
-        if (err) {
-                xprt_destroy(xprt);
-                return ERR_PTR(err);
-        }
+        rpc_xprt_debugfs_register(xprt);
 
         dprintk("RPC:       created transport %p with %u slots\n", xprt,
                         xprt->max_reqs);
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 935205e6bcfe..be1c9fa60b09 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -152,11 +152,11 @@ out_netlink:
 static void __exit tipc_exit(void)
 {
         tipc_bearer_cleanup();
+        unregister_pernet_subsys(&tipc_net_ops);
         tipc_netlink_stop();
         tipc_netlink_compat_stop();
         tipc_socket_stop();
         tipc_unregister_sysctl();
-        unregister_pernet_subsys(&tipc_net_ops);
 
         pr_info("Deactivated\n");
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index be2501538011..b6f84f6a2a09 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4400,6 +4400,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
                 return -EINVAL;
 
+        /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
+         * as userspace might just pass through the capabilities from the IEs
+         * directly, rather than enforcing this restriction and returning an
+         * error in this case.
+         */
+        if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
+                params.ht_capa = NULL;
+                params.vht_capa = NULL;
+        }
+
         /* When you run into this, adjust the code below for the new flag */
         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cee479bc655c..638af0655aaf 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2269,11 +2269,9 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                  * have the xfrm_state's. We need to wait for KM to
                  * negotiate new SA's or bail out with error.*/
                 if (net->xfrm.sysctl_larval_drop) {
-                        dst_release(dst);
-                        xfrm_pols_put(pols, drop_pols);
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
-
-                        return ERR_PTR(-EREMOTE);
+                        err = -EREMOTE;
+                        goto error;
                 }
 
                 err = -EAGAIN;
@@ -2324,7 +2322,8 @@ nopol:
 error:
         dst_release(dst);
 dropdst:
-        dst_release(dst_orig);
+        if (!(flags & XFRM_LOOKUP_KEEP_DST_REF))
+                dst_release(dst_orig);
         xfrm_pols_put(pols, drop_pols);
         return ERR_PTR(err);
 }
@@ -2338,7 +2337,8 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
                                     struct sock *sk, int flags)
 {
         struct dst_entry *dst = xfrm_lookup(net, dst_orig, fl, sk,
-                                            flags | XFRM_LOOKUP_QUEUE);
+                                            flags | XFRM_LOOKUP_QUEUE |
+                                            XFRM_LOOKUP_KEEP_DST_REF);
 
         if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                 return make_blackhole(net, dst_orig->ops->family, dst_orig);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 1684bcc78b34..5fde34326dcf 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
                 goto out;
 
         /* No partial writes. */
-        length = EINVAL;
+        length = -EINVAL;
         if (*ppos != 0)
                 goto out;
 
diff --git a/sound/core/control.c b/sound/core/control.c
index 35324a8e83c8..eeb691d1911f 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1170,6 +1170,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
 
         if (info->count < 1)
                 return -EINVAL;
+        if (!*info->id.name)
+                return -EINVAL;
+        if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
+                return -EINVAL;
         access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
                 (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
                                  SNDRV_CTL_ELEM_ACCESS_INACTIVE|
diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
index a422aaa3bb0c..9ee25a63f684 100644
--- a/sound/firewire/bebob/bebob_maudio.c
+++ b/sound/firewire/bebob/bebob_maudio.c
@@ -96,10 +96,10 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
         struct fw_device *device = fw_parent_device(unit);
         int err, rcode;
         u64 date;
-        __be32 cues[3] = {
-                MAUDIO_BOOTLOADER_CUE1,
-                MAUDIO_BOOTLOADER_CUE2,
-                MAUDIO_BOOTLOADER_CUE3
+        __le32 cues[3] = {
+                cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
+                cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
+                cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
         };
 
         /* check date of software used to build */
diff --git a/sound/firewire/dice/dice-interface.h b/sound/firewire/dice/dice-interface.h
index de7602bd69b5..27b044f84c81 100644
--- a/sound/firewire/dice/dice-interface.h
+++ b/sound/firewire/dice/dice-interface.h
@@ -299,23 +299,23 @@
 #define RX_ISOCHRONOUS                  0x008
 
 /*
+ * Index of first quadlet to be interpreted; read/write.  If > 0, that many
+ * quadlets at the beginning of each data block will be ignored, and all the
+ * audio and MIDI quadlets will follow.
+ */
+#define RX_SEQ_START                    0x00c
+
+/*
  * The number of audio channels; read-only.  There will be one quadlet per
  * channel.
  */
-#define RX_NUMBER_AUDIO                 0x00c
+#define RX_NUMBER_AUDIO                 0x010
 
 /*
  * The number of MIDI ports, 0-8; read-only.  If > 0, there will be one
  * additional quadlet in each data block, following the audio quadlets.
  */
-#define RX_NUMBER_MIDI                  0x010
-
-/*
- * Index of first quadlet to be interpreted; read/write.  If > 0, that many
- * quadlets at the beginning of each data block will be ignored, and all the
- * audio and MIDI quadlets will follow.
- */
-#define RX_SEQ_START                    0x014
+#define RX_NUMBER_MIDI                  0x014
 
 /*
  * Names of all audio channels; read-only.  Quadlets are byte-swapped.  Names
diff --git a/sound/firewire/dice/dice-proc.c b/sound/firewire/dice/dice-proc.c
index ecfe20fd4de5..f5c1d1bced59 100644
--- a/sound/firewire/dice/dice-proc.c
+++ b/sound/firewire/dice/dice-proc.c
@@ -99,9 +99,9 @@ static void dice_proc_read(struct snd_info_entry *entry,
                 } tx;
                 struct {
                         u32 iso;
+                        u32 seq_start;
                         u32 number_audio;
                         u32 number_midi;
-                        u32 seq_start;
                         char names[RX_NAMES_SIZE];
                         u32 ac3_caps;
                         u32 ac3_enable;
@@ -204,10 +204,10 @@ static void dice_proc_read(struct snd_info_entry *entry,
                         break;
                 snd_iprintf(buffer, "rx %u:\n", stream);
                 snd_iprintf(buffer, "  iso channel: %d\n", (int)buf.rx.iso);
+                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 snd_iprintf(buffer, "  audio channels: %u\n",
                             buf.rx.number_audio);
                 snd_iprintf(buffer, "  midi ports: %u\n", buf.rx.number_midi);
-                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 if (quadlets >= 68) {
                         dice_proc_fixup_string(buf.rx.names, RX_NAMES_SIZE);
                         snd_iprintf(buffer, "  names: %s\n", buf.rx.names);
diff --git a/sound/firewire/iso-resources.c b/sound/firewire/iso-resources.c
index 5f17b77ee152..f0e4d502d604 100644
--- a/sound/firewire/iso-resources.c
+++ b/sound/firewire/iso-resources.c
@@ -26,7 +26,7 @@
 int fw_iso_resources_init(struct fw_iso_resources *r, struct fw_unit *unit)
 {
         r->channels_mask = ~0uLL;
-        r->unit = fw_unit_get(unit);
+        r->unit = unit;
         mutex_init(&r->mutex);
         r->allocated = false;
 
@@ -42,7 +42,6 @@ void fw_iso_resources_destroy(struct fw_iso_resources *r)
 {
         WARN_ON(r->allocated);
         mutex_destroy(&r->mutex);
-        fw_unit_put(r->unit);
 }
 EXPORT_SYMBOL(fw_iso_resources_destroy);
 
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index a2ce773bdc62..17c2637d842c 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -1164,7 +1164,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
                 }
         }
 
-        if (!bus->no_response_fallback)
+        if (bus->no_response_fallback)
                 return -1;
 
         if (!chip->polling_mode && chip->poll_count < 2) {
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index b680b4ec6331..8ec5289f8e05 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -687,12 +687,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
         return val;
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
+{
+        unsigned int wcaps = get_wcaps(codec, nid);
+        hda_nid_t conn;
+
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+        if (snd_hda_get_num_conns(codec, nid) != 1)
+                return false;
+        if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
+}
+
 /* initialize the amp value (only at the first time) */
 static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
 {
         unsigned int caps = query_amp_caps(codec, nid, dir);
         int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-        snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+
+        if (is_stereo_amps(codec, nid, dir))
+                snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+        else
+                snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
+}
+
+/* update the amp, doing in stereo or mono depending on NID */
+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
+                      unsigned int mask, unsigned int val)
+{
+        if (is_stereo_amps(codec, nid, dir))
+                return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
+                                                mask, val);
+        else
+                return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
+                                                mask, val);
 }
 
 /* calculate amp value mask we can modify;
@@ -732,7 +765,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
                 return;
 
         val &= mask;
-        snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
+        update_amp(codec, nid, dir, idx, mask, val);
 }
 
 static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
@@ -4424,13 +4457,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
         has_amp = nid_has_mute(codec, mix, HDA_INPUT);
         for (i = 0; i < nums; i++) {
                 if (has_amp)
-                        snd_hda_codec_amp_stereo(codec, mix,
-                                                 HDA_INPUT, i,
-                                                 0xff, HDA_AMP_MUTE);
+                        update_amp(codec, mix, HDA_INPUT, i,
+                                   0xff, HDA_AMP_MUTE);
                 else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
-                        snd_hda_codec_amp_stereo(codec, conn[i],
-                                                 HDA_OUTPUT, 0,
-                                                 0xff, HDA_AMP_MUTE);
+                        update_amp(codec, conn[i], HDA_OUTPUT, 0,
+                                   0xff, HDA_AMP_MUTE);
         }
 }
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 4ca3d5d02436..a8a1e14272a1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1989,7 +1989,7 @@ static const struct pci_device_id azx_ids[] = {
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
         /* Sunrise Point */
         { PCI_DEVICE(0x8086, 0xa170),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
         /* Sunrise Point-LP */
         { PCI_DEVICE(0x8086, 0x9d70),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index ce5a6da83419..05e19f78b4cb 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
                     (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
+                           int dir, unsigned int wcaps, int indices)
+{
+        hda_nid_t conn;
+
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        /* check for a stereo-to-mono mix; it must be:
+         * only a single connection, only for input, and only a mixer widget
+         */
+        if (indices != 1 || dir != HDA_INPUT ||
+            get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+
+        if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        /* the connection source is a stereo? */
+        wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
+        return !!(wcaps & AC_WCAP_STEREO);
+}
+
 static void print_amp_vals(struct snd_info_buffer *buffer,
                            struct hda_codec *codec, hda_nid_t nid,
-                           int dir, int stereo, int indices)
+                           int dir, unsigned int wcaps, int indices)
 {
         unsigned int val;
+        bool stereo;
         int i;
 
+        stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
+
         dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
         for (i = 0; i < indices; i++) {
                 snd_iprintf(buffer, " [");
@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                             (codec->single_adc_amp &&
                              wid_type == AC_WID_AUD_IN))
                                 print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
-                                               1);
+                                               wid_caps, 1);
                         else
                                 print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
-                                               conn_len);
+                                               wid_caps, conn_len);
                 }
                 if (wid_caps & AC_WCAP_OUT_AMP) {
                         snd_iprintf(buffer, "  Amp-Out caps: ");
@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                         if (wid_type == AC_WID_PIN &&
                             codec->pin_amp_workaround)
                                 print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO,
-                                               conn_len);
+                                               wid_caps, conn_len);
                         else
                                 print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO, 1);
+                                               wid_caps, 1);
                 }
 
                 switch (wid_type) {
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 1589c9bcce3e..dd2b3d92071f 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -393,6 +393,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
         SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
         SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+        SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
         SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
         SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
         {} /* terminator */
@@ -584,6 +585,7 @@ static int patch_cs420x(struct hda_codec *codec)
                 return -ENOMEM;
 
         spec->gen.automute_hook = cs_automute;
+        codec->single_adc_amp = 1;
 
         snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
                            cs420x_fixups);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index fd3ed18670e9..da67ea8645a6 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -223,6 +223,7 @@ enum {
         CXT_PINCFG_LENOVO_TP410,
         CXT_PINCFG_LEMOTE_A1004,
         CXT_PINCFG_LEMOTE_A1205,
+        CXT_PINCFG_COMPAQ_CQ60,
         CXT_FIXUP_STEREO_DMIC,
         CXT_FIXUP_INC_MIC_BOOST,
         CXT_FIXUP_HEADPHONE_MIC_PIN,
@@ -660,6 +661,15 @@ static const struct hda_fixup cxt_fixups[] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = cxt_pincfg_lemote,
         },
+        [CXT_PINCFG_COMPAQ_CQ60] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        /* 0x17 was falsely set up as a mic, it should 0x1d */
+                        { 0x17, 0x400001f0 },
+                        { 0x1d, 0x97a70120 },
+                        { }
+                }
+        },
         [CXT_FIXUP_STEREO_DMIC] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cxt_fixup_stereo_dmic,
@@ -769,6 +779,7 @@ static const struct hda_model_fixup cxt5047_fixup_models[] = {
 };
 
 static const struct snd_pci_quirk cxt5051_fixups[] = {
+        SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
         {}
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 526398a4a442..f9d12c0a7e5a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -396,7 +396,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
 {
         /* We currently only handle front, HP */
         static hda_nid_t pins[] = {
-                0x0f, 0x10, 0x14, 0x15, 0
+                0x0f, 0x10, 0x14, 0x15, 0x17, 0
         };
         hda_nid_t *p;
         for (p = pins; *p; p++)
@@ -2912,6 +2912,8 @@ static void alc283_init(struct hda_codec *codec)
 
         if (!hp_pin)
                 return;
+
+        msleep(30);
         hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 
         /* Index 0x43 Direct Drive HP AMP LPM Control 1 */
@@ -3607,6 +3609,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
 
         switch (codec->vendor_id) {
         case 0x10ec0255:
+        case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
                 break;
         case 0x10ec0233:
@@ -3662,6 +3665,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
 
         switch (codec->vendor_id) {
         case 0x10ec0255:
+        case 0x10ec0256:
                 alc_write_coef_idx(codec, 0x45, 0xc489);
                 snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
                 alc_process_coef_fw(codec, coef0255);
@@ -3731,6 +3735,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)
 
         switch (codec->vendor_id) {
         case 0x10ec0255:
+        case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
                 break;
         case 0x10ec0233:
@@ -3785,6 +3790,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
 
         switch (codec->vendor_id) {
         case 0x10ec0255:
+        case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
                 break;
         case 0x10ec0233:
@@ -3839,6 +3845,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
 
         switch (codec->vendor_id) {
         case 0x10ec0255:
+        case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
                 break;
         case 0x10ec0233:
@@ -3884,6 +3891,7 @@ static void alc_determine_headset_type(struct hda_codec *codec)
 
         switch (codec->vendor_id) {
         case 0x10ec0255:
+        case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
                 msleep(300);
                 val = alc_read_coef_idx(codec, 0x46);
@@ -4364,6 +4372,7 @@ enum {
         ALC269_FIXUP_QUANTA_MUTE,
         ALC269_FIXUP_LIFEBOOK,
         ALC269_FIXUP_LIFEBOOK_EXTMIC,
+        ALC269_FIXUP_LIFEBOOK_HP_PIN,
         ALC269_FIXUP_AMIC,
         ALC269_FIXUP_DMIC,
         ALC269VB_FIXUP_AMIC,
@@ -4517,6 +4526,13 @@ static const struct hda_fixup alc269_fixups[] = {
                         { }
                 },
         },
+        [ALC269_FIXUP_LIFEBOOK_HP_PIN] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x21, 0x0221102f }, /* HP out */
+                        { }
+                },
+        },
         [ALC269_FIXUP_AMIC] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -5010,6 +5026,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
         SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
         SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
+        SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
         SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
         SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
@@ -5036,6 +5053,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
         SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
@@ -5216,6 +5234,16 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x17, 0x40000000},
                 {0x1d, 0x40700001},
                 {0x21, 0x02211050}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60140},
+                {0x13, 0x40000000},
+                {0x14, 0x90170110},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211020}),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
                 {0x12, 0x90a60130},
                 {0x13, 0x40000000},
diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
index b67480f1b1aa..4373ada95648 100644
--- a/sound/soc/codecs/adav80x.c
+++ b/sound/soc/codecs/adav80x.c
@@ -317,7 +317,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
-        unsigned int deemph = ucontrol->value.enumerated.item[0];
+        unsigned int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
@@ -333,7 +333,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = adav80x->deemph;
+        ucontrol->value.integer.value[0] = adav80x->deemph;
         return 0;
 };
 
diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
index 70861c7b1631..81b54a270bd8 100644
--- a/sound/soc/codecs/ak4641.c
+++ b/sound/soc/codecs/ak4641.c
@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = ak4641->deemph;
+        ucontrol->value.integer.value[0] = ak4641->deemph;
         return 0;
 };
 
diff --git a/sound/soc/codecs/ak4671.c b/sound/soc/codecs/ak4671.c
index 632e89f793a7..2a58b1dccd2f 100644
--- a/sound/soc/codecs/ak4671.c
+++ b/sound/soc/codecs/ak4671.c
@@ -343,25 +343,25 @@ static const struct snd_soc_dapm_widget ak4671_dapm_widgets[] = {
 };
 
 static const struct snd_soc_dapm_route ak4671_intercon[] = {
-        {"DAC Left", "NULL", "PMPLL"},
-        {"DAC Right", "NULL", "PMPLL"},
-        {"ADC Left", "NULL", "PMPLL"},
-        {"ADC Right", "NULL", "PMPLL"},
+        {"DAC Left", NULL, "PMPLL"},
+        {"DAC Right", NULL, "PMPLL"},
+        {"ADC Left", NULL, "PMPLL"},
+        {"ADC Right", NULL, "PMPLL"},
 
         /* Outputs */
-        {"LOUT1", "NULL", "LOUT1 Mixer"},
-        {"ROUT1", "NULL", "ROUT1 Mixer"},
-        {"LOUT2", "NULL", "LOUT2 Mix Amp"},
-        {"ROUT2", "NULL", "ROUT2 Mix Amp"},
-        {"LOUT3", "NULL", "LOUT3 Mixer"},
-        {"ROUT3", "NULL", "ROUT3 Mixer"},
+        {"LOUT1", NULL, "LOUT1 Mixer"},
+        {"ROUT1", NULL, "ROUT1 Mixer"},
+        {"LOUT2", NULL, "LOUT2 Mix Amp"},
+        {"ROUT2", NULL, "ROUT2 Mix Amp"},
+        {"LOUT3", NULL, "LOUT3 Mixer"},
+        {"ROUT3", NULL, "ROUT3 Mixer"},
 
         {"LOUT1 Mixer", "DACL", "DAC Left"},
         {"ROUT1 Mixer", "DACR", "DAC Right"},
         {"LOUT2 Mixer", "DACHL", "DAC Left"},
         {"ROUT2 Mixer", "DACHR", "DAC Right"},
-        {"LOUT2 Mix Amp", "NULL", "LOUT2 Mixer"},
-        {"ROUT2 Mix Amp", "NULL", "ROUT2 Mixer"},
+        {"LOUT2 Mix Amp", NULL, "LOUT2 Mixer"},
+        {"ROUT2 Mix Amp", NULL, "ROUT2 Mixer"},
         {"LOUT3 Mixer", "DACSL", "DAC Left"},
         {"ROUT3 Mixer", "DACSR", "DAC Right"},
 
@@ -381,18 +381,18 @@ static const struct snd_soc_dapm_route ak4671_intercon[] = {
         {"LIN2", NULL, "Mic Bias"},
         {"RIN2", NULL, "Mic Bias"},
 
-        {"ADC Left", "NULL", "LIN MUX"},
-        {"ADC Right", "NULL", "RIN MUX"},
+        {"ADC Left", NULL, "LIN MUX"},
+        {"ADC Right", NULL, "RIN MUX"},
 
         /* Analog Loops */
-        {"LIN1 Mixing Circuit", "NULL", "LIN1"},
-        {"RIN1 Mixing Circuit", "NULL", "RIN1"},
-        {"LIN2 Mixing Circuit", "NULL", "LIN2"},
-        {"RIN2 Mixing Circuit", "NULL", "RIN2"},
-        {"LIN3 Mixing Circuit", "NULL", "LIN3"},
-        {"RIN3 Mixing Circuit", "NULL", "RIN3"},
-        {"LIN4 Mixing Circuit", "NULL", "LIN4"},
-        {"RIN4 Mixing Circuit", "NULL", "RIN4"},
+        {"LIN1 Mixing Circuit", NULL, "LIN1"},
+        {"RIN1 Mixing Circuit", NULL, "RIN1"},
+        {"LIN2 Mixing Circuit", NULL, "LIN2"},
+        {"RIN2 Mixing Circuit", NULL, "RIN2"},
+        {"LIN3 Mixing Circuit", NULL, "LIN3"},
+        {"RIN3 Mixing Circuit", NULL, "RIN3"},
+        {"LIN4 Mixing Circuit", NULL, "LIN4"},
+        {"RIN4 Mixing Circuit", NULL, "RIN4"},
 
         {"LOUT1 Mixer", "LINL1", "LIN1 Mixing Circuit"},
         {"ROUT1 Mixer", "RINR1", "RIN1 Mixing Circuit"},
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 79a4efcb894c..7d3a6accaf9a 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -286,7 +286,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = cs4271->deemph;
+        ucontrol->value.integer.value[0] = cs4271->deemph;
         return 0;
 }
 
@@ -296,7 +296,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
-        cs4271->deemph = ucontrol->value.enumerated.item[0];
+        cs4271->deemph = ucontrol->value.integer.value[0];
         return cs4271_set_deemph(codec);
 }
 
diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
index ffe96175a8a5..911c26c705fc 100644
--- a/sound/soc/codecs/da732x.c
+++ b/sound/soc/codecs/da732x.c
@@ -876,11 +876,11 @@ static const struct snd_soc_dapm_widget da732x_dapm_widgets[] = {
 
 static const struct snd_soc_dapm_route da732x_dapm_routes[] = {
         /* Inputs */
-        {"AUX1L PGA", "NULL", "AUX1L"},
-        {"AUX1R PGA", "NULL", "AUX1R"},
+        {"AUX1L PGA", NULL, "AUX1L"},
+        {"AUX1R PGA", NULL, "AUX1R"},
         {"MIC1 PGA", NULL, "MIC1"},
-        {"MIC2 PGA", "NULL", "MIC2"},
-        {"MIC3 PGA", "NULL", "MIC3"},
+        {"MIC2 PGA", NULL, "MIC2"},
+        {"MIC3 PGA", NULL, "MIC3"},
 
         /* Capture Path */
         {"ADC1 Left MUX", "MIC1", "MIC1 PGA"},
diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index f27325155ace..c5f35a07e8e4 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -120,7 +120,7 @@ static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = es8328->deemph;
+        ucontrol->value.integer.value[0] = es8328->deemph;
         return 0;
 }
 
@@ -129,7 +129,7 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
         int ret;
 
         if (deemph > 1)
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index a722a023c262..477e13d30971 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = priv->deemph;
+        ucontrol->value.integer.value[0] = priv->deemph;
 
         return 0;
 }
@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        priv->deemph = ucontrol->value.enumerated.item[0];
+        priv->deemph = ucontrol->value.integer.value[0];
 
         return pcm1681_set_deemph(codec);
 }
diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 9974f201a08f..474cae82a874 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -1156,25 +1156,6 @@ static int pcm512x_hw_params(struct snd_pcm_substream *substream,
                                 ret, pcm512x->pll_out);
                         return ret;
                 }
-
-                gpio = PCM512x_G1OE << (4 - 1);
-                ret = regmap_update_bits(pcm512x->regmap, PCM512x_GPIO_EN,
-                                         gpio, gpio);
-                if (ret != 0) {
-                        dev_err(codec->dev, "Failed to enable gpio %d: %d\n",
-                                4, ret);
-                        return ret;
-                }
-
-                gpio = PCM512x_GPIO_OUTPUT_1 + 4 - 1;
-                ret = regmap_update_bits(pcm512x->regmap, gpio,
-                                         PCM512x_GxSL, PCM512x_GxSL_PLLLK);
-                if (ret != 0) {
-                        dev_err(codec->dev,
-                                "Failed to output pll lock on %d: %d\n",
-                                ret, 4);
-                        return ret;
-                }
         }
 
         ret = regmap_update_bits(pcm512x->regmap, PCM512x_SYNCHRONIZE,
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index f374840a5a7c..9b541e52da8c 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1198,7 +1198,7 @@ static struct dmi_system_id dmi_dell_dino[] = {
                 .ident = "Dell Dino",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_BOARD_NAME, "0144P8")
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343")
                 }
         },
         { }
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index e182e6569bbd..3593a1496056 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -1151,13 +1151,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
                 /* Enable VDDC charge pump */
                 ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
         } else if (vddio >= 3100 && vdda >= 3100) {
-                /*
-                 * if vddio and vddd > 3.1v,
-                 * charge pump should be clean before set ana_pwr
-                 */
-                snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
-                                SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
-
+                ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
                 /* VDDC use VDDIO rail */
                 lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
                 lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
index 47b257e41809..82095d6cd070 100644
--- a/sound/soc/codecs/sn95031.c
+++ b/sound/soc/codecs/sn95031.c
@@ -538,8 +538,8 @@ static const struct snd_soc_dapm_route sn95031_audio_map[] = {
         /* speaker map */
         { "IHFOUTL", NULL, "Speaker Rail"},
         { "IHFOUTR", NULL, "Speaker Rail"},
-        { "IHFOUTL", "NULL", "Speaker Left Playback"},
-        { "IHFOUTR", "NULL", "Speaker Right Playback"},
+        { "IHFOUTL", NULL, "Speaker Left Playback"},
+        { "IHFOUTR", NULL, "Speaker Right Playback"},
         { "Speaker Left Playback", NULL, "Speaker Left Filter"},
         { "Speaker Right Playback", NULL, "Speaker Right Filter"},
         { "Speaker Left Filter", NULL, "IHFDAC Left"},
diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
index 249ef5c4c762..32942bed34b1 100644
--- a/sound/soc/codecs/tas5086.c
+++ b/sound/soc/codecs/tas5086.c
@@ -281,7 +281,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = priv->deemph;
+        ucontrol->value.integer.value[0] = priv->deemph;
 
         return 0;
 }
@@ -292,7 +292,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        priv->deemph = ucontrol->value.enumerated.item[0];
+        priv->deemph = ucontrol->value.integer.value[0];
 
         return tas5086_set_deemph(codec);
 }
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index 8d9de49a5052..21d5402e343f 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
 
-        ucontrol->value.enumerated.item[0] = wm2000->anc_active;
+        ucontrol->value.integer.value[0] = wm2000->anc_active;
 
         return 0;
 }
@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        int anc_active = ucontrol->value.enumerated.item[0];
+        int anc_active = ucontrol->value.integer.value[0];
         int ret;
 
         if (anc_active > 1)
@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
 
-        ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
+        ucontrol->value.integer.value[0] = wm2000->spk_ena;
 
         return 0;
 }
@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        int val = ucontrol->value.enumerated.item[0];
+        int val = ucontrol->value.integer.value[0];
         int ret;
 
         if (val > 1)
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index 098c143f44d6..c6d10533e2bd 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -125,7 +125,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8731->deemph;
+        ucontrol->value.integer.value[0] = wm8731->deemph;
 
         return 0;
 }
@@ -135,7 +135,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
         int ret = 0;
 
         if (deemph > 1)
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index dde462c082be..04b04f8e147c 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8903->deemph;
+        ucontrol->value.integer.value[0] = wm8903->deemph;
 
         return 0;
 }
@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
         int ret = 0;
 
         if (deemph > 1)
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index d3b3f57668cc..215e93c1ddf0 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -525,7 +525,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8904->deemph;
+        ucontrol->value.integer.value[0] = wm8904->deemph;
         return 0;
 }
 
@@ -534,7 +534,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
index 1ab2d462afad..00bec915d652 100644
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8955->deemph;
+        ucontrol->value.integer.value[0] = wm8955->deemph;
         return 0;
 }
 
@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index cf8fecf97f2c..3035d9856415 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -184,7 +184,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8960->deemph;
+        ucontrol->value.integer.value[0] = wm8960->deemph;
         return 0;
 }
 
@@ -193,7 +193,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index 9517571e820d..98c9525bd751 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -180,7 +180,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
         struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
         struct wm9712_priv *wm9712 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val = ucontrol->value.enumerated.item[0];
+        unsigned int val = ucontrol->value.integer.value[0];
         struct soc_mixer_control *mc =
                 (struct soc_mixer_control *)kcontrol->private_value;
         unsigned int mixer, mask, shift, old;
@@ -193,7 +193,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
 
         mutex_lock(&wm9712->lock);
         old = wm9712->hp_mixer[mixer];
-        if (ucontrol->value.enumerated.item[0])
+        if (ucontrol->value.integer.value[0])
                 wm9712->hp_mixer[mixer] |= mask;
         else
                 wm9712->hp_mixer[mixer] &= ~mask;
@@ -231,7 +231,7 @@ static int wm9712_hp_mixer_get(struct snd_kcontrol *kcontrol,
         mixer = mc->shift >> 8;
         shift = mc->shift & 0xff;
 
-        ucontrol->value.enumerated.item[0] =
+        ucontrol->value.integer.value[0] =
                 (wm9712->hp_mixer[mixer] >> shift) & 1;
 
         return 0;
diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
index 68222917b396..79552953e1bd 100644
--- a/sound/soc/codecs/wm9713.c
+++ b/sound/soc/codecs/wm9713.c
@@ -255,7 +255,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
         struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
         struct wm9713_priv *wm9713 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val = ucontrol->value.enumerated.item[0];
+        unsigned int val = ucontrol->value.integer.value[0];
         struct soc_mixer_control *mc =
                 (struct soc_mixer_control *)kcontrol->private_value;
         unsigned int mixer, mask, shift, old;
@@ -268,7 +268,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
 
         mutex_lock(&wm9713->lock);
         old = wm9713->hp_mixer[mixer];
-        if (ucontrol->value.enumerated.item[0])
+        if (ucontrol->value.integer.value[0])
                 wm9713->hp_mixer[mixer] |= mask;
         else
                 wm9713->hp_mixer[mixer] &= ~mask;
@@ -306,7 +306,7 @@ static int wm9713_hp_mixer_get(struct snd_kcontrol *kcontrol,
         mixer = mc->shift >> 8;
         shift = mc->shift & 0xff;
 
-        ucontrol->value.enumerated.item[0] =
+        ucontrol->value.integer.value[0] =
                 (wm9713->hp_mixer[mixer] >> shift) & 1;
 
         return 0;
diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
index 75870c0ea2c9..91eb3aef7f02 100644
--- a/sound/soc/fsl/fsl_spdif.c
+++ b/sound/soc/fsl/fsl_spdif.c
@@ -1049,7 +1049,7 @@ static u32 fsl_spdif_txclk_caldiv(struct fsl_spdif_priv *spdif_priv,
                                 enum spdif_txrate index, bool round)
 {
         const u32 rate[] = { 32000, 44100, 48000, 96000, 192000 };
-        bool is_sysclk = clk == spdif_priv->sysclk;
+        bool is_sysclk = clk_is_match(clk, spdif_priv->sysclk);
         u64 rate_ideal, rate_actual, sub;
         u32 sysclk_dfmin, sysclk_dfmax;
         u32 txclk_df, sysclk_df, arate;
@@ -1143,7 +1143,7 @@ static int fsl_spdif_probe_txclk(struct fsl_spdif_priv *spdif_priv,
                         spdif_priv->txclk_src[index], rate[index]);
         dev_dbg(&pdev->dev, "use txclk df %d for %dHz sample rate\n",
                         spdif_priv->txclk_df[index], rate[index]);
-        if (spdif_priv->txclk[index] == spdif_priv->sysclk)
+        if (clk_is_match(spdif_priv->txclk[index], spdif_priv->sysclk))
                 dev_dbg(&pdev->dev, "use sysclk df %d for %dHz sample rate\n",
                                 spdif_priv->sysclk_df[index], rate[index]);
         dev_dbg(&pdev->dev, "the best rate for %dHz sample rate is %dHz\n",
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index b9fabbf69db6..6b0c8f717ec2 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -603,7 +603,7 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
         factor = (div2 + 1) * (7 * psr + 1) * 2;
 
         for (i = 0; i < 255; i++) {
-                tmprate = freq * factor * (i + 2);
+                tmprate = freq * factor * (i + 1);
 
                 if (baudclk_is_used)
                         clkrate = clk_get_rate(ssi_private->baudclk);
@@ -1227,7 +1227,7 @@ static int fsl_ssi_imx_probe(struct platform_device *pdev,
         ssi_private->dma_params_tx.addr = ssi_private->ssi_phys + CCSR_SSI_STX0;
         ssi_private->dma_params_rx.addr = ssi_private->ssi_phys + CCSR_SSI_SRX0;
 
-        ret = !of_property_read_u32_array(np, "dmas", dmas, 4);
+        ret = of_property_read_u32_array(np, "dmas", dmas, 4);
         if (ssi_private->use_dma && !ret && dmas[2] == IMX_DMATYPE_SSI_DUAL) {
                 ssi_private->use_dual_fifo = true;
                 /* When using dual fifo mode, we need to keep watermark
diff --git a/sound/soc/intel/sst-haswell-dsp.c b/sound/soc/intel/sst-haswell-dsp.c
index c42ffae5fe9f..402b728c0a06 100644
--- a/sound/soc/intel/sst-haswell-dsp.c
+++ b/sound/soc/intel/sst-haswell-dsp.c
@@ -207,9 +207,6 @@ static int hsw_parse_fw_image(struct sst_fw *sst_fw)
                 module = (void *)module + sizeof(*module) + module->mod_size;
         }
 
-        /* allocate scratch mem regions */
-        sst_block_alloc_scratch(dsp);
-
         return 0;
 }
 
diff --git a/sound/soc/intel/sst-haswell-ipc.c b/sound/soc/intel/sst-haswell-ipc.c
index 394af5684c05..863a9ca34b8e 100644
--- a/sound/soc/intel/sst-haswell-ipc.c
+++ b/sound/soc/intel/sst-haswell-ipc.c
@@ -1732,6 +1732,7 @@ static void sst_hsw_drop_all(struct sst_hsw *hsw)
 int sst_hsw_dsp_load(struct sst_hsw *hsw)
 {
         struct sst_dsp *dsp = hsw->dsp;
+        struct sst_fw *sst_fw, *t;
         int ret;
 
         dev_dbg(hsw->dev, "loading audio DSP....");
@@ -1748,12 +1749,17 @@ int sst_hsw_dsp_load(struct sst_hsw *hsw)
                 return ret;
         }
 
-        ret = sst_fw_reload(hsw->sst_fw);
-        if (ret < 0) {
-                dev_err(hsw->dev, "error: SST FW reload failed\n");
-                sst_dsp_dma_put_channel(dsp);
-                return -ENOMEM;
+        list_for_each_entry_safe_reverse(sst_fw, t, &dsp->fw_list, list) {
+                ret = sst_fw_reload(sst_fw);
+                if (ret < 0) {
+                        dev_err(hsw->dev, "error: SST FW reload failed\n");
+                        sst_dsp_dma_put_channel(dsp);
+                        return -ENOMEM;
+                }
         }
+        ret = sst_block_alloc_scratch(hsw->dsp);
+        if (ret < 0)
+                return -EINVAL;
 
         sst_dsp_dma_put_channel(dsp);
         return 0;
@@ -1809,12 +1815,17 @@ int sst_hsw_dsp_runtime_suspend(struct sst_hsw *hsw)
 
 int sst_hsw_dsp_runtime_sleep(struct sst_hsw *hsw)
 {
-        sst_fw_unload(hsw->sst_fw);
-        sst_block_free_scratch(hsw->dsp);
+        struct sst_fw *sst_fw, *t;
+        struct sst_dsp *dsp = hsw->dsp;
+
+        list_for_each_entry_safe(sst_fw, t, &dsp->fw_list, list) {
+                sst_fw_unload(sst_fw);
+        }
+        sst_block_free_scratch(dsp);
 
         hsw->boot_complete = false;
 
-        sst_dsp_sleep(hsw->dsp);
+        sst_dsp_sleep(dsp);
 
         return 0;
 }
@@ -1943,6 +1954,11 @@ int sst_hsw_dsp_init(struct device *dev, struct sst_pdata *pdata)
                 goto fw_err;
         }
 
+        /* allocate scratch mem regions */
+        ret = sst_block_alloc_scratch(hsw->dsp);
+        if (ret < 0)
+                goto boot_err;
+
         /* wait for DSP boot completion */
         sst_dsp_boot(hsw->dsp);
         ret = wait_event_timeout(hsw->boot_wait, hsw->boot_complete,
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index def7d8260c4e..d19483081f9b 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -579,7 +579,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
                 if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
                         return -EPROBE_DEFER;
         } else {
-                if (priv->extclk == priv->clk) {
+                if (clk_is_match(priv->extclk, priv->clk)) {
                         devm_clk_put(&pdev->dev, priv->extclk);
                         priv->extclk = ERR_PTR(-EINVAL);
                 } else {
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 30579ca5bacb..e5c990889dcc 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -347,6 +347,8 @@ static ssize_t codec_list_read_file(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
+        mutex_lock(&client_mutex);
+
         list_for_each_entry(codec, &codec_list, list) {
                 len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
                                codec->component.name);
@@ -358,6 +360,8 @@ static ssize_t codec_list_read_file(struct file *file, char __user *user_buf,
                 }
         }
 
+        mutex_unlock(&client_mutex);
+
         if (ret >= 0)
                 ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
 
@@ -382,6 +386,8 @@ static ssize_t dai_list_read_file(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
+        mutex_lock(&client_mutex);
+
         list_for_each_entry(component, &component_list, list) {
                 list_for_each_entry(dai, &component->dai_list, list) {
                         len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
@@ -395,6 +401,8 @@ static ssize_t dai_list_read_file(struct file *file, char __user *user_buf,
                 }
         }
 
+        mutex_unlock(&client_mutex);
+
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
 
         kfree(buf);
@@ -418,6 +426,8 @@ static ssize_t platform_list_read_file(struct file *file,
         if (!buf)
                 return -ENOMEM;
 
+        mutex_lock(&client_mutex);
+
         list_for_each_entry(platform, &platform_list, list) {
                 len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
                                platform->component.name);
@@ -429,6 +439,8 @@ static ssize_t platform_list_read_file(struct file *file,
                 }
         }
 
+        mutex_unlock(&client_mutex);
+
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
 
         kfree(buf);
@@ -836,6 +848,8 @@ static struct snd_soc_component *soc_find_component(
 {
         struct snd_soc_component *component;
 
+        lockdep_assert_held(&client_mutex);
+
         list_for_each_entry(component, &component_list, list) {
                 if (of_node) {
                         if (component->dev->of_node == of_node)
@@ -854,6 +868,8 @@ static struct snd_soc_dai *snd_soc_find_dai(
         struct snd_soc_component *component;
         struct snd_soc_dai *dai;
 
+        lockdep_assert_held(&client_mutex);
+
         /* Find CPU DAI from registered DAIs*/
         list_for_each_entry(component, &component_list, list) {
                 if (dlc->of_node && component->dev->of_node != dlc->of_node)
@@ -1508,6 +1524,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
         struct snd_soc_codec *codec;
         int ret, i, order;
 
+        mutex_lock(&client_mutex);
         mutex_lock_nested(&card->mutex, SND_SOC_CARD_CLASS_INIT);
 
         /* bind DAIs */
@@ -1662,6 +1679,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
         card->instantiated = 1;
         snd_soc_dapm_sync(&card->dapm);
         mutex_unlock(&card->mutex);
+        mutex_unlock(&client_mutex);
 
         return 0;
 
@@ -1680,6 +1698,7 @@ card_probe_error:
 
 base_error:
         mutex_unlock(&card->mutex);
+        mutex_unlock(&client_mutex);
 
         return ret;
 }
@@ -2713,13 +2732,6 @@ static void snd_soc_component_del_unlocked(struct snd_soc_component *component)
         list_del(&component->list);
 }
 
-static void snd_soc_component_del(struct snd_soc_component *component)
-{
-        mutex_lock(&client_mutex);
-        snd_soc_component_del_unlocked(component);
-        mutex_unlock(&client_mutex);
-}
-
 int snd_soc_register_component(struct device *dev,
                                const struct snd_soc_component_driver *cmpnt_drv,
                                struct snd_soc_dai_driver *dai_drv,
@@ -2767,14 +2779,17 @@ void snd_soc_unregister_component(struct device *dev)
 {
         struct snd_soc_component *cmpnt;
 
+        mutex_lock(&client_mutex);
         list_for_each_entry(cmpnt, &component_list, list) {
                 if (dev == cmpnt->dev && cmpnt->registered_as_component)
                         goto found;
         }
+        mutex_unlock(&client_mutex);
         return;
 
 found:
-        snd_soc_component_del(cmpnt);
+        snd_soc_component_del_unlocked(cmpnt);
+        mutex_unlock(&client_mutex);
         snd_soc_component_cleanup(cmpnt);
         kfree(cmpnt);
 }
@@ -2882,10 +2897,14 @@ struct snd_soc_platform *snd_soc_lookup_platform(struct device *dev)
 {
         struct snd_soc_platform *platform;
 
+        mutex_lock(&client_mutex);
         list_for_each_entry(platform, &platform_list, list) {
-                if (dev == platform->dev)
+                if (dev == platform->dev) {
+                        mutex_unlock(&client_mutex);
                         return platform;
+                }
         }
+        mutex_unlock(&client_mutex);
 
         return NULL;
 }
@@ -3090,15 +3109,15 @@ void snd_soc_unregister_codec(struct device *dev)
 {
         struct snd_soc_codec *codec;
 
+        mutex_lock(&client_mutex);
         list_for_each_entry(codec, &codec_list, list) {
                 if (dev == codec->dev)
                         goto found;
         }
+        mutex_unlock(&client_mutex);
         return;
 
 found:
-
-        mutex_lock(&client_mutex);
         list_del(&codec->list);
         snd_soc_component_del_unlocked(&codec->component);
         mutex_unlock(&client_mutex);
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index dc9df007d3e3..337c317ead6f 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -192,6 +192,7 @@ static const struct rc_config {
         { USB_ID(0x041e, 0x3040), 2, 2, 6, 6,  2,  0x6e91 }, /* Live! 24-bit */
         { USB_ID(0x041e, 0x3042), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 */
         { USB_ID(0x041e, 0x30df), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 Pro */
+        { USB_ID(0x041e, 0x3237), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 Pro */
         { USB_ID(0x041e, 0x3048), 2, 2, 6, 6,  2,  0x6e91 }, /* Toshiba SB0500 */
 };
 
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 67d476548dcf..07f984d5f516 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                 }
         }
 },
+{
+        USB_DEVICE(0x0582, 0x0159),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                /* .vendor_name = "Roland", */
+                /* .product_name = "UA-22", */
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = & (const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
 /* this catches most recent vendor-specific Roland devices */
 {
         .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 753a47de8459..9a28365126f9 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1113,8 +1113,13 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
 
 bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
 {
-        /* MS Lifecam HD-5000 doesn't support reading the sample rate. */
-        return chip->usb_id == USB_ID(0x045E, 0x076D);
+        /* devices which do not support reading the sample rate. */
+        switch (chip->usb_id) {
+        case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
+        case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+                return true;
+        }
+        return false;
 }
 
 /* Marantz/Denon USB DACs need a vendor cmd to switch
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 61bf9128e1f2..9d9db3b296dd 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -30,6 +30,8 @@ static int disasm_line__parse(char *line, char **namep, char **rawp);
 
 static void ins__delete(struct ins_operands *ops)
 {
+        if (ops == NULL)
+                return;
         zfree(&ops->source.raw);
         zfree(&ops->source.name);
         zfree(&ops->target.raw);
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 3ed7c0476d48..2e2ba2efa0d9 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -209,7 +209,7 @@ $(OUTPUT)%.o: %.c
 
 $(OUTPUT)cpupower: $(UTIL_OBJS) $(OUTPUT)libcpupower.so.$(LIB_MAJ)
         $(ECHO) "  CC      " $@
-        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) $(UTIL_OBJS) -lcpupower -Wl,-rpath=./ -lrt -lpci -L$(OUTPUT) -o $@
+        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) $(UTIL_OBJS) -lcpupower -lrt -lpci -L$(OUTPUT) -o $@
         $(QUIET) $(STRIPCMD) $@
 
 $(OUTPUT)po/$(PACKAGE).pot: $(UTIL_SRC)
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 4e511221a0c1..d643d5242537 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -22,6 +22,14 @@ TARGETS += vm
 TARGETS_HOTPLUG = cpu-hotplug
 TARGETS_HOTPLUG += memory-hotplug
 
+# Clear LDFLAGS and MAKEFLAGS if called from main
+# Makefile to avoid test build failures when test
+# Makefile doesn't have explicit build rules.
+ifeq (1,$(MAKELEVEL))
+undefine LDFLAGS
+override MAKEFLAGS =
+endif
+
 all:
         for TARGET in $(TARGETS); do \
                 make -C $$TARGET; \
@@ -47,7 +55,40 @@ clean_hotplug:
                 make -C $$TARGET clean; \
         done;
 
+INSTALL_PATH ?= install
+INSTALL_PATH := $(abspath $(INSTALL_PATH))
+ALL_SCRIPT := $(INSTALL_PATH)/run_kselftest.sh
+
+install:
+ifdef INSTALL_PATH
+        @# Ask all targets to install their files
+        mkdir -p $(INSTALL_PATH)
+        for TARGET in $(TARGETS); do \
+                mkdir -p $(INSTALL_PATH)/$$TARGET ; \
+                make -C $$TARGET INSTALL_PATH=$(INSTALL_PATH)/$$TARGET install; \
+        done;
+
+        @# Ask all targets to emit their test scripts
+        echo "#!/bin/bash" > $(ALL_SCRIPT)
+        echo "cd \$$(dirname \$$0)" >> $(ALL_SCRIPT)
+        echo "ROOT=\$$PWD" >> $(ALL_SCRIPT)
+
+        for TARGET in $(TARGETS); do \
+                echo "echo ; echo Running tests in $$TARGET" >> $(ALL_SCRIPT); \
+                echo "echo ========================================" >> $(ALL_SCRIPT); \
+                echo "cd $$TARGET" >> $(ALL_SCRIPT); \
+                make -s --no-print-directory -C $$TARGET emit_tests >> $(ALL_SCRIPT); \
+                echo "cd \$$ROOT" >> $(ALL_SCRIPT); \
+        done;
+
+        chmod u+x $(ALL_SCRIPT)
+else
+        $(error Error: set INSTALL_PATH to use install)
+endif
+
 clean:
         for TARGET in $(TARGETS); do \
                 make -C $$TARGET clean; \
         done;
+
+.PHONY: install
diff --git a/tools/testing/selftests/breakpoints/Makefile b/tools/testing/selftests/breakpoints/Makefile
index e18b42b254af..182235640209 100644
--- a/tools/testing/selftests/breakpoints/Makefile
+++ b/tools/testing/selftests/breakpoints/Makefile
@@ -16,8 +16,9 @@ else
         echo "Not an x86 target, can't build breakpoints selftests"
 endif
 
-run_tests:
-        @./breakpoint_test || echo "breakpoints selftests: [FAIL]"
+TEST_PROGS := breakpoint_test
+
+include ../lib.mk
 
 clean:
         rm -fr breakpoint_test
diff --git a/tools/testing/selftests/cpu-hotplug/Makefile b/tools/testing/selftests/cpu-hotplug/Makefile
index e9c28d8dc84b..fe1f99101c5d 100644
--- a/tools/testing/selftests/cpu-hotplug/Makefile
+++ b/tools/testing/selftests/cpu-hotplug/Makefile
@@ -1,9 +1,10 @@
 all:
 
-run_tests:
-        @/bin/bash ./on-off-test.sh || echo "cpu-hotplug selftests: [FAIL]"
+TEST_PROGS := cpu-on-off-test.sh
+
+include ../lib.mk
 
 run_full_test:
-        @/bin/bash ./on-off-test.sh -a || echo "cpu-hotplug selftests: [FAIL]"
+        @/bin/bash ./cpu-on-off-test.sh -a || echo "cpu-hotplug selftests: [FAIL]"
 
 clean:
diff --git a/tools/testing/selftests/cpu-hotplug/on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
index 98b1d6565f2c..98b1d6565f2c 100644..100755
--- a/tools/testing/selftests/cpu-hotplug/on-off-test.sh
+++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
diff --git a/tools/testing/selftests/efivarfs/Makefile b/tools/testing/selftests/efivarfs/Makefile
index 29e8c6bc81b0..736c3ddfc787 100644
--- a/tools/testing/selftests/efivarfs/Makefile
+++ b/tools/testing/selftests/efivarfs/Makefile
@@ -1,12 +1,13 @@
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall
 
 test_objs = open-unlink create-read
 
 all: $(test_objs)
 
-run_tests: all
-        @/bin/bash ./efivarfs.sh || echo "efivarfs selftests: [FAIL]"
+TEST_PROGS := efivarfs.sh
+TEST_FILES := $(test_objs)
+
+include ../lib.mk
 
 clean:
         rm -f $(test_objs)
diff --git a/tools/testing/selftests/efivarfs/efivarfs.sh b/tools/testing/selftests/efivarfs/efivarfs.sh
index 77edcdcc016b..77edcdcc016b 100644..100755
--- a/tools/testing/selftests/efivarfs/efivarfs.sh
+++ b/tools/testing/selftests/efivarfs/efivarfs.sh
diff --git a/tools/testing/selftests/exec/Makefile b/tools/testing/selftests/exec/Makefile
index 66dfc2ce1788..4edb7d0da29b 100644
--- a/tools/testing/selftests/exec/Makefile
+++ b/tools/testing/selftests/exec/Makefile
@@ -1,4 +1,3 @@
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall
 BINARIES = execveat
 DEPS = execveat.symlink execveat.denatured script subdir
@@ -18,8 +17,12 @@ execveat.denatured: execveat
 %: %.c
         $(CC) $(CFLAGS) -o $@ $^
 
-run_tests: all
-        ./execveat
+TEST_PROGS := execveat
+TEST_FILES := $(DEPS)
+
+include ../lib.mk
+
+override EMIT_TESTS := echo "mkdir -p subdir; (./execveat && echo \"selftests: execveat [PASS]\") || echo \"selftests: execveat [FAIL]\""
 
 clean:
         rm -rf $(BINARIES) $(DEPS) subdir.moved execveat.moved xxxxx*
diff --git a/tools/testing/selftests/exec/execveat.c b/tools/testing/selftests/exec/execveat.c
index e238c9559caf..8d5d1d2ee7c1 100644
--- a/tools/testing/selftests/exec/execveat.c
+++ b/tools/testing/selftests/exec/execveat.c
@@ -30,7 +30,7 @@ static int execveat_(int fd, const char *path, char **argv, char **envp,
 #ifdef __NR_execveat
         return syscall(__NR_execveat, fd, path, argv, envp, flags);
 #else
-        errno = -ENOSYS;
+        errno = ENOSYS;
         return -1;
 #endif
 }
@@ -234,6 +234,14 @@ static int run_tests(void)
         int fd_cloexec = open_or_die("execveat", O_RDONLY|O_CLOEXEC);
         int fd_script_cloexec = open_or_die("script", O_RDONLY|O_CLOEXEC);
 
+        /* Check if we have execveat at all, and bail early if not */
+        errno = 0;
+        execveat_(-1, NULL, NULL, NULL, 0);
+        if (errno == ENOSYS) {
+                printf("[FAIL] ENOSYS calling execveat - no kernel support?\n");
+                return 1;
+        }
+
         /* Change file position to confirm it doesn't affect anything */
         lseek(fd, 10, SEEK_SET);
 
diff --git a/tools/testing/selftests/firmware/Makefile b/tools/testing/selftests/firmware/Makefile
index e23cce0bbc3a..9bf82234855b 100644
--- a/tools/testing/selftests/firmware/Makefile
+++ b/tools/testing/selftests/firmware/Makefile
@@ -3,25 +3,9 @@
 # No binaries, but make sure arg-less "make" doesn't trigger "run_tests"
 all:
 
-fw_filesystem:
-        @if /bin/sh ./fw_filesystem.sh ; then \
-                echo "fw_filesystem: ok"; \
-        else \
-                echo "fw_filesystem: [FAIL]"; \
-                exit 1; \
-        fi
+TEST_PROGS := fw_filesystem.sh fw_userhelper.sh
 
-fw_userhelper:
-        @if /bin/sh ./fw_userhelper.sh ; then \
-                echo "fw_userhelper: ok"; \
-        else \
-                echo "fw_userhelper: [FAIL]"; \
-                exit 1; \
-        fi
-
-run_tests: all fw_filesystem fw_userhelper
+include ../lib.mk
 
 # Nothing to clean up.
 clean:
-
-.PHONY: all clean run_tests fw_filesystem fw_userhelper
diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh
index 3fc6c10c2479..3fc6c10c2479 100644..100755
--- a/tools/testing/selftests/firmware/fw_filesystem.sh
+++ b/tools/testing/selftests/firmware/fw_filesystem.sh
diff --git a/tools/testing/selftests/firmware/fw_userhelper.sh b/tools/testing/selftests/firmware/fw_userhelper.sh
index 6efbade12139..6efbade12139 100644..100755
--- a/tools/testing/selftests/firmware/fw_userhelper.sh
+++ b/tools/testing/selftests/firmware/fw_userhelper.sh
diff --git a/tools/testing/selftests/ftrace/Makefile b/tools/testing/selftests/ftrace/Makefile
index 76cc9f156267..346720639d1d 100644
--- a/tools/testing/selftests/ftrace/Makefile
+++ b/tools/testing/selftests/ftrace/Makefile
@@ -1,7 +1,8 @@
 all:
 
-run_tests:
-        @/bin/sh ./ftracetest || echo "ftrace selftests: [FAIL]"
+TEST_PROGS := ftracetest
+
+include ../lib.mk
 
 clean:
         rm -rf logs/*
diff --git a/tools/testing/selftests/ftrace/test.d/00basic/basic4.tc b/tools/testing/selftests/ftrace/test.d/00basic/basic4.tc
index fd9c49a13612..aa51f6c17359 100644
--- a/tools/testing/selftests/ftrace/test.d/00basic/basic4.tc
+++ b/tools/testing/selftests/ftrace/test.d/00basic/basic4.tc
@@ -2,4 +2,4 @@
 # description: Basic event tracing check
 test -f available_events -a -f set_event -a -d events
 # check scheduler events are available
-grep -q sched available_events && exit 0 || exit -1
\ No newline at end of file
+grep -q sched available_events && exit 0 || exit $FAIL
diff --git a/tools/testing/selftests/ftrace/test.d/event/event-enable.tc b/tools/testing/selftests/ftrace/test.d/event/event-enable.tc
index 668616d9bb03..87eb9d6dd4ca 100644
--- a/tools/testing/selftests/ftrace/test.d/event/event-enable.tc
+++ b/tools/testing/selftests/ftrace/test.d/event/event-enable.tc
@@ -9,7 +9,11 @@ do_reset() {
 fail() { #msg
     do_reset
     echo $1
-    exit -1
+    exit $FAIL
+}
+
+yield() {
+    ping localhost -c 1 || sleep .001 || usleep 1 || sleep 1
 }
 
 if [ ! -f set_event -o ! -d events/sched ]; then
@@ -21,7 +25,8 @@ reset_tracer
 do_reset
 
 echo 'sched:sched_switch' > set_event
-usleep 1
+
+yield
 
 count=`cat trace | grep sched_switch | wc -l`
 if [ $count -eq 0 ]; then
@@ -31,7 +36,8 @@ fi
 do_reset
 
 echo 1 > events/sched/sched_switch/enable
-usleep 1
+
+yield
 
 count=`cat trace | grep sched_switch | wc -l`
 if [ $count -eq 0 ]; then
@@ -41,7 +47,8 @@ fi
 do_reset
 
 echo 0 > events/sched/sched_switch/enable
-usleep 1
+
+yield
 
 count=`cat trace | grep sched_switch | wc -l`
 if [ $count -ne 0 ]; then
diff --git a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc
index 655c415b6e7f..ced27ef0638f 100644
--- a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc
+++ b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc
@@ -9,7 +9,11 @@ do_reset() {
 fail() { #msg
     do_reset
     echo $1
-    exit -1
+    exit $FAIL
+}
+
+yield() {
+    ping localhost -c 1 || sleep .001 || usleep 1 || sleep 1
 }
 
 if [ ! -f set_event -o ! -d events/sched ]; then
@@ -21,7 +25,8 @@ reset_tracer
 do_reset
 
 echo 'sched:*' > set_event
-usleep 1
+
+yield
 
 count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -lt 3 ]; then
@@ -31,7 +36,8 @@ fi
 do_reset
 
 echo 1 > events/sched/enable
-usleep 1
+
+yield
 
 count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -lt 3 ]; then
@@ -41,7 +47,8 @@ fi
 do_reset
 
 echo 0 > events/sched/enable
-usleep 1
+
+yield
 
 count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -ne 0 ]; then
diff --git a/tools/testing/selftests/ftrace/test.d/event/toplevel-enable.tc b/tools/testing/selftests/ftrace/test.d/event/toplevel-enable.tc
index 480845774007..0bb5df3c00d4 100644
--- a/tools/testing/selftests/ftrace/test.d/event/toplevel-enable.tc
+++ b/tools/testing/selftests/ftrace/test.d/event/toplevel-enable.tc
@@ -9,7 +9,11 @@ do_reset() {
 fail() { #msg
     do_reset
     echo $1
-    exit -1
+    exit $FAIL
+}
+
+yield() {
+    ping localhost -c 1 || sleep .001 || usleep 1 || sleep 1
 }
 
 if [ ! -f available_events -o ! -f set_event -o ! -d events ]; then
@@ -21,6 +25,9 @@ reset_tracer
 do_reset
 
 echo '*:*' > set_event
+
+yield
+
 count=`cat trace | grep -v ^# | wc -l`
 if [ $count -eq 0 ]; then
     fail "none of events are recorded"
@@ -29,6 +36,9 @@ fi
 do_reset
 
 echo 1 > events/enable
+
+yield
+
 count=`cat trace | grep -v ^# | wc -l`
 if [ $count -eq 0 ]; then
     fail "none of events are recorded"
@@ -37,6 +47,9 @@ fi
 do_reset
 
 echo 0 > events/enable
+
+yield
+
 count=`cat trace | grep -v ^# | wc -l`
 if [ $count -ne 0 ]; then
     fail "any of events should not be recorded"
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter-stack.tc b/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter-stack.tc
index c15e018e0220..15c2dba06ea2 100644
--- a/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter-stack.tc
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter-stack.tc
@@ -16,7 +16,9 @@ fi
 
 do_reset() {
     reset_tracer
-    echo 0 > /proc/sys/kernel/stack_tracer_enabled
+    if [ -e /proc/sys/kernel/stack_tracer_enabled ]; then
+            echo 0 > /proc/sys/kernel/stack_tracer_enabled
+    fi
     enable_tracing
     clear_trace
     echo > set_ftrace_filter
@@ -25,7 +27,7 @@ do_reset() {
 fail() { # msg
     do_reset
     echo $1
-    exit -1
+    exit $FAIL
 }
 
 disable_tracing
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter.tc b/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter.tc
index 6af5f6360b18..0ab2189613ef 100644
--- a/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter.tc
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/fgraph-filter.tc
@@ -17,7 +17,7 @@ do_reset() {
 fail() { # msg
     do_reset
     echo $1
-    exit -1
+    exit $FAIL
 }
 
 disable_tracing
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_profiler.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_profiler.tc
index 2e719cb1fc4d..7808336d6f50 100644
--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_profiler.tc
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_profiler.tc
@@ -31,7 +31,7 @@ fail() { # mesg
     reset_tracer
     echo > set_ftrace_filter
     echo $1
-    exit -1
+    exit $FAIL
 }
 
 echo "Testing function tracer with profiler:"
diff --git a/tools/testing/selftests/gen_kselftest_tar.sh b/tools/testing/selftests/gen_kselftest_tar.sh
new file mode 100755
index 000000000000..17d5bd0c0936
--- /dev/null
+++ b/tools/testing/selftests/gen_kselftest_tar.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+#
+# gen_kselftest_tar
+# Generate kselftest tarball
+# Author: Shuah Khan <shuahkh@osg.samsung.com>
+# Copyright (C) 2015 Samsung Electronics Co., Ltd.
+
+# This software may be freely redistributed under the terms of the GNU
+# General Public License (GPLv2).
+
+# main
+main()
+{
+        if [ "$#" -eq 0 ]; then
+                echo "$0: Generating default compression gzip"
+                copts="cvzf"
+                ext=".tar.gz"
+        else
+                case "$1" in
+                        tar)
+                                copts="cvf"
+                                ext=".tar"
+                                ;;
+                        targz)
+                                copts="cvzf"
+                                ext=".tar.gz"
+                                ;;
+                        tarbz2)
+                                copts="cvjf"
+                                ext=".tar.bz2"
+                                ;;
+                        tarxz)
+                                copts="cvJf"
+                                ext=".tar.xz"
+                                ;;
+                        *)
+                        echo "Unknown tarball format $1"
+                        exit 1
+                        ;;
+        esac
+        fi
+
+        install_dir=./kselftest
+
+# Run install using INSTALL_KSFT_PATH override to generate install
+# directory
+./kselftest_install.sh
+tar $copts kselftest${ext} $install_dir
+echo "Kselftest archive kselftest${ext} created!"
+
+# clean up install directory
+rm -rf kselftest
+}
+
+main "$@"
diff --git a/tools/testing/selftests/ipc/Makefile b/tools/testing/selftests/ipc/Makefile
index 74bbefdeaf4c..25d2e702c68a 100644
--- a/tools/testing/selftests/ipc/Makefile
+++ b/tools/testing/selftests/ipc/Makefile
@@ -12,14 +12,11 @@ endif
 CFLAGS += -I../../../../usr/include/
 
 all:
-ifeq ($(ARCH),x86)
-        gcc $(CFLAGS) msgque.c -o msgque_test
-else
-        echo "Not an x86 target, can't build msgque selftest"
-endif
+        $(CC) $(CFLAGS) msgque.c -o msgque_test
+
+TEST_PROGS := msgque_test
 
-run_tests: all
-        ./msgque_test
+include ../lib.mk
 
 clean:
         rm -fr ./msgque_test
diff --git a/tools/testing/selftests/kcmp/Makefile b/tools/testing/selftests/kcmp/Makefile
index ff0eefdc6ceb..2ae7450a9a89 100644
--- a/tools/testing/selftests/kcmp/Makefile
+++ b/tools/testing/selftests/kcmp/Makefile
@@ -1,10 +1,10 @@
-CC := $(CROSS_COMPILE)$(CC)
 CFLAGS += -I../../../../usr/include/
 
 all: kcmp_test
 
-run_tests: all
-        @./kcmp_test || echo "kcmp_test: [FAIL]"
+TEST_PROGS := kcmp_test
+
+include ../lib.mk
 
 clean:
         $(RM) kcmp_test kcmp-test-file
diff --git a/tools/testing/selftests/kselftest_install.sh b/tools/testing/selftests/kselftest_install.sh
new file mode 100755
index 000000000000..1555fbdb08da
--- /dev/null
+++ b/tools/testing/selftests/kselftest_install.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+#
+# Kselftest Install
+# Install kselftest tests
+# Author: Shuah Khan <shuahkh@osg.samsung.com>
+# Copyright (C) 2015 Samsung Electronics Co., Ltd.
+
+# This software may be freely redistributed under the terms of the GNU
+# General Public License (GPLv2).
+
+install_loc=`pwd`
+
+main()
+{
+        if [ $(basename $install_loc) !=  "selftests" ]; then
+                echo "$0: Please run it in selftests directory ..."
+                exit 1;
+        fi
+        if [ "$#" -eq 0 ]; then
+                echo "$0: Installing in default location - $install_loc ..."
+        elif [ ! -d "$1" ]; then
+                echo "$0: $1 doesn't exist!!"
+                exit 1;
+        else
+                install_loc=$1
+                echo "$0: Installing in specified location - $install_loc ..."
+        fi
+
+        install_dir=$install_loc/kselftest
+
+# Create install directory
+        mkdir -p $install_dir
+# Build tests
+        INSTALL_PATH=$install_dir make install
+}
+
+main "$@"
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
new file mode 100644
index 000000000000..2194155ae62a
--- /dev/null
+++ b/tools/testing/selftests/lib.mk
@@ -0,0 +1,35 @@
+# This mimics the top-level Makefile. We do it explicitly here so that this
+# Makefile can operate with or without the kbuild infrastructure.
+CC := $(CROSS_COMPILE)gcc
+
+define RUN_TESTS
+        @for TEST in $(TEST_PROGS); do \
+                (./$$TEST && echo "selftests: $$TEST [PASS]") || echo "selftests: $$TEST [FAIL]"; \
+        done;
+endef
+
+run_tests: all
+        $(RUN_TESTS)
+
+define INSTALL_RULE
+        mkdir -p $(INSTALL_PATH)
+        install -t $(INSTALL_PATH) $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES)
+endef
+
+install: all
+ifdef INSTALL_PATH
+        $(INSTALL_RULE)
+else
+        $(error Error: set INSTALL_PATH to use install)
+endif
+
+define EMIT_TESTS
+        @for TEST in $(TEST_PROGS); do \
+                echo "(./$$TEST && echo \"selftests: $$TEST [PASS]\") || echo \"selftests: $$TEST [FAIL]\""; \
+        done;
+endef
+
+emit_tests:
+        $(EMIT_TESTS)
+
+.PHONY: run_tests all clean install emit_tests
diff --git a/tools/testing/selftests/memfd/Makefile b/tools/testing/selftests/memfd/Makefile
index b80cd10d53ba..3e7eb7972511 100644
--- a/tools/testing/selftests/memfd/Makefile
+++ b/tools/testing/selftests/memfd/Makefile
@@ -1,17 +1,19 @@
+CC = $(CROSS_COMPILE)gcc
 CFLAGS += -D_FILE_OFFSET_BITS=64
 CFLAGS += -I../../../../include/uapi/
 CFLAGS += -I../../../../include/
+CFLAGS += -I../../../../usr/include/
 
 all:
-        gcc $(CFLAGS) memfd_test.c -o memfd_test
+        $(CC) $(CFLAGS) memfd_test.c -o memfd_test
 
-run_tests: all
-        gcc $(CFLAGS) memfd_test.c -o memfd_test
-        @./memfd_test || echo "memfd_test: [FAIL]"
+TEST_PROGS := memfd_test
+
+include ../lib.mk
 
 build_fuse:
-        gcc $(CFLAGS) fuse_mnt.c `pkg-config fuse --cflags --libs` -o fuse_mnt
-        gcc $(CFLAGS) fuse_test.c -o fuse_test
+        $(CC) $(CFLAGS) fuse_mnt.c `pkg-config fuse --cflags --libs` -o fuse_mnt
+        $(CC) $(CFLAGS) fuse_test.c -o fuse_test
 
 run_fuse: build_fuse
         @./run_fuse_test.sh || echo "fuse_test: [FAIL]"
diff --git a/tools/testing/selftests/memory-hotplug/Makefile b/tools/testing/selftests/memory-hotplug/Makefile
index d46b8d489cd2..afb2624c7048 100644
--- a/tools/testing/selftests/memory-hotplug/Makefile
+++ b/tools/testing/selftests/memory-hotplug/Makefile
@@ -1,9 +1,12 @@
 all:
 
-run_tests:
-        @/bin/bash ./on-off-test.sh -r 2 || echo "memory-hotplug selftests: [FAIL]"
+include ../lib.mk
+
+TEST_PROGS := mem-on-off-test.sh
+override RUN_TESTS := ./mem-on-off-test.sh -r 2 || echo "selftests: memory-hotplug [FAIL]"
+override EMIT_TESTS := echo "$(RUN_TESTS)"
 
 run_full_test:
-        @/bin/bash ./on-off-test.sh || echo "memory-hotplug selftests: [FAIL]"
+        @/bin/bash ./mem-on-off-test.sh || echo "memory-hotplug selftests: [FAIL]"
 
 clean:
diff --git a/tools/testing/selftests/memory-hotplug/on-off-test.sh b/tools/testing/selftests/memory-hotplug/mem-on-off-test.sh
index 6cddde0b96f8..6cddde0b96f8 100644..100755
--- a/tools/testing/selftests/memory-hotplug/on-off-test.sh
+++ b/tools/testing/selftests/memory-hotplug/mem-on-off-test.sh
diff --git a/tools/testing/selftests/mount/.gitignore b/tools/testing/selftests/mount/.gitignore
new file mode 100644
index 000000000000..856ad4107eb3
--- /dev/null
+++ b/tools/testing/selftests/mount/.gitignore
@@ -0,0 +1 @@
+unprivileged-remount-test
diff --git a/tools/testing/selftests/mount/Makefile b/tools/testing/selftests/mount/Makefile
index 337d853c2b72..95580a97326e 100644
--- a/tools/testing/selftests/mount/Makefile
+++ b/tools/testing/selftests/mount/Makefile
@@ -1,17 +1,16 @@
 # Makefile for mount selftests.
-
+CFLAGS = -Wall \
+         -O2
 all: unprivileged-remount-test
 
 unprivileged-remount-test: unprivileged-remount-test.c
-        gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test
+        $(CC) $(CFLAGS) unprivileged-remount-test.c -o unprivileged-remount-test
 
-# Allow specific tests to be selected.
-test_unprivileged_remount: unprivileged-remount-test
-        @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi
+include ../lib.mk
 
-run_tests: all test_unprivileged_remount
+TEST_PROGS := unprivileged-remount-test
+override RUN_TESTS := if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi
+override EMIT_TESTS := echo "$(RUN_TESTS)"
 
 clean:
         rm -f unprivileged-remount-test
-
-.PHONY: all test_unprivileged_remount
diff --git a/tools/testing/selftests/mqueue/Makefile b/tools/testing/selftests/mqueue/Makefile
index 8056e2e68fa4..0e3b41eb85cd 100644
--- a/tools/testing/selftests/mqueue/Makefile
+++ b/tools/testing/selftests/mqueue/Makefile
@@ -1,10 +1,22 @@
+CFLAGS = -O2
+
 all:
-        gcc -O2 mq_open_tests.c -o mq_open_tests -lrt
-        gcc -O2 -o mq_perf_tests mq_perf_tests.c -lrt -lpthread -lpopt
+        $(CC) $(CFLAGS) mq_open_tests.c -o mq_open_tests -lrt
+        $(CC) $(CFLAGS) -o mq_perf_tests mq_perf_tests.c -lrt -lpthread -lpopt
+
+include ../lib.mk
+
+override define RUN_TESTS
+        @./mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
+        @./mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
+endef
+
+TEST_PROGS := mq_open_tests mq_perf_tests
 
-run_tests:
-        @./mq_open_tests /test1 || echo "mq_open_tests: [FAIL]"
-        @./mq_perf_tests || echo "mq_perf_tests: [FAIL]"
+override define EMIT_TESTS
+        echo "./mq_open_tests /test1 || echo \"selftests: mq_open_tests [FAIL]\""
+        echo "./mq_perf_tests || echo \"selftests: mq_perf_tests [FAIL]\""
+endef
 
 clean:
         rm -f mq_open_tests mq_perf_tests
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 62f22cc9941c..fac4782c51d8 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -1,6 +1,5 @@
 # Makefile for net selftests
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -O2 -g
 
 CFLAGS += -I../../../../usr/include/
@@ -11,9 +10,10 @@ all: $(NET_PROGS)
 %: %.c
         $(CC) $(CFLAGS) -o $@ $^
 
-run_tests: all
-        @/bin/sh ./run_netsocktests || echo "sockettests: [FAIL]"
-        @/bin/sh ./run_afpackettests || echo "afpackettests: [FAIL]"
-        ./test_bpf.sh
+TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh
+TEST_FILES := $(NET_PROGS)
+
+include ../lib.mk
+
 clean:
         $(RM) $(NET_PROGS)
diff --git a/tools/testing/selftests/net/run_afpackettests b/tools/testing/selftests/net/run_afpackettests
index 5246e782d6e8..5246e782d6e8 100644..100755
--- a/tools/testing/selftests/net/run_afpackettests
+++ b/tools/testing/selftests/net/run_afpackettests
diff --git a/tools/testing/selftests/net/run_netsocktests b/tools/testing/selftests/net/run_netsocktests
index c09a682df56a..c09a682df56a 100644..100755
--- a/tools/testing/selftests/net/run_netsocktests
+++ b/tools/testing/selftests/net/run_netsocktests
diff --git a/tools/testing/selftests/powerpc/Makefile b/tools/testing/selftests/powerpc/Makefile
index 1d5e7ad2c460..2958fe9a74e9 100644
--- a/tools/testing/selftests/powerpc/Makefile
+++ b/tools/testing/selftests/powerpc/Makefile
@@ -8,10 +8,9 @@ ifeq ($(ARCH),powerpc)
 
 GIT_VERSION = $(shell git describe --always --long --dirty || echo "unknown")
 
-CC := $(CROSS_COMPILE)$(CC)
 CFLAGS := -Wall -O2 -flto -Wall -Werror -DGIT_VERSION='"$(GIT_VERSION)"' -I$(CURDIR) $(CFLAGS)
 
-export CC CFLAGS
+export CFLAGS
 
 TARGETS = pmu copyloops mm tm primitives stringloops
 
@@ -22,10 +21,25 @@ all: $(TARGETS)
 $(TARGETS):
         $(MAKE) -k -C $@ all
 
-run_tests: all
+include ../lib.mk
+
+override define RUN_TESTS
         @for TARGET in $(TARGETS); do \
                 $(MAKE) -C $$TARGET run_tests; \
         done;
+endef
+
+override define INSTALL_RULE
+        @for TARGET in $(TARGETS); do \
+                $(MAKE) -C $$TARGET install; \
+        done;
+endef
+
+override define EMIT_TESTS
+        @for TARGET in $(TARGETS); do \
+                $(MAKE) -s -C $$TARGET emit_tests; \
+        done;
+endef
 
 clean:
         @for TARGET in $(TARGETS); do \
@@ -36,4 +50,4 @@ clean:
 tags:
         find . -name '*.c' -o -name '*.h' | xargs ctags
 
-.PHONY: all run_tests clean tags $(TARGETS)
+.PHONY: tags $(TARGETS)
diff --git a/tools/testing/selftests/powerpc/copyloops/Makefile b/tools/testing/selftests/powerpc/copyloops/Makefile
index 6f2d3be227f9..c05023514ce8 100644
--- a/tools/testing/selftests/powerpc/copyloops/Makefile
+++ b/tools/testing/selftests/powerpc/copyloops/Makefile
@@ -6,24 +6,19 @@ CFLAGS += -D SELFTEST
 # Use our CFLAGS for the implicit .S rule
 ASFLAGS = $(CFLAGS)
 
-PROGS := copyuser_64 copyuser_power7 memcpy_64 memcpy_power7
+TEST_PROGS := copyuser_64 copyuser_power7 memcpy_64 memcpy_power7
 EXTRA_SOURCES := validate.c ../harness.c
 
-all: $(PROGS)
+all: $(TEST_PROGS)
 
 copyuser_64:     CPPFLAGS += -D COPY_LOOP=test___copy_tofrom_user_base
 copyuser_power7: CPPFLAGS += -D COPY_LOOP=test___copy_tofrom_user_power7
 memcpy_64:       CPPFLAGS += -D COPY_LOOP=test_memcpy
 memcpy_power7:   CPPFLAGS += -D COPY_LOOP=test_memcpy_power7
 
-$(PROGS): $(EXTRA_SOURCES)
+$(TEST_PROGS): $(EXTRA_SOURCES)
 
-run_tests: all
-        @-for PROG in $(PROGS); do \
-                ./$$PROG; \
-        done;
+include ../../lib.mk
 
 clean:
-        rm -f $(PROGS) *.o
-
-.PHONY: all run_tests clean
+        rm -f $(TEST_PROGS) *.o
diff --git a/tools/testing/selftests/powerpc/mm/Makefile b/tools/testing/selftests/powerpc/mm/Makefile
index a14c538dd7f8..41cc3ed66818 100644
--- a/tools/testing/selftests/powerpc/mm/Makefile
+++ b/tools/testing/selftests/powerpc/mm/Makefile
@@ -1,21 +1,16 @@
 noarg:
         $(MAKE) -C ../
 
-PROGS := hugetlb_vs_thp_test subpage_prot
+TEST_PROGS := hugetlb_vs_thp_test subpage_prot
 
-all: $(PROGS) tempfile
+all: $(TEST_PROGS) tempfile
 
-$(PROGS): ../harness.c
+$(TEST_PROGS): ../harness.c
 
-run_tests: all
-        @-for PROG in $(PROGS); do \
-                ./$$PROG; \
-        done;
+include ../../lib.mk
 
 tempfile:
         dd if=/dev/zero of=tempfile bs=64k count=1
 
 clean:
-        rm -f $(PROGS) tempfile
-
-.PHONY: all run_tests clean
+        rm -f $(TEST_PROGS) tempfile
diff --git a/tools/testing/selftests/powerpc/pmu/Makefile b/tools/testing/selftests/powerpc/pmu/Makefile
index c9f4263906a5..5a161175bbd4 100644
--- a/tools/testing/selftests/powerpc/pmu/Makefile
+++ b/tools/testing/selftests/powerpc/pmu/Makefile
@@ -1,38 +1,42 @@
 noarg:
         $(MAKE) -C ../
 
-PROGS := count_instructions l3_bank_test per_event_excludes
+TEST_PROGS := count_instructions l3_bank_test per_event_excludes
 EXTRA_SOURCES := ../harness.c event.c lib.c
 
-SUB_TARGETS = ebb
+all: $(TEST_PROGS) ebb
 
-all: $(PROGS) $(SUB_TARGETS)
-
-$(PROGS): $(EXTRA_SOURCES)
+$(TEST_PROGS): $(EXTRA_SOURCES)
 
 # loop.S can only be built 64-bit
 count_instructions: loop.S count_instructions.c $(EXTRA_SOURCES)
         $(CC) $(CFLAGS) -m64 -o $@ $^
 
-run_tests: all sub_run_tests
-        @-for PROG in $(PROGS); do \
-                ./$$PROG; \
-        done;
+include ../../lib.mk
 
-clean: sub_clean
-        rm -f $(PROGS) loop.o
+DEFAULT_RUN_TESTS := $(RUN_TESTS)
+override define RUN_TESTS
+        $(DEFAULT_RUN_TESTS)
+        $(MAKE) -C ebb run_tests
+endef
 
-$(SUB_TARGETS):
-        $(MAKE) -k -C $@ all
+DEFAULT_EMIT_TESTS := $(EMIT_TESTS)
+override define EMIT_TESTS
+        $(DEFAULT_EMIT_TESTS)
+        $(MAKE) -s -C ebb emit_tests
+endef
 
-sub_run_tests: all
-        @for TARGET in $(SUB_TARGETS); do \
-                $(MAKE) -C $$TARGET run_tests; \
-        done;
+DEFAULT_INSTALL := $(INSTALL_RULE)
+override define INSTALL_RULE
+        $(DEFAULT_INSTALL_RULE)
+        $(MAKE) -C ebb install
+endef
 
-sub_clean:
-        @for TARGET in $(SUB_TARGETS); do \
-                $(MAKE) -C $$TARGET clean; \
-        done;
+clean:
+        rm -f $(TEST_PROGS) loop.o
+        $(MAKE) -C ebb clean
+
+ebb:
+        $(MAKE) -k -C $@ all
 
-.PHONY: all run_tests clean sub_run_tests sub_clean $(SUB_TARGETS)
+.PHONY: all run_tests clean ebb
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/Makefile b/tools/testing/selftests/powerpc/pmu/ebb/Makefile
index 3dc4332698cb..5cdc9dbf2b27 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/Makefile
+++ b/tools/testing/selftests/powerpc/pmu/ebb/Makefile
@@ -4,7 +4,7 @@ noarg:
 # The EBB handler is 64-bit code and everything links against it
 CFLAGS += -m64
 
-PROGS := reg_access_test event_attributes_test cycles_test      \
+TEST_PROGS := reg_access_test event_attributes_test cycles_test \
          cycles_with_freeze_test pmc56_overflow_test            \
          ebb_vs_cpu_event_test cpu_event_vs_ebb_test            \
          cpu_event_pinned_vs_ebb_test task_event_vs_ebb_test    \
@@ -16,18 +16,15 @@ PROGS := reg_access_test event_attributes_test cycles_test	\
          lost_exception_test no_handler_test                    \
          cycles_with_mmcr2_test
 
-all: $(PROGS)
+all: $(TEST_PROGS)
 
-$(PROGS): ../../harness.c ../event.c ../lib.c ebb.c ebb_handler.S trace.c busy_loop.S
+$(TEST_PROGS): ../../harness.c ../event.c ../lib.c ebb.c ebb_handler.S trace.c busy_loop.S
 
 instruction_count_test: ../loop.S
 
 lost_exception_test: ../lib.c
 
-run_tests: all
-        @-for PROG in $(PROGS); do \
-                ./$$PROG; \
-        done;
+include ../../../lib.mk
 
 clean:
-        rm -f $(PROGS)
+        rm -f $(TEST_PROGS)
diff --git a/tools/testing/selftests/powerpc/primitives/Makefile b/tools/testing/selftests/powerpc/primitives/Makefile
index ea737ca01732..b68c6221d3d1 100644
--- a/tools/testing/selftests/powerpc/primitives/Makefile
+++ b/tools/testing/selftests/powerpc/primitives/Makefile
@@ -1,17 +1,12 @@
 CFLAGS += -I$(CURDIR)
 
-PROGS := load_unaligned_zeropad
+TEST_PROGS := load_unaligned_zeropad
 
-all: $(PROGS)
+all: $(TEST_PROGS)
 
-$(PROGS): ../harness.c
+$(TEST_PROGS): ../harness.c
 
-run_tests: all
-        @-for PROG in $(PROGS); do \
-                ./$$PROG; \
-        done;
+include ../../lib.mk
 
 clean:
-        rm -f $(PROGS) *.o
-
-.PHONY: all run_tests clean
+        rm -f $(TEST_PROGS) *.o
diff --git a/tools/testing/selftests/powerpc/stringloops/Makefile b/tools/testing/selftests/powerpc/stringloops/Makefile
index 506d77346477..2a728f4d2873 100644
--- a/tools/testing/selftests/powerpc/stringloops/Makefile
+++ b/tools/testing/selftests/powerpc/stringloops/Makefile
@@ -2,19 +2,14 @@
 CFLAGS += -m64
 CFLAGS += -I$(CURDIR)
 
-PROGS := memcmp
+TEST_PROGS := memcmp
 EXTRA_SOURCES := memcmp_64.S ../harness.c
 
-all: $(PROGS)
+all: $(TEST_PROGS)
 
-$(PROGS): $(EXTRA_SOURCES)
+$(TEST_PROGS): $(EXTRA_SOURCES)
 
-run_tests: all
-        @-for PROG in $(PROGS); do \
-                ./$$PROG; \
-        done;
+include ../../lib.mk
 
 clean:
-        rm -f $(PROGS) *.o
-
-.PHONY: all run_tests clean
+        rm -f $(TEST_PROGS) *.o
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index 2cede239a074..34f2ec634b40 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -1,15 +1,10 @@
-PROGS := tm-resched-dscr
+TEST_PROGS := tm-resched-dscr
 
-all: $(PROGS)
+all: $(TEST_PROGS)
 
-$(PROGS): ../harness.c
+$(TEST_PROGS): ../harness.c
 
-run_tests: all
-        @-for PROG in $(PROGS); do \
-                ./$$PROG; \
-        done;
+include ../../lib.mk
 
 clean:
-        rm -f $(PROGS) *.o
-
-.PHONY: all run_tests clean
+        rm -f $(TEST_PROGS) *.o
diff --git a/tools/testing/selftests/ptrace/Makefile b/tools/testing/selftests/ptrace/Makefile
index 47ae2d385ce8..453927fea90c 100644
--- a/tools/testing/selftests/ptrace/Makefile
+++ b/tools/testing/selftests/ptrace/Makefile
@@ -6,5 +6,6 @@ all: peeksiginfo
 clean:
         rm -f peeksiginfo
 
-run_tests: all
-        @./peeksiginfo || echo "peeksiginfo selftests: [FAIL]"
+TEST_PROGS := peeksiginfo
+
+include ../lib.mk
diff --git a/tools/testing/selftests/size/Makefile b/tools/testing/selftests/size/Makefile
index 04dc25e4fa92..bbd0b5398b61 100644
--- a/tools/testing/selftests/size/Makefile
+++ b/tools/testing/selftests/size/Makefile
@@ -1,12 +1,11 @@
-CC = $(CROSS_COMPILE)gcc
-
 all: get_size
 
 get_size: get_size.c
         $(CC) -static -ffreestanding -nostartfiles -s $< -o $@
 
-run_tests: all
-        ./get_size
+TEST_PROGS := get_size
+
+include ../lib.mk
 
 clean:
         $(RM) get_size
diff --git a/tools/testing/selftests/sysctl/Makefile b/tools/testing/selftests/sysctl/Makefile
index 0a92adaf0865..b3c33e071f10 100644
--- a/tools/testing/selftests/sysctl/Makefile
+++ b/tools/testing/selftests/sysctl/Makefile
@@ -4,16 +4,10 @@
 # No binaries, but make sure arg-less "make" doesn't trigger "run_tests".
 all:
 
-# Allow specific tests to be selected.
-test_num:
-        @/bin/sh ./run_numerictests
+TEST_PROGS := run_numerictests run_stringtests
+TEST_FILES := common_tests
 
-test_string:
-        @/bin/sh ./run_stringtests
-
-run_tests: all test_num test_string
+include ../lib.mk
 
 # Nothing to clean up.
 clean:
-
-.PHONY: all run_tests clean test_num test_string
diff --git a/tools/testing/selftests/sysctl/run_numerictests b/tools/testing/selftests/sysctl/run_numerictests
index 8510f93f2d14..8510f93f2d14 100644..100755
--- a/tools/testing/selftests/sysctl/run_numerictests
+++ b/tools/testing/selftests/sysctl/run_numerictests
diff --git a/tools/testing/selftests/sysctl/run_stringtests b/tools/testing/selftests/sysctl/run_stringtests
index 90a9293d520c..90a9293d520c 100644..100755
--- a/tools/testing/selftests/sysctl/run_stringtests
+++ b/tools/testing/selftests/sysctl/run_stringtests
diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
index eb2859f4ad21..89a3f44bf355 100644
--- a/tools/testing/selftests/timers/Makefile
+++ b/tools/testing/selftests/timers/Makefile
@@ -1,8 +1,36 @@
-all:
-        gcc posix_timers.c -o posix_timers -lrt
+CC = $(CROSS_COMPILE)gcc
+BUILD_FLAGS = -DKTEST
+CFLAGS += -O3 -Wl,-no-as-needed -Wall $(BUILD_FLAGS)
+LDFLAGS += -lrt -lpthread
 
-run_tests: all
-        ./posix_timers
+# these are all "safe" tests that don't modify
+# system time or require escalated privledges
+TEST_PROGS = posix_timers nanosleep nsleep-lat set-timer-lat mqueue-lat \
+             inconsistency-check raw_skew threadtest rtctest
+
+TEST_PROGS_EXTENDED = alarmtimer-suspend valid-adjtimex change_skew \
+                      skew_consistency clocksource-switch leap-a-day \
+                      leapcrash set-tai set-2038
+
+bins = $(TEST_PROGS) $(TEST_PROGS_EXTENDED)
+
+all: ${bins}
+
+include ../lib.mk
+
+# these tests require escalated privledges
+# and may modify the system time or trigger
+# other behavior like suspend
+run_destructive_tests: run_tests
+        ./alarmtimer-suspend
+        ./valid-adjtimex
+        ./change_skew
+        ./skew_consistency
+        ./clocksource-switch
+        ./leap-a-day -s -i 10
+        ./leapcrash
+        ./set-tai
+        ./set-2038
 
 clean:
-        rm -f ./posix_timers
+        rm -f ${bins}
diff --git a/tools/testing/selftests/timers/alarmtimer-suspend.c b/tools/testing/selftests/timers/alarmtimer-suspend.c
new file mode 100644
index 000000000000..aaffbde1d5ee
--- /dev/null
+++ b/tools/testing/selftests/timers/alarmtimer-suspend.c
@@ -0,0 +1,185 @@
+/* alarmtimer suspend test
+ *              John Stultz (john.stultz@linaro.org)
+ *              (C) Copyright Linaro 2013
+ *              Licensed under the GPLv2
+ *
+ *   This test makes sure the alarmtimer & RTC wakeup code is
+ *   functioning.
+ *
+ *  To build:
+ *      $ gcc alarmtimer-suspend.c -o alarmtimer-suspend -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+#include <stdio.h>
+#include <unistd.h>
+#include <time.h>
+#include <string.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <pthread.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define CLOCK_REALTIME                  0
+#define CLOCK_MONOTONIC                 1
+#define CLOCK_PROCESS_CPUTIME_ID        2
+#define CLOCK_THREAD_CPUTIME_ID         3
+#define CLOCK_MONOTONIC_RAW             4
+#define CLOCK_REALTIME_COARSE           5
+#define CLOCK_MONOTONIC_COARSE          6
+#define CLOCK_BOOTTIME                  7
+#define CLOCK_REALTIME_ALARM            8
+#define CLOCK_BOOTTIME_ALARM            9
+#define CLOCK_HWSPECIFIC                10
+#define CLOCK_TAI                       11
+#define NR_CLOCKIDS                     12
+
+
+#define NSEC_PER_SEC 1000000000ULL
+#define UNREASONABLE_LAT (NSEC_PER_SEC * 4) /* hopefully we resume in 4secs */
+
+#define SUSPEND_SECS 15
+int alarmcount;
+int alarm_clock_id;
+struct timespec start_time;
+
+
+char *clockstring(int clockid)
+{
+        switch (clockid) {
+        case CLOCK_REALTIME:
+                return "CLOCK_REALTIME";
+        case CLOCK_MONOTONIC:
+                return "CLOCK_MONOTONIC";
+        case CLOCK_PROCESS_CPUTIME_ID:
+                return "CLOCK_PROCESS_CPUTIME_ID";
+        case CLOCK_THREAD_CPUTIME_ID:
+                return "CLOCK_THREAD_CPUTIME_ID";
+        case CLOCK_MONOTONIC_RAW:
+                return "CLOCK_MONOTONIC_RAW";
+        case CLOCK_REALTIME_COARSE:
+                return "CLOCK_REALTIME_COARSE";
+        case CLOCK_MONOTONIC_COARSE:
+                return "CLOCK_MONOTONIC_COARSE";
+        case CLOCK_BOOTTIME:
+                return "CLOCK_BOOTTIME";
+        case CLOCK_REALTIME_ALARM:
+                return "CLOCK_REALTIME_ALARM";
+        case CLOCK_BOOTTIME_ALARM:
+                return "CLOCK_BOOTTIME_ALARM";
+        case CLOCK_TAI:
+                return "CLOCK_TAI";
+        };
+        return "UNKNOWN_CLOCKID";
+}
+
+
+long long timespec_sub(struct timespec a, struct timespec b)
+{
+        long long ret = NSEC_PER_SEC * b.tv_sec + b.tv_nsec;
+
+        ret -= NSEC_PER_SEC * a.tv_sec + a.tv_nsec;
+        return ret;
+}
+
+int final_ret = 0;
+
+void sigalarm(int signo)
+{
+        long long delta_ns;
+        struct timespec ts;
+
+        clock_gettime(alarm_clock_id, &ts);
+        alarmcount++;
+
+        delta_ns = timespec_sub(start_time, ts);
+        delta_ns -= NSEC_PER_SEC * SUSPEND_SECS * alarmcount;
+
+        printf("ALARM(%i): %ld:%ld latency: %lld ns ", alarmcount, ts.tv_sec,
+                                                        ts.tv_nsec, delta_ns);
+
+        if (delta_ns > UNREASONABLE_LAT) {
+                printf("[FAIL]\n");
+                final_ret = -1;
+        } else
+                printf("[OK]\n");
+
+}
+
+int main(void)
+{
+        timer_t tm1;
+        struct itimerspec its1, its2;
+        struct sigevent se;
+        struct sigaction act;
+        int signum = SIGRTMAX;
+
+        /* Set up signal handler: */
+        sigfillset(&act.sa_mask);
+        act.sa_flags = 0;
+        act.sa_handler = sigalarm;
+        sigaction(signum, &act, NULL);
+
+        /* Set up timer: */
+        memset(&se, 0, sizeof(se));
+        se.sigev_notify = SIGEV_SIGNAL;
+        se.sigev_signo = signum;
+        se.sigev_value.sival_int = 0;
+
+        for (alarm_clock_id = CLOCK_REALTIME_ALARM;
+                        alarm_clock_id <= CLOCK_BOOTTIME_ALARM;
+                        alarm_clock_id++) {
+
+                alarmcount = 0;
+                timer_create(alarm_clock_id, &se, &tm1);
+
+                clock_gettime(alarm_clock_id, &start_time);
+                printf("Start time (%s): %ld:%ld\n", clockstring(alarm_clock_id),
+                                start_time.tv_sec, start_time.tv_nsec);
+                printf("Setting alarm for every %i seconds\n", SUSPEND_SECS);
+                its1.it_value = start_time;
+                its1.it_value.tv_sec += SUSPEND_SECS;
+                its1.it_interval.tv_sec = SUSPEND_SECS;
+                its1.it_interval.tv_nsec = 0;
+
+                timer_settime(tm1, TIMER_ABSTIME, &its1, &its2);
+
+                while (alarmcount < 5)
+                        sleep(1); /* First 5 alarms, do nothing */
+
+                printf("Starting suspend loops\n");
+                while (alarmcount < 10) {
+                        int ret;
+
+                        sleep(1);
+                        ret = system("echo mem > /sys/power/state");
+                        if (ret)
+                                break;
+                }
+                timer_delete(tm1);
+        }
+        if (final_ret)
+                return ksft_exit_fail();
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/change_skew.c b/tools/testing/selftests/timers/change_skew.c
new file mode 100644
index 000000000000..cb1968977c04
--- /dev/null
+++ b/tools/testing/selftests/timers/change_skew.c
@@ -0,0 +1,107 @@
+/* ADJ_FREQ Skew change test
+ *              by: john stultz (johnstul@us.ibm.com)
+ *              (C) Copyright IBM 2012
+ *              Licensed under the GPLv2
+ *
+ *  NOTE: This is a meta-test which cranks the ADJ_FREQ knob and
+ *  then uses other tests to detect problems. Thus this test requires
+ *  that the raw_skew, inconsistency-check and nanosleep tests be
+ *  present in the same directory it is run from.
+ *
+ *  To build:
+ *      $ gcc change_skew.c -o change_skew -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <time.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000LL
+
+
+int change_skew_test(int ppm)
+{
+        struct timex tx;
+        int ret;
+
+        tx.modes = ADJ_FREQUENCY;
+        tx.freq = ppm << 16;
+
+        ret = adjtimex(&tx);
+        if (ret < 0) {
+                printf("Error adjusting freq\n");
+                return ret;
+        }
+
+        ret = system("./raw_skew");
+        ret |= system("./inconsistency-check");
+        ret |= system("./nanosleep");
+
+        return ret;
+}
+
+
+int main(int argv, char **argc)
+{
+        struct timex tx;
+        int i, ret;
+
+        int ppm[5] = {0, 250, 500, -250, -500};
+
+        /* Kill ntpd */
+        ret = system("killall -9 ntpd");
+
+        /* Make sure there's no offset adjustment going on */
+        tx.modes = ADJ_OFFSET;
+        tx.offset = 0;
+        ret = adjtimex(&tx);
+
+        if (ret < 0) {
+                printf("Maybe you're not running as root?\n");
+                return -1;
+        }
+
+        for (i = 0; i < 5; i++) {
+                printf("Using %i ppm adjustment\n", ppm[i]);
+                ret = change_skew_test(ppm[i]);
+                if (ret)
+                        break;
+        }
+
+        /* Set things back */
+        tx.modes = ADJ_FREQUENCY;
+        tx.offset = 0;
+        adjtimex(&tx);
+
+        if (ret) {
+                printf("[FAIL]");
+                return ksft_exit_fail();
+        }
+        printf("[OK]");
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c
new file mode 100644
index 000000000000..627ec7425f78
--- /dev/null
+++ b/tools/testing/selftests/timers/clocksource-switch.c
@@ -0,0 +1,179 @@
+/* Clocksource change test
+ *              by: john stultz (johnstul@us.ibm.com)
+ *              (C) Copyright IBM 2012
+ *              Licensed under the GPLv2
+ *
+ *  NOTE: This is a meta-test which quickly changes the clocksourc and
+ *  then uses other tests to detect problems. Thus this test requires
+ *  that the inconsistency-check and nanosleep tests be present in the
+ *  same directory it is run from.
+ *
+ *  To build:
+ *      $ gcc clocksource-switch.c -o clocksource-switch -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <time.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/wait.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+
+int get_clocksources(char list[][30])
+{
+        int fd, i;
+        size_t size;
+        char buf[512];
+        char *head, *tmp;
+
+        fd = open("/sys/devices/system/clocksource/clocksource0/available_clocksource", O_RDONLY);
+
+        size = read(fd, buf, 512);
+
+        close(fd);
+
+        for (i = 0; i < 30; i++)
+                list[i][0] = '\0';
+
+        head = buf;
+        i = 0;
+        while (head - buf < size) {
+                /* Find the next space */
+                for (tmp = head; *tmp != ' '; tmp++) {
+                        if (*tmp == '\n')
+                                break;
+                        if (*tmp == '\0')
+                                break;
+                }
+                *tmp = '\0';
+                strcpy(list[i], head);
+                head = tmp + 1;
+                i++;
+        }
+
+        return i-1;
+}
+
+int get_cur_clocksource(char *buf, size_t size)
+{
+        int fd;
+
+        fd = open("/sys/devices/system/clocksource/clocksource0/current_clocksource", O_RDONLY);
+
+        size = read(fd, buf, size);
+
+        return 0;
+}
+
+int change_clocksource(char *clocksource)
+{
+        int fd;
+        size_t size;
+
+        fd = open("/sys/devices/system/clocksource/clocksource0/current_clocksource", O_WRONLY);
+
+        if (fd < 0)
+                return -1;
+
+        size = write(fd, clocksource, strlen(clocksource));
+
+        if (size < 0)
+                return -1;
+
+        close(fd);
+        return 0;
+}
+
+
+int run_tests(int secs)
+{
+        int ret;
+        char buf[255];
+
+        sprintf(buf, "./inconsistency-check -t %i", secs);
+        ret = system(buf);
+        if (ret)
+                return ret;
+        ret = system("./nanosleep");
+        return ret;
+}
+
+
+char clocksource_list[10][30];
+
+int main(int argv, char **argc)
+{
+        char orig_clk[512];
+        int count, i, status;
+        pid_t pid;
+
+        get_cur_clocksource(orig_clk, 512);
+
+        count = get_clocksources(clocksource_list);
+
+        if (change_clocksource(clocksource_list[0])) {
+                printf("Error: You probably need to run this as root\n");
+                return -1;
+        }
+
+        /* Check everything is sane before we start switching asyncrhonously */
+        for (i = 0; i < count; i++) {
+                printf("Validating clocksource %s\n", clocksource_list[i]);
+                if (change_clocksource(clocksource_list[i])) {
+                        status = -1;
+                        goto out;
+                }
+                if (run_tests(5)) {
+                        status = -1;
+                        goto out;
+                }
+        }
+
+
+        printf("Running Asyncrhonous Switching Tests...\n");
+        pid = fork();
+        if (!pid)
+                return run_tests(60);
+
+        while (pid != waitpid(pid, &status, WNOHANG))
+                for (i = 0; i < count; i++)
+                        if (change_clocksource(clocksource_list[i])) {
+                                status = -1;
+                                goto out;
+                        }
+out:
+        change_clocksource(orig_clk);
+
+        if (status)
+                return ksft_exit_fail();
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/inconsistency-check.c b/tools/testing/selftests/timers/inconsistency-check.c
new file mode 100644
index 000000000000..caf1bc9257c4
--- /dev/null
+++ b/tools/testing/selftests/timers/inconsistency-check.c
@@ -0,0 +1,204 @@
+/* Time inconsistency check test
+ *              by: john stultz (johnstul@us.ibm.com)
+ *              (C) Copyright IBM 2003, 2004, 2005, 2012
+ *              (C) Copyright Linaro Limited 2015
+ *              Licensed under the GPLv2
+ *
+ *  To build:
+ *      $ gcc inconsistency-check.c -o inconsistency-check -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define CALLS_PER_LOOP 64
+#define NSEC_PER_SEC 1000000000ULL
+
+#define CLOCK_REALTIME                  0
+#define CLOCK_MONOTONIC                 1
+#define CLOCK_PROCESS_CPUTIME_ID        2
+#define CLOCK_THREAD_CPUTIME_ID         3
+#define CLOCK_MONOTONIC_RAW             4
+#define CLOCK_REALTIME_COARSE           5
+#define CLOCK_MONOTONIC_COARSE          6
+#define CLOCK_BOOTTIME                  7
+#define CLOCK_REALTIME_ALARM            8
+#define CLOCK_BOOTTIME_ALARM            9
+#define CLOCK_HWSPECIFIC                10
+#define CLOCK_TAI                       11
+#define NR_CLOCKIDS                     12
+
+char *clockstring(int clockid)
+{
+        switch (clockid) {
+        case CLOCK_REALTIME:
+                return "CLOCK_REALTIME";
+        case CLOCK_MONOTONIC:
+                return "CLOCK_MONOTONIC";
+        case CLOCK_PROCESS_CPUTIME_ID:
+                return "CLOCK_PROCESS_CPUTIME_ID";
+        case CLOCK_THREAD_CPUTIME_ID:
+                return "CLOCK_THREAD_CPUTIME_ID";
+        case CLOCK_MONOTONIC_RAW:
+                return "CLOCK_MONOTONIC_RAW";
+        case CLOCK_REALTIME_COARSE:
+                return "CLOCK_REALTIME_COARSE";
+        case CLOCK_MONOTONIC_COARSE:
+                return "CLOCK_MONOTONIC_COARSE";
+        case CLOCK_BOOTTIME:
+                return "CLOCK_BOOTTIME";
+        case CLOCK_REALTIME_ALARM:
+                return "CLOCK_REALTIME_ALARM";
+        case CLOCK_BOOTTIME_ALARM:
+                return "CLOCK_BOOTTIME_ALARM";
+        case CLOCK_TAI:
+                return "CLOCK_TAI";
+        };
+        return "UNKNOWN_CLOCKID";
+}
+
+/* returns 1 if a <= b, 0 otherwise */
+static inline int in_order(struct timespec a, struct timespec b)
+{
+        /* use unsigned to avoid false positives on 2038 rollover */
+        if ((unsigned long)a.tv_sec < (unsigned long)b.tv_sec)
+                return 1;
+        if ((unsigned long)a.tv_sec > (unsigned long)b.tv_sec)
+                return 0;
+        if (a.tv_nsec > b.tv_nsec)
+                return 0;
+        return 1;
+}
+
+
+
+int consistency_test(int clock_type, unsigned long seconds)
+{
+        struct timespec list[CALLS_PER_LOOP];
+        int i, inconsistent;
+        long now, then;
+        time_t t;
+        char *start_str;
+
+        clock_gettime(clock_type, &list[0]);
+        now = then = list[0].tv_sec;
+
+        /* timestamp start of test */
+        t = time(0);
+        start_str = ctime(&t);
+
+        while (seconds == -1 || now - then < seconds) {
+                inconsistent = 0;
+
+                /* Fill list */
+                for (i = 0; i < CALLS_PER_LOOP; i++)
+                        clock_gettime(clock_type, &list[i]);
+
+                /* Check for inconsistencies */
+                for (i = 0; i < CALLS_PER_LOOP - 1; i++)
+                        if (!in_order(list[i], list[i+1]))
+                                inconsistent = i;
+
+                /* display inconsistency */
+                if (inconsistent) {
+                        unsigned long long delta;
+
+                        printf("\%s\n", start_str);
+                        for (i = 0; i < CALLS_PER_LOOP; i++) {
+                                if (i == inconsistent)
+                                        printf("--------------------\n");
+                                printf("%lu:%lu\n", list[i].tv_sec,
+                                                        list[i].tv_nsec);
+                                if (i == inconsistent + 1)
+                                        printf("--------------------\n");
+                        }
+                        delta = list[inconsistent].tv_sec * NSEC_PER_SEC;
+                        delta += list[inconsistent].tv_nsec;
+                        delta -= list[inconsistent+1].tv_sec * NSEC_PER_SEC;
+                        delta -= list[inconsistent+1].tv_nsec;
+                        printf("Delta: %llu ns\n", delta);
+                        fflush(0);
+                        /* timestamp inconsistency*/
+                        t = time(0);
+                        printf("%s\n", ctime(&t));
+                        printf("[FAILED]\n");
+                        return -1;
+                }
+                now = list[0].tv_sec;
+        }
+        printf("[OK]\n");
+        return 0;
+}
+
+
+int main(int argc, char *argv[])
+{
+        int clockid, opt;
+        int userclock = CLOCK_REALTIME;
+        int maxclocks = NR_CLOCKIDS;
+        int runtime = 10;
+        struct timespec ts;
+
+        /* Process arguments */
+        while ((opt = getopt(argc, argv, "t:c:")) != -1) {
+                switch (opt) {
+                case 't':
+                        runtime = atoi(optarg);
+                        break;
+                case 'c':
+                        userclock = atoi(optarg);
+                        maxclocks = userclock + 1;
+                        break;
+                default:
+                        printf("Usage: %s [-t <secs>] [-c <clockid>]\n", argv[0]);
+                        printf("        -t: Number of seconds to run\n");
+                        printf("        -c: clockid to use (default, all clockids)\n");
+                        exit(-1);
+                }
+        }
+
+        setbuf(stdout, NULL);
+
+        for (clockid = userclock; clockid < maxclocks; clockid++) {
+
+                if (clockid == CLOCK_HWSPECIFIC)
+                        continue;
+
+                if (!clock_gettime(clockid, &ts)) {
+                        printf("Consistent %-30s ", clockstring(clockid));
+                        if (consistency_test(clockid, runtime))
+                                return ksft_exit_fail();
+                }
+        }
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/leap-a-day.c b/tools/testing/selftests/timers/leap-a-day.c
new file mode 100644
index 000000000000..b8272e6c4b3b
--- /dev/null
+++ b/tools/testing/selftests/timers/leap-a-day.c
@@ -0,0 +1,319 @@
+/* Leap second stress test
+ *              by: John Stultz (john.stultz@linaro.org)
+ *              (C) Copyright IBM 2012
+ *              (C) Copyright 2013, 2015 Linaro Limited
+ *              Licensed under the GPLv2
+ *
+ *  This test signals the kernel to insert a leap second
+ *  every day at midnight GMT. This allows for stessing the
+ *  kernel's leap-second behavior, as well as how well applications
+ *  handle the leap-second discontinuity.
+ *
+ *  Usage: leap-a-day [-s] [-i <num>]
+ *
+ *  Options:
+ *      -s:     Each iteration, set the date to 10 seconds before midnight GMT.
+ *              This speeds up the number of leapsecond transitions tested,
+ *              but because it calls settimeofday frequently, advancing the
+ *              time by 24 hours every ~16 seconds, it may cause application
+ *              disruption.
+ *
+ *      -i:     Number of iterations to run (default: infinite)
+ *
+ *  Other notes: Disabling NTP prior to running this is advised, as the two
+ *               may conflict in their commands to the kernel.
+ *
+ *  To build:
+ *      $ gcc leap-a-day.c -o leap-a-day -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000ULL
+#define CLOCK_TAI 11
+
+/* returns 1 if a <= b, 0 otherwise */
+static inline int in_order(struct timespec a, struct timespec b)
+{
+        if (a.tv_sec < b.tv_sec)
+                return 1;
+        if (a.tv_sec > b.tv_sec)
+                return 0;
+        if (a.tv_nsec > b.tv_nsec)
+                return 0;
+        return 1;
+}
+
+struct timespec timespec_add(struct timespec ts, unsigned long long ns)
+{
+        ts.tv_nsec += ns;
+        while (ts.tv_nsec >= NSEC_PER_SEC) {
+                ts.tv_nsec -= NSEC_PER_SEC;
+                ts.tv_sec++;
+        }
+        return ts;
+}
+
+char *time_state_str(int state)
+{
+        switch (state) {
+        case TIME_OK:   return "TIME_OK";
+        case TIME_INS:  return "TIME_INS";
+        case TIME_DEL:  return "TIME_DEL";
+        case TIME_OOP:  return "TIME_OOP";
+        case TIME_WAIT: return "TIME_WAIT";
+        case TIME_BAD:  return "TIME_BAD";
+        }
+        return "ERROR";
+}
+
+/* clear NTP time_status & time_state */
+int clear_time_state(void)
+{
+        struct timex tx;
+        int ret;
+
+        /*
+         * We have to call adjtime twice here, as kernels
+         * prior to 6b1859dba01c7 (included in 3.5 and
+         * -stable), had an issue with the state machine
+         * and wouldn't clear the STA_INS/DEL flag directly.
+         */
+        tx.modes = ADJ_STATUS;
+        tx.status = STA_PLL;
+        ret = adjtimex(&tx);
+
+        /* Clear maxerror, as it can cause UNSYNC to be set */
+        tx.modes = ADJ_MAXERROR;
+        tx.maxerror = 0;
+        ret = adjtimex(&tx);
+
+        /* Clear the status */
+        tx.modes = ADJ_STATUS;
+        tx.status = 0;
+        ret = adjtimex(&tx);
+
+        return ret;
+}
+
+/* Make sure we cleanup on ctrl-c */
+void handler(int unused)
+{
+        clear_time_state();
+        exit(0);
+}
+
+/* Test for known hrtimer failure */
+void test_hrtimer_failure(void)
+{
+        struct timespec now, target;
+
+        clock_gettime(CLOCK_REALTIME, &now);
+        target = timespec_add(now, NSEC_PER_SEC/2);
+        clock_nanosleep(CLOCK_REALTIME, TIMER_ABSTIME, &target, NULL);
+        clock_gettime(CLOCK_REALTIME, &now);
+
+        if (!in_order(target, now))
+                printf("ERROR: hrtimer early expiration failure observed.\n");
+}
+
+int main(int argc, char **argv)
+{
+        int settime = 0;
+        int tai_time = 0;
+        int insert = 1;
+        int iterations = -1;
+        int opt;
+
+        /* Process arguments */
+        while ((opt = getopt(argc, argv, "sti:")) != -1) {
+                switch (opt) {
+                case 's':
+                        printf("Setting time to speed up testing\n");
+                        settime = 1;
+                        break;
+                case 'i':
+                        iterations = atoi(optarg);
+                        break;
+                case 't':
+                        tai_time = 1;
+                        break;
+                default:
+                        printf("Usage: %s [-s] [-i <iterations>]\n", argv[0]);
+                        printf("        -s: Set time to right before leap second each iteration\n");
+                        printf("        -i: Number of iterations\n");
+                        printf("        -t: Print TAI time\n");
+                        exit(-1);
+                }
+        }
+
+        /* Make sure TAI support is present if -t was used */
+        if (tai_time) {
+                struct timespec ts;
+
+                if (clock_gettime(CLOCK_TAI, &ts)) {
+                        printf("System doesn't support CLOCK_TAI\n");
+                        ksft_exit_fail();
+                }
+        }
+
+        signal(SIGINT, handler);
+        signal(SIGKILL, handler);
+
+        if (iterations < 0)
+                printf("This runs continuously. Press ctrl-c to stop\n");
+        else
+                printf("Running for %i iterations. Press ctrl-c to stop\n", iterations);
+
+        printf("\n");
+        while (1) {
+                int ret;
+                struct timespec ts;
+                struct timex tx;
+                time_t now, next_leap;
+
+                /* Get the current time */
+                clock_gettime(CLOCK_REALTIME, &ts);
+
+                /* Calculate the next possible leap second 23:59:60 GMT */
+                next_leap = ts.tv_sec;
+                next_leap += 86400 - (next_leap % 86400);
+
+                if (settime) {
+                        struct timeval tv;
+
+                        tv.tv_sec = next_leap - 10;
+                        tv.tv_usec = 0;
+                        settimeofday(&tv, NULL);
+                        printf("Setting time to %s", ctime(&tv.tv_sec));
+                }
+
+                /* Reset NTP time state */
+                clear_time_state();
+
+                /* Set the leap second insert flag */
+                tx.modes = ADJ_STATUS;
+                if (insert)
+                        tx.status = STA_INS;
+                else
+                        tx.status = STA_DEL;
+                ret = adjtimex(&tx);
+                if (ret < 0) {
+                        printf("Error: Problem setting STA_INS/STA_DEL!: %s\n",
+                                                        time_state_str(ret));
+                        return ksft_exit_fail();
+                }
+
+                /* Validate STA_INS was set */
+                tx.modes = 0;
+                ret = adjtimex(&tx);
+                if (tx.status != STA_INS && tx.status != STA_DEL) {
+                        printf("Error: STA_INS/STA_DEL not set!: %s\n",
+                                                        time_state_str(ret));
+                        return ksft_exit_fail();
+                }
+
+                if (tai_time) {
+                        printf("Using TAI time,"
+                                " no inconsistencies should be seen!\n");
+                }
+
+                printf("Scheduling leap second for %s", ctime(&next_leap));
+
+                /* Wake up 3 seconds before leap */
+                ts.tv_sec = next_leap - 3;
+                ts.tv_nsec = 0;
+
+                while (clock_nanosleep(CLOCK_REALTIME, TIMER_ABSTIME, &ts, NULL))
+                        printf("Something woke us up, returning to sleep\n");
+
+                /* Validate STA_INS is still set */
+                tx.modes = 0;
+                ret = adjtimex(&tx);
+                if (tx.status != STA_INS && tx.status != STA_DEL) {
+                        printf("Something cleared STA_INS/STA_DEL, setting it again.\n");
+                        tx.modes = ADJ_STATUS;
+                        if (insert)
+                                tx.status = STA_INS;
+                        else
+                                tx.status = STA_DEL;
+                        ret = adjtimex(&tx);
+                }
+
+                /* Check adjtimex output every half second */
+                now = tx.time.tv_sec;
+                while (now < next_leap + 2) {
+                        char buf[26];
+                        struct timespec tai;
+
+                        tx.modes = 0;
+                        ret = adjtimex(&tx);
+
+                        if (tai_time) {
+                                clock_gettime(CLOCK_TAI, &tai);
+                                printf("%ld sec, %9ld ns\t%s\n",
+                                                tai.tv_sec,
+                                                tai.tv_nsec,
+                                                time_state_str(ret));
+                        } else {
+                                ctime_r(&tx.time.tv_sec, buf);
+                                buf[strlen(buf)-1] = 0; /*remove trailing\n */
+
+                                printf("%s + %6ld us (%i)\t%s\n",
+                                                buf,
+                                                tx.time.tv_usec,
+                                                tx.tai,
+                                                time_state_str(ret));
+                        }
+                        now = tx.time.tv_sec;
+                        /* Sleep for another half second */
+                        ts.tv_sec = 0;
+                        ts.tv_nsec = NSEC_PER_SEC / 2;
+                        clock_nanosleep(CLOCK_MONOTONIC, 0, &ts, NULL);
+                }
+                /* Switch to using other mode */
+                insert = !insert;
+
+                /* Note if kernel has known hrtimer failure */
+                test_hrtimer_failure();
+
+                printf("Leap complete\n\n");
+
+                if ((iterations != -1) && !(--iterations))
+                        break;
+        }
+
+        clear_time_state();
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/leapcrash.c b/tools/testing/selftests/timers/leapcrash.c
new file mode 100644
index 000000000000..a1071bdbdeb7
--- /dev/null
+++ b/tools/testing/selftests/timers/leapcrash.c
@@ -0,0 +1,120 @@
+/* Demo leapsecond deadlock
+ *              by: John Stultz (john.stultz@linaro.org)
+ *              (C) Copyright IBM 2012
+ *              (C) Copyright 2013, 2015 Linaro Limited
+ *              Licensed under the GPL
+ *
+ * This test demonstrates leapsecond deadlock that is possibe
+ * on kernels from 2.6.26 to 3.3.
+ *
+ * WARNING: THIS WILL LIKELY HARDHANG SYSTEMS AND MAY LOSE DATA
+ * RUN AT YOUR OWN RISK!
+ *  To build:
+ *      $ gcc leapcrash.c -o leapcrash -lrt
+ */
+
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+
+
+/* clear NTP time_status & time_state */
+int clear_time_state(void)
+{
+        struct timex tx;
+        int ret;
+
+        /*
+         * We have to call adjtime twice here, as kernels
+         * prior to 6b1859dba01c7 (included in 3.5 and
+         * -stable), had an issue with the state machine
+         * and wouldn't clear the STA_INS/DEL flag directly.
+         */
+        tx.modes = ADJ_STATUS;
+        tx.status = STA_PLL;
+        ret = adjtimex(&tx);
+
+        tx.modes = ADJ_STATUS;
+        tx.status = 0;
+        ret = adjtimex(&tx);
+
+        return ret;
+}
+
+/* Make sure we cleanup on ctrl-c */
+void handler(int unused)
+{
+        clear_time_state();
+        exit(0);
+}
+
+
+int main(void)
+{
+        struct timex tx;
+        struct timespec ts;
+        time_t next_leap;
+        int count = 0;
+
+        setbuf(stdout, NULL);
+
+        signal(SIGINT, handler);
+        signal(SIGKILL, handler);
+        printf("This runs for a few minutes. Press ctrl-c to stop\n");
+
+        clear_time_state();
+
+
+        /* Get the current time */
+        clock_gettime(CLOCK_REALTIME, &ts);
+
+        /* Calculate the next possible leap second 23:59:60 GMT */
+        next_leap = ts.tv_sec;
+        next_leap += 86400 - (next_leap % 86400);
+
+        for (count = 0; count < 20; count++) {
+                struct timeval tv;
+
+
+                /* set the time to 2 seconds before the leap */
+                tv.tv_sec = next_leap - 2;
+                tv.tv_usec = 0;
+                if (settimeofday(&tv, NULL)) {
+                        printf("Error: You're likely not running with proper (ie: root) permissions\n");
+                        return ksft_exit_fail();
+                }
+                tx.modes = 0;
+                adjtimex(&tx);
+
+                /* hammer on adjtime w/ STA_INS */
+                while (tx.time.tv_sec < next_leap + 1) {
+                        /* Set the leap second insert flag */
+                        tx.modes = ADJ_STATUS;
+                        tx.status = STA_INS;
+                        adjtimex(&tx);
+                }
+                clear_time_state();
+                printf(".");
+        }
+        printf("[OK]\n");
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/mqueue-lat.c b/tools/testing/selftests/timers/mqueue-lat.c
new file mode 100644
index 000000000000..a2a3924d0b41
--- /dev/null
+++ b/tools/testing/selftests/timers/mqueue-lat.c
@@ -0,0 +1,124 @@
+/* Measure mqueue timeout latency
+ *              by: john stultz (john.stultz@linaro.org)
+ *              (C) Copyright Linaro 2013
+ *
+ *              Inspired with permission from example test by:
+ *                      Romain Francoise <romain@orebokech.com>
+ *              Licensed under the GPLv2
+ *
+ *  To build:
+ *      $ gcc mqueue-lat.c -o mqueue-lat -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#include <errno.h>
+#include <mqueue.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000ULL
+
+#define TARGET_TIMEOUT          100000000       /* 100ms in nanoseconds */
+#define UNRESONABLE_LATENCY     40000000        /* 40ms in nanosecs */
+
+
+long long timespec_sub(struct timespec a, struct timespec b)
+{
+        long long ret = NSEC_PER_SEC * b.tv_sec + b.tv_nsec;
+
+        ret -= NSEC_PER_SEC * a.tv_sec + a.tv_nsec;
+        return ret;
+}
+
+struct timespec timespec_add(struct timespec ts, unsigned long long ns)
+{
+        ts.tv_nsec += ns;
+        while (ts.tv_nsec >= NSEC_PER_SEC) {
+                ts.tv_nsec -= NSEC_PER_SEC;
+                ts.tv_sec++;
+        }
+        return ts;
+}
+
+int mqueue_lat_test(void)
+{
+
+        mqd_t q;
+        struct mq_attr attr;
+        struct timespec start, end, now, target;
+        int i, count, ret;
+
+        q = mq_open("/foo", O_CREAT | O_RDONLY, 0666, NULL);
+        if (q < 0) {
+                perror("mq_open");
+                return -1;
+        }
+        mq_getattr(q, &attr);
+
+
+        count = 100;
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        for (i = 0; i < count; i++) {
+                char buf[attr.mq_msgsize];
+
+                clock_gettime(CLOCK_REALTIME, &now);
+                target = now;
+                target = timespec_add(now, TARGET_TIMEOUT); /* 100ms */
+
+                ret = mq_timedreceive(q, buf, sizeof(buf), NULL, &target);
+                if (ret < 0 && errno != ETIMEDOUT) {
+                        perror("mq_timedreceive");
+                        return -1;
+                }
+        }
+        clock_gettime(CLOCK_MONOTONIC, &end);
+
+        mq_close(q);
+
+        if ((timespec_sub(start, end)/count) > TARGET_TIMEOUT + UNRESONABLE_LATENCY)
+                return -1;
+
+        return 0;
+}
+
+int main(int argc, char **argv)
+{
+        int ret;
+
+        printf("Mqueue latency :                          ");
+
+        ret = mqueue_lat_test();
+        if (ret < 0) {
+                printf("[FAILED]\n");
+                return ksft_exit_fail();
+        }
+        printf("[OK]\n");
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/nanosleep.c b/tools/testing/selftests/timers/nanosleep.c
new file mode 100644
index 000000000000..8a3c29de7d49
--- /dev/null
+++ b/tools/testing/selftests/timers/nanosleep.c
@@ -0,0 +1,174 @@
+/* Make sure timers don't return early
+ *              by: john stultz (johnstul@us.ibm.com)
+ *                  John Stultz (john.stultz@linaro.org)
+ *              (C) Copyright IBM 2012
+ *              (C) Copyright Linaro 2013 2015
+ *              Licensed under the GPLv2
+ *
+ *  To build:
+ *      $ gcc nanosleep.c -o nanosleep -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000ULL
+
+#define CLOCK_REALTIME                  0
+#define CLOCK_MONOTONIC                 1
+#define CLOCK_PROCESS_CPUTIME_ID        2
+#define CLOCK_THREAD_CPUTIME_ID         3
+#define CLOCK_MONOTONIC_RAW             4
+#define CLOCK_REALTIME_COARSE           5
+#define CLOCK_MONOTONIC_COARSE          6
+#define CLOCK_BOOTTIME                  7
+#define CLOCK_REALTIME_ALARM            8
+#define CLOCK_BOOTTIME_ALARM            9
+#define CLOCK_HWSPECIFIC                10
+#define CLOCK_TAI                       11
+#define NR_CLOCKIDS                     12
+
+#define UNSUPPORTED 0xf00f
+
+char *clockstring(int clockid)
+{
+        switch (clockid) {
+        case CLOCK_REALTIME:
+                return "CLOCK_REALTIME";
+        case CLOCK_MONOTONIC:
+                return "CLOCK_MONOTONIC";
+        case CLOCK_PROCESS_CPUTIME_ID:
+                return "CLOCK_PROCESS_CPUTIME_ID";
+        case CLOCK_THREAD_CPUTIME_ID:
+                return "CLOCK_THREAD_CPUTIME_ID";
+        case CLOCK_MONOTONIC_RAW:
+                return "CLOCK_MONOTONIC_RAW";
+        case CLOCK_REALTIME_COARSE:
+                return "CLOCK_REALTIME_COARSE";
+        case CLOCK_MONOTONIC_COARSE:
+                return "CLOCK_MONOTONIC_COARSE";
+        case CLOCK_BOOTTIME:
+                return "CLOCK_BOOTTIME";
+        case CLOCK_REALTIME_ALARM:
+                return "CLOCK_REALTIME_ALARM";
+        case CLOCK_BOOTTIME_ALARM:
+                return "CLOCK_BOOTTIME_ALARM";
+        case CLOCK_TAI:
+                return "CLOCK_TAI";
+        };
+        return "UNKNOWN_CLOCKID";
+}
+
+/* returns 1 if a <= b, 0 otherwise */
+static inline int in_order(struct timespec a, struct timespec b)
+{
+        if (a.tv_sec < b.tv_sec)
+                return 1;
+        if (a.tv_sec > b.tv_sec)
+                return 0;
+        if (a.tv_nsec > b.tv_nsec)
+                return 0;
+        return 1;
+}
+
+struct timespec timespec_add(struct timespec ts, unsigned long long ns)
+{
+        ts.tv_nsec += ns;
+        while (ts.tv_nsec >= NSEC_PER_SEC) {
+                ts.tv_nsec -= NSEC_PER_SEC;
+                ts.tv_sec++;
+        }
+        return ts;
+}
+
+int nanosleep_test(int clockid, long long ns)
+{
+        struct timespec now, target, rel;
+
+        /* First check abs time */
+        if (clock_gettime(clockid, &now))
+                return UNSUPPORTED;
+        target = timespec_add(now, ns);
+
+        if (clock_nanosleep(clockid, TIMER_ABSTIME, &target, NULL))
+                return UNSUPPORTED;
+        clock_gettime(clockid, &now);
+
+        if (!in_order(target, now))
+                return -1;
+
+        /* Second check reltime */
+        clock_gettime(clockid, &now);
+        rel.tv_sec = 0;
+        rel.tv_nsec = 0;
+        rel = timespec_add(rel, ns);
+        target = timespec_add(now, ns);
+        clock_nanosleep(clockid, 0, &rel, NULL);
+        clock_gettime(clockid, &now);
+
+        if (!in_order(target, now))
+                return -1;
+        return 0;
+}
+
+int main(int argc, char **argv)
+{
+        long long length;
+        int clockid, ret;
+
+        for (clockid = CLOCK_REALTIME; clockid < NR_CLOCKIDS; clockid++) {
+
+                /* Skip cputime clockids since nanosleep won't increment cputime */
+                if (clockid == CLOCK_PROCESS_CPUTIME_ID ||
+                                clockid == CLOCK_THREAD_CPUTIME_ID ||
+                                clockid == CLOCK_HWSPECIFIC)
+                        continue;
+
+                printf("Nanosleep %-31s ", clockstring(clockid));
+
+                length = 10;
+                while (length <= (NSEC_PER_SEC * 10)) {
+                        ret = nanosleep_test(clockid, length);
+                        if (ret == UNSUPPORTED) {
+                                printf("[UNSUPPORTED]\n");
+                                goto next;
+                        }
+                        if (ret < 0) {
+                                printf("[FAILED]\n");
+                                return ksft_exit_fail();
+                        }
+                        length *= 100;
+                }
+                printf("[OK]\n");
+next:
+                ret = 0;
+        }
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/nsleep-lat.c b/tools/testing/selftests/timers/nsleep-lat.c
new file mode 100644
index 000000000000..2d7898fda0f1
--- /dev/null
+++ b/tools/testing/selftests/timers/nsleep-lat.c
@@ -0,0 +1,190 @@
+/* Measure nanosleep timer latency
+ *              by: john stultz (john.stultz@linaro.org)
+ *              (C) Copyright Linaro 2013
+ *              Licensed under the GPLv2
+ *
+ *  To build:
+ *      $ gcc nsleep-lat.c -o nsleep-lat -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000ULL
+
+#define UNRESONABLE_LATENCY 40000000 /* 40ms in nanosecs */
+
+
+#define CLOCK_REALTIME                  0
+#define CLOCK_MONOTONIC                 1
+#define CLOCK_PROCESS_CPUTIME_ID        2
+#define CLOCK_THREAD_CPUTIME_ID         3
+#define CLOCK_MONOTONIC_RAW             4
+#define CLOCK_REALTIME_COARSE           5
+#define CLOCK_MONOTONIC_COARSE          6
+#define CLOCK_BOOTTIME                  7
+#define CLOCK_REALTIME_ALARM            8
+#define CLOCK_BOOTTIME_ALARM            9
+#define CLOCK_HWSPECIFIC                10
+#define CLOCK_TAI                       11
+#define NR_CLOCKIDS                     12
+
+#define UNSUPPORTED 0xf00f
+
+char *clockstring(int clockid)
+{
+        switch (clockid) {
+        case CLOCK_REALTIME:
+                return "CLOCK_REALTIME";
+        case CLOCK_MONOTONIC:
+                return "CLOCK_MONOTONIC";
+        case CLOCK_PROCESS_CPUTIME_ID:
+                return "CLOCK_PROCESS_CPUTIME_ID";
+        case CLOCK_THREAD_CPUTIME_ID:
+                return "CLOCK_THREAD_CPUTIME_ID";
+        case CLOCK_MONOTONIC_RAW:
+                return "CLOCK_MONOTONIC_RAW";
+        case CLOCK_REALTIME_COARSE:
+                return "CLOCK_REALTIME_COARSE";
+        case CLOCK_MONOTONIC_COARSE:
+                return "CLOCK_MONOTONIC_COARSE";
+        case CLOCK_BOOTTIME:
+                return "CLOCK_BOOTTIME";
+        case CLOCK_REALTIME_ALARM:
+                return "CLOCK_REALTIME_ALARM";
+        case CLOCK_BOOTTIME_ALARM:
+                return "CLOCK_BOOTTIME_ALARM";
+        case CLOCK_TAI:
+                return "CLOCK_TAI";
+        };
+        return "UNKNOWN_CLOCKID";
+}
+
+struct timespec timespec_add(struct timespec ts, unsigned long long ns)
+{
+        ts.tv_nsec += ns;
+        while (ts.tv_nsec >= NSEC_PER_SEC) {
+                ts.tv_nsec -= NSEC_PER_SEC;
+                ts.tv_sec++;
+        }
+        return ts;
+}
+
+
+long long timespec_sub(struct timespec a, struct timespec b)
+{
+        long long ret = NSEC_PER_SEC * b.tv_sec + b.tv_nsec;
+
+        ret -= NSEC_PER_SEC * a.tv_sec + a.tv_nsec;
+        return ret;
+}
+
+int nanosleep_lat_test(int clockid, long long ns)
+{
+        struct timespec start, end, target;
+        long long latency = 0;
+        int i, count;
+
+        target.tv_sec = ns/NSEC_PER_SEC;
+        target.tv_nsec = ns%NSEC_PER_SEC;
+
+        if (clock_gettime(clockid, &start))
+                return UNSUPPORTED;
+        if (clock_nanosleep(clockid, 0, &target, NULL))
+                return UNSUPPORTED;
+
+        count = 10;
+
+        /* First check relative latency */
+        clock_gettime(clockid, &start);
+        for (i = 0; i < count; i++)
+                clock_nanosleep(clockid, 0, &target, NULL);
+        clock_gettime(clockid, &end);
+
+        if (((timespec_sub(start, end)/count)-ns) > UNRESONABLE_LATENCY) {
+                printf("Large rel latency: %lld ns :", (timespec_sub(start, end)/count)-ns);
+                return -1;
+        }
+
+        /* Next check absolute latency */
+        for (i = 0; i < count; i++) {
+                clock_gettime(clockid, &start);
+                target = timespec_add(start, ns);
+                clock_nanosleep(clockid, TIMER_ABSTIME, &target, NULL);
+                clock_gettime(clockid, &end);
+                latency += timespec_sub(target, end);
+        }
+
+        if (latency/count > UNRESONABLE_LATENCY) {
+                printf("Large abs latency: %lld ns :", latency/count);
+                return -1;
+        }
+
+        return 0;
+}
+
+
+
+int main(int argc, char **argv)
+{
+        long long length;
+        int clockid, ret;
+
+        for (clockid = CLOCK_REALTIME; clockid < NR_CLOCKIDS; clockid++) {
+
+                /* Skip cputime clockids since nanosleep won't increment cputime */
+                if (clockid == CLOCK_PROCESS_CPUTIME_ID ||
+                                clockid == CLOCK_THREAD_CPUTIME_ID ||
+                                clockid == CLOCK_HWSPECIFIC)
+                        continue;
+
+                printf("nsleep latency %-26s ", clockstring(clockid));
+
+                length = 10;
+                while (length <= (NSEC_PER_SEC * 10)) {
+                        ret = nanosleep_lat_test(clockid, length);
+                        if (ret)
+                                break;
+                        length *= 100;
+
+                }
+
+                if (ret == UNSUPPORTED) {
+                        printf("[UNSUPPORTED]\n");
+                        continue;
+                }
+                if (ret < 0) {
+                        printf("[FAILED]\n");
+                        return ksft_exit_fail();
+                }
+                printf("[OK]\n");
+        }
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/posix_timers.c b/tools/testing/selftests/timers/posix_timers.c
index f87d970a485c..5a246a02dff3 100644
--- a/tools/testing/selftests/timers/posix_timers.c
+++ b/tools/testing/selftests/timers/posix_timers.c
@@ -35,10 +35,11 @@ static void user_loop(void)
 static void kernel_loop(void)
 {
         void *addr = sbrk(0);
+        int err = 0;
 
-        while (!done) {
-                brk(addr + 4096);
-                brk(addr);
+        while (!done && !err) {
+                err = brk(addr + 4096);
+                err |= brk(addr);
         }
 }
 
@@ -190,8 +191,6 @@ static int check_timer_create(int which)
 
 int main(int argc, char **argv)
 {
-        int err;
-
         printf("Testing posix timers. False negative may happen on CPU execution \n");
         printf("based timers if other threads run on the CPU...\n");
 
diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c
new file mode 100644
index 000000000000..30906bfd9c1b
--- /dev/null
+++ b/tools/testing/selftests/timers/raw_skew.c
@@ -0,0 +1,154 @@
+/* CLOCK_MONOTONIC vs CLOCK_MONOTONIC_RAW skew test
+ *              by: john stultz (johnstul@us.ibm.com)
+ *                  John Stultz <john.stultz@linaro.org>
+ *              (C) Copyright IBM 2012
+ *              (C) Copyright Linaro Limited 2015
+ *              Licensed under the GPLv2
+ *
+ *  To build:
+ *      $ gcc raw_skew.c -o raw_skew -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <time.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+
+#define CLOCK_MONOTONIC_RAW             4
+#define NSEC_PER_SEC 1000000000LL
+
+#define shift_right(x, s) ({            \
+        __typeof__(x) __x = (x);        \
+        __typeof__(s) __s = (s);        \
+        __x < 0 ? -(-__x >> __s) : __x >> __s; \
+})
+
+long long llabs(long long val)
+{
+        if (val < 0)
+                val = -val;
+        return val;
+}
+
+unsigned long long ts_to_nsec(struct timespec ts)
+{
+        return ts.tv_sec * NSEC_PER_SEC + ts.tv_nsec;
+}
+
+struct timespec nsec_to_ts(long long ns)
+{
+        struct timespec ts;
+
+        ts.tv_sec = ns/NSEC_PER_SEC;
+        ts.tv_nsec = ns%NSEC_PER_SEC;
+        return ts;
+}
+
+long long diff_timespec(struct timespec start, struct timespec end)
+{
+        long long start_ns, end_ns;
+
+        start_ns = ts_to_nsec(start);
+        end_ns = ts_to_nsec(end);
+        return end_ns - start_ns;
+}
+
+void get_monotonic_and_raw(struct timespec *mon, struct timespec *raw)
+{
+        struct timespec start, mid, end;
+        long long diff = 0, tmp;
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                long long newdiff;
+
+                clock_gettime(CLOCK_MONOTONIC, &start);
+                clock_gettime(CLOCK_MONOTONIC_RAW, &mid);
+                clock_gettime(CLOCK_MONOTONIC, &end);
+
+                newdiff = diff_timespec(start, end);
+                if (diff == 0 || newdiff < diff) {
+                        diff = newdiff;
+                        *raw = mid;
+                        tmp = (ts_to_nsec(start) + ts_to_nsec(end))/2;
+                        *mon = nsec_to_ts(tmp);
+                }
+        }
+}
+
+int main(int argv, char **argc)
+{
+        struct timespec mon, raw, start, end;
+        long long delta1, delta2, interval, eppm, ppm;
+        struct timex tx1, tx2;
+
+        setbuf(stdout, NULL);
+
+        if (clock_gettime(CLOCK_MONOTONIC_RAW, &raw)) {
+                printf("ERR: NO CLOCK_MONOTONIC_RAW\n");
+                return -1;
+        }
+
+        tx1.modes = 0;
+        adjtimex(&tx1);
+        get_monotonic_and_raw(&mon, &raw);
+        start = mon;
+        delta1 = diff_timespec(mon, raw);
+
+        if (tx1.offset)
+                printf("WARNING: ADJ_OFFSET in progress, this will cause inaccurate results\n");
+
+        printf("Estimating clock drift: ");
+        sleep(120);
+
+        get_monotonic_and_raw(&mon, &raw);
+        end = mon;
+        tx2.modes = 0;
+        adjtimex(&tx2);
+        delta2 = diff_timespec(mon, raw);
+
+        interval = diff_timespec(start, end);
+
+        /* calculate measured ppm between MONOTONIC and MONOTONIC_RAW */
+        eppm = ((delta2-delta1)*NSEC_PER_SEC)/interval;
+        eppm = -eppm;
+        printf("%lld.%i(est)", eppm/1000, abs((int)(eppm%1000)));
+
+        /* Avg the two actual freq samples adjtimex gave us */
+        ppm = (tx1.freq + tx2.freq) * 1000 / 2;
+        ppm = (long long)tx1.freq * 1000;
+        ppm = shift_right(ppm, 16);
+        printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000)));
+
+        if (llabs(eppm - ppm) > 1000) {
+                printf("        [FAILED]\n");
+                return ksft_exit_fail();
+        }
+        printf("        [OK]\n");
+        return  ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/rtctest.c b/tools/testing/selftests/timers/rtctest.c
new file mode 100644
index 000000000000..d80ae852334d
--- /dev/null
+++ b/tools/testing/selftests/timers/rtctest.c
@@ -0,0 +1,271 @@
+/*
+ *      Real Time Clock Driver Test/Example Program
+ *
+ *      Compile with:
+ *                   gcc -s -Wall -Wstrict-prototypes rtctest.c -o rtctest
+ *
+ *      Copyright (C) 1996, Paul Gortmaker.
+ *
+ *      Released under the GNU General Public License, version 2,
+ *      included herein by reference.
+ *
+ */
+
+#include <stdio.h>
+#include <linux/rtc.h>
+#include <sys/ioctl.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+
+
+/*
+ * This expects the new RTC class driver framework, working with
+ * clocks that will often not be clones of what the PC-AT had.
+ * Use the command line to specify another RTC if you need one.
+ */
+static const char default_rtc[] = "/dev/rtc0";
+
+
+int main(int argc, char **argv)
+{
+        int i, fd, retval, irqcount = 0;
+        unsigned long tmp, data;
+        struct rtc_time rtc_tm;
+        const char *rtc = default_rtc;
+        struct timeval start, end, diff;
+
+        switch (argc) {
+        case 2:
+                rtc = argv[1];
+                /* FALLTHROUGH */
+        case 1:
+                break;
+        default:
+                fprintf(stderr, "usage:  rtctest [rtcdev]\n");
+                return 1;
+        }
+
+        fd = open(rtc, O_RDONLY);
+
+        if (fd ==  -1) {
+                perror(rtc);
+                exit(errno);
+        }
+
+        fprintf(stderr, "\n\t\t\tRTC Driver Test Example.\n\n");
+
+        /* Turn on update interrupts (one per second) */
+        retval = ioctl(fd, RTC_UIE_ON, 0);
+        if (retval == -1) {
+                if (errno == ENOTTY) {
+                        fprintf(stderr,
+                                "\n...Update IRQs not supported.\n");
+                        goto test_READ;
+                }
+                perror("RTC_UIE_ON ioctl");
+                exit(errno);
+        }
+
+        fprintf(stderr, "Counting 5 update (1/sec) interrupts from reading %s:",
+                        rtc);
+        fflush(stderr);
+        for (i=1; i<6; i++) {
+                /* This read will block */
+                retval = read(fd, &data, sizeof(unsigned long));
+                if (retval == -1) {
+                        perror("read");
+                        exit(errno);
+                }
+                fprintf(stderr, " %d",i);
+                fflush(stderr);
+                irqcount++;
+        }
+
+        fprintf(stderr, "\nAgain, from using select(2) on /dev/rtc:");
+        fflush(stderr);
+        for (i=1; i<6; i++) {
+                struct timeval tv = {5, 0};     /* 5 second timeout on select */
+                fd_set readfds;
+
+                FD_ZERO(&readfds);
+                FD_SET(fd, &readfds);
+                /* The select will wait until an RTC interrupt happens. */
+                retval = select(fd+1, &readfds, NULL, NULL, &tv);
+                if (retval == -1) {
+                        perror("select");
+                        exit(errno);
+                }
+                /* This read won't block unlike the select-less case above. */
+                retval = read(fd, &data, sizeof(unsigned long));
+                if (retval == -1) {
+                        perror("read");
+                        exit(errno);
+                }
+                fprintf(stderr, " %d",i);
+                fflush(stderr);
+                irqcount++;
+        }
+
+        /* Turn off update interrupts */
+        retval = ioctl(fd, RTC_UIE_OFF, 0);
+        if (retval == -1) {
+                perror("RTC_UIE_OFF ioctl");
+                exit(errno);
+        }
+
+test_READ:
+        /* Read the RTC time/date */
+        retval = ioctl(fd, RTC_RD_TIME, &rtc_tm);
+        if (retval == -1) {
+                perror("RTC_RD_TIME ioctl");
+                exit(errno);
+        }
+
+        fprintf(stderr, "\n\nCurrent RTC date/time is %d-%d-%d, %02d:%02d:%02d.\n",
+                rtc_tm.tm_mday, rtc_tm.tm_mon + 1, rtc_tm.tm_year + 1900,
+                rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
+
+        /* Set the alarm to 5 sec in the future, and check for rollover */
+        rtc_tm.tm_sec += 5;
+        if (rtc_tm.tm_sec >= 60) {
+                rtc_tm.tm_sec %= 60;
+                rtc_tm.tm_min++;
+        }
+        if (rtc_tm.tm_min == 60) {
+                rtc_tm.tm_min = 0;
+                rtc_tm.tm_hour++;
+        }
+        if (rtc_tm.tm_hour == 24)
+                rtc_tm.tm_hour = 0;
+
+        retval = ioctl(fd, RTC_ALM_SET, &rtc_tm);
+        if (retval == -1) {
+                if (errno == ENOTTY) {
+                        fprintf(stderr,
+                                "\n...Alarm IRQs not supported.\n");
+                        goto test_PIE;
+                }
+                perror("RTC_ALM_SET ioctl");
+                exit(errno);
+        }
+
+        /* Read the current alarm settings */
+        retval = ioctl(fd, RTC_ALM_READ, &rtc_tm);
+        if (retval == -1) {
+                perror("RTC_ALM_READ ioctl");
+                exit(errno);
+        }
+
+        fprintf(stderr, "Alarm time now set to %02d:%02d:%02d.\n",
+                rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
+
+        /* Enable alarm interrupts */
+        retval = ioctl(fd, RTC_AIE_ON, 0);
+        if (retval == -1) {
+                perror("RTC_AIE_ON ioctl");
+                exit(errno);
+        }
+
+        fprintf(stderr, "Waiting 5 seconds for alarm...");
+        fflush(stderr);
+        /* This blocks until the alarm ring causes an interrupt */
+        retval = read(fd, &data, sizeof(unsigned long));
+        if (retval == -1) {
+                perror("read");
+                exit(errno);
+        }
+        irqcount++;
+        fprintf(stderr, " okay. Alarm rang.\n");
+
+        /* Disable alarm interrupts */
+        retval = ioctl(fd, RTC_AIE_OFF, 0);
+        if (retval == -1) {
+                perror("RTC_AIE_OFF ioctl");
+                exit(errno);
+        }
+
+test_PIE:
+        /* Read periodic IRQ rate */
+        retval = ioctl(fd, RTC_IRQP_READ, &tmp);
+        if (retval == -1) {
+                /* not all RTCs support periodic IRQs */
+                if (errno == ENOTTY) {
+                        fprintf(stderr, "\nNo periodic IRQ support\n");
+                        goto done;
+                }
+                perror("RTC_IRQP_READ ioctl");
+                exit(errno);
+        }
+        fprintf(stderr, "\nPeriodic IRQ rate is %ldHz.\n", tmp);
+
+        fprintf(stderr, "Counting 20 interrupts at:");
+        fflush(stderr);
+
+        /* The frequencies 128Hz, 256Hz, ... 8192Hz are only allowed for root. */
+        for (tmp=2; tmp<=64; tmp*=2) {
+
+                retval = ioctl(fd, RTC_IRQP_SET, tmp);
+                if (retval == -1) {
+                        /* not all RTCs can change their periodic IRQ rate */
+                        if (errno == ENOTTY) {
+                                fprintf(stderr,
+                                        "\n...Periodic IRQ rate is fixed\n");
+                                goto done;
+                        }
+                        perror("RTC_IRQP_SET ioctl");
+                        exit(errno);
+                }
+
+                fprintf(stderr, "\n%ldHz:\t", tmp);
+                fflush(stderr);
+
+                /* Enable periodic interrupts */
+                retval = ioctl(fd, RTC_PIE_ON, 0);
+                if (retval == -1) {
+                        perror("RTC_PIE_ON ioctl");
+                        exit(errno);
+                }
+
+                for (i=1; i<21; i++) {
+                        gettimeofday(&start, NULL);
+                        /* This blocks */
+                        retval = read(fd, &data, sizeof(unsigned long));
+                        if (retval == -1) {
+                                perror("read");
+                                exit(errno);
+                        }
+                        gettimeofday(&end, NULL);
+                        timersub(&end, &start, &diff);
+                        if (diff.tv_sec > 0 ||
+                            diff.tv_usec > ((1000000L / tmp) * 1.10)) {
+                                fprintf(stderr, "\nPIE delta error: %ld.%06ld should be close to 0.%06ld\n",
+                                       diff.tv_sec, diff.tv_usec,
+                                       (1000000L / tmp));
+                                fflush(stdout);
+                                exit(-1);
+                        }
+
+                        fprintf(stderr, " %d",i);
+                        fflush(stderr);
+                        irqcount++;
+                }
+
+                /* Disable periodic interrupts */
+                retval = ioctl(fd, RTC_PIE_OFF, 0);
+                if (retval == -1) {
+                        perror("RTC_PIE_OFF ioctl");
+                        exit(errno);
+                }
+        }
+
+done:
+        fprintf(stderr, "\n\n\t\t\t *** Test complete ***\n");
+
+        close(fd);
+
+        return 0;
+}
diff --git a/tools/testing/selftests/timers/set-2038.c b/tools/testing/selftests/timers/set-2038.c
new file mode 100644
index 000000000000..c8a7e14446b1
--- /dev/null
+++ b/tools/testing/selftests/timers/set-2038.c
@@ -0,0 +1,144 @@
+/* Time bounds setting test
+ *              by: john stultz (johnstul@us.ibm.com)
+ *              (C) Copyright IBM 2012
+ *              Licensed under the GPLv2
+ *
+ *  NOTE: This is a meta-test which sets the time to edge cases then
+ *  uses other tests to detect problems. Thus this test requires that
+ *  the inconsistency-check and nanosleep tests be present in the same
+ *  directory it is run from.
+ *
+ *  To build:
+ *      $ gcc set-2038.c -o set-2038 -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+#include <sys/time.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000LL
+
+#define KTIME_MAX       ((long long)~((unsigned long long)1 << 63))
+#define KTIME_SEC_MAX   (KTIME_MAX / NSEC_PER_SEC)
+
+#define YEAR_1901 (-0x7fffffffL)
+#define YEAR_1970 1
+#define YEAR_2038 0x7fffffffL                   /*overflows 32bit time_t */
+#define YEAR_2262 KTIME_SEC_MAX                 /*overflows 64bit ktime_t */
+#define YEAR_MAX  ((long long)((1ULL<<63)-1))   /*overflows 64bit time_t */
+
+int is32bits(void)
+{
+        return (sizeof(long) == 4);
+}
+
+int settime(long long time)
+{
+        struct timeval now;
+        int ret;
+
+        now.tv_sec = (time_t)time;
+        now.tv_usec  = 0;
+
+        ret = settimeofday(&now, NULL);
+
+        printf("Setting time to 0x%lx: %d\n", (long)time, ret);
+        return ret;
+}
+
+int do_tests(void)
+{
+        int ret;
+
+        ret = system("date");
+        ret = system("./inconsistency-check -c 0 -t 20");
+        ret |= system("./nanosleep");
+        ret |= system("./nsleep-lat");
+        return ret;
+
+}
+
+int main(int argc, char *argv[])
+{
+        int ret = 0;
+        int opt, dangerous = 0;
+        time_t start;
+
+        /* Process arguments */
+        while ((opt = getopt(argc, argv, "d")) != -1) {
+                switch (opt) {
+                case 'd':
+                        dangerous = 1;
+                }
+        }
+
+        start = time(0);
+
+        /* First test that crazy values don't work */
+        if (!settime(YEAR_1901)) {
+                ret = -1;
+                goto out;
+        }
+        if (!settime(YEAR_MAX)) {
+                ret = -1;
+                goto out;
+        }
+        if (!is32bits() && !settime(YEAR_2262)) {
+                ret = -1;
+                goto out;
+        }
+
+        /* Now test behavior near edges */
+        settime(YEAR_1970);
+        ret = do_tests();
+        if (ret)
+                goto out;
+
+        settime(YEAR_2038 - 600);
+        ret = do_tests();
+        if (ret)
+                goto out;
+
+        /* The rest of the tests can blowup on 32bit systems */
+        if (is32bits() && !dangerous)
+                goto out;
+        /* Test rollover behavior 32bit edge */
+        settime(YEAR_2038 - 10);
+        ret = do_tests();
+        if (ret)
+                goto out;
+
+        settime(YEAR_2262 - 600);
+        ret = do_tests();
+
+out:
+        /* restore clock */
+        settime(start);
+        if (ret)
+                return ksft_exit_fail();
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/set-tai.c b/tools/testing/selftests/timers/set-tai.c
new file mode 100644
index 000000000000..dc88dbc8831f
--- /dev/null
+++ b/tools/testing/selftests/timers/set-tai.c
@@ -0,0 +1,79 @@
+/* Set tai offset
+ *              by: John Stultz <john.stultz@linaro.org>
+ *              (C) Copyright Linaro 2013
+ *              Licensed under the GPLv2
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+int set_tai(int offset)
+{
+        struct timex tx;
+
+        memset(&tx, 0, sizeof(tx));
+
+        tx.modes = ADJ_TAI;
+        tx.constant = offset;
+
+        return adjtimex(&tx);
+}
+
+int get_tai(void)
+{
+        struct timex tx;
+
+        memset(&tx, 0, sizeof(tx));
+
+        adjtimex(&tx);
+        return tx.tai;
+}
+
+int main(int argc, char **argv)
+{
+        int i, ret;
+
+        ret = get_tai();
+        printf("tai offset started at %i\n", ret);
+
+        printf("Checking tai offsets can be properly set: ");
+        for (i = 1; i <= 60; i++) {
+                ret = set_tai(i);
+                ret = get_tai();
+                if (ret != i) {
+                        printf("[FAILED] expected: %i got %i\n", i, ret);
+                        return ksft_exit_fail();
+                }
+        }
+        printf("[OK]\n");
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/set-timer-lat.c b/tools/testing/selftests/timers/set-timer-lat.c
new file mode 100644
index 000000000000..4fc98c5b0899
--- /dev/null
+++ b/tools/testing/selftests/timers/set-timer-lat.c
@@ -0,0 +1,216 @@
+/* set_timer latency test
+ *              John Stultz (john.stultz@linaro.org)
+ *              (C) Copyright Linaro 2014
+ *              Licensed under the GPLv2
+ *
+ *   This test makes sure the set_timer api is correct
+ *
+ *  To build:
+ *      $ gcc set-timer-lat.c -o set-timer-lat -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+#include <stdio.h>
+#include <unistd.h>
+#include <time.h>
+#include <string.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <pthread.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define CLOCK_REALTIME                  0
+#define CLOCK_MONOTONIC                 1
+#define CLOCK_PROCESS_CPUTIME_ID        2
+#define CLOCK_THREAD_CPUTIME_ID         3
+#define CLOCK_MONOTONIC_RAW             4
+#define CLOCK_REALTIME_COARSE           5
+#define CLOCK_MONOTONIC_COARSE          6
+#define CLOCK_BOOTTIME                  7
+#define CLOCK_REALTIME_ALARM            8
+#define CLOCK_BOOTTIME_ALARM            9
+#define CLOCK_HWSPECIFIC                10
+#define CLOCK_TAI                       11
+#define NR_CLOCKIDS                     12
+
+
+#define NSEC_PER_SEC 1000000000ULL
+#define UNRESONABLE_LATENCY 40000000 /* 40ms in nanosecs */
+
+#define TIMER_SECS 1
+int alarmcount;
+int clock_id;
+struct timespec start_time;
+long long max_latency_ns;
+
+char *clockstring(int clockid)
+{
+        switch (clockid) {
+        case CLOCK_REALTIME:
+                return "CLOCK_REALTIME";
+        case CLOCK_MONOTONIC:
+                return "CLOCK_MONOTONIC";
+        case CLOCK_PROCESS_CPUTIME_ID:
+                return "CLOCK_PROCESS_CPUTIME_ID";
+        case CLOCK_THREAD_CPUTIME_ID:
+                return "CLOCK_THREAD_CPUTIME_ID";
+        case CLOCK_MONOTONIC_RAW:
+                return "CLOCK_MONOTONIC_RAW";
+        case CLOCK_REALTIME_COARSE:
+                return "CLOCK_REALTIME_COARSE";
+        case CLOCK_MONOTONIC_COARSE:
+                return "CLOCK_MONOTONIC_COARSE";
+        case CLOCK_BOOTTIME:
+                return "CLOCK_BOOTTIME";
+        case CLOCK_REALTIME_ALARM:
+                return "CLOCK_REALTIME_ALARM";
+        case CLOCK_BOOTTIME_ALARM:
+                return "CLOCK_BOOTTIME_ALARM";
+        case CLOCK_TAI:
+                return "CLOCK_TAI";
+        };
+        return "UNKNOWN_CLOCKID";
+}
+
+
+long long timespec_sub(struct timespec a, struct timespec b)
+{
+        long long ret = NSEC_PER_SEC * b.tv_sec + b.tv_nsec;
+
+        ret -= NSEC_PER_SEC * a.tv_sec + a.tv_nsec;
+        return ret;
+}
+
+
+void sigalarm(int signo)
+{
+        long long delta_ns;
+        struct timespec ts;
+
+        clock_gettime(clock_id, &ts);
+        alarmcount++;
+
+        delta_ns = timespec_sub(start_time, ts);
+        delta_ns -= NSEC_PER_SEC * TIMER_SECS * alarmcount;
+
+        if (delta_ns < 0)
+                printf("%s timer fired early: FAIL\n", clockstring(clock_id));
+
+        if (delta_ns > max_latency_ns)
+                max_latency_ns = delta_ns;
+}
+
+int do_timer(int clock_id, int flags)
+{
+        struct sigevent se;
+        timer_t tm1;
+        struct itimerspec its1, its2;
+        int err;
+
+        /* Set up timer: */
+        memset(&se, 0, sizeof(se));
+        se.sigev_notify = SIGEV_SIGNAL;
+        se.sigev_signo = SIGRTMAX;
+        se.sigev_value.sival_int = 0;
+
+        max_latency_ns = 0;
+        alarmcount = 0;
+
+        err = timer_create(clock_id, &se, &tm1);
+        if (err) {
+                if ((clock_id == CLOCK_REALTIME_ALARM) ||
+                    (clock_id == CLOCK_BOOTTIME_ALARM)) {
+                        printf("%-22s %s missing CAP_WAKE_ALARM?    : [UNSUPPORTED]\n",
+                                        clockstring(clock_id),
+                                        flags ? "ABSTIME":"RELTIME");
+                        return 0;
+                }
+                printf("%s - timer_create() failed\n", clockstring(clock_id));
+                return -1;
+        }
+
+        clock_gettime(clock_id, &start_time);
+        if (flags) {
+                its1.it_value = start_time;
+                its1.it_value.tv_sec += TIMER_SECS;
+        } else {
+                its1.it_value.tv_sec = TIMER_SECS;
+                its1.it_value.tv_nsec = 0;
+        }
+        its1.it_interval.tv_sec = TIMER_SECS;
+        its1.it_interval.tv_nsec = 0;
+
+        err = timer_settime(tm1, flags, &its1, &its2);
+        if (err) {
+                printf("%s - timer_settime() failed\n", clockstring(clock_id));
+                return -1;
+        }
+
+        while (alarmcount < 5)
+                sleep(1);
+
+        printf("%-22s %s max latency: %10lld ns : ",
+                        clockstring(clock_id),
+                        flags ? "ABSTIME":"RELTIME",
+                        max_latency_ns);
+
+        timer_delete(tm1);
+        if (max_latency_ns < UNRESONABLE_LATENCY) {
+                printf("[OK]\n");
+                return 0;
+        }
+        printf("[FAILED]\n");
+        return -1;
+}
+
+int main(void)
+{
+        struct sigaction act;
+        int signum = SIGRTMAX;
+        int ret = 0;
+
+        /* Set up signal handler: */
+        sigfillset(&act.sa_mask);
+        act.sa_flags = 0;
+        act.sa_handler = sigalarm;
+        sigaction(signum, &act, NULL);
+
+        printf("Setting timers for every %i seconds\n", TIMER_SECS);
+        for (clock_id = 0; clock_id < NR_CLOCKIDS; clock_id++) {
+
+                if ((clock_id == CLOCK_PROCESS_CPUTIME_ID) ||
+                                (clock_id == CLOCK_THREAD_CPUTIME_ID) ||
+                                (clock_id == CLOCK_MONOTONIC_RAW) ||
+                                (clock_id == CLOCK_REALTIME_COARSE) ||
+                                (clock_id == CLOCK_MONOTONIC_COARSE) ||
+                                (clock_id == CLOCK_HWSPECIFIC))
+                        continue;
+
+                ret |= do_timer(clock_id, TIMER_ABSTIME);
+                ret |= do_timer(clock_id, 0);
+        }
+        if (ret)
+                return ksft_exit_fail();
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/skew_consistency.c b/tools/testing/selftests/timers/skew_consistency.c
new file mode 100644
index 000000000000..5562f84ee07c
--- /dev/null
+++ b/tools/testing/selftests/timers/skew_consistency.c
@@ -0,0 +1,89 @@
+/* ADJ_FREQ Skew consistency test
+ *              by: john stultz (johnstul@us.ibm.com)
+ *              (C) Copyright IBM 2012
+ *              Licensed under the GPLv2
+ *
+ *  NOTE: This is a meta-test which cranks the ADJ_FREQ knob back
+ *  and forth and watches for consistency problems. Thus this test requires
+ *  that the inconsistency-check tests be present in the same directory it
+ *  is run from.
+ *
+ *  To build:
+ *      $ gcc skew_consistency.c -o skew_consistency -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <time.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/wait.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000LL
+
+int main(int argv, char **argc)
+{
+        struct timex tx;
+        int ret, ppm;
+        pid_t pid;
+
+
+        printf("Running Asyncrhonous Frequency Changing Tests...\n");
+
+        pid = fork();
+        if (!pid)
+                return system("./inconsistency-check -c 1 -t 600");
+
+        ppm = 500;
+        ret = 0;
+
+        while (pid != waitpid(pid, &ret, WNOHANG)) {
+                ppm = -ppm;
+                tx.modes = ADJ_FREQUENCY;
+                tx.freq = ppm << 16;
+                adjtimex(&tx);
+                usleep(500000);
+        }
+
+        /* Set things back */
+        tx.modes = ADJ_FREQUENCY;
+        tx.offset = 0;
+        adjtimex(&tx);
+
+
+        if (ret) {
+                printf("[FAILED]\n");
+                return ksft_exit_fail();
+        }
+        printf("[OK]\n");
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/threadtest.c b/tools/testing/selftests/timers/threadtest.c
new file mode 100644
index 000000000000..e632e116f05e
--- /dev/null
+++ b/tools/testing/selftests/timers/threadtest.c
@@ -0,0 +1,204 @@
+/* threadtest.c
+ *              by: john stultz (johnstul@us.ibm.com)
+ *              (C) Copyright IBM 2004, 2005, 2006, 2012
+ *              Licensed under the GPLv2
+ *
+ *  To build:
+ *      $ gcc threadtest.c -o threadtest -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/time.h>
+#include <pthread.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+
+/* serializes shared list access */
+pthread_mutex_t list_lock = PTHREAD_MUTEX_INITIALIZER;
+/* serializes console output */
+pthread_mutex_t print_lock = PTHREAD_MUTEX_INITIALIZER;
+
+
+#define MAX_THREADS 128
+#define LISTSIZE 128
+
+int done = 0;
+
+struct timespec global_list[LISTSIZE];
+int listcount = 0;
+
+
+void checklist(struct timespec *list, int size)
+{
+        int i, j;
+        struct timespec *a, *b;
+
+        /* scan the list */
+        for (i = 0; i < size-1; i++) {
+                a = &list[i];
+                b = &list[i+1];
+
+                /* look for any time inconsistencies */
+                if ((b->tv_sec <= a->tv_sec) &&
+                        (b->tv_nsec < a->tv_nsec)) {
+
+                        /* flag other threads */
+                        done = 1;
+
+                        /*serialize printing to avoid junky output*/
+                        pthread_mutex_lock(&print_lock);
+
+                        /* dump the list */
+                        printf("\n");
+                        for (j = 0; j < size; j++) {
+                                if (j == i)
+                                        printf("---------------\n");
+                                printf("%lu:%lu\n", list[j].tv_sec, list[j].tv_nsec);
+                                if (j == i+1)
+                                        printf("---------------\n");
+                        }
+                        printf("[FAILED]\n");
+
+                        pthread_mutex_unlock(&print_lock);
+                }
+        }
+}
+
+/* The shared thread shares a global list
+ * that each thread fills while holding the lock.
+ * This stresses clock syncronization across cpus.
+ */
+void *shared_thread(void *arg)
+{
+        while (!done) {
+                /* protect the list */
+                pthread_mutex_lock(&list_lock);
+
+                /* see if we're ready to check the list */
+                if (listcount >= LISTSIZE) {
+                        checklist(global_list, LISTSIZE);
+                        listcount = 0;
+                }
+                clock_gettime(CLOCK_MONOTONIC, &global_list[listcount++]);
+
+                pthread_mutex_unlock(&list_lock);
+        }
+        return NULL;
+}
+
+
+/* Each independent thread fills in its own
+ * list. This stresses clock_gettime() lock contention.
+ */
+void *independent_thread(void *arg)
+{
+        struct timespec my_list[LISTSIZE];
+        int count;
+
+        while (!done) {
+                /* fill the list */
+                for (count = 0; count < LISTSIZE; count++)
+                        clock_gettime(CLOCK_MONOTONIC, &my_list[count]);
+                checklist(my_list, LISTSIZE);
+        }
+        return NULL;
+}
+
+#define DEFAULT_THREAD_COUNT 8
+#define DEFAULT_RUNTIME 30
+
+int main(int argc, char **argv)
+{
+        int thread_count, i;
+        time_t start, now, runtime;
+        char buf[255];
+        pthread_t pth[MAX_THREADS];
+        int opt;
+        void *tret;
+        int ret = 0;
+        void *(*thread)(void *) = shared_thread;
+
+        thread_count = DEFAULT_THREAD_COUNT;
+        runtime = DEFAULT_RUNTIME;
+
+        /* Process arguments */
+        while ((opt = getopt(argc, argv, "t:n:i")) != -1) {
+                switch (opt) {
+                case 't':
+                        runtime = atoi(optarg);
+                        break;
+                case 'n':
+                        thread_count = atoi(optarg);
+                        break;
+                case 'i':
+                        thread = independent_thread;
+                        printf("using independent threads\n");
+                        break;
+                default:
+                        printf("Usage: %s [-t <secs>] [-n <numthreads>] [-i]\n", argv[0]);
+                        printf("        -t: time to run\n");
+                        printf("        -n: number of threads\n");
+                        printf("        -i: use independent threads\n");
+                        return -1;
+                }
+        }
+
+        if (thread_count > MAX_THREADS)
+                thread_count = MAX_THREADS;
+
+
+        setbuf(stdout, NULL);
+
+        start = time(0);
+        strftime(buf, 255, "%a, %d %b %Y %T %z", localtime(&start));
+        printf("%s\n", buf);
+        printf("Testing consistency with %i threads for %ld seconds: ", thread_count, runtime);
+
+        /* spawn */
+        for (i = 0; i < thread_count; i++)
+                pthread_create(&pth[i], 0, thread, 0);
+
+        while (time(&now) < start + runtime) {
+                sleep(1);
+                if (done) {
+                        ret = 1;
+                        strftime(buf, 255, "%a, %d %b %Y %T %z", localtime(&now));
+                        printf("%s\n", buf);
+                        goto out;
+                }
+        }
+        printf("[OK]\n");
+        done = 1;
+
+out:
+        /* wait */
+        for (i = 0; i < thread_count; i++)
+                pthread_join(pth[i], &tret);
+
+        /* die */
+        if (ret)
+                ksft_exit_fail();
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c
new file mode 100644
index 000000000000..e86d937cc22c
--- /dev/null
+++ b/tools/testing/selftests/timers/valid-adjtimex.c
@@ -0,0 +1,202 @@
+/* valid adjtimex test
+ *              by: John Stultz <john.stultz@linaro.org>
+ *              (C) Copyright Linaro 2015
+ *              Licensed under the GPLv2
+ *
+ *  This test validates adjtimex interface with valid
+ *  and invalid test data.
+ *
+ *  Usage: valid-adjtimex
+ *
+ *  To build:
+ *      $ gcc valid-adjtimex.c -o valid-adjtimex -lrt
+ *
+ *   This program is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ */
+
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/timex.h>
+#include <string.h>
+#include <signal.h>
+#include <unistd.h>
+#ifdef KTEST
+#include "../kselftest.h"
+#else
+static inline int ksft_exit_pass(void)
+{
+        exit(0);
+}
+static inline int ksft_exit_fail(void)
+{
+        exit(1);
+}
+#endif
+
+#define NSEC_PER_SEC 1000000000L
+
+/* clear NTP time_status & time_state */
+int clear_time_state(void)
+{
+        struct timex tx;
+        int ret;
+
+        tx.modes = ADJ_STATUS;
+        tx.status = 0;
+        ret = adjtimex(&tx);
+        return ret;
+}
+
+#define NUM_FREQ_VALID 32
+#define NUM_FREQ_OUTOFRANGE 4
+#define NUM_FREQ_INVALID 2
+
+long valid_freq[NUM_FREQ_VALID] = {
+        -499<<16,
+        -450<<16,
+        -400<<16,
+        -350<<16,
+        -300<<16,
+        -250<<16,
+        -200<<16,
+        -150<<16,
+        -100<<16,
+        -75<<16,
+        -50<<16,
+        -25<<16,
+        -10<<16,
+        -5<<16,
+        -1<<16,
+        -1000,
+        1<<16,
+        5<<16,
+        10<<16,
+        25<<16,
+        50<<16,
+        75<<16,
+        100<<16,
+        150<<16,
+        200<<16,
+        250<<16,
+        300<<16,
+        350<<16,
+        400<<16,
+        450<<16,
+        499<<16,
+};
+
+long outofrange_freq[NUM_FREQ_OUTOFRANGE] = {
+        -1000<<16,
+        -550<<16,
+        550<<16,
+        1000<<16,
+};
+
+#define LONG_MAX (~0UL>>1)
+#define LONG_MIN (-LONG_MAX - 1)
+
+long invalid_freq[NUM_FREQ_INVALID] = {
+        LONG_MAX,
+        LONG_MIN,
+};
+
+int validate_freq(void)
+{
+        struct timex tx;
+        int ret, pass = 0;
+        int i;
+
+        clear_time_state();
+
+        memset(&tx, 0, sizeof(struct timex));
+        /* Set the leap second insert flag */
+
+        printf("Testing ADJ_FREQ... ");
+        for (i = 0; i < NUM_FREQ_VALID; i++) {
+                tx.modes = ADJ_FREQUENCY;
+                tx.freq = valid_freq[i];
+
+                ret = adjtimex(&tx);
+                if (ret < 0) {
+                        printf("[FAIL]\n");
+                        printf("Error: adjtimex(ADJ_FREQ, %ld - %ld ppm\n",
+                                valid_freq[i], valid_freq[i]>>16);
+                        pass = -1;
+                        goto out;
+                }
+                tx.modes = 0;
+                ret = adjtimex(&tx);
+                if (tx.freq != valid_freq[i]) {
+                        printf("Warning: freq value %ld not what we set it (%ld)!\n",
+                                        tx.freq, valid_freq[i]);
+                }
+        }
+        for (i = 0; i < NUM_FREQ_OUTOFRANGE; i++) {
+                tx.modes = ADJ_FREQUENCY;
+                tx.freq = outofrange_freq[i];
+
+                ret = adjtimex(&tx);
+                if (ret < 0) {
+                        printf("[FAIL]\n");
+                        printf("Error: adjtimex(ADJ_FREQ, %ld - %ld ppm\n",
+                                outofrange_freq[i], outofrange_freq[i]>>16);
+                        pass = -1;
+                        goto out;
+                }
+                tx.modes = 0;
+                ret = adjtimex(&tx);
+                if (tx.freq == outofrange_freq[i]) {
+                        printf("[FAIL]\n");
+                        printf("ERROR: out of range value %ld actually set!\n",
+                                        tx.freq);
+                        pass = -1;
+                        goto out;
+                }
+        }
+
+
+        if (sizeof(long) == 8) { /* this case only applies to 64bit systems */
+                for (i = 0; i < NUM_FREQ_INVALID; i++) {
+                        tx.modes = ADJ_FREQUENCY;
+                        tx.freq = invalid_freq[i];
+                        ret = adjtimex(&tx);
+                        if (ret >= 0) {
+                                printf("[FAIL]\n");
+                                printf("Error: No failure on invalid ADJ_FREQUENCY %ld\n",
+                                        invalid_freq[i]);
+                                pass = -1;
+                                goto out;
+                        }
+                }
+        }
+
+        printf("[OK]\n");
+out:
+        /* reset freq to zero */
+        tx.modes = ADJ_FREQUENCY;
+        tx.freq = 0;
+        ret = adjtimex(&tx);
+
+        return pass;
+}
+
+
+int main(int argc, char **argv)
+{
+        if (validate_freq())
+                return ksft_exit_fail();
+
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/user/Makefile b/tools/testing/selftests/user/Makefile
index 12c9d15bab07..d401b63c5b1a 100644
--- a/tools/testing/selftests/user/Makefile
+++ b/tools/testing/selftests/user/Makefile
@@ -3,5 +3,6 @@
 # No binaries, but make sure arg-less "make" doesn't trigger "run_tests"
 all:
 
-run_tests: all
-        ./test_user_copy.sh
+TEST_PROGS := test_user_copy.sh
+
+include ../lib.mk
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 077828c889f1..a5ce9534eb15 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -1,6 +1,5 @@
 # Makefile for vm selftests
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall
 BINARIES = hugepage-mmap hugepage-shm map_hugetlb thuge-gen hugetlbfstest
 BINARIES += transhuge-stress
@@ -9,8 +8,10 @@ all: $(BINARIES)
 %: %.c
         $(CC) $(CFLAGS) -o $@ $^ -lrt
 
-run_tests: all
-        @/bin/sh ./run_vmtests || (echo "vmtests: [FAIL]"; exit 1)
+TEST_PROGS := run_vmtests
+TEST_FILES := $(BINARIES)
+
+include ../lib.mk
 
 clean:
         $(RM) $(BINARIES)
diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests
index c87b6812300d..c87b6812300d 100644..100755
--- a/tools/testing/selftests/vm/run_vmtests
+++ b/tools/testing/selftests/vm/run_vmtests
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 91a36e21c0fb..d3fc9399062a 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -471,7 +471,7 @@ static struct kvm *kvm_create_vm(unsigned long type)
         BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
 
         r = -ENOMEM;
-        kvm->memslots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+        kvm->memslots = kvm_kvzalloc(sizeof(struct kvm_memslots));
         if (!kvm->memslots)
                 goto out_err_no_srcu;
 
@@ -522,7 +522,7 @@ out_err_no_srcu:
 out_err_no_disable:
         for (i = 0; i < KVM_NR_BUSES; i++)
                 kfree(kvm->buses[i]);
-        kfree(kvm->memslots);
+        kvfree(kvm->memslots);
         kvm_arch_free_vm(kvm);
         return ERR_PTR(r);
 }
@@ -570,7 +570,7 @@ static void kvm_free_physmem(struct kvm *kvm)
         kvm_for_each_memslot(memslot, slots)
                 kvm_free_physmem_slot(kvm, memslot, NULL);
 
-        kfree(kvm->memslots);
+        kvfree(kvm->memslots);
 }
 
 static void kvm_destroy_devices(struct kvm *kvm)
@@ -863,10 +863,10 @@ int __kvm_set_memory_region(struct kvm *kvm,
                         goto out_free;
         }
 
-        slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
-                        GFP_KERNEL);
+        slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
         if (!slots)
                 goto out_free;
+        memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
 
         if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
                 slot = id_to_memslot(slots, mem->slot);
@@ -909,7 +909,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
         kvm_arch_commit_memory_region(kvm, mem, &old, change);
 
         kvm_free_physmem_slot(kvm, &old, &new);
-        kfree(old_memslots);
+        kvfree(old_memslots);
 
         /*
          * IOMMU mapping:  New slots need to be mapped.  Old slots need to be
@@ -928,7 +928,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
         return 0;
 
 out_slots:
-        kfree(slots);
+        kvfree(slots);
 out_free:
         kvm_free_physmem_slot(kvm, &new, &old);
 out:
@@ -2478,6 +2478,7 @@ static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
         case KVM_CAP_SIGNAL_MSI:
 #endif
 #ifdef CONFIG_HAVE_KVM_IRQFD
+        case KVM_CAP_IRQFD:
         case KVM_CAP_IRQFD_RESAMPLE:
 #endif
         case KVM_CAP_CHECK_EXTENSION_VM: