213 files changed, 2022 insertions, 1084 deletions

diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt
new file mode 100644
index 000000000000..2b40e04d3c49
--- /dev/null
+++ b/Documentation/module-signing.txt
@@ -0,0 +1,240 @@
+                        ==============================
+                        KERNEL MODULE SIGNING FACILITY
+                        ==============================
+
+CONTENTS
+
+ - Overview.
+ - Configuring module signing.
+ - Generating signing keys.
+ - Public keys in the kernel.
+ - Manually signing modules.
+ - Signed modules and stripping.
+ - Loading signed modules.
+ - Non-valid signatures and unsigned modules.
+ - Administering/protecting the private key.
+
+
+========
+OVERVIEW
+========
+
+The kernel module signing facility cryptographically signs modules during
+installation and then checks the signature upon loading the module.  This
+allows increased kernel security by disallowing the loading of unsigned modules
+or modules signed with an invalid key.  Module signing increases security by
+making it harder to load a malicious module into the kernel.  The module
+signature checking is done by the kernel so that it is not necessary to have
+trusted userspace bits.
+
+This facility uses X.509 ITU-T standard certificates to encode the public keys
+involved.  The signatures are not themselves encoded in any industrial standard
+type.  The facility currently only supports the RSA public key encryption
+standard (though it is pluggable and permits others to be used).  The possible
+hash algorithms that can be used are SHA-1, SHA-224, SHA-256, SHA-384, and
+SHA-512 (the algorithm is selected by data in the signature).
+
+
+==========================
+CONFIGURING MODULE SIGNING
+==========================
+
+The module signing facility is enabled by going to the "Enable Loadable Module
+Support" section of the kernel configuration and turning on
+
+        CONFIG_MODULE_SIG       "Module signature verification"
+
+This has a number of options available:
+
+ (1) "Require modules to be validly signed" (CONFIG_MODULE_SIG_FORCE)
+
+     This specifies how the kernel should deal with a module that has a
+     signature for which the key is not known or a module that is unsigned.
+
+     If this is off (ie. "permissive"), then modules for which the key is not
+     available and modules that are unsigned are permitted, but the kernel will
+     be marked as being tainted.
+
+     If this is on (ie. "restrictive"), only modules that have a valid
+     signature that can be verified by a public key in the kernel's possession
+     will be loaded.  All other modules will generate an error.
+
+     Irrespective of the setting here, if the module has a signature block that
+     cannot be parsed, it will be rejected out of hand.
+
+
+ (2) "Automatically sign all modules" (CONFIG_MODULE_SIG_ALL)
+
+     If this is on then modules will be automatically signed during the
+     modules_install phase of a build.  If this is off, then the modules must
+     be signed manually using:
+
+        scripts/sign-file
+
+
+ (3) "Which hash algorithm should modules be signed with?"
+
+     This presents a choice of which hash algorithm the installation phase will
+     sign the modules with:
+
+        CONFIG_SIG_SHA1         "Sign modules with SHA-1"
+        CONFIG_SIG_SHA224       "Sign modules with SHA-224"
+        CONFIG_SIG_SHA256       "Sign modules with SHA-256"
+        CONFIG_SIG_SHA384       "Sign modules with SHA-384"
+        CONFIG_SIG_SHA512       "Sign modules with SHA-512"
+
+     The algorithm selected here will also be built into the kernel (rather
+     than being a module) so that modules signed with that algorithm can have
+     their signatures checked without causing a dependency loop.
+
+
+=======================
+GENERATING SIGNING KEYS
+=======================
+
+Cryptographic keypairs are required to generate and check signatures.  A
+private key is used to generate a signature and the corresponding public key is
+used to check it.  The private key is only needed during the build, after which
+it can be deleted or stored securely.  The public key gets built into the
+kernel so that it can be used to check the signatures as the modules are
+loaded.
+
+Under normal conditions, the kernel build will automatically generate a new
+keypair using openssl if one does not exist in the files:
+
+        signing_key.priv
+        signing_key.x509
+
+during the building of vmlinux (the public part of the key needs to be built
+into vmlinux) using parameters in the:
+
+        x509.genkey
+
+file (which is also generated if it does not already exist).
+
+It is strongly recommended that you provide your own x509.genkey file.
+
+Most notably, in the x509.genkey file, the req_distinguished_name section
+should be altered from the default:
+
+        [ req_distinguished_name ]
+        O = Magrathea
+        CN = Glacier signing key
+        emailAddress = slartibartfast@magrathea.h2g2
+
+The generated RSA key size can also be set with:
+
+        [ req ]
+        default_bits = 4096
+
+
+It is also possible to manually generate the key private/public files using the
+x509.genkey key generation configuration file in the root node of the Linux
+kernel sources tree and the openssl command.  The following is an example to
+generate the public/private key files:
+
+        openssl req -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \
+           -config x509.genkey -outform DER -out signing_key.x509 \
+           -keyout signing_key.priv
+
+
+=========================
+PUBLIC KEYS IN THE KERNEL
+=========================
+
+The kernel contains a ring of public keys that can be viewed by root.  They're
+in a keyring called ".system_keyring" that can be seen by:
+
+        [root@deneb ~]# cat /proc/keys
+        ...
+        223c7853 I------     1 perm 1f030000     0     0 keyring   .system_keyring: 1
+        302d2d52 I------     1 perm 1f010000     0     0 asymmetri Fedora kernel signing key: d69a84e6bce3d216b979e9505b3e3ef9a7118079: X509.RSA a7118079 []
+        ...
+
+Beyond the public key generated specifically for module signing, any file
+placed in the kernel source root directory or the kernel build root directory
+whose name is suffixed with ".x509" will be assumed to be an X.509 public key
+and will be added to the keyring.
+
+Further, the architecture code may take public keys from a hardware store and
+add those in also (e.g. from the UEFI key database).
+
+Finally, it is possible to add additional public keys by doing:
+
+        keyctl padd asymmetric "" [.system_keyring-ID] <[key-file]
+
+e.g.:
+
+        keyctl padd asymmetric "" 0x223c7853 <my_public_key.x509
+
+Note, however, that the kernel will only permit keys to be added to
+.system_keyring _if_ the new key's X.509 wrapper is validly signed by a key
+that is already resident in the .system_keyring at the time the key was added.
+
+
+=========================
+MANUALLY SIGNING MODULES
+=========================
+
+To manually sign a module, use the scripts/sign-file tool available in
+the Linux kernel source tree.  The script requires 4 arguments:
+
+        1.  The hash algorithm (e.g., sha256)
+        2.  The private key filename
+        3.  The public key filename
+        4.  The kernel module to be signed
+
+The following is an example to sign a kernel module:
+
+        scripts/sign-file sha512 kernel-signkey.priv \
+                kernel-signkey.x509 module.ko
+
+The hash algorithm used does not have to match the one configured, but if it
+doesn't, you should make sure that hash algorithm is either built into the
+kernel or can be loaded without requiring itself.
+
+
+============================
+SIGNED MODULES AND STRIPPING
+============================
+
+A signed module has a digital signature simply appended at the end.  The string
+"~Module signature appended~." at the end of the module's file confirms that a
+signature is present but it does not confirm that the signature is valid!
+
+Signed modules are BRITTLE as the signature is outside of the defined ELF
+container.  Thus they MAY NOT be stripped once the signature is computed and
+attached.  Note the entire module is the signed payload, including any and all
+debug information present at the time of signing.
+
+
+======================
+LOADING SIGNED MODULES
+======================
+
+Modules are loaded with insmod, modprobe, init_module() or finit_module(),
+exactly as for unsigned modules as no processing is done in userspace.  The
+signature checking is all done within the kernel.
+
+
+=========================================
+NON-VALID SIGNATURES AND UNSIGNED MODULES
+=========================================
+
+If CONFIG_MODULE_SIG_FORCE is enabled or enforcemodulesig=1 is supplied on
+the kernel command line, the kernel will only load validly signed modules
+for which it has a public key.   Otherwise, it will also load modules that are
+unsigned.   Any module for which the kernel has a key, but which proves to have
+a signature mismatch will not be permitted to load.
+
+Any module that has an unparseable signature will be rejected.
+
+
+=========================================
+ADMINISTERING/PROTECTING THE PRIVATE KEY
+=========================================
+
+Since the private key is used to sign modules, viruses and malware could use
+the private key to sign modules and compromise the operating system.  The
+private key must be either destroyed or moved to a secure location and not kept
+in the root node of the kernel source tree.
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 3c12d9a7ed00..8a984e994e61 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -16,8 +16,12 @@ ip_default_ttl - INTEGER
         Default: 64 (as recommended by RFC1700)
 
 ip_no_pmtu_disc - BOOLEAN
-        Disable Path MTU Discovery.
-        default FALSE
+        Disable Path MTU Discovery. If enabled and a
+        fragmentation-required ICMP is received, the PMTU to this
+        destination will be set to min_pmtu (see below). You will need
+        to raise min_pmtu to the smallest interface MTU on your system
+        manually if you want to avoid locally generated fragments.
+        Default: FALSE
 
 min_pmtu - INTEGER
         default 552 - minimum discovered Path MTU
diff --git a/MAINTAINERS b/MAINTAINERS
index 5593bc604146..d5e4ff328cc7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3763,9 +3763,11 @@ F:	include/uapi/linux/gigaset_dev.h
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
-S:      Maintained
+M:      Alexandre Courbot <gnurou@gmail.com>
 L:      linux-gpio@vger.kernel.org
-F:      Documentation/gpio.txt
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
+S:      Maintained
+F:      Documentation/gpio/
 F:      drivers/gpio/
 F:      include/linux/gpio*
 F:      include/asm-generic/gpio.h
@@ -3833,6 +3835,12 @@ T:	git git://linuxtv.org/media_tree.git
 S:      Maintained
 F:      drivers/media/usb/gspca/
 
+GUID PARTITION TABLE (GPT)
+M:      Davidlohr Bueso <davidlohr@hp.com>
+L:      linux-efi@vger.kernel.org
+S:      Maintained
+F:      block/partitions/efi.*
+
 STK1160 USB VIDEO CAPTURE DRIVER
 M:      Ezequiel Garcia <elezegarcia@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -5913,12 +5921,21 @@ M:	Steffen Klassert <steffen.klassert@secunet.com>
 M:      Herbert Xu <herbert@gondor.apana.org.au>
 M:      "David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git
 S:      Maintained
 F:      net/xfrm/
 F:      net/key/
 F:      net/ipv4/xfrm*
+F:      net/ipv4/esp4.c
+F:      net/ipv4/ah4.c
+F:      net/ipv4/ipcomp.c
+F:      net/ipv4/ip_vti.c
 F:      net/ipv6/xfrm*
+F:      net/ipv6/esp6.c
+F:      net/ipv6/ah6.c
+F:      net/ipv6/ipcomp6.c
+F:      net/ipv6/ip6_vti.c
 F:      include/uapi/linux/xfrm.h
 F:      include/net/xfrm.h
 
@@ -9573,7 +9590,7 @@ F:	drivers/xen/*swiotlb*
 
 XFS FILESYSTEM
 P:      Silicon Graphics Inc
-M:      Dave Chinner <dchinner@fromorbit.com>
+M:      Dave Chinner <david@fromorbit.com>
 M:      Ben Myers <bpm@sgi.com>
 M:      xfs@oss.sgi.com
 L:      xfs@oss.sgi.com
diff --git a/Makefile b/Makefile
index 858a147fd836..82ea7dd9fc98 100644
--- a/Makefile
+++ b/Makefile
@@ -732,19 +732,15 @@ export mod_strip_cmd
 # Select initial ramdisk compression format, default is gzip(1).
 # This shall be used by the dracut(8) tool while creating an initramfs image.
 #
-INITRD_COMPRESS=gzip
-ifeq ($(CONFIG_RD_BZIP2), y)
-        INITRD_COMPRESS=bzip2
-else ifeq ($(CONFIG_RD_LZMA), y)
-        INITRD_COMPRESS=lzma
-else ifeq ($(CONFIG_RD_XZ), y)
-        INITRD_COMPRESS=xz
-else ifeq ($(CONFIG_RD_LZO), y)
-        INITRD_COMPRESS=lzo
-else ifeq ($(CONFIG_RD_LZ4), y)
-        INITRD_COMPRESS=lz4
-endif
-export INITRD_COMPRESS
+INITRD_COMPRESS-y                  := gzip
+INITRD_COMPRESS-$(CONFIG_RD_BZIP2) := bzip2
+INITRD_COMPRESS-$(CONFIG_RD_LZMA)  := lzma
+INITRD_COMPRESS-$(CONFIG_RD_XZ)    := xz
+INITRD_COMPRESS-$(CONFIG_RD_LZO)   := lzo
+INITRD_COMPRESS-$(CONFIG_RD_LZ4)   := lz4
+# do not export INITRD_COMPRESS, since we didn't actually
+# choose a sane default compression above.
+# export INITRD_COMPRESS := $(INITRD_COMPRESS-y)
 
 ifdef CONFIG_MODULE_SIG_ALL
 MODSECKEY = ./signing_key.priv
diff --git a/arch/arc/include/uapi/asm/unistd.h b/arch/arc/include/uapi/asm/unistd.h
index 68125dd766c6..39e58d1cdf90 100644
--- a/arch/arc/include/uapi/asm/unistd.h
+++ b/arch/arc/include/uapi/asm/unistd.h
@@ -8,7 +8,11 @@
 
 /******** no-legacy-syscalls-ABI *******/
 
-#ifndef _UAPI_ASM_ARC_UNISTD_H
+/*
+ * Non-typical guard macro to enable inclusion twice in ARCH sys.c
+ * That is how the Generic syscall wrapper generator works
+ */
+#if !defined(_UAPI_ASM_ARC_UNISTD_H) || defined(__SYSCALL)
 #define _UAPI_ASM_ARC_UNISTD_H
 
 #define __ARCH_WANT_SYS_EXECVE
@@ -36,4 +40,6 @@ __SYSCALL(__NR_arc_gettls, sys_arc_gettls)
 #define __NR_sysfs              (__NR_arch_specific_syscall + 3)
 __SYSCALL(__NR_sysfs, sys_sysfs)
 
+#undef __SYSCALL
+
 #endif
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 83e4f959ee47..85501238b425 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -96,7 +96,7 @@ static int remap_pte_fn(pte_t *ptep, pgtable_t token, unsigned long addr,
         struct remap_data *info = data;
         struct page *page = info->pages[info->index++];
         unsigned long pfn = page_to_pfn(page);
-        pte_t pte = pfn_pte(pfn, info->prot);
+        pte_t pte = pte_mkspecial(pfn_pte(pfn, info->prot));
 
         if (map_foreign_page(pfn, info->fgmfn, info->domid))
                 return -EFAULT;
@@ -224,10 +224,10 @@ static int __init xen_guest_init(void)
         }
         if (of_address_to_resource(node, GRANT_TABLE_PHYSADDR, &res))
                 return 0;
-        xen_hvm_resume_frames = res.start >> PAGE_SHIFT;
+        xen_hvm_resume_frames = res.start;
         xen_events_irq = irq_of_parse_and_map(node, 0);
         pr_info("Xen %s support found, events_irq=%d gnttab_frame_pfn=%lx\n",
-                        version, xen_events_irq, xen_hvm_resume_frames);
+                        version, xen_events_irq, (xen_hvm_resume_frames >> PAGE_SHIFT));
         xen_domain_type = XEN_HVM_DOMAIN;
 
         xen_setup_features();
diff --git a/arch/arm64/include/asm/xen/page-coherent.h b/arch/arm64/include/asm/xen/page-coherent.h
index 2820f1a6eebe..dde3fc9c49f0 100644
--- a/arch/arm64/include/asm/xen/page-coherent.h
+++ b/arch/arm64/include/asm/xen/page-coherent.h
@@ -23,25 +23,21 @@ static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
              unsigned long offset, size_t size, enum dma_data_direction dir,
              struct dma_attrs *attrs)
 {
-        __generic_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
 }
 
 static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
                 size_t size, enum dma_data_direction dir,
                 struct dma_attrs *attrs)
 {
-        __generic_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
 }
 
 static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
                 dma_addr_t handle, size_t size, enum dma_data_direction dir)
 {
-        __generic_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
 }
 
 static inline void xen_dma_sync_single_for_device(struct device *hwdev,
                 dma_addr_t handle, size_t size, enum dma_data_direction dir)
 {
-        __generic_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
 }
 #endif /* _ASM_ARM64_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 6777a2192b83..6a8928bba03c 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -214,31 +214,29 @@ static int ptrace_hbp_fill_attr_ctrl(unsigned int note_type,
 {
         int err, len, type, disabled = !ctrl.enabled;
 
-        if (disabled) {
-                len = 0;
-                type = HW_BREAKPOINT_EMPTY;
-        } else {
-                err = arch_bp_generic_fields(ctrl, &len, &type);
-                if (err)
-                        return err;
-
-                switch (note_type) {
-                case NT_ARM_HW_BREAK:
-                        if ((type & HW_BREAKPOINT_X) != type)
-                                return -EINVAL;
-                        break;
-                case NT_ARM_HW_WATCH:
-                        if ((type & HW_BREAKPOINT_RW) != type)
-                                return -EINVAL;
-                        break;
-                default:
+        attr->disabled = disabled;
+        if (disabled)
+                return 0;
+
+        err = arch_bp_generic_fields(ctrl, &len, &type);
+        if (err)
+                return err;
+
+        switch (note_type) {
+        case NT_ARM_HW_BREAK:
+                if ((type & HW_BREAKPOINT_X) != type)
                         return -EINVAL;
-                }
+                break;
+        case NT_ARM_HW_WATCH:
+                if ((type & HW_BREAKPOINT_RW) != type)
+                        return -EINVAL;
+                break;
+        default:
+                return -EINVAL;
         }
 
         attr->bp_len    = len;
         attr->bp_type   = type;
-        attr->disabled  = disabled;
 
         return 0;
 }
diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h
index 4a594b76674d..bc23b1ba7980 100644
--- a/arch/powerpc/include/asm/kvm_book3s.h
+++ b/arch/powerpc/include/asm/kvm_book3s.h
@@ -192,6 +192,10 @@ extern void kvmppc_load_up_vsx(void);
 extern u32 kvmppc_alignment_dsisr(struct kvm_vcpu *vcpu, unsigned int inst);
 extern ulong kvmppc_alignment_dar(struct kvm_vcpu *vcpu, unsigned int inst);
 extern int kvmppc_h_pr(struct kvm_vcpu *vcpu, unsigned long cmd);
+extern void kvmppc_copy_to_svcpu(struct kvmppc_book3s_shadow_vcpu *svcpu,
+                                 struct kvm_vcpu *vcpu);
+extern void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu,
+                                   struct kvmppc_book3s_shadow_vcpu *svcpu);
 
 static inline struct kvmppc_vcpu_book3s *to_book3s(struct kvm_vcpu *vcpu)
 {
diff --git a/arch/powerpc/include/asm/kvm_book3s_asm.h b/arch/powerpc/include/asm/kvm_book3s_asm.h
index 0bd9348a4db9..192917d2239c 100644
--- a/arch/powerpc/include/asm/kvm_book3s_asm.h
+++ b/arch/powerpc/include/asm/kvm_book3s_asm.h
@@ -79,6 +79,7 @@ struct kvmppc_host_state {
         ulong vmhandler;
         ulong scratch0;
         ulong scratch1;
+        ulong scratch2;
         u8 in_guest;
         u8 restore_hid5;
         u8 napping;
@@ -106,6 +107,7 @@ struct kvmppc_host_state {
 };
 
 struct kvmppc_book3s_shadow_vcpu {
+        bool in_use;
         ulong gpr[14];
         u32 cr;
         u32 xer;
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index 033c06be1d84..7bdcf340016c 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -720,13 +720,13 @@ int64_t opal_pci_next_error(uint64_t phb_id, uint64_t *first_frozen_pe,
 int64_t opal_pci_poll(uint64_t phb_id);
 int64_t opal_return_cpu(void);
 
-int64_t opal_xscom_read(uint32_t gcid, uint32_t pcb_addr, uint64_t *val);
+int64_t opal_xscom_read(uint32_t gcid, uint32_t pcb_addr, __be64 *val);
 int64_t opal_xscom_write(uint32_t gcid, uint32_t pcb_addr, uint64_t val);
 
 int64_t opal_lpc_write(uint32_t chip_id, enum OpalLPCAddressType addr_type,
                        uint32_t addr, uint32_t data, uint32_t sz);
 int64_t opal_lpc_read(uint32_t chip_id, enum OpalLPCAddressType addr_type,
-                      uint32_t addr, uint32_t *data, uint32_t sz);
+                      uint32_t addr, __be32 *data, uint32_t sz);
 int64_t opal_validate_flash(uint64_t buffer, uint32_t *size, uint32_t *result);
 int64_t opal_manage_flash(uint8_t op);
 int64_t opal_update_flash(uint64_t blk_list);
diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h
index 9ee12610af02..aace90547614 100644
--- a/arch/powerpc/include/asm/switch_to.h
+++ b/arch/powerpc/include/asm/switch_to.h
@@ -35,7 +35,7 @@ extern void giveup_vsx(struct task_struct *);
 extern void enable_kernel_spe(void);
 extern void giveup_spe(struct task_struct *);
 extern void load_up_spe(struct task_struct *);
-extern void switch_booke_debug_regs(struct thread_struct *new_thread);
+extern void switch_booke_debug_regs(struct debug_reg *new_debug);
 
 #ifndef CONFIG_SMP
 extern void discard_lazy_cpu_state(void);
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 2ea5cc033ec8..d3de01066f7d 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -576,6 +576,7 @@ int main(void)
         HSTATE_FIELD(HSTATE_VMHANDLER, vmhandler);
         HSTATE_FIELD(HSTATE_SCRATCH0, scratch0);
         HSTATE_FIELD(HSTATE_SCRATCH1, scratch1);
+        HSTATE_FIELD(HSTATE_SCRATCH2, scratch2);
         HSTATE_FIELD(HSTATE_IN_GUEST, in_guest);
         HSTATE_FIELD(HSTATE_RESTORE_HID5, restore_hid5);
         HSTATE_FIELD(HSTATE_NAPPING, napping);
diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
index 779a78c26435..11c1d069d920 100644
--- a/arch/powerpc/kernel/crash_dump.c
+++ b/arch/powerpc/kernel/crash_dump.c
@@ -124,15 +124,15 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
 void crash_free_reserved_phys_range(unsigned long begin, unsigned long end)
 {
         unsigned long addr;
-        const u32 *basep, *sizep;
+        const __be32 *basep, *sizep;
         unsigned int rtas_start = 0, rtas_end = 0;
 
         basep = of_get_property(rtas.dev, "linux,rtas-base", NULL);
         sizep = of_get_property(rtas.dev, "rtas-size", NULL);
 
         if (basep && sizep) {
-                rtas_start = *basep;
-                rtas_end = *basep + *sizep;
+                rtas_start = be32_to_cpup(basep);
+                rtas_end = rtas_start + be32_to_cpup(sizep);
         }
 
         for (addr = begin; addr < end; addr += PAGE_SIZE) {
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 3386d8ab7eb0..4a96556fd2d4 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -339,7 +339,7 @@ static void set_debug_reg_defaults(struct thread_struct *thread)
 #endif
 }
 
-static void prime_debug_regs(struct thread_struct *thread)
+static void prime_debug_regs(struct debug_reg *debug)
 {
         /*
          * We could have inherited MSR_DE from userspace, since
@@ -348,22 +348,22 @@ static void prime_debug_regs(struct thread_struct *thread)
          */
         mtmsr(mfmsr() & ~MSR_DE);
 
-        mtspr(SPRN_IAC1, thread->debug.iac1);
-        mtspr(SPRN_IAC2, thread->debug.iac2);
+        mtspr(SPRN_IAC1, debug->iac1);
+        mtspr(SPRN_IAC2, debug->iac2);
 #if CONFIG_PPC_ADV_DEBUG_IACS > 2
-        mtspr(SPRN_IAC3, thread->debug.iac3);
-        mtspr(SPRN_IAC4, thread->debug.iac4);
+        mtspr(SPRN_IAC3, debug->iac3);
+        mtspr(SPRN_IAC4, debug->iac4);
 #endif
-        mtspr(SPRN_DAC1, thread->debug.dac1);
-        mtspr(SPRN_DAC2, thread->debug.dac2);
+        mtspr(SPRN_DAC1, debug->dac1);
+        mtspr(SPRN_DAC2, debug->dac2);
 #if CONFIG_PPC_ADV_DEBUG_DVCS > 0
-        mtspr(SPRN_DVC1, thread->debug.dvc1);
-        mtspr(SPRN_DVC2, thread->debug.dvc2);
+        mtspr(SPRN_DVC1, debug->dvc1);
+        mtspr(SPRN_DVC2, debug->dvc2);
 #endif
-        mtspr(SPRN_DBCR0, thread->debug.dbcr0);
-        mtspr(SPRN_DBCR1, thread->debug.dbcr1);
+        mtspr(SPRN_DBCR0, debug->dbcr0);
+        mtspr(SPRN_DBCR1, debug->dbcr1);
 #ifdef CONFIG_BOOKE
-        mtspr(SPRN_DBCR2, thread->debug.dbcr2);
+        mtspr(SPRN_DBCR2, debug->dbcr2);
 #endif
 }
 /*
@@ -371,11 +371,11 @@ static void prime_debug_regs(struct thread_struct *thread)
  * debug registers, set the debug registers from the values
  * stored in the new thread.
  */
-void switch_booke_debug_regs(struct thread_struct *new_thread)
+void switch_booke_debug_regs(struct debug_reg *new_debug)
 {
         if ((current->thread.debug.dbcr0 & DBCR0_IDM)
-                || (new_thread->debug.dbcr0 & DBCR0_IDM))
-                        prime_debug_regs(new_thread);
+                || (new_debug->dbcr0 & DBCR0_IDM))
+                        prime_debug_regs(new_debug);
 }
 EXPORT_SYMBOL_GPL(switch_booke_debug_regs);
 #else   /* !CONFIG_PPC_ADV_DEBUG_REGS */
@@ -683,7 +683,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
 #endif /* CONFIG_SMP */
 
 #ifdef CONFIG_PPC_ADV_DEBUG_REGS
-        switch_booke_debug_regs(&new->thread);
+        switch_booke_debug_regs(&new->thread.debug);
 #else
 /*
  * For PPC_BOOK3S_64, we use the hw-breakpoint interfaces that would
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 75fb40498b41..2e3d2bf536c5 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1555,7 +1555,7 @@ long arch_ptrace(struct task_struct *child, long request,
 
                         flush_fp_to_thread(child);
                         if (fpidx < (PT_FPSCR - PT_FPR0))
-                                memcpy(&tmp, &child->thread.fp_state.fpr,
+                                memcpy(&tmp, &child->thread.TS_FPR(fpidx),
                                        sizeof(long));
                         else
                                 tmp = child->thread.fp_state.fpscr;
@@ -1588,7 +1588,7 @@ long arch_ptrace(struct task_struct *child, long request,
 
                         flush_fp_to_thread(child);
                         if (fpidx < (PT_FPSCR - PT_FPR0))
-                                memcpy(&child->thread.fp_state.fpr, &data,
+                                memcpy(&child->thread.TS_FPR(fpidx), &data,
                                        sizeof(long));
                         else
                                 child->thread.fp_state.fpscr = data;
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index febc80445d25..bc76cc6b419c 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -479,7 +479,7 @@ void __init smp_setup_cpu_maps(void)
         if (machine_is(pseries) && firmware_has_feature(FW_FEATURE_LPAR) &&
             (dn = of_find_node_by_path("/rtas"))) {
                 int num_addr_cell, num_size_cell, maxcpus;
-                const unsigned int *ireg;
+                const __be32 *ireg;
 
                 num_addr_cell = of_n_addr_cells(dn);
                 num_size_cell = of_n_size_cells(dn);
@@ -489,7 +489,7 @@ void __init smp_setup_cpu_maps(void)
                 if (!ireg)
                         goto out;
 
-                maxcpus = ireg[num_addr_cell + num_size_cell];
+                maxcpus = be32_to_cpup(ireg + num_addr_cell + num_size_cell);
 
                 /* Double maxcpus for processors which have SMT capability */
                 if (cpu_has_feature(CPU_FTR_SMT))
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index a3b64f3bf9a2..c1cf4a1522d9 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -580,7 +580,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
 int cpu_to_core_id(int cpu)
 {
         struct device_node *np;
-        const int *reg;
+        const __be32 *reg;
         int id = -1;
 
         np = of_get_cpu_node(cpu, NULL);
@@ -591,7 +591,7 @@ int cpu_to_core_id(int cpu)
         if (!reg)
                 goto out;
 
-        id = *reg;
+        id = be32_to_cpup(reg);
 out:
         of_node_put(np);
         return id;
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index f3ff587a8b7d..c5d148434c08 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -469,11 +469,14 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
                 slb_v = vcpu->kvm->arch.vrma_slb_v;
         }
 
+        preempt_disable();
         /* Find the HPTE in the hash table */
         index = kvmppc_hv_find_lock_hpte(kvm, eaddr, slb_v,
                                          HPTE_V_VALID | HPTE_V_ABSENT);
-        if (index < 0)
+        if (index < 0) {
+                preempt_enable();
                 return -ENOENT;
+        }
         hptep = (unsigned long *)(kvm->arch.hpt_virt + (index << 4));
         v = hptep[0] & ~HPTE_V_HVLOCK;
         gr = kvm->arch.revmap[index].guest_rpte;
@@ -481,6 +484,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
         /* Unlock the HPTE */
         asm volatile("lwsync" : : : "memory");
         hptep[0] = v;
+        preempt_enable();
 
         gpte->eaddr = eaddr;
         gpte->vpage = ((v & HPTE_V_AVPN) << 4) | ((eaddr >> 12) & 0xfff);
@@ -665,6 +669,7 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                         return -EFAULT;
         } else {
                 page = pages[0];
+                pfn = page_to_pfn(page);
                 if (PageHuge(page)) {
                         page = compound_head(page);
                         pte_size <<= compound_order(page);
@@ -689,7 +694,6 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                         }
                         rcu_read_unlock_sched();
                 }
-                pfn = page_to_pfn(page);
         }
 
         ret = -EFAULT;
@@ -707,8 +711,14 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                 r = (r & ~(HPTE_R_W|HPTE_R_I|HPTE_R_G)) | HPTE_R_M;
         }
 
-        /* Set the HPTE to point to pfn */
-        r = (r & ~(HPTE_R_PP0 - pte_size)) | (pfn << PAGE_SHIFT);
+        /*
+         * Set the HPTE to point to pfn.
+         * Since the pfn is at PAGE_SIZE granularity, make sure we
+         * don't mask out lower-order bits if psize < PAGE_SIZE.
+         */
+        if (psize < PAGE_SIZE)
+                psize = PAGE_SIZE;
+        r = (r & ~(HPTE_R_PP0 - psize)) | ((pfn << PAGE_SHIFT) & ~(psize - 1));
         if (hpte_is_writable(r) && !write_ok)
                 r = hpte_make_readonly(r);
         ret = RESUME_GUEST;
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 072287f1c3bc..b51d5db78068 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -131,8 +131,9 @@ static void kvmppc_fast_vcpu_kick_hv(struct kvm_vcpu *vcpu)
 static void kvmppc_core_vcpu_load_hv(struct kvm_vcpu *vcpu, int cpu)
 {
         struct kvmppc_vcore *vc = vcpu->arch.vcore;
+        unsigned long flags;
 
-        spin_lock(&vcpu->arch.tbacct_lock);
+        spin_lock_irqsave(&vcpu->arch.tbacct_lock, flags);
         if (vc->runner == vcpu && vc->vcore_state != VCORE_INACTIVE &&
             vc->preempt_tb != TB_NIL) {
                 vc->stolen_tb += mftb() - vc->preempt_tb;
@@ -143,19 +144,20 @@ static void kvmppc_core_vcpu_load_hv(struct kvm_vcpu *vcpu, int cpu)
                 vcpu->arch.busy_stolen += mftb() - vcpu->arch.busy_preempt;
                 vcpu->arch.busy_preempt = TB_NIL;
         }
-        spin_unlock(&vcpu->arch.tbacct_lock);
+        spin_unlock_irqrestore(&vcpu->arch.tbacct_lock, flags);
 }
 
 static void kvmppc_core_vcpu_put_hv(struct kvm_vcpu *vcpu)
 {
         struct kvmppc_vcore *vc = vcpu->arch.vcore;
+        unsigned long flags;
 
-        spin_lock(&vcpu->arch.tbacct_lock);
+        spin_lock_irqsave(&vcpu->arch.tbacct_lock, flags);
         if (vc->runner == vcpu && vc->vcore_state != VCORE_INACTIVE)
                 vc->preempt_tb = mftb();
         if (vcpu->arch.state == KVMPPC_VCPU_BUSY_IN_HOST)
                 vcpu->arch.busy_preempt = mftb();
-        spin_unlock(&vcpu->arch.tbacct_lock);
+        spin_unlock_irqrestore(&vcpu->arch.tbacct_lock, flags);
 }
 
 static void kvmppc_set_msr_hv(struct kvm_vcpu *vcpu, u64 msr)
@@ -486,11 +488,11 @@ static u64 vcore_stolen_time(struct kvmppc_vcore *vc, u64 now)
          */
         if (vc->vcore_state != VCORE_INACTIVE &&
             vc->runner->arch.run_task != current) {
-                spin_lock(&vc->runner->arch.tbacct_lock);
+                spin_lock_irq(&vc->runner->arch.tbacct_lock);
                 p = vc->stolen_tb;
                 if (vc->preempt_tb != TB_NIL)
                         p += now - vc->preempt_tb;
-                spin_unlock(&vc->runner->arch.tbacct_lock);
+                spin_unlock_irq(&vc->runner->arch.tbacct_lock);
         } else {
                 p = vc->stolen_tb;
         }
@@ -512,10 +514,10 @@ static void kvmppc_create_dtl_entry(struct kvm_vcpu *vcpu,
         core_stolen = vcore_stolen_time(vc, now);
         stolen = core_stolen - vcpu->arch.stolen_logged;
         vcpu->arch.stolen_logged = core_stolen;
-        spin_lock(&vcpu->arch.tbacct_lock);
+        spin_lock_irq(&vcpu->arch.tbacct_lock);
         stolen += vcpu->arch.busy_stolen;
         vcpu->arch.busy_stolen = 0;
-        spin_unlock(&vcpu->arch.tbacct_lock);
+        spin_unlock_irq(&vcpu->arch.tbacct_lock);
         if (!dt || !vpa)
                 return;
         memset(dt, 0, sizeof(struct dtl_entry));
@@ -589,7 +591,9 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
                 if (list_empty(&vcpu->kvm->arch.rtas_tokens))
                         return RESUME_HOST;
 
+                idx = srcu_read_lock(&vcpu->kvm->srcu);
                 rc = kvmppc_rtas_hcall(vcpu);
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
 
                 if (rc == -ENOENT)
                         return RESUME_HOST;
@@ -1115,13 +1119,13 @@ static void kvmppc_remove_runnable(struct kvmppc_vcore *vc,
 
         if (vcpu->arch.state != KVMPPC_VCPU_RUNNABLE)
                 return;
-        spin_lock(&vcpu->arch.tbacct_lock);
+        spin_lock_irq(&vcpu->arch.tbacct_lock);
         now = mftb();
         vcpu->arch.busy_stolen += vcore_stolen_time(vc, now) -
                 vcpu->arch.stolen_logged;
         vcpu->arch.busy_preempt = now;
         vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
-        spin_unlock(&vcpu->arch.tbacct_lock);
+        spin_unlock_irq(&vcpu->arch.tbacct_lock);
         --vc->n_runnable;
         list_del(&vcpu->arch.run_list);
 }
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 9c515440ad1a..8689e2e30857 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -225,6 +225,7 @@ long kvmppc_do_h_enter(struct kvm *kvm, unsigned long flags,
                 is_io = pa & (HPTE_R_I | HPTE_R_W);
                 pte_size = PAGE_SIZE << (pa & KVMPPC_PAGE_ORDER_MASK);
                 pa &= PAGE_MASK;
+                pa |= gpa & ~PAGE_MASK;
         } else {
                 /* Translate to host virtual address */
                 hva = __gfn_to_hva_memslot(memslot, gfn);
@@ -238,13 +239,13 @@ long kvmppc_do_h_enter(struct kvm *kvm, unsigned long flags,
                                 ptel = hpte_make_readonly(ptel);
                         is_io = hpte_cache_bits(pte_val(pte));
                         pa = pte_pfn(pte) << PAGE_SHIFT;
+                        pa |= hva & (pte_size - 1);
+                        pa |= gpa & ~PAGE_MASK;
                 }
         }
 
         if (pte_size < psize)
                 return H_PARAMETER;
-        if (pa && pte_size > psize)
-                pa |= gpa & (pte_size - 1);
 
         ptel &= ~(HPTE_R_PP0 - psize);
         ptel |= pa;
@@ -749,6 +750,10 @@ static int slb_base_page_shift[4] = {
         20,     /* 1M, unsupported */
 };
 
+/* When called from virtmode, this func should be protected by
+ * preempt_disable(), otherwise, the holding of HPTE_V_HVLOCK
+ * can trigger deadlock issue.
+ */
 long kvmppc_hv_find_lock_hpte(struct kvm *kvm, gva_t eaddr, unsigned long slb_v,
                               unsigned long valid)
 {
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index bc8de75b1925..be4fa04a37c9 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -153,7 +153,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
 
 13:     b       machine_check_fwnmi
 
-
 /*
  * We come in here when wakened from nap mode on a secondary hw thread.
  * Relocation is off and most register values are lost.
@@ -224,6 +223,11 @@ kvm_start_guest:
         /* Clear our vcpu pointer so we don't come back in early */
         li      r0, 0
         std     r0, HSTATE_KVM_VCPU(r13)
+        /*
+         * Make sure we clear HSTATE_KVM_VCPU(r13) before incrementing
+         * the nap_count, because once the increment to nap_count is
+         * visible we could be given another vcpu.
+         */
         lwsync
         /* Clear any pending IPI - we're an offline thread */
         ld      r5, HSTATE_XICS_PHYS(r13)
@@ -241,7 +245,6 @@ kvm_start_guest:
         /* increment the nap count and then go to nap mode */
         ld      r4, HSTATE_KVM_VCORE(r13)
         addi    r4, r4, VCORE_NAP_COUNT
-        lwsync                          /* make previous updates visible */
 51:     lwarx   r3, 0, r4
         addi    r3, r3, 1
         stwcx.  r3, 0, r4
@@ -751,15 +754,14 @@ kvmppc_interrupt_hv:
          * guest CR, R12 saved in shadow VCPU SCRATCH1/0
          * guest R13 saved in SPRN_SCRATCH0
          */
-        /* abuse host_r2 as third scratch area; we get r2 from PACATOC(r13) */
-        std     r9, HSTATE_HOST_R2(r13)
+        std     r9, HSTATE_SCRATCH2(r13)
 
         lbz     r9, HSTATE_IN_GUEST(r13)
         cmpwi   r9, KVM_GUEST_MODE_HOST_HV
         beq     kvmppc_bad_host_intr
 #ifdef CONFIG_KVM_BOOK3S_PR_POSSIBLE
         cmpwi   r9, KVM_GUEST_MODE_GUEST
-        ld      r9, HSTATE_HOST_R2(r13)
+        ld      r9, HSTATE_SCRATCH2(r13)
         beq     kvmppc_interrupt_pr
 #endif
         /* We're now back in the host but in guest MMU context */
@@ -779,7 +781,7 @@ kvmppc_interrupt_hv:
         std     r6, VCPU_GPR(R6)(r9)
         std     r7, VCPU_GPR(R7)(r9)
         std     r8, VCPU_GPR(R8)(r9)
-        ld      r0, HSTATE_HOST_R2(r13)
+        ld      r0, HSTATE_SCRATCH2(r13)
         std     r0, VCPU_GPR(R9)(r9)
         std     r10, VCPU_GPR(R10)(r9)
         std     r11, VCPU_GPR(R11)(r9)
@@ -990,14 +992,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201)
          */
         /* Increment the threads-exiting-guest count in the 0xff00
            bits of vcore->entry_exit_count */
-        lwsync
         ld      r5,HSTATE_KVM_VCORE(r13)
         addi    r6,r5,VCORE_ENTRY_EXIT
 41:     lwarx   r3,0,r6
         addi    r0,r3,0x100
         stwcx.  r0,0,r6
         bne     41b
-        lwsync
+        isync           /* order stwcx. vs. reading napping_threads */
 
         /*
          * At this point we have an interrupt that we have to pass
@@ -1030,6 +1031,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201)
         sld     r0,r0,r4
         andc.   r3,r3,r0                /* no sense IPI'ing ourselves */
         beq     43f
+        /* Order entry/exit update vs. IPIs */
+        sync
         mulli   r4,r4,PACA_SIZE         /* get paca for thread 0 */
         subf    r6,r4,r13
 42:     andi.   r0,r3,1
@@ -1638,10 +1641,10 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_206)
         bge     kvm_cede_exit
         stwcx.  r4,0,r6
         bne     31b
+        /* order napping_threads update vs testing entry_exit_count */
+        isync
         li      r0,1
         stb     r0,HSTATE_NAPPING(r13)
-        /* order napping_threads update vs testing entry_exit_count */
-        lwsync
         mr      r4,r3
         lwz     r7,VCORE_ENTRY_EXIT(r5)
         cmpwi   r7,0x100
diff --git a/arch/powerpc/kvm/book3s_interrupts.S b/arch/powerpc/kvm/book3s_interrupts.S
index f4dd041c14ea..f779450cb07c 100644
--- a/arch/powerpc/kvm/book3s_interrupts.S
+++ b/arch/powerpc/kvm/book3s_interrupts.S
@@ -129,29 +129,32 @@ kvm_start_lightweight:
          * R12      = exit handler id
          * R13      = PACA
          * SVCPU.*  = guest *
+         * MSR.EE   = 1
          *
          */
 
+        PPC_LL  r3, GPR4(r1)            /* vcpu pointer */
+
+        /*
+         * kvmppc_copy_from_svcpu can clobber volatile registers, save
+         * the exit handler id to the vcpu and restore it from there later.
+         */
+        stw     r12, VCPU_TRAP(r3)
+
         /* Transfer reg values from shadow vcpu back to vcpu struct */
         /* On 64-bit, interrupts are still off at this point */
-        PPC_LL  r3, GPR4(r1)            /* vcpu pointer */
+
         GET_SHADOW_VCPU(r4)
         bl      FUNC(kvmppc_copy_from_svcpu)
         nop
 
 #ifdef CONFIG_PPC_BOOK3S_64
-        /* Re-enable interrupts */
-        ld      r3, HSTATE_HOST_MSR(r13)
-        ori     r3, r3, MSR_EE
-        MTMSR_EERI(r3)
-
         /*
          * Reload kernel SPRG3 value.
          * No need to save guest value as usermode can't modify SPRG3.
          */
         ld      r3, PACA_SPRG3(r13)
         mtspr   SPRN_SPRG3, r3
-
 #endif /* CONFIG_PPC_BOOK3S_64 */
 
         /* R7 = vcpu */
@@ -177,7 +180,7 @@ kvm_start_lightweight:
         PPC_STL r31, VCPU_GPR(R31)(r7)
 
         /* Pass the exit number as 3rd argument to kvmppc_handle_exit */
-        mr      r5, r12
+        lwz     r5, VCPU_TRAP(r7)
 
         /* Restore r3 (kvm_run) and r4 (vcpu) */
         REST_2GPRS(3, r1)
diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
index fe14ca3dd171..5b9e9063cfaf 100644
--- a/arch/powerpc/kvm/book3s_pr.c
+++ b/arch/powerpc/kvm/book3s_pr.c
@@ -66,6 +66,7 @@ static void kvmppc_core_vcpu_load_pr(struct kvm_vcpu *vcpu, int cpu)
         struct kvmppc_book3s_shadow_vcpu *svcpu = svcpu_get(vcpu);
         memcpy(svcpu->slb, to_book3s(vcpu)->slb_shadow, sizeof(svcpu->slb));
         svcpu->slb_max = to_book3s(vcpu)->slb_shadow_max;
+        svcpu->in_use = 0;
         svcpu_put(svcpu);
 #endif
         vcpu->cpu = smp_processor_id();
@@ -78,6 +79,9 @@ static void kvmppc_core_vcpu_put_pr(struct kvm_vcpu *vcpu)
 {
 #ifdef CONFIG_PPC_BOOK3S_64
         struct kvmppc_book3s_shadow_vcpu *svcpu = svcpu_get(vcpu);
+        if (svcpu->in_use) {
+                kvmppc_copy_from_svcpu(vcpu, svcpu);
+        }
         memcpy(to_book3s(vcpu)->slb_shadow, svcpu->slb, sizeof(svcpu->slb));
         to_book3s(vcpu)->slb_shadow_max = svcpu->slb_max;
         svcpu_put(svcpu);
@@ -110,12 +114,26 @@ void kvmppc_copy_to_svcpu(struct kvmppc_book3s_shadow_vcpu *svcpu,
         svcpu->ctr = vcpu->arch.ctr;
         svcpu->lr  = vcpu->arch.lr;
         svcpu->pc  = vcpu->arch.pc;
+        svcpu->in_use = true;
 }
 
 /* Copy data touched by real-mode code from shadow vcpu back to vcpu */
 void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu,
                             struct kvmppc_book3s_shadow_vcpu *svcpu)
 {
+        /*
+         * vcpu_put would just call us again because in_use hasn't
+         * been updated yet.
+         */
+        preempt_disable();
+
+        /*
+         * Maybe we were already preempted and synced the svcpu from
+         * our preempt notifiers. Don't bother touching this svcpu then.
+         */
+        if (!svcpu->in_use)
+                goto out;
+
         vcpu->arch.gpr[0] = svcpu->gpr[0];
         vcpu->arch.gpr[1] = svcpu->gpr[1];
         vcpu->arch.gpr[2] = svcpu->gpr[2];
@@ -139,6 +157,10 @@ void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu,
         vcpu->arch.fault_dar   = svcpu->fault_dar;
         vcpu->arch.fault_dsisr = svcpu->fault_dsisr;
         vcpu->arch.last_inst   = svcpu->last_inst;
+        svcpu->in_use = false;
+
+out:
+        preempt_enable();
 }
 
 static int kvmppc_core_check_requests_pr(struct kvm_vcpu *vcpu)
diff --git a/arch/powerpc/kvm/book3s_rmhandlers.S b/arch/powerpc/kvm/book3s_rmhandlers.S
index a38c4c9edab8..c3c5231adade 100644
--- a/arch/powerpc/kvm/book3s_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_rmhandlers.S
@@ -153,15 +153,11 @@ _GLOBAL(kvmppc_entry_trampoline)
 
         li      r6, MSR_IR | MSR_DR
         andc    r6, r5, r6      /* Clear DR and IR in MSR value */
-#ifdef CONFIG_PPC_BOOK3S_32
         /*
          * Set EE in HOST_MSR so that it's enabled when we get into our
-         * C exit handler function.  On 64-bit we delay enabling
-         * interrupts until we have finished transferring stuff
-         * to or from the PACA.
+         * C exit handler function.
          */
         ori     r5, r5, MSR_EE
-#endif
         mtsrr0  r7
         mtsrr1  r6
         RFI
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index 53e65a210b9a..0591e05db74b 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -681,7 +681,7 @@ int kvmppc_core_check_requests(struct kvm_vcpu *vcpu)
 int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
 {
         int ret, s;
-        struct thread_struct thread;
+        struct debug_reg debug;
 #ifdef CONFIG_PPC_FPU
         struct thread_fp_state fp;
         int fpexc_mode;
@@ -723,9 +723,9 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
 #endif
 
         /* Switch to guest debug context */
-        thread.debug = vcpu->arch.shadow_dbg_reg;
-        switch_booke_debug_regs(&thread);
-        thread.debug = current->thread.debug;
+        debug = vcpu->arch.shadow_dbg_reg;
+        switch_booke_debug_regs(&debug);
+        debug = current->thread.debug;
         current->thread.debug = vcpu->arch.shadow_dbg_reg;
 
         kvmppc_fix_ee_before_entry();
@@ -736,8 +736,8 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
            We also get here with interrupts enabled. */
 
         /* Switch back to user space debug context */
-        switch_booke_debug_regs(&thread);
-        current->thread.debug = thread.debug;
+        switch_booke_debug_regs(&debug);
+        current->thread.debug = debug;
 
 #ifdef CONFIG_PPC_FPU
         kvmppc_save_guest_fp(vcpu);
diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platforms/powernv/opal-lpc.c
index e7e59e4f9892..79d83cad3d67 100644
--- a/arch/powerpc/platforms/powernv/opal-lpc.c
+++ b/arch/powerpc/platforms/powernv/opal-lpc.c
@@ -24,25 +24,25 @@ static int opal_lpc_chip_id = -1;
 static u8 opal_lpc_inb(unsigned long port)
 {
         int64_t rc;
-        uint32_t data;
+        __be32 data;
 
         if (opal_lpc_chip_id < 0 || port > 0xffff)
                 return 0xff;
         rc = opal_lpc_read(opal_lpc_chip_id, OPAL_LPC_IO, port, &data, 1);
-        return rc ? 0xff : data;
+        return rc ? 0xff : be32_to_cpu(data);
 }
 
 static __le16 __opal_lpc_inw(unsigned long port)
 {
         int64_t rc;
-        uint32_t data;
+        __be32 data;
 
         if (opal_lpc_chip_id < 0 || port > 0xfffe)
                 return 0xffff;
         if (port & 1)
                 return (__le16)opal_lpc_inb(port) << 8 | opal_lpc_inb(port + 1);
         rc = opal_lpc_read(opal_lpc_chip_id, OPAL_LPC_IO, port, &data, 2);
-        return rc ? 0xffff : data;
+        return rc ? 0xffff : be32_to_cpu(data);
 }
 static u16 opal_lpc_inw(unsigned long port)
 {
@@ -52,7 +52,7 @@ static u16 opal_lpc_inw(unsigned long port)
 static __le32 __opal_lpc_inl(unsigned long port)
 {
         int64_t rc;
-        uint32_t data;
+        __be32 data;
 
         if (opal_lpc_chip_id < 0 || port > 0xfffc)
                 return 0xffffffff;
@@ -62,7 +62,7 @@ static __le32 __opal_lpc_inl(unsigned long port)
                        (__le32)opal_lpc_inb(port + 2) <<  8 |
                                opal_lpc_inb(port + 3);
         rc = opal_lpc_read(opal_lpc_chip_id, OPAL_LPC_IO, port, &data, 4);
-        return rc ? 0xffffffff : data;
+        return rc ? 0xffffffff : be32_to_cpu(data);
 }
 
 static u32 opal_lpc_inl(unsigned long port)
diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c
index 4d99a8fd55ac..4fbf276ac99e 100644
--- a/arch/powerpc/platforms/powernv/opal-xscom.c
+++ b/arch/powerpc/platforms/powernv/opal-xscom.c
@@ -96,9 +96,11 @@ static int opal_scom_read(scom_map_t map, u64 reg, u64 *value)
 {
         struct opal_scom_map *m = map;
         int64_t rc;
+        __be64 v;
 
         reg = opal_scom_unmangle(reg);
-        rc = opal_xscom_read(m->chip, m->addr + reg, (uint64_t *)__pa(value));
+        rc = opal_xscom_read(m->chip, m->addr + reg, (__be64 *)__pa(&v));
+        *value = be64_to_cpu(v);
         return opal_xscom_err_xlate(rc);
 }
 
diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index e738007eae64..c9fecf09b8fa 100644
--- a/arch/powerpc/platforms/pseries/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c
@@ -157,7 +157,7 @@ static void parse_ppp_data(struct seq_file *m)
 {
         struct hvcall_ppp_data ppp_data;
         struct device_node *root;
-        const int *perf_level;
+        const __be32 *perf_level;
         int rc;
 
         rc = h_get_ppp(&ppp_data);
@@ -201,7 +201,7 @@ static void parse_ppp_data(struct seq_file *m)
                 perf_level = of_get_property(root,
                                 "ibm,partition-performance-parameters-level",
                                              NULL);
-                if (perf_level && (*perf_level >= 1)) {
+                if (perf_level && (be32_to_cpup(perf_level) >= 1)) {
                         seq_printf(m,
                             "physical_procs_allocated_to_virtualization=%d\n",
                                    ppp_data.phys_platform_procs);
@@ -435,7 +435,7 @@ static int pseries_lparcfg_data(struct seq_file *m, void *v)
         int partition_potential_processors;
         int partition_active_processors;
         struct device_node *rtas_node;
-        const int *lrdrp = NULL;
+        const __be32 *lrdrp = NULL;
 
         rtas_node = of_find_node_by_path("/rtas");
         if (rtas_node)
@@ -444,7 +444,7 @@ static int pseries_lparcfg_data(struct seq_file *m, void *v)
         if (lrdrp == NULL) {
                 partition_potential_processors = vdso_data->processorCount;
         } else {
-                partition_potential_processors = *(lrdrp + 4);
+                partition_potential_processors = be32_to_cpup(lrdrp + 4);
         }
         of_node_put(rtas_node);
 
@@ -654,7 +654,7 @@ static int lparcfg_data(struct seq_file *m, void *v)
         const char *model = "";
         const char *system_id = "";
         const char *tmp;
-        const unsigned int *lp_index_ptr;
+        const __be32 *lp_index_ptr;
         unsigned int lp_index = 0;
 
         seq_printf(m, "%s %s\n", MODULE_NAME, MODULE_VERS);
@@ -670,7 +670,7 @@ static int lparcfg_data(struct seq_file *m, void *v)
                 lp_index_ptr = of_get_property(rootdn, "ibm,partition-no",
                                         NULL);
                 if (lp_index_ptr)
-                        lp_index = *lp_index_ptr;
+                        lp_index = be32_to_cpup(lp_index_ptr);
                 of_node_put(rootdn);
         }
         seq_printf(m, "serial_number=%s\n", system_id);
diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c
index 6d2f0abce6fa..0c882e83c4ce 100644
--- a/arch/powerpc/platforms/pseries/msi.c
+++ b/arch/powerpc/platforms/pseries/msi.c
@@ -130,7 +130,8 @@ static int check_req(struct pci_dev *pdev, int nvec, char *prop_name)
 {
         struct device_node *dn;
         struct pci_dn *pdn;
-        const u32 *req_msi;
+        const __be32 *p;
+        u32 req_msi;
 
         pdn = pci_get_pdn(pdev);
         if (!pdn)
@@ -138,19 +139,20 @@ static int check_req(struct pci_dev *pdev, int nvec, char *prop_name)
 
         dn = pdn->node;
 
-        req_msi = of_get_property(dn, prop_name, NULL);
-        if (!req_msi) {
+        p = of_get_property(dn, prop_name, NULL);
+        if (!p) {
                 pr_debug("rtas_msi: No %s on %s\n", prop_name, dn->full_name);
                 return -ENOENT;
         }
 
-        if (*req_msi < nvec) {
+        req_msi = be32_to_cpup(p);
+        if (req_msi < nvec) {
                 pr_debug("rtas_msi: %s requests < %d MSIs\n", prop_name, nvec);
 
-                if (*req_msi == 0) /* Be paranoid */
+                if (req_msi == 0) /* Be paranoid */
                         return -ENOSPC;
 
-                return *req_msi;
+                return req_msi;
         }
 
         return 0;
@@ -171,7 +173,7 @@ static int check_req_msix(struct pci_dev *pdev, int nvec)
 static struct device_node *find_pe_total_msi(struct pci_dev *dev, int *total)
 {
         struct device_node *dn;
-        const u32 *p;
+        const __be32 *p;
 
         dn = of_node_get(pci_device_to_OF_node(dev));
         while (dn) {
@@ -179,7 +181,7 @@ static struct device_node *find_pe_total_msi(struct pci_dev *dev, int *total)
                 if (p) {
                         pr_debug("rtas_msi: found prop on dn %s\n",
                                 dn->full_name);
-                        *total = *p;
+                        *total = be32_to_cpup(p);
                         return dn;
                 }
 
@@ -232,13 +234,13 @@ struct msi_counts {
 static void *count_non_bridge_devices(struct device_node *dn, void *data)
 {
         struct msi_counts *counts = data;
-        const u32 *p;
+        const __be32 *p;
         u32 class;
 
         pr_debug("rtas_msi: counting %s\n", dn->full_name);
 
         p = of_get_property(dn, "class-code", NULL);
-        class = p ? *p : 0;
+        class = p ? be32_to_cpup(p) : 0;
 
         if ((class >> 8) != PCI_CLASS_BRIDGE_PCI)
                 counts->num_devices++;
@@ -249,7 +251,7 @@ static void *count_non_bridge_devices(struct device_node *dn, void *data)
 static void *count_spare_msis(struct device_node *dn, void *data)
 {
         struct msi_counts *counts = data;
-        const u32 *p;
+        const __be32 *p;
         int req;
 
         if (dn == counts->requestor)
@@ -260,11 +262,11 @@ static void *count_spare_msis(struct device_node *dn, void *data)
                 req = 0;
                 p = of_get_property(dn, "ibm,req#msi", NULL);
                 if (p)
-                        req = *p;
+                        req = be32_to_cpup(p);
 
                 p = of_get_property(dn, "ibm,req#msi-x", NULL);
                 if (p)
-                        req = max(req, (int)*p);
+                        req = max(req, (int)be32_to_cpup(p));
         }
 
         if (req < counts->quota)
diff --git a/arch/powerpc/platforms/pseries/nvram.c b/arch/powerpc/platforms/pseries/nvram.c
index 7bfaf58d4664..d7096f2f7751 100644
--- a/arch/powerpc/platforms/pseries/nvram.c
+++ b/arch/powerpc/platforms/pseries/nvram.c
@@ -43,8 +43,8 @@ static char nvram_buf[NVRW_CNT];	/* assume this is in the first 4GB */
 static DEFINE_SPINLOCK(nvram_lock);
 
 struct err_log_info {
-        int error_type;
-        unsigned int seq_num;
+        __be32 error_type;
+        __be32 seq_num;
 };
 
 struct nvram_os_partition {
@@ -79,9 +79,9 @@ static const char *pseries_nvram_os_partitions[] = {
 };
 
 struct oops_log_info {
-        u16 version;
-        u16 report_length;
-        u64 timestamp;
+        __be16 version;
+        __be16 report_length;
+        __be64 timestamp;
 } __attribute__((packed));
 
 static void oops_to_nvram(struct kmsg_dumper *dumper,
@@ -291,8 +291,8 @@ int nvram_write_os_partition(struct nvram_os_partition *part, char * buff,
                 length = part->size;
         }
 
-        info.error_type = err_type;
-        info.seq_num = error_log_cnt;
+        info.error_type = cpu_to_be32(err_type);
+        info.seq_num = cpu_to_be32(error_log_cnt);
 
         tmp_index = part->index;
 
@@ -364,8 +364,8 @@ int nvram_read_partition(struct nvram_os_partition *part, char *buff,
         }
 
         if (part->os_partition) {
-                *error_log_cnt = info.seq_num;
-                *err_type = info.error_type;
+                *error_log_cnt = be32_to_cpu(info.seq_num);
+                *err_type = be32_to_cpu(info.error_type);
         }
 
         return 0;
@@ -529,9 +529,9 @@ static int zip_oops(size_t text_len)
                 pr_err("nvram: logging uncompressed oops/panic report\n");
                 return -1;
         }
-        oops_hdr->version = OOPS_HDR_VERSION;
-        oops_hdr->report_length = (u16) zipped_len;
-        oops_hdr->timestamp = get_seconds();
+        oops_hdr->version = cpu_to_be16(OOPS_HDR_VERSION);
+        oops_hdr->report_length = cpu_to_be16(zipped_len);
+        oops_hdr->timestamp = cpu_to_be64(get_seconds());
         return 0;
 }
 
@@ -574,9 +574,9 @@ static int nvram_pstore_write(enum pstore_type_id type,
                                 clobbering_unread_rtas_event())
                 return -1;
 
-        oops_hdr->version = OOPS_HDR_VERSION;
-        oops_hdr->report_length = (u16) size;
-        oops_hdr->timestamp = get_seconds();
+        oops_hdr->version = cpu_to_be16(OOPS_HDR_VERSION);
+        oops_hdr->report_length = cpu_to_be16(size);
+        oops_hdr->timestamp = cpu_to_be64(get_seconds());
 
         if (compressed)
                 err_type = ERR_TYPE_KERNEL_PANIC_GZ;
@@ -670,16 +670,16 @@ static ssize_t nvram_pstore_read(u64 *id, enum pstore_type_id *type,
                 size_t length, hdr_size;
 
                 oops_hdr = (struct oops_log_info *)buff;
-                if (oops_hdr->version < OOPS_HDR_VERSION) {
+                if (be16_to_cpu(oops_hdr->version) < OOPS_HDR_VERSION) {
                         /* Old format oops header had 2-byte record size */
                         hdr_size = sizeof(u16);
-                        length = oops_hdr->version;
+                        length = be16_to_cpu(oops_hdr->version);
                         time->tv_sec = 0;
                         time->tv_nsec = 0;
                 } else {
                         hdr_size = sizeof(*oops_hdr);
-                        length = oops_hdr->report_length;
-                        time->tv_sec = oops_hdr->timestamp;
+                        length = be16_to_cpu(oops_hdr->report_length);
+                        time->tv_sec = be64_to_cpu(oops_hdr->timestamp);
                         time->tv_nsec = 0;
                 }
                 *buf = kmalloc(length, GFP_KERNEL);
@@ -889,13 +889,13 @@ static void oops_to_nvram(struct kmsg_dumper *dumper,
                 kmsg_dump_get_buffer(dumper, false,
                                      oops_data, oops_data_sz, &text_len);
                 err_type = ERR_TYPE_KERNEL_PANIC;
-                oops_hdr->version = OOPS_HDR_VERSION;
-                oops_hdr->report_length = (u16) text_len;
-                oops_hdr->timestamp = get_seconds();
+                oops_hdr->version = cpu_to_be16(OOPS_HDR_VERSION);
+                oops_hdr->report_length = cpu_to_be16(text_len);
+                oops_hdr->timestamp = cpu_to_be64(get_seconds());
         }
 
         (void) nvram_write_os_partition(&oops_log_partition, oops_buf,
-                (int) (sizeof(*oops_hdr) + oops_hdr->report_length), err_type,
+                (int) (sizeof(*oops_hdr) + text_len), err_type,
                 ++oops_count);
 
         spin_unlock_irqrestore(&lock, flags);
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index 5f93856cdf47..70670a2d9cf2 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -113,7 +113,7 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
 {
         struct device_node *dn, *pdn;
         struct pci_bus *bus;
-        const uint32_t *pcie_link_speed_stats;
+        const __be32 *pcie_link_speed_stats;
 
         bus = bridge->bus;
 
@@ -122,7 +122,7 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
                 return 0;
 
         for (pdn = dn; pdn != NULL; pdn = of_get_next_parent(pdn)) {
-                pcie_link_speed_stats = (const uint32_t *) of_get_property(pdn,
+                pcie_link_speed_stats = of_get_property(pdn,
                         "ibm,pcie-link-speed-stats", NULL);
                 if (pcie_link_speed_stats)
                         break;
@@ -135,7 +135,7 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
                 return 0;
         }
 
-        switch (pcie_link_speed_stats[0]) {
+        switch (be32_to_cpup(pcie_link_speed_stats)) {
         case 0x01:
                 bus->max_bus_speed = PCIE_SPEED_2_5GT;
                 break;
@@ -147,7 +147,7 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
                 break;
         }
 
-        switch (pcie_link_speed_stats[1]) {
+        switch (be32_to_cpup(pcie_link_speed_stats)) {
         case 0x01:
                 bus->cur_bus_speed = PCIE_SPEED_2_5GT;
                 break;
diff --git a/arch/sh/lib/Makefile b/arch/sh/lib/Makefile
index 7b95f29e3174..3baff31e58cf 100644
--- a/arch/sh/lib/Makefile
+++ b/arch/sh/lib/Makefile
@@ -6,7 +6,7 @@ lib-y  = delay.o memmove.o memchr.o \
          checksum.o strlen.o div64.o div64-generic.o
 
 # Extracted from libgcc
-lib-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
+obj-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
          ashlsi3.o ashrsi3.o ashiftrt.o lshrsi3.o \
          udiv_qrnnd.o
 
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 8358dc144959..0f9e94537eee 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -619,7 +619,7 @@ static inline unsigned long pte_present(pte_t pte)
 }
 
 #define pte_accessible pte_accessible
-static inline unsigned long pte_accessible(pte_t a)
+static inline unsigned long pte_accessible(struct mm_struct *mm, pte_t a)
 {
         return pte_val(a) & _PAGE_VALID;
 }
@@ -847,7 +847,7 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
          * SUN4V NOTE: _PAGE_VALID is the same value in both the SUN4U
          *             and SUN4V pte layout, so this inline test is fine.
          */
-        if (likely(mm != &init_mm) && pte_accessible(orig))
+        if (likely(mm != &init_mm) && pte_accessible(mm, orig))
                 tlb_batch_add(mm, addr, ptep, orig, fullmm);
 }
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index e903c71f7e69..0952ecd60eca 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -26,6 +26,7 @@ config X86
         select HAVE_AOUT if X86_32
         select HAVE_UNSTABLE_SCHED_CLOCK
         select ARCH_SUPPORTS_NUMA_BALANCING
+        select ARCH_SUPPORTS_INT128 if X86_64
         select ARCH_WANTS_PROT_NUMA_PROT_NONE
         select HAVE_IDE
         select HAVE_OPROFILE
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 3d1999458709..bbc8b12fa443 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -452,9 +452,16 @@ static inline int pte_present(pte_t a)
 }
 
 #define pte_accessible pte_accessible
-static inline int pte_accessible(pte_t a)
+static inline bool pte_accessible(struct mm_struct *mm, pte_t a)
 {
-        return pte_flags(a) & _PAGE_PRESENT;
+        if (pte_flags(a) & _PAGE_PRESENT)
+                return true;
+
+        if ((pte_flags(a) & (_PAGE_PROTNONE | _PAGE_NUMA)) &&
+                        mm_tlb_flush_pending(mm))
+                return true;
+
+        return false;
 }
 
 static inline int pte_hidden(pte_t pte)
diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h
index 8729723636fd..c8b051933b1b 100644
--- a/arch/x86/include/asm/preempt.h
+++ b/arch/x86/include/asm/preempt.h
@@ -8,6 +8,12 @@
 DECLARE_PER_CPU(int, __preempt_count);
 
 /*
+ * We use the PREEMPT_NEED_RESCHED bit as an inverted NEED_RESCHED such
+ * that a decrement hitting 0 means we can and should reschedule.
+ */
+#define PREEMPT_ENABLED (0 + PREEMPT_NEED_RESCHED)
+
+/*
  * We mask the PREEMPT_NEED_RESCHED bit so as not to confuse all current users
  * that think a non-zero value indicates we cannot preempt.
  */
@@ -74,6 +80,11 @@ static __always_inline void __preempt_count_sub(int val)
         __this_cpu_add_4(__preempt_count, -val);
 }
 
+/*
+ * Because we keep PREEMPT_NEED_RESCHED set when we do _not_ need to reschedule
+ * a decrement which hits zero means we have no preempt_count and should
+ * reschedule.
+ */
 static __always_inline bool __preempt_count_dec_and_test(void)
 {
         GEN_UNARY_RMWcc("decl", __preempt_count, __percpu_arg(0), "e");
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index fd00bb29425d..c1a861829d81 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -262,11 +262,20 @@ struct cpu_hw_events {
         __EVENT_CONSTRAINT(c, n, INTEL_ARCH_EVENT_MASK, \
                           HWEIGHT(n), 0, PERF_X86_EVENT_PEBS_ST_HSW)
 
-#define EVENT_CONSTRAINT_END            \
-        EVENT_CONSTRAINT(0, 0, 0)
+/*
+ * We define the end marker as having a weight of -1
+ * to enable blacklisting of events using a counter bitmask
+ * of zero and thus a weight of zero.
+ * The end marker has a weight that cannot possibly be
+ * obtained from counting the bits in the bitmask.
+ */
+#define EVENT_CONSTRAINT_END { .weight = -1 }
 
+/*
+ * Check for end marker with weight == -1
+ */
 #define for_each_event_constraint(e, c) \
-        for ((e) = (c); (e)->weight; (e)++)
+        for ((e) = (c); (e)->weight != -1; (e)++)
 
 /*
  * Extra registers for specific events.
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index dd74e46828c0..0596e8e0cc19 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -83,6 +83,12 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                 pte_t pte = gup_get_pte(ptep);
                 struct page *page;
 
+                /* Similar to the PMD case, NUMA hinting must take slow path */
+                if (pte_numa(pte)) {
+                        pte_unmap(ptep);
+                        return 0;
+                }
+
                 if ((pte_flags(pte) & (mask | _PAGE_SPECIAL)) != mask) {
                         pte_unmap(ptep);
                         return 0;
@@ -167,6 +173,13 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
                 if (pmd_none(pmd) || pmd_trans_splitting(pmd))
                         return 0;
                 if (unlikely(pmd_large(pmd))) {
+                        /*
+                         * NUMA hinting faults need to be handled in the GUP
+                         * slowpath for accounting purposes and so that they
+                         * can be serialised against THP migration.
+                         */
+                        if (pmd_numa(pmd))
+                                return 0;
                         if (!gup_huge_pmd(pmd, addr, next, write, pages, nr))
                                 return 0;
                 } else {
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 26311f23c824..cb1d557fc22c 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -942,6 +942,7 @@ static int erst_clearer(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info erst_info = {
         .owner          = THIS_MODULE,
         .name           = "erst",
+        .flags          = PSTORE_FLAGS_FRAGILE,
         .open           = erst_open_pstore,
         .close          = erst_close_pstore,
         .read           = erst_reader,
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 7be41e676a64..00a3abe103a5 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -60,7 +60,7 @@ static int s2mps11_clk_prepare(struct clk_hw *hw)
         struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
         int ret;
 
-        ret = regmap_update_bits(s2mps11->iodev->regmap,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic,
                                 S2MPS11_REG_RTC_CTRL,
                                  s2mps11->mask, s2mps11->mask);
         if (!ret)
@@ -74,7 +74,7 @@ static void s2mps11_clk_unprepare(struct clk_hw *hw)
         struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
         int ret;
 
-        ret = regmap_update_bits(s2mps11->iodev->regmap, S2MPS11_REG_RTC_CTRL,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic, S2MPS11_REG_RTC_CTRL,
                            s2mps11->mask, ~s2mps11->mask);
 
         if (!ret)
@@ -174,7 +174,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
                 s2mps11_clk->hw.init = &s2mps11_clks_init[i];
                 s2mps11_clk->mask = 1 << i;
 
-                ret = regmap_read(s2mps11_clk->iodev->regmap,
+                ret = regmap_read(s2mps11_clk->iodev->regmap_pmic,
                                   S2MPS11_REG_RTC_CTRL, &val);
                 if (ret < 0)
                         goto err_reg;
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 5c07a56962db..634c4d6dd45a 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -75,6 +75,7 @@ config CLKSRC_DBX500_PRCMU_SCHED_CLOCK
 config CLKSRC_EFM32
         bool "Clocksource for Energy Micro's EFM32 SoCs" if !ARCH_EFM32
         depends on OF && ARM && (ARCH_EFM32 || COMPILE_TEST)
+        select CLKSRC_MMIO
         default ARCH_EFM32
         help
           Support to use the timers of EFM32 SoCs as clock source and clock
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index 35639cf4e5a2..b9ddd9e3a2f5 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -35,6 +35,5 @@ void __init clocksource_of_init(void)
 
                 init_func = match->data;
                 init_func(np);
-                of_node_put(np);
         }
 }
diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c
index 45ba8aecc729..2a2ea2717f3a 100644
--- a/drivers/clocksource/dw_apb_timer_of.c
+++ b/drivers/clocksource/dw_apb_timer_of.c
@@ -108,12 +108,11 @@ static void __init add_clocksource(struct device_node *source_timer)
 
 static u64 read_sched_clock(void)
 {
-        return __raw_readl(sched_io_base);
+        return ~__raw_readl(sched_io_base);
 }
 
 static const struct of_device_id sptimer_ids[] __initconst = {
         { .compatible = "picochip,pc3x2-rtc" },
-        { .compatible = "snps,dw-apb-timer-sp" },
         { /* Sentinel */ },
 };
 
@@ -151,4 +150,6 @@ static void __init dw_apb_timer_init(struct device_node *timer)
         num_called++;
 }
 CLOCKSOURCE_OF_DECLARE(pc3x2_timer, "picochip,pc3x2-timer", dw_apb_timer_init);
-CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_osc, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_sp, "snps,dw-apb-timer-sp", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer", dw_apb_timer_init);
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index 2fb4695a28d8..a4f6119aafd8 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -179,6 +179,9 @@ static void __init sun4i_timer_init(struct device_node *node)
         writel(TIMER_CTL_CLK_SRC(TIMER_CTL_CLK_SRC_OSC24M),
                timer_base + TIMER_CTL_REG(0));
 
+        /* Make sure timer is stopped before playing with interrupts */
+        sun4i_clkevt_time_stop(0);
+
         ret = setup_irq(irq, &sun4i_timer_irq);
         if (ret)
                 pr_warn("failed to setup irq %d\n", irq);
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index d8e47e502785..4e7f6802e840 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -256,11 +256,6 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
         ticks_per_jiffy = (timer_clk + HZ / 2) / HZ;
 
         /*
-         * Set scale and timer for sched_clock.
-         */
-        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
-
-        /*
          * Setup free-running clocksource timer (interrupts
          * disabled).
          */
@@ -270,6 +265,11 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
         timer_ctrl_clrset(0, TIMER0_EN | TIMER0_RELOAD_EN |
                              TIMER0_DIV(TIMER_DIVIDER_SHIFT));
 
+        /*
+         * Set scale and timer for sched_clock.
+         */
+        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
+
         clocksource_mmio_init(timer_base + TIMER0_VAL_OFF,
                               "armada_370_xp_clocksource",
                               timer_clk, 300, 32, clocksource_mmio_readl_down);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 446687cc2334..c823daaf9043 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -62,6 +62,7 @@ config INTEL_IOATDMA
         tristate "Intel I/OAT DMA support"
         depends on PCI && X86
         select DMA_ENGINE
+        select DMA_ENGINE_RAID
         select DCA
         help
           Enable support for the Intel(R) I/OAT DMA engine present
@@ -112,6 +113,7 @@ config MV_XOR
         bool "Marvell XOR engine support"
         depends on PLAT_ORION
         select DMA_ENGINE
+        select DMA_ENGINE_RAID
         select ASYNC_TX_ENABLE_CHANNEL_SWITCH
         ---help---
           Enable support for the Marvell XOR engine.
@@ -187,6 +189,7 @@ config AMCC_PPC440SPE_ADMA
         tristate "AMCC PPC440SPe ADMA support"
         depends on 440SPe || 440SP
         select DMA_ENGINE
+        select DMA_ENGINE_RAID
         select ARCH_HAS_ASYNC_TX_FIND_CHANNEL
         select ASYNC_TX_ENABLE_CHANNEL_SWITCH
         help
@@ -352,6 +355,7 @@ config NET_DMA
         bool "Network: TCP receive copy offload"
         depends on DMA_ENGINE && NET
         default (INTEL_IOATDMA || FSL_DMA)
+        depends on BROKEN
         help
           This enables the use of DMA engines in the network stack to
           offload receive copy-to-user operations, freeing CPU cycles.
@@ -377,4 +381,7 @@ config DMATEST
           Simple DMA test client. Say N unless you're debugging a
           DMA Device driver.
 
+config DMA_ENGINE_RAID
+        bool
+
 endif
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index f31d647acdfa..2787aba60c6b 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -347,10 +347,6 @@ static struct device *chan2dev(struct dma_chan *chan)
 {
         return &chan->dev->device;
 }
-static struct device *chan2parent(struct dma_chan *chan)
-{
-        return chan->dev->device.parent;
-}
 
 #if defined(VERBOSE_DEBUG)
 static void vdbg_dump_regs(struct at_dma_chan *atchan)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index ea806bdc12ef..ef63b9058f3c 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -912,7 +912,7 @@ struct dmaengine_unmap_pool {
 #define __UNMAP_POOL(x) { .size = x, .name = "dmaengine-unmap-" __stringify(x) }
 static struct dmaengine_unmap_pool unmap_pool[] = {
         __UNMAP_POOL(2),
-        #if IS_ENABLED(CONFIG_ASYNC_TX_DMA)
+        #if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
         __UNMAP_POOL(16),
         __UNMAP_POOL(128),
         __UNMAP_POOL(256),
@@ -1054,7 +1054,7 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
         dma_cookie_t cookie;
         unsigned long flags;
 
-        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOIO);
+        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOWAIT);
         if (!unmap)
                 return -ENOMEM;
 
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 20f9a3aaf926..9dfcaf5c1288 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -539,9 +539,9 @@ static int dmatest_func(void *data)
 
                 um->len = params->buf_size;
                 for (i = 0; i < src_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->srcs[i];
+                        void *buf = thread->srcs[i];
                         struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
 
                         um->addr[i] = dma_map_page(dev->dev, pg, pg_off,
                                                    um->len, DMA_TO_DEVICE);
@@ -559,9 +559,9 @@ static int dmatest_func(void *data)
                 /* map with DMA_BIDIRECTIONAL to force writeback/invalidate */
                 dsts = &um->addr[src_cnt];
                 for (i = 0; i < dst_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->dsts[i];
+                        void *buf = thread->dsts[i];
                         struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
 
                         dsts[i] = dma_map_page(dev->dev, pg, pg_off, um->len,
                                                DMA_BIDIRECTIONAL);
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 7086a16a55f2..f157c6f76b32 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -86,11 +86,6 @@ static void set_desc_cnt(struct fsldma_chan *chan,
         hw->count = CPU_TO_DMA(chan, count, 32);
 }
 
-static u32 get_desc_cnt(struct fsldma_chan *chan, struct fsl_desc_sw *desc)
-{
-        return DMA_TO_CPU(chan, desc->hw.count, 32);
-}
-
 static void set_desc_src(struct fsldma_chan *chan,
                          struct fsl_dma_ld_hw *hw, dma_addr_t src)
 {
@@ -101,16 +96,6 @@ static void set_desc_src(struct fsldma_chan *chan,
         hw->src_addr = CPU_TO_DMA(chan, snoop_bits | src, 64);
 }
 
-static dma_addr_t get_desc_src(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_SATR_SREADTYPE_SNOOP_READ << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.src_addr, 64) & ~snoop_bits;
-}
-
 static void set_desc_dst(struct fsldma_chan *chan,
                          struct fsl_dma_ld_hw *hw, dma_addr_t dst)
 {
@@ -121,16 +106,6 @@ static void set_desc_dst(struct fsldma_chan *chan,
         hw->dst_addr = CPU_TO_DMA(chan, snoop_bits | dst, 64);
 }
 
-static dma_addr_t get_desc_dst(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_DATR_DWRITETYPE_SNOOP_WRITE << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.dst_addr, 64) & ~snoop_bits;
-}
-
 static void set_desc_next(struct fsldma_chan *chan,
                           struct fsl_dma_ld_hw *hw, dma_addr_t next)
 {
@@ -408,7 +383,7 @@ static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
         struct fsl_desc_sw *desc = tx_to_fsl_desc(tx);
         struct fsl_desc_sw *child;
         unsigned long flags;
-        dma_cookie_t cookie;
+        dma_cookie_t cookie = -EINVAL;
 
         spin_lock_irqsave(&chan->desc_lock, flags);
 
@@ -854,10 +829,6 @@ static void fsldma_cleanup_descriptor(struct fsldma_chan *chan,
                                       struct fsl_desc_sw *desc)
 {
         struct dma_async_tx_descriptor *txd = &desc->async_tx;
-        struct device *dev = chan->common.device->dev;
-        dma_addr_t src = get_desc_src(chan, desc);
-        dma_addr_t dst = get_desc_dst(chan, desc);
-        u32 len = get_desc_cnt(chan, desc);
 
         /* Run the link descriptor callback function */
         if (txd->callback) {
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 7807f0ef4e20..53fb0c8365b0 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -54,12 +54,6 @@ static void mv_desc_init(struct mv_xor_desc_slot *desc, unsigned long flags)
         hw_desc->desc_command = (1 << 31);
 }
 
-static u32 mv_desc_get_dest_addr(struct mv_xor_desc_slot *desc)
-{
-        struct mv_xor_desc *hw_desc = desc->hw_desc;
-        return hw_desc->phy_dest_addr;
-}
-
 static void mv_desc_set_byte_count(struct mv_xor_desc_slot *desc,
                                    u32 byte_count)
 {
@@ -787,7 +781,6 @@ static void mv_xor_issue_pending(struct dma_chan *chan)
 /*
  * Perform a transaction to verify the HW works.
  */
-#define MV_XOR_TEST_SIZE 2000
 
 static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
 {
@@ -797,20 +790,21 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
         struct dma_chan *dma_chan;
         dma_cookie_t cookie;
         struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
         int err = 0;
 
-        src = kmalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        src = kmalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
         if (!src)
                 return -ENOMEM;
 
-        dest = kzalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        dest = kzalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
         if (!dest) {
                 kfree(src);
                 return -ENOMEM;
         }
 
         /* Fill in src buffer */
-        for (i = 0; i < MV_XOR_TEST_SIZE; i++)
+        for (i = 0; i < PAGE_SIZE; i++)
                 ((u8 *) src)[i] = (u8)i;
 
         dma_chan = &mv_chan->dmachan;
@@ -819,14 +813,26 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
                 goto out;
         }
 
-        dest_dma = dma_map_single(dma_chan->device->dev, dest,
-                                  MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, 2, GFP_KERNEL);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
+
+        src_dma = dma_map_page(dma_chan->device->dev, virt_to_page(src), 0,
+                                 PAGE_SIZE, DMA_TO_DEVICE);
+        unmap->to_cnt = 1;
+        unmap->addr[0] = src_dma;
 
-        src_dma = dma_map_single(dma_chan->device->dev, src,
-                                 MV_XOR_TEST_SIZE, DMA_TO_DEVICE);
+        dest_dma = dma_map_page(dma_chan->device->dev, virt_to_page(dest), 0,
+                                  PAGE_SIZE, DMA_FROM_DEVICE);
+        unmap->from_cnt = 1;
+        unmap->addr[1] = dest_dma;
+
+        unmap->len = PAGE_SIZE;
 
         tx = mv_xor_prep_dma_memcpy(dma_chan, dest_dma, src_dma,
-                                    MV_XOR_TEST_SIZE, 0);
+                                    PAGE_SIZE, 0);
         cookie = mv_xor_tx_submit(tx);
         mv_xor_issue_pending(dma_chan);
         async_tx_ack(tx);
@@ -841,8 +847,8 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
         }
 
         dma_sync_single_for_cpu(dma_chan->device->dev, dest_dma,
-                                MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
-        if (memcmp(src, dest, MV_XOR_TEST_SIZE)) {
+                                PAGE_SIZE, DMA_FROM_DEVICE);
+        if (memcmp(src, dest, PAGE_SIZE)) {
                 dev_err(dma_chan->device->dev,
                         "Self-test copy failed compare, disabling\n");
                 err = -ENODEV;
@@ -850,6 +856,7 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
         }
 
 free_resources:
+        dmaengine_unmap_put(unmap);
         mv_xor_free_chan_resources(dma_chan);
 out:
         kfree(src);
@@ -867,13 +874,15 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
         dma_addr_t dma_srcs[MV_XOR_NUM_SRC_TEST];
         dma_addr_t dest_dma;
         struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
         struct dma_chan *dma_chan;
         dma_cookie_t cookie;
         u8 cmp_byte = 0;
         u32 cmp_word;
         int err = 0;
+        int src_count = MV_XOR_NUM_SRC_TEST;
 
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                 xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
                 if (!xor_srcs[src_idx]) {
                         while (src_idx--)
@@ -890,13 +899,13 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
         }
 
         /* Fill in src buffers */
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                 u8 *ptr = page_address(xor_srcs[src_idx]);
                 for (i = 0; i < PAGE_SIZE; i++)
                         ptr[i] = (1 << src_idx);
         }
 
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++)
+        for (src_idx = 0; src_idx < src_count; src_idx++)
                 cmp_byte ^= (u8) (1 << src_idx);
 
         cmp_word = (cmp_byte << 24) | (cmp_byte << 16) |
@@ -910,16 +919,29 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
                 goto out;
         }
 
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, src_count + 1,
+                                         GFP_KERNEL);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
+
         /* test xor */
-        dest_dma = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
-                                DMA_FROM_DEVICE);
+        for (i = 0; i < src_count; i++) {
+                unmap->addr[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
+                                              0, PAGE_SIZE, DMA_TO_DEVICE);
+                dma_srcs[i] = unmap->addr[i];
+                unmap->to_cnt++;
+        }
 
-        for (i = 0; i < MV_XOR_NUM_SRC_TEST; i++)
-                dma_srcs[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
-                                           0, PAGE_SIZE, DMA_TO_DEVICE);
+        unmap->addr[src_count] = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
+                                      DMA_FROM_DEVICE);
+        dest_dma = unmap->addr[src_count];
+        unmap->from_cnt = 1;
+        unmap->len = PAGE_SIZE;
 
         tx = mv_xor_prep_dma_xor(dma_chan, dest_dma, dma_srcs,
-                                 MV_XOR_NUM_SRC_TEST, PAGE_SIZE, 0);
+                                 src_count, PAGE_SIZE, 0);
 
         cookie = mv_xor_tx_submit(tx);
         mv_xor_issue_pending(dma_chan);
@@ -948,9 +970,10 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
         }
 
 free_resources:
+        dmaengine_unmap_put(unmap);
         mv_xor_free_chan_resources(dma_chan);
 out:
-        src_idx = MV_XOR_NUM_SRC_TEST;
+        src_idx = src_count;
         while (src_idx--)
                 __free_page(xor_srcs[src_idx]);
         __free_page(dest);
@@ -1176,6 +1199,7 @@ static int mv_xor_probe(struct platform_device *pdev)
                 int i = 0;
 
                 for_each_child_of_node(pdev->dev.of_node, np) {
+                        struct mv_xor_chan *chan;
                         dma_cap_mask_t cap_mask;
                         int irq;
 
@@ -1193,21 +1217,21 @@ static int mv_xor_probe(struct platform_device *pdev)
                                 goto err_channel_add;
                         }
 
-                        xordev->channels[i] =
-                                mv_xor_channel_add(xordev, pdev, i,
-                                                   cap_mask, irq);
-                        if (IS_ERR(xordev->channels[i])) {
-                                ret = PTR_ERR(xordev->channels[i]);
-                                xordev->channels[i] = NULL;
+                        chan = mv_xor_channel_add(xordev, pdev, i,
+                                                  cap_mask, irq);
+                        if (IS_ERR(chan)) {
+                                ret = PTR_ERR(chan);
                                 irq_dispose_mapping(irq);
                                 goto err_channel_add;
                         }
 
+                        xordev->channels[i] = chan;
                         i++;
                 }
         } else if (pdata && pdata->channels) {
                 for (i = 0; i < MV_XOR_MAX_CHANNELS; i++) {
                         struct mv_xor_channel_data *cd;
+                        struct mv_xor_chan *chan;
                         int irq;
 
                         cd = &pdata->channels[i];
@@ -1222,13 +1246,14 @@ static int mv_xor_probe(struct platform_device *pdev)
                                 goto err_channel_add;
                         }
 
-                        xordev->channels[i] =
-                                mv_xor_channel_add(xordev, pdev, i,
-                                                   cd->cap_mask, irq);
-                        if (IS_ERR(xordev->channels[i])) {
-                                ret = PTR_ERR(xordev->channels[i]);
+                        chan = mv_xor_channel_add(xordev, pdev, i,
+                                                  cd->cap_mask, irq);
+                        if (IS_ERR(chan)) {
+                                ret = PTR_ERR(chan);
                                 goto err_channel_add;
                         }
+
+                        xordev->channels[i] = chan;
                 }
         }
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index cdf0483b8f2d..536632f6479c 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2492,12 +2492,9 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
 
 static inline void _init_desc(struct dma_pl330_desc *desc)
 {
-        desc->pchan = NULL;
         desc->req.x = &desc->px;
         desc->req.token = desc;
         desc->rqcfg.swap = SWAP_NO;
-        desc->rqcfg.privileged = 0;
-        desc->rqcfg.insnaccess = 0;
         desc->rqcfg.scctl = SCCTRL0;
         desc->rqcfg.dcctl = DCCTRL0;
         desc->req.cfg = &desc->rqcfg;
@@ -2517,7 +2514,7 @@ static int add_desc(struct dma_pl330_dmac *pdmac, gfp_t flg, int count)
         if (!pdmac)
                 return 0;
 
-        desc = kmalloc(count * sizeof(*desc), flg);
+        desc = kcalloc(count, sizeof(*desc), flg);
         if (!desc)
                 return 0;
 
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 8da48c6b2a38..8bba298535b0 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -533,29 +533,6 @@ static void ppc440spe_desc_init_memcpy(struct ppc440spe_adma_desc_slot *desc,
 }
 
 /**
- * ppc440spe_desc_init_memset - initialize the descriptor for MEMSET operation
- */
-static void ppc440spe_desc_init_memset(struct ppc440spe_adma_desc_slot *desc,
-                                        int value, unsigned long flags)
-{
-        struct dma_cdb *hw_desc = desc->hw_desc;
-
-        memset(desc->hw_desc, 0, sizeof(struct dma_cdb));
-        desc->hw_next = NULL;
-        desc->src_cnt = 1;
-        desc->dst_cnt = 1;
-
-        if (flags & DMA_PREP_INTERRUPT)
-                set_bit(PPC440SPE_DESC_INT, &desc->flags);
-        else
-                clear_bit(PPC440SPE_DESC_INT, &desc->flags);
-
-        hw_desc->sg1u = hw_desc->sg1l = cpu_to_le32((u32)value);
-        hw_desc->sg3u = hw_desc->sg3l = cpu_to_le32((u32)value);
-        hw_desc->opc = DMA_CDB_OPC_DFILL128;
-}
-
-/**
  * ppc440spe_desc_set_src_addr - set source address into the descriptor
  */
 static void ppc440spe_desc_set_src_addr(struct ppc440spe_adma_desc_slot *desc,
@@ -1504,8 +1481,6 @@ static dma_cookie_t ppc440spe_adma_run_tx_complete_actions(
                 struct ppc440spe_adma_chan *chan,
                 dma_cookie_t cookie)
 {
-        int i;
-
         BUG_ON(desc->async_tx.cookie < 0);
         if (desc->async_tx.cookie > 0) {
                 cookie = desc->async_tx.cookie;
@@ -3898,7 +3873,7 @@ static void ppc440spe_adma_init_capabilities(struct ppc440spe_adma_device *adev)
                         ppc440spe_adma_prep_dma_interrupt;
         }
         pr_info("%s: AMCC(R) PPC440SP(E) ADMA Engine: "
-          "( %s%s%s%s%s%s%s)\n",
+          "( %s%s%s%s%s%s)\n",
           dev_name(adev->dev),
           dma_has_cap(DMA_PQ, adev->common.cap_mask) ? "pq " : "",
           dma_has_cap(DMA_PQ_VAL, adev->common.cap_mask) ? "pq_val " : "",
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index bae6c29f5502..17686caf64d5 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -406,7 +406,6 @@ txx9dmac_descriptor_complete(struct txx9dmac_chan *dc,
         dma_async_tx_callback callback;
         void *param;
         struct dma_async_tx_descriptor *txd = &desc->txd;
-        struct txx9dmac_slave *ds = dc->chan.private;
 
         dev_vdbg(chan2dev(&dc->chan), "descriptor %u %p complete\n",
                  txd->cookie, desc);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index b0bb056458a3..281029daf98c 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1623,7 +1623,6 @@ static struct scsi_host_template scsi_driver_template = {
         .cmd_per_lun            = 1,
         .can_queue              = 1,
         .sdev_attrs             = sbp2_scsi_sysfs_attrs,
-        .no_write_same          = 1,
 };
 
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 743fd426f21b..4b9dc836dcf9 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -356,6 +356,7 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info efi_pstore_info = {
         .owner          = THIS_MODULE,
         .name           = "efi",
+        .flags          = PSTORE_FLAGS_FRAGILE,
         .open           = efi_pstore_open,
         .close          = efi_pstore_close,
         .read           = efi_pstore_read,
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index 7b37300973db..2baf0ddf7e02 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -252,7 +252,7 @@ static void msm_gpio_irq_mask(struct irq_data *d)
 
         spin_lock_irqsave(&tlmm_lock, irq_flags);
         writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio));
-        clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
         __clear_bit(gpio, msm_gpio.enabled_irqs);
         spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
@@ -264,7 +264,7 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
 
         spin_lock_irqsave(&tlmm_lock, irq_flags);
         __set_bit(gpio, msm_gpio.enabled_irqs);
-        set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
         writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio));
         spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index fe088a30567a..8b7e719a68c3 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -169,7 +169,8 @@ static irqreturn_t gpio_rcar_irq_handler(int irq, void *dev_id)
         u32 pending;
         unsigned int offset, irqs_handled = 0;
 
-        while ((pending = gpio_rcar_read(p, INTDT))) {
+        while ((pending = gpio_rcar_read(p, INTDT) &
+                          gpio_rcar_read(p, INTMSK))) {
                 offset = __ffs(pending);
                 gpio_rcar_write(p, INTCLR, BIT(offset));
                 generic_handle_irq(irq_find_mapping(p->irq_domain, offset));
diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
index b97d6a6577b9..f9996899c1f2 100644
--- a/drivers/gpio/gpio-twl4030.c
+++ b/drivers/gpio/gpio-twl4030.c
@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_chip *chip, unsigned offset)
         if (offset < TWL4030_GPIO_MAX)
                 ret = twl4030_set_gpio_direction(offset, 1);
         else
-                ret = -EINVAL;
+                ret = -EINVAL;  /* LED outputs can't be set as input */
 
         if (!ret)
                 priv->direction &= ~BIT(offset);
@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
 static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
-        int ret = -EINVAL;
+        int ret = 0;
 
         mutex_lock(&priv->mutex);
-        if (offset < TWL4030_GPIO_MAX)
+        if (offset < TWL4030_GPIO_MAX) {
                 ret = twl4030_set_gpio_direction(offset, 0);
+                if (ret) {
+                        mutex_unlock(&priv->mutex);
+                        return ret;
+                }
+        }
+
+        /*
+         *  LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output
+         */
 
         priv->direction |= BIT(offset);
         mutex_unlock(&priv->mutex);
diff --git a/drivers/gpu/drm/armada/armada_drm.h b/drivers/gpu/drm/armada/armada_drm.h
index eef09ec9a5ff..a72cae03b99b 100644
--- a/drivers/gpu/drm/armada/armada_drm.h
+++ b/drivers/gpu/drm/armada/armada_drm.h
@@ -103,6 +103,7 @@ void armada_drm_queue_unref_work(struct drm_device *,
 extern const struct drm_mode_config_funcs armada_drm_mode_config_funcs;
 
 int armada_fbdev_init(struct drm_device *);
+void armada_fbdev_lastclose(struct drm_device *);
 void armada_fbdev_fini(struct drm_device *);
 
 int armada_overlay_plane_create(struct drm_device *, unsigned long);
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index 4f2b28354915..62d0ff3efddf 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -321,6 +321,11 @@ static struct drm_ioctl_desc armada_ioctls[] = {
                 DRM_UNLOCKED),
 };
 
+static void armada_drm_lastclose(struct drm_device *dev)
+{
+        armada_fbdev_lastclose(dev);
+}
+
 static const struct file_operations armada_drm_fops = {
         .owner                  = THIS_MODULE,
         .llseek                 = no_llseek,
@@ -337,7 +342,7 @@ static struct drm_driver armada_drm_driver = {
         .open                   = NULL,
         .preclose               = NULL,
         .postclose              = NULL,
-        .lastclose              = NULL,
+        .lastclose              = armada_drm_lastclose,
         .unload                 = armada_drm_unload,
         .get_vblank_counter     = drm_vblank_count,
         .enable_vblank          = armada_drm_enable_vblank,
diff --git a/drivers/gpu/drm/armada/armada_fbdev.c b/drivers/gpu/drm/armada/armada_fbdev.c
index dd5ea77dac96..948cb14c561e 100644
--- a/drivers/gpu/drm/armada/armada_fbdev.c
+++ b/drivers/gpu/drm/armada/armada_fbdev.c
@@ -105,9 +105,9 @@ static int armada_fb_create(struct drm_fb_helper *fbh,
         drm_fb_helper_fill_fix(info, dfb->fb.pitches[0], dfb->fb.depth);
         drm_fb_helper_fill_var(info, fbh, sizes->fb_width, sizes->fb_height);
 
-        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08x\n",
-                dfb->fb.width, dfb->fb.height,
-                dfb->fb.bits_per_pixel, obj->phys_addr);
+        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08llx\n",
+                dfb->fb.width, dfb->fb.height, dfb->fb.bits_per_pixel,
+                (unsigned long long)obj->phys_addr);
 
         return 0;
 
@@ -177,6 +177,16 @@ int armada_fbdev_init(struct drm_device *dev)
         return ret;
 }
 
+void armada_fbdev_lastclose(struct drm_device *dev)
+{
+        struct armada_private *priv = dev->dev_private;
+
+        drm_modeset_lock_all(dev);
+        if (priv->fbdev)
+                drm_fb_helper_restore_fbdev_mode(priv->fbdev);
+        drm_modeset_unlock_all(dev);
+}
+
 void armada_fbdev_fini(struct drm_device *dev)
 {
         struct armada_private *priv = dev->dev_private;
@@ -192,11 +202,11 @@ void armada_fbdev_fini(struct drm_device *dev)
                         framebuffer_release(info);
                 }
 
+                drm_fb_helper_fini(fbh);
+
                 if (fbh->fb)
                         fbh->fb->funcs->destroy(fbh->fb);
 
-                drm_fb_helper_fini(fbh);
-
                 priv->fbdev = NULL;
         }
 }
diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c
index 9f2356bae7fd..887816f43476 100644
--- a/drivers/gpu/drm/armada/armada_gem.c
+++ b/drivers/gpu/drm/armada/armada_gem.c
@@ -172,8 +172,9 @@ armada_gem_linear_back(struct drm_device *dev, struct armada_gem_object *obj)
                 obj->dev_addr = obj->linear->start;
         }
 
-        DRM_DEBUG_DRIVER("obj %p phys %#x dev %#x\n",
-                         obj, obj->phys_addr, obj->dev_addr);
+        DRM_DEBUG_DRIVER("obj %p phys %#llx dev %#llx\n", obj,
+                         (unsigned long long)obj->phys_addr,
+                         (unsigned long long)obj->dev_addr);
 
         return 0;
 }
@@ -557,7 +558,6 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
                          * refcount on the gem object itself.
                          */
                         drm_gem_object_reference(obj);
-                        dma_buf_put(buf);
                         return obj;
                 }
         }
@@ -573,6 +573,7 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
         }
 
         dobj->obj.import_attach = attach;
+        get_dma_buf(buf);
 
         /*
          * Don't call dma_buf_map_attachment() here - it maps the
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 0a1e4a5f4234..8835dcddfac3 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -68,6 +68,8 @@
 #define EDID_QUIRK_DETAILED_SYNC_PP             (1 << 6)
 /* Force reduced-blanking timings for detailed modes */
 #define EDID_QUIRK_FORCE_REDUCED_BLANKING       (1 << 7)
+/* Force 8bpc */
+#define EDID_QUIRK_FORCE_8BPC                   (1 << 8)
 
 struct detailed_mode_closure {
         struct drm_connector *connector;
@@ -128,6 +130,9 @@ static struct edid_quirk {
 
         /* Medion MD 30217 PG */
         { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+
+        /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
+        { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
 };
 
 /*
@@ -3435,6 +3440,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
 
         drm_add_display_info(edid, &connector->display_info);
 
+        if (quirks & EDID_QUIRK_FORCE_8BPC)
+                connector->display_info.bpc = 8;
+
         return num_modes;
 }
 EXPORT_SYMBOL(drm_add_edid_modes);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index f53d5246979c..66dd3a001cf1 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -566,11 +566,11 @@ err_unload:
         if (dev->driver->unload)
                 dev->driver->unload(dev);
 err_primary_node:
-        drm_put_minor(dev->primary);
+        drm_unplug_minor(dev->primary);
 err_render_node:
-        drm_put_minor(dev->render);
+        drm_unplug_minor(dev->render);
 err_control_node:
-        drm_put_minor(dev->control);
+        drm_unplug_minor(dev->control);
 err_agp:
         if (dev->driver->bus->agp_destroy)
                 dev->driver->bus->agp_destroy(dev);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 0cab2d045135..5c648425c1e0 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -83,6 +83,14 @@ void i915_update_dri1_breadcrumb(struct drm_device *dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_master_private *master_priv;
 
+        /*
+         * The dri breadcrumb update races against the drm master disappearing.
+         * Instead of trying to fix this (this is by far not the only ums issue)
+         * just don't do the update in kms mode.
+         */
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
+
         if (dev->primary->master) {
                 master_priv = dev->primary->master->driver_priv;
                 if (master_priv->sarea_priv)
@@ -1490,16 +1498,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         spin_lock_init(&dev_priv->uncore.lock);
         spin_lock_init(&dev_priv->mm.object_stat_lock);
         mutex_init(&dev_priv->dpio_lock);
-        mutex_init(&dev_priv->rps.hw_lock);
         mutex_init(&dev_priv->modeset_restore_lock);
 
-        mutex_init(&dev_priv->pc8.lock);
-        dev_priv->pc8.requirements_met = false;
-        dev_priv->pc8.gpu_idle = false;
-        dev_priv->pc8.irqs_disabled = false;
-        dev_priv->pc8.enabled = false;
-        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
-        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
+        intel_pm_setup(dev);
 
         intel_display_crc_init(dev);
 
@@ -1603,7 +1604,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         }
 
         intel_irq_init(dev);
-        intel_pm_init(dev);
         intel_uncore_sanitize(dev);
 
         /* Try to make sure MCHBAR is enabled before poking at it */
@@ -1848,8 +1848,10 @@ void i915_driver_lastclose(struct drm_device * dev)
 
 void i915_driver_preclose(struct drm_device * dev, struct drm_file *file_priv)
 {
+        mutex_lock(&dev->struct_mutex);
         i915_gem_context_close(dev, file_priv);
         i915_gem_release(dev, file_priv);
+        mutex_unlock(&dev->struct_mutex);
 }
 
 void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 2e367a1c6a64..5b7b7e06cb3a 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -651,6 +651,7 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
                 intel_modeset_init_hw(dev);
 
                 drm_modeset_lock_all(dev);
+                drm_mode_config_reset(dev);
                 intel_modeset_setup_hw_state(dev, true);
                 drm_modeset_unlock_all(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index ccdbecca070d..90fcccba17b0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1755,8 +1755,13 @@ struct drm_i915_file_private {
 #define IS_MOBILE(dev)          (INTEL_INFO(dev)->is_mobile)
 #define IS_HSW_EARLY_SDV(dev)   (IS_HASWELL(dev) && \
                                  ((dev)->pdev->device & 0xFF00) == 0x0C00)
-#define IS_ULT(dev)             (IS_HASWELL(dev) && \
+#define IS_BDW_ULT(dev)         (IS_BROADWELL(dev) && \
+                                 (((dev)->pdev->device & 0xf) == 0x2  || \
+                                 ((dev)->pdev->device & 0xf) == 0x6 || \
+                                 ((dev)->pdev->device & 0xf) == 0xe))
+#define IS_HSW_ULT(dev)         (IS_HASWELL(dev) && \
                                  ((dev)->pdev->device & 0xFF00) == 0x0A00)
+#define IS_ULT(dev)             (IS_HSW_ULT(dev) || IS_BDW_ULT(dev))
 #define IS_HSW_GT3(dev)         (IS_HASWELL(dev) && \
                                  ((dev)->pdev->device & 0x00F0) == 0x0020)
 #define IS_PRELIMINARY_HW(intel_info) ((intel_info)->is_preliminary)
@@ -1901,9 +1906,7 @@ void i915_queue_hangcheck(struct drm_device *dev);
 void i915_handle_error(struct drm_device *dev, bool wedged);
 
 extern void intel_irq_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 extern void intel_hpd_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 
 extern void intel_uncore_sanitize(struct drm_device *dev);
 extern void intel_uncore_early_sanitize(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 72a3df32292f..b0f42b9ca037 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -347,10 +347,8 @@ void i915_gem_context_close(struct drm_device *dev, struct drm_file *file)
 {
         struct drm_i915_file_private *file_priv = file->driver_priv;
 
-        mutex_lock(&dev->struct_mutex);
         idr_for_each(&file_priv->context_idr, context_idr_cleanup, NULL);
         idr_destroy(&file_priv->context_idr);
-        mutex_unlock(&dev->struct_mutex);
 }
 
 static struct i915_hw_context *
@@ -423,11 +421,21 @@ static int do_switch(struct i915_hw_context *to)
         if (ret)
                 return ret;
 
-        /* Clear this page out of any CPU caches for coherent swap-in/out. Note
+        /*
+         * Pin can switch back to the default context if we end up calling into
+         * evict_everything - as a last ditch gtt defrag effort that also
+         * switches to the default context. Hence we need to reload from here.
+         */
+        from = ring->last_context;
+
+        /*
+         * Clear this page out of any CPU caches for coherent swap-in/out. Note
          * that thanks to write = false in this call and us not setting any gpu
          * write domains when putting a context object onto the active list
          * (when switching away from it), this won't block.
-         * XXX: We need a real interface to do this instead of trickery. */
+         *
+         * XXX: We need a real interface to do this instead of trickery.
+         */
         ret = i915_gem_object_set_to_gtt_domain(to->obj, false);
         if (ret) {
                 i915_gem_object_unpin(to->obj);
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index b7376533633d..8f3adc7d0dc8 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -88,6 +88,7 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
         } else
                 drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
 
+search_again:
         /* First see if there is a large enough contiguous idle region... */
         list_for_each_entry(vma, &vm->inactive_list, mm_list) {
                 if (mark_free(vma, &unwind_list))
@@ -115,10 +116,17 @@ none:
                 list_del_init(&vma->exec_list);
         }
 
-        /* We expect the caller to unpin, evict all and try again, or give up.
-         * So calling i915_gem_evict_vm() is unnecessary.
+        /* Can we unpin some objects such as idle hw contents,
+         * or pending flips?
          */
-        return -ENOSPC;
+        ret = nonblocking ? -ENOSPC : i915_gpu_idle(dev);
+        if (ret)
+                return ret;
+
+        /* Only idle the GPU and repeat the search once */
+        i915_gem_retire_requests(dev);
+        nonblocking = true;
+        goto search_again;
 
 found:
         /* drm_mm doesn't allow any other other operations while
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 38cb8d44a013..c79dd2b1f70e 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -337,8 +337,8 @@ static void gen8_ppgtt_cleanup(struct i915_address_space *vm)
                 kfree(ppgtt->gen8_pt_dma_addr[i]);
         }
 
-        __free_pages(ppgtt->gen8_pt_pages, ppgtt->num_pt_pages << PAGE_SHIFT);
-        __free_pages(ppgtt->pd_pages, ppgtt->num_pd_pages << PAGE_SHIFT);
+        __free_pages(ppgtt->gen8_pt_pages, get_order(ppgtt->num_pt_pages << PAGE_SHIFT));
+        __free_pages(ppgtt->pd_pages, get_order(ppgtt->num_pd_pages << PAGE_SHIFT));
 }
 
 /**
@@ -1241,6 +1241,11 @@ static inline unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl)
         bdw_gmch_ctl &= BDW_GMCH_GGMS_MASK;
         if (bdw_gmch_ctl)
                 bdw_gmch_ctl = 1 << bdw_gmch_ctl;
+        if (bdw_gmch_ctl > 4) {
+                WARN_ON(!i915_preliminary_hw_support);
+                return 4<<20;
+        }
+
         return bdw_gmch_ctl << 20;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 080f6fd4e839..8b8bde7dce53 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9135,7 +9135,7 @@ intel_pipe_config_compare(struct drm_device *dev,
         if (IS_G4X(dev) || INTEL_INFO(dev)->gen >= 5)
                 PIPE_CONF_CHECK_I(pipe_bpp);
 
-        if (!IS_HASWELL(dev)) {
+        if (!HAS_DDI(dev)) {
                 PIPE_CONF_CHECK_CLOCK_FUZZY(adjusted_mode.crtc_clock);
                 PIPE_CONF_CHECK_CLOCK_FUZZY(port_clock);
         }
@@ -11036,8 +11036,6 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
         }
 
         intel_modeset_check_state(dev);
-
-        drm_mode_config_reset(dev);
 }
 
 void intel_modeset_gem_init(struct drm_device *dev)
@@ -11046,7 +11044,10 @@ void intel_modeset_gem_init(struct drm_device *dev)
 
         intel_setup_overlay(dev);
 
+        drm_modeset_lock_all(dev);
+        drm_mode_config_reset(dev);
         intel_modeset_setup_hw_state(dev, false);
+        drm_modeset_unlock_all(dev);
 }
 
 void intel_modeset_cleanup(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index a18e88b3e425..79f91f26e288 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -821,6 +821,7 @@ void intel_update_sprite_watermarks(struct drm_plane *plane,
                                     uint32_t sprite_width, int pixel_size,
                                     bool enabled, bool scaled);
 void intel_init_pm(struct drm_device *dev);
+void intel_pm_setup(struct drm_device *dev);
 bool intel_fbc_enabled(struct drm_device *dev);
 void intel_update_fbc(struct drm_device *dev);
 void intel_gpu_ips_init(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index f161ac02c4f6..e6f782d1c669 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -451,7 +451,9 @@ static u32 intel_panel_get_backlight(struct drm_device *dev,
 
         spin_lock_irqsave(&dev_priv->backlight.lock, flags);
 
-        if (HAS_PCH_SPLIT(dev)) {
+        if (IS_BROADWELL(dev)) {
+                val = I915_READ(BLC_PWM_PCH_CTL2) & BACKLIGHT_DUTY_CYCLE_MASK;
+        } else if (HAS_PCH_SPLIT(dev)) {
                 val = I915_READ(BLC_PWM_CPU_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
         } else {
                 if (IS_VALLEYVIEW(dev))
@@ -479,6 +481,13 @@ static u32 intel_panel_get_backlight(struct drm_device *dev,
         return val;
 }
 
+static void intel_bdw_panel_set_backlight(struct drm_device *dev, u32 level)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 val = I915_READ(BLC_PWM_PCH_CTL2) & ~BACKLIGHT_DUTY_CYCLE_MASK;
+        I915_WRITE(BLC_PWM_PCH_CTL2, val | level);
+}
+
 static void intel_pch_panel_set_backlight(struct drm_device *dev, u32 level)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -496,7 +505,9 @@ static void intel_panel_actually_set_backlight(struct drm_device *dev,
         DRM_DEBUG_DRIVER("set backlight PWM = %d\n", level);
         level = intel_panel_compute_brightness(dev, pipe, level);
 
-        if (HAS_PCH_SPLIT(dev))
+        if (IS_BROADWELL(dev))
+                return intel_bdw_panel_set_backlight(dev, level);
+        else if (HAS_PCH_SPLIT(dev))
                 return intel_pch_panel_set_backlight(dev, level);
 
         if (is_backlight_combination_mode(dev)) {
@@ -666,7 +677,16 @@ void intel_panel_enable_backlight(struct intel_connector *connector)
                 POSTING_READ(reg);
                 I915_WRITE(reg, tmp | BLM_PWM_ENABLE);
 
-                if (HAS_PCH_SPLIT(dev) &&
+                if (IS_BROADWELL(dev)) {
+                        /*
+                         * Broadwell requires PCH override to drive the PCH
+                         * backlight pin. The above will configure the CPU
+                         * backlight pin, which we don't plan to use.
+                         */
+                        tmp = I915_READ(BLC_PWM_PCH_CTL1);
+                        tmp |= BLM_PCH_OVERRIDE_ENABLE | BLM_PCH_PWM_ENABLE;
+                        I915_WRITE(BLC_PWM_PCH_CTL1, tmp);
+                } else if (HAS_PCH_SPLIT(dev) &&
                     !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) {
                         tmp = I915_READ(BLC_PWM_PCH_CTL1);
                         tmp |= BLM_PCH_PWM_ENABLE;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 6e0d5e075b15..3657ab43c8fd 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5685,6 +5685,7 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         bool is_enabled, enable_requested;
+        unsigned long irqflags;
         uint32_t tmp;
 
         tmp = I915_READ(HSW_PWR_WELL_DRIVER);
@@ -5702,9 +5703,24 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
                                       HSW_PWR_WELL_STATE_ENABLED), 20))
                                 DRM_ERROR("Timeout enabling power well\n");
                 }
+
+                if (IS_BROADWELL(dev)) {
+                        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
+                        I915_WRITE(GEN8_DE_PIPE_IMR(PIPE_B),
+                                   dev_priv->de_irq_mask[PIPE_B]);
+                        I915_WRITE(GEN8_DE_PIPE_IER(PIPE_B),
+                                   ~dev_priv->de_irq_mask[PIPE_B] |
+                                   GEN8_PIPE_VBLANK);
+                        I915_WRITE(GEN8_DE_PIPE_IMR(PIPE_C),
+                                   dev_priv->de_irq_mask[PIPE_C]);
+                        I915_WRITE(GEN8_DE_PIPE_IER(PIPE_C),
+                                   ~dev_priv->de_irq_mask[PIPE_C] |
+                                   GEN8_PIPE_VBLANK);
+                        POSTING_READ(GEN8_DE_PIPE_IER(PIPE_C));
+                        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+                }
         } else {
                 if (enable_requested) {
-                        unsigned long irqflags;
                         enum pipe p;
 
                         I915_WRITE(HSW_PWR_WELL_DRIVER, 0);
@@ -6130,10 +6146,19 @@ int vlv_freq_opcode(int ddr_freq, int val)
         return val;
 }
 
-void intel_pm_init(struct drm_device *dev)
+void intel_pm_setup(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        mutex_init(&dev_priv->rps.hw_lock);
+
+        mutex_init(&dev_priv->pc8.lock);
+        dev_priv->pc8.requirements_met = false;
+        dev_priv->pc8.gpu_idle = false;
+        dev_priv->pc8.irqs_disabled = false;
+        dev_priv->pc8.enabled = false;
+        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
+        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
         INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                           intel_gen6_powersave_work);
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b620337e6d67..c2f09d456300 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -965,6 +965,7 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
         } else if (IS_GEN6(ring->dev)) {
                 mmio = RING_HWS_PGA_GEN6(ring->mmio_base);
         } else {
+                /* XXX: gen8 returns to sanity */
                 mmio = RING_HWS_PGA(ring->mmio_base);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index 0b02078a0b84..25cbe073c388 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -784,6 +784,7 @@ static int gen6_do_reset(struct drm_device *dev)
 int intel_gpu_reset(struct drm_device *dev)
 {
         switch (INTEL_INFO(dev)->gen) {
+        case 8:
         case 7:
         case 6: return gen6_do_reset(dev);
         case 5: return ironlake_do_reset(dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 7a3759f1c41a..98a22e6e27a1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -858,6 +858,12 @@ static int nouveau_pmops_runtime_suspend(struct device *dev)
         if (nouveau_runtime_pm == 0)
                 return -EINVAL;
 
+        /* are we optimus enabled? */
+        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
+                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+                return -EINVAL;
+        }
+
         nv_debug_level(SILENT);
         drm_kms_helper_poll_disable(drm_dev);
         vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_OFF);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 80a20120e625..b1970596a782 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1196,7 +1196,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
         } else if ((rdev->family == CHIP_TAHITI) ||
                    (rdev->family == CHIP_PITCAIRN))
                 fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P8_32x32_8x16);
-        else if (rdev->family == CHIP_VERDE)
+        else if ((rdev->family == CHIP_VERDE) ||
+                 (rdev->family == CHIP_OLAND) ||
+                 (rdev->family == CHIP_HAINAN)) /* for completeness.  HAINAN has no display hw */
                 fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P4_8x16);
 
         switch (radeon_crtc->crtc_id) {
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 0300727a4f70..d08b83c6267b 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -458,7 +458,7 @@ int cik_copy_dma(struct radeon_device *rdev,
                 radeon_ring_write(ring, 0); /* src/dst endian swap */
                 radeon_ring_write(ring, src_offset & 0xffffffff);
                 radeon_ring_write(ring, upper_32_bits(src_offset) & 0xffffffff);
-                radeon_ring_write(ring, dst_offset & 0xfffffffc);
+                radeon_ring_write(ring, dst_offset & 0xffffffff);
                 radeon_ring_write(ring, upper_32_bits(dst_offset) & 0xffffffff);
                 src_offset += cur_size_in_bytes;
                 dst_offset += cur_size_in_bytes;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index e354ce94cdd1..c0425bb6223a 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -2021,7 +2021,7 @@ static struct radeon_asic ci_asic = {
                 .hdmi_setmode = &evergreen_hdmi_setmode,
         },
         .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                 .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .dma = &cik_copy_dma,
                 .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
@@ -2122,7 +2122,7 @@ static struct radeon_asic kv_asic = {
                 .hdmi_setmode = &evergreen_hdmi_setmode,
         },
         .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                 .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .dma = &cik_copy_dma,
                 .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 9f5ff28864f6..1958b36ad0e5 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -508,15 +508,6 @@ static const struct file_operations radeon_driver_kms_fops = {
 #endif
 };
 
-
-static void
-radeon_pci_shutdown(struct pci_dev *pdev)
-{
-        struct drm_device *dev = pci_get_drvdata(pdev);
-
-        radeon_driver_unload_kms(dev);
-}
-
 static struct drm_driver kms_driver = {
         .driver_features =
             DRIVER_USE_AGP |
@@ -586,7 +577,6 @@ static struct pci_driver radeon_kms_pci_driver = {
         .probe = radeon_pci_probe,
         .remove = radeon_pci_remove,
         .driver.pm = &radeon_pm_ops,
-        .shutdown = radeon_pci_shutdown,
 };
 
 static int __init radeon_init(void)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 1c560629575a..e7dab069cccf 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -162,6 +162,16 @@ static void rs690_mc_init(struct radeon_device *rdev)
         base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
         base = G_000100_MC_FB_START(base) << 16;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+        /* Some boards seem to be configured for 128MB of sideport memory,
+         * but really only have 64MB.  Just skip the sideport and use
+         * UMA memory.
+         */
+        if (rdev->mc.igp_sideport_enabled &&
+            (rdev->mc.real_vram_size == (384 * 1024 * 1024))) {
+                base += 128 * 1024 * 1024;
+                rdev->mc.real_vram_size -= 128 * 1024 * 1024;
+                rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
+        }
 
         /* Use K8 direct mapping for fast fb access. */ 
         rdev->fastfb_working = false;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index b249ab9b1eb2..6440eeac22d2 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -169,9 +169,9 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         }
 
         page_offset = ((address - vma->vm_start) >> PAGE_SHIFT) +
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
-        page_last = vma_pages(vma) +
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
+                vma->vm_pgoff - drm_vma_node_start(&bo->vma_node);
+        page_last = vma_pages(vma) + vma->vm_pgoff -
+                drm_vma_node_start(&bo->vma_node);
 
         if (unlikely(page_offset >= bo->num_pages)) {
                 retval = VM_FAULT_SIGBUS;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index a51f48e3e917..45d5b5ab6ca9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -68,6 +68,9 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                                   SVGA_FIFO_3D_HWVERSION));
                 break;
         }
+        case DRM_VMW_PARAM_MAX_SURF_MEMORY:
+                param->value = dev_priv->memory_size;
+                break;
         default:
                 DRM_ERROR("Illegal vmwgfx get param request: %d\n",
                           param->param);
diff --git a/drivers/iio/adc/ad7887.c b/drivers/iio/adc/ad7887.c
index acb7f90359a3..749a6cadab8b 100644
--- a/drivers/iio/adc/ad7887.c
+++ b/drivers/iio/adc/ad7887.c
@@ -200,7 +200,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                         .address = 1,
                         .scan_index = 1,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                 },
                 .channel[1] = {
                         .type = IIO_VOLTAGE,
@@ -210,7 +216,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                         .address = 0,
                         .scan_index = 0,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                 },
                 .channel[2] = IIO_CHAN_SOFT_TIMESTAMP(2),
                 .int_vref_mv = 2500,
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index 3fb7757a1028..368660dfe135 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -651,7 +651,12 @@ static const struct iio_chan_spec adis16448_channels[] = {
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = ADIS16448_BARO_OUT,
                 .scan_index = ADIS16400_SCAN_BARO,
-                .scan_type = IIO_ST('s', 16, 16, 0),
+                .scan_type = {
+                        .sign = 's',
+                        .realbits = 16,
+                        .storagebits = 16,
+                        .endianness = IIO_BE,
+                },
         },
         ADIS16400_TEMP_CHAN(ADIS16448_TEMP_OUT, 12),
         IIO_CHAN_SOFT_TIMESTAMP(11)
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index 21df57130018..0922e39b0ea9 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -387,7 +387,7 @@ static int cm36651_read_int_time(struct cm36651_data *cm36651,
                 return -EINVAL;
         }
 
-        return IIO_VAL_INT_PLUS_MICRO;
+        return IIO_VAL_INT;
 }
 
 static int cm36651_write_int_time(struct cm36651_data *cm36651,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 6be57c38638d..9804fca6bf06 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -207,7 +207,9 @@ isert_free_rx_descriptors(struct isert_conn *isert_conn)
         isert_conn->conn_rx_descs = NULL;
 }
 
+static void isert_cq_tx_work(struct work_struct *);
 static void isert_cq_tx_callback(struct ib_cq *, void *);
+static void isert_cq_rx_work(struct work_struct *);
 static void isert_cq_rx_callback(struct ib_cq *, void *);
 
 static int
@@ -259,26 +261,36 @@ isert_create_device_ib_res(struct isert_device *device)
                 cq_desc[i].device = device;
                 cq_desc[i].cq_index = i;
 
+                INIT_WORK(&cq_desc[i].cq_rx_work, isert_cq_rx_work);
                 device->dev_rx_cq[i] = ib_create_cq(device->ib_device,
                                                 isert_cq_rx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
                                                 ISER_MAX_RX_CQ_LEN, i);
-                if (IS_ERR(device->dev_rx_cq[i]))
+                if (IS_ERR(device->dev_rx_cq[i])) {
+                        ret = PTR_ERR(device->dev_rx_cq[i]);
+                        device->dev_rx_cq[i] = NULL;
                         goto out_cq;
+                }
 
+                INIT_WORK(&cq_desc[i].cq_tx_work, isert_cq_tx_work);
                 device->dev_tx_cq[i] = ib_create_cq(device->ib_device,
                                                 isert_cq_tx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
                                                 ISER_MAX_TX_CQ_LEN, i);
-                if (IS_ERR(device->dev_tx_cq[i]))
+                if (IS_ERR(device->dev_tx_cq[i])) {
+                        ret = PTR_ERR(device->dev_tx_cq[i]);
+                        device->dev_tx_cq[i] = NULL;
                         goto out_cq;
+                }
 
-                if (ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                         goto out_cq;
 
-                if (ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                         goto out_cq;
         }
 
@@ -1724,7 +1736,6 @@ isert_cq_tx_callback(struct ib_cq *cq, void *context)
 {
         struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
 
-        INIT_WORK(&cq_desc->cq_tx_work, isert_cq_tx_work);
         queue_work(isert_comp_wq, &cq_desc->cq_tx_work);
 }
 
@@ -1768,7 +1779,6 @@ isert_cq_rx_callback(struct ib_cq *cq, void *context)
 {
         struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
 
-        INIT_WORK(&cq_desc->cq_rx_work, isert_cq_rx_work);
         queue_work(isert_rx_wq, &cq_desc->cq_rx_work);
 }
 
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 5f9a7ad9b964..8aeec0b4601a 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -625,6 +625,7 @@ static int ems_usb_start(struct ems_usb *dev)
                         usb_unanchor_urb(urb);
                         usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
                                           urb->transfer_dma);
+                        usb_free_urb(urb);
                         break;
                 }
 
@@ -798,8 +799,8 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
          * allowed (MAX_TX_URBS).
          */
         if (!context) {
-                usb_unanchor_urb(urb);
                 usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);
+                usb_free_urb(urb);
 
                 netdev_warn(netdev, "couldn't find free context\n");
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 8ee9d1556e6e..263dd921edc4 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -927,6 +927,9 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
         /* set LED in default state (end of init phase) */
         pcan_usb_pro_set_led(dev, 0, 1);
 
+        kfree(bi);
+        kfree(fi);
+
         return 0;
 
  err_out:
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index b1cb0ffb15c7..6055d397a29e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -447,8 +447,9 @@ irqreturn_t qlcnic_83xx_intr(int irq, void *data)
 
         qlcnic_83xx_poll_process_aen(adapter);
 
-        if (ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
-                ahw->diag_cnt++;
+        if (ahw->diag_test) {
+                if (ahw->diag_test == QLCNIC_INTERRUPT_TEST)
+                        ahw->diag_cnt++;
                 qlcnic_83xx_enable_legacy_msix_mbx_intr(adapter);
                 return IRQ_HANDLED;
         }
@@ -1345,11 +1346,6 @@ static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test,
         }
 
         if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                /* disable and free mailbox interrupt */
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        qlcnic_83xx_enable_mbx_poll(adapter);
-                        qlcnic_83xx_free_mbx_intr(adapter);
-                }
                 adapter->ahw->loopback_state = 0;
                 adapter->ahw->hw_ops->setup_link_event(adapter, 1);
         }
@@ -1363,33 +1359,20 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_host_sds_ring *sds_ring;
-        int ring, err;
+        int ring;
 
         clear_bit(__QLCNIC_DEV_UP, &adapter->state);
         if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                 for (ring = 0; ring < adapter->drv_sds_rings; ring++) {
                         sds_ring = &adapter->recv_ctx->sds_rings[ring];
-                        qlcnic_83xx_disable_intr(adapter, sds_ring);
-                        if (!(adapter->flags & QLCNIC_MSIX_ENABLED))
-                                qlcnic_83xx_enable_mbx_poll(adapter);
+                        if (adapter->flags & QLCNIC_MSIX_ENABLED)
+                                qlcnic_83xx_disable_intr(adapter, sds_ring);
                 }
         }
 
         qlcnic_fw_destroy_ctx(adapter);
         qlcnic_detach(adapter);
 
-        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        err = qlcnic_83xx_setup_mbx_intr(adapter);
-                        qlcnic_83xx_disable_mbx_poll(adapter);
-                        if (err) {
-                                dev_err(&adapter->pdev->dev,
-                                        "%s: failed to setup mbx interrupt\n",
-                                        __func__);
-                                goto out;
-                        }
-                }
-        }
         adapter->ahw->diag_test = 0;
         adapter->drv_sds_rings = drv_sds_rings;
 
@@ -1399,9 +1382,6 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
         if (netif_running(netdev))
                 __qlcnic_up(adapter, netdev);
 
-        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST &&
-            !(adapter->flags & QLCNIC_MSIX_ENABLED))
-                qlcnic_83xx_disable_mbx_poll(adapter);
 out:
         netif_device_attach(netdev);
 }
@@ -3754,6 +3734,19 @@ static void qlcnic_83xx_decode_mbx_rsp(struct qlcnic_adapter *adapter,
         return;
 }
 
+static inline void qlcnic_dump_mailbox_registers(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 offset;
+
+        offset = QLCRDX(ahw, QLCNIC_DEF_INT_MASK);
+        dev_info(&adapter->pdev->dev, "Mbx interrupt mask=0x%x, Mbx interrupt enable=0x%x, Host mbx control=0x%x, Fw mbx control=0x%x",
+                 readl(ahw->pci_base0 + offset),
+                 QLCRDX(ahw, QLCNIC_MBX_INTR_ENBL),
+                 QLCRDX(ahw, QLCNIC_HOST_MBX_CTRL),
+                 QLCRDX(ahw, QLCNIC_FW_MBX_CTRL));
+}
+
 static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
 {
         struct qlcnic_mailbox *mbx = container_of(work, struct qlcnic_mailbox,
@@ -3798,6 +3791,8 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
                                 __func__, cmd->cmd_op, cmd->type, ahw->pci_func,
                                 ahw->op_mode);
                         clear_bit(QLC_83XX_MBX_READY, &mbx->status);
+                        qlcnic_dump_mailbox_registers(adapter);
+                        qlcnic_83xx_get_mbx_data(adapter, cmd);
                         qlcnic_dump_mbx(adapter, cmd);
                         qlcnic_83xx_idc_request_reset(adapter,
                                                       QLCNIC_FORCE_FW_DUMP_KEY);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 4cae6caa6bfa..a6a33508e401 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -662,4 +662,5 @@ pci_ers_result_t qlcnic_83xx_io_error_detected(struct pci_dev *,
                                                pci_channel_state_t);
 pci_ers_result_t qlcnic_83xx_io_slot_reset(struct pci_dev *);
 void qlcnic_83xx_io_resume(struct pci_dev *);
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *);
 #endif
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 89208e5b25d6..918e18ddf038 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -740,6 +740,7 @@ static int qlcnic_83xx_idc_unknown_state(struct qlcnic_adapter *adapter)
         adapter->ahw->idc.err_code = -EIO;
         dev_err(&adapter->pdev->dev,
                 "%s: Device in unknown state\n", __func__);
+        clear_bit(__QLCNIC_RESETTING, &adapter->state);
         return 0;
 }
 
@@ -818,7 +819,6 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
         struct qlcnic_hardware_context *ahw = adapter->ahw;
         struct qlcnic_mailbox *mbx = ahw->mailbox;
         int ret = 0;
-        u32 owner;
         u32 val;
 
         /* Perform NIC configuration based ready state entry actions */
@@ -848,9 +848,9 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
                         set_bit(__QLCNIC_RESETTING, &adapter->state);
                         qlcnic_83xx_idc_enter_need_reset_state(adapter, 1);
                 }  else {
-                        owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
-                        if (ahw->pci_func == owner)
-                                qlcnic_dump_fw(adapter);
+                        netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                                    __func__);
+                        qlcnic_83xx_idc_enter_failed_state(adapter, 1);
                 }
                 return -EIO;
         }
@@ -948,13 +948,26 @@ static int qlcnic_83xx_idc_need_quiesce_state(struct qlcnic_adapter *adapter)
         return 0;
 }
 
-static int qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
+static void qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
 {
-        dev_err(&adapter->pdev->dev, "%s: please restart!!\n", __func__);
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 val, owner;
+
+        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                if (ahw->pci_func == owner) {
+                        qlcnic_83xx_stop_hw(adapter);
+                        qlcnic_dump_fw(adapter);
+                }
+        }
+
+        netdev_warn(adapter->netdev, "%s: Reboot will be required to recover the adapter!!\n",
+                    __func__);
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        adapter->ahw->idc.err_code = -EIO;
+        ahw->idc.err_code = -EIO;
 
-        return 0;
+        return;
 }
 
 static int qlcnic_83xx_idc_quiesce_state(struct qlcnic_adapter *adapter)
@@ -1063,12 +1076,6 @@ void qlcnic_83xx_idc_poll_dev_state(struct work_struct *work)
         adapter->ahw->idc.prev_state = adapter->ahw->idc.curr_state;
         qlcnic_83xx_periodic_tasks(adapter);
 
-        /* Do not reschedule if firmaware is in hanged state and auto
-         * recovery is disabled
-         */
-        if ((adapter->flags & QLCNIC_FW_HANG) && !qlcnic_auto_fw_reset)
-                return;
-
         /* Re-schedule the function */
         if (test_bit(QLC_83XX_MODULE_LOADED, &adapter->ahw->idc.status))
                 qlcnic_schedule_work(adapter, qlcnic_83xx_idc_poll_dev_state,
@@ -1219,10 +1226,10 @@ void qlcnic_83xx_idc_request_reset(struct qlcnic_adapter *adapter, u32 key)
         }
 
         val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
-        if ((val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) ||
-            !qlcnic_auto_fw_reset) {
-                dev_err(&adapter->pdev->dev,
-                        "%s:failed, device in non reset mode\n", __func__);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                            __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 0);
                 qlcnic_83xx_unlock_driver(adapter);
                 return;
         }
@@ -1254,24 +1261,24 @@ static int qlcnic_83xx_copy_bootloader(struct qlcnic_adapter *adapter)
         if (size & 0xF)
                 size = (size + 16) & ~0xF;
 
-        p_cache = kzalloc(size, GFP_KERNEL);
+        p_cache = vzalloc(size);
         if (p_cache == NULL)
                 return -ENOMEM;
 
         ret = qlcnic_83xx_lockless_flash_read32(adapter, src, p_cache,
                                                 size / sizeof(u32));
         if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                 return ret;
         }
         /* 16 byte write to MS memory */
         ret = qlcnic_83xx_ms_mem_write128(adapter, dest, (u32 *)p_cache,
                                           size / 16);
         if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                 return ret;
         }
-        kfree(p_cache);
+        vfree(p_cache);
 
         return ret;
 }
@@ -1939,7 +1946,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
         p_dev->ahw->reset.seq_index = index;
 }
 
-static void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
 {
         p_dev->ahw->reset.seq_index = 0;
 
@@ -1994,6 +2001,14 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter)
         val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
         if (!(val & QLC_83XX_IDC_GRACEFULL_RESET))
                 qlcnic_dump_fw(adapter);
+
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                            __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 1);
+                return err;
+        }
+
         qlcnic_83xx_init_hw(adapter);
 
         if (qlcnic_83xx_copy_bootloader(adapter))
@@ -2073,8 +2088,8 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
                 ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                 adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
                 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
-                adapter->max_sds_rings = ahw->max_rx_ques;
-                adapter->max_tx_rings = ahw->max_tx_ques;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
+                adapter->max_tx_rings = QLCNIC_MAX_TX_RINGS;
         } else {
                 return -EIO;
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index b36c02fafcfd..e3be2760665c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -667,30 +667,25 @@ qlcnic_set_ringparam(struct net_device *dev,
 static int qlcnic_validate_ring_count(struct qlcnic_adapter *adapter,
                                       u8 rx_ring, u8 tx_ring)
 {
+        if (rx_ring == 0 || tx_ring == 0)
+                return -EINVAL;
+
         if (rx_ring != 0) {
                 if (rx_ring > adapter->max_sds_rings) {
-                        netdev_err(adapter->netdev, "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
+                        netdev_err(adapter->netdev,
+                                   "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
                                    rx_ring, adapter->max_sds_rings);
                         return -EINVAL;
                 }
         }
 
          if (tx_ring != 0) {
-                if (qlcnic_82xx_check(adapter) &&
-                    (tx_ring > adapter->max_tx_rings)) {
+                if (tx_ring > adapter->max_tx_rings) {
                         netdev_err(adapter->netdev,
                                    "Invalid ring count, Tx ring count %d should not be greater than max %d driver Tx rings.\n",
                                    tx_ring, adapter->max_tx_rings);
                         return -EINVAL;
                 }
-
-                if (qlcnic_83xx_check(adapter) &&
-                    (tx_ring > QLCNIC_SINGLE_RING)) {
-                        netdev_err(adapter->netdev,
-                                   "Invalid ring count, Tx ring count %d should not be greater than %d driver Tx rings.\n",
-                                   tx_ring, QLCNIC_SINGLE_RING);
-                         return -EINVAL;
-                }
         }
 
         return 0;
@@ -948,6 +943,7 @@ static int qlcnic_irq_test(struct net_device *netdev)
         struct qlcnic_hardware_context *ahw = adapter->ahw;
         struct qlcnic_cmd_args cmd;
         int ret, drv_sds_rings = adapter->drv_sds_rings;
+        int drv_tx_rings = adapter->drv_tx_rings;
 
         if (qlcnic_83xx_check(adapter))
                 return qlcnic_83xx_interrupt_test(netdev);
@@ -980,6 +976,7 @@ free_diag_res:
 
 clear_diag_irq:
         adapter->drv_sds_rings = drv_sds_rings;
+        adapter->drv_tx_rings = drv_tx_rings;
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
 
         return ret;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 0149c9495347..eda6c691d897 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -687,17 +687,11 @@ void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup)
         if (adapter->ahw->linkup && !linkup) {
                 netdev_info(netdev, "NIC Link is down\n");
                 adapter->ahw->linkup = 0;
-                if (netif_running(netdev)) {
-                        netif_carrier_off(netdev);
-                        netif_tx_stop_all_queues(netdev);
-                }
+                netif_carrier_off(netdev);
         } else if (!adapter->ahw->linkup && linkup) {
                 netdev_info(netdev, "NIC Link is up\n");
                 adapter->ahw->linkup = 1;
-                if (netif_running(netdev)) {
-                        netif_carrier_on(netdev);
-                        netif_wake_queue(netdev);
-                }
+                netif_carrier_on(netdev);
         }
 }
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 05c1eef8df13..2c8cac0c6a55 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1178,6 +1178,7 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
         } else {
                 adapter->ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                 adapter->max_tx_rings = QLCNIC_MAX_HW_TX_RINGS;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
                 adapter->flags &= ~QLCNIC_ESWITCH_ENABLED;
         }
 
@@ -1940,7 +1941,6 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test)
         qlcnic_detach(adapter);
 
         adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
-        adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
         adapter->ahw->diag_test = test;
         adapter->ahw->linkup = 0;
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 524f713f6017..f8135725bcf6 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -327,7 +327,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
                 return -EINVAL;
 
         nvdev->start_remove = true;
-        cancel_delayed_work_sync(&ndevctx->dwork);
         cancel_work_sync(&ndevctx->work);
         netif_tx_disable(ndev);
         rndis_filter_device_remove(hdev);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e884ee1fe7ed..27bbe58dcbe7 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1197,6 +1197,9 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
 
         err = -EPROTO;
 
+        if (fragment)
+                goto out;
+
         switch (ip_hdr(skb)->protocol) {
         case IPPROTO_TCP:
                 err = maybe_pull_tail(skb,
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index a344f3d52361..330ef2d06567 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -24,8 +24,8 @@ config PHY_EXYNOS_MIPI_VIDEO
 config OMAP_USB2
         tristate "OMAP USB2 PHY Driver"
         depends on ARCH_OMAP2PLUS
+        depends on USB_PHY
         select GENERIC_PHY
-        select USB_PHY
         select OMAP_CONTROL_USB
         help
           Enable this to support the transceiver that is part of SOC. This
@@ -36,8 +36,8 @@ config OMAP_USB2
 config TWL4030_USB
         tristate "TWL4030 USB Transceiver Driver"
         depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
+        depends on USB_PHY
         select GENERIC_PHY
-        select USB_PHY
         help
           Enable this to support the USB OTG transceiver on TWL4030
           family chips (including the TWL5030 and TPS659x0 devices).
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 03cf8fb81554..58e0e9739028 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -437,23 +437,18 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
         int id;
         struct phy *phy;
 
-        if (!dev) {
-                dev_WARN(dev, "no device provided for PHY\n");
-                ret = -EINVAL;
-                goto err0;
-        }
+        if (WARN_ON(!dev))
+                return ERR_PTR(-EINVAL);
 
         phy = kzalloc(sizeof(*phy), GFP_KERNEL);
-        if (!phy) {
-                ret = -ENOMEM;
-                goto err0;
-        }
+        if (!phy)
+                return ERR_PTR(-ENOMEM);
 
         id = ida_simple_get(&phy_ida, 0, 0, GFP_KERNEL);
         if (id < 0) {
                 dev_err(dev, "unable to get id\n");
                 ret = id;
-                goto err0;
+                goto free_phy;
         }
 
         device_initialize(&phy->dev);
@@ -468,11 +463,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
 
         ret = dev_set_name(&phy->dev, "phy-%s.%d", dev_name(dev), id);
         if (ret)
-                goto err1;
+                goto put_dev;
 
         ret = device_add(&phy->dev);
         if (ret)
-                goto err1;
+                goto put_dev;
 
         if (pm_runtime_enabled(dev)) {
                 pm_runtime_enable(&phy->dev);
@@ -481,12 +476,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
 
         return phy;
 
-err1:
-        ida_remove(&phy_ida, phy->id);
+put_dev:
         put_device(&phy->dev);
+        ida_remove(&phy_ida, phy->id);
+free_phy:
         kfree(phy);
-
-err0:
         return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(phy_create);
diff --git a/drivers/pinctrl/sh-pfc/sh_pfc.h b/drivers/pinctrl/sh-pfc/sh_pfc.h
index 11bd0d970a52..e2142956a8e5 100644
--- a/drivers/pinctrl/sh-pfc/sh_pfc.h
+++ b/drivers/pinctrl/sh-pfc/sh_pfc.h
@@ -254,7 +254,7 @@ struct sh_pfc_soc_info {
 #define PINMUX_GPIO(_pin)                                               \
         [GPIO_##_pin] = {                                               \
                 .pin = (u16)-1,                                         \
-                .name = __stringify(name),                              \
+                .name = __stringify(GPIO_##_pin),                       \
                 .enum_id = _pin##_DATA,                                 \
         }
 
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 333677d68d0e..9e61922d8230 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -438,7 +438,7 @@ common_reg:
         platform_set_drvdata(pdev, s2mps11);
 
         config.dev = &pdev->dev;
-        config.regmap = iodev->regmap;
+        config.regmap = iodev->regmap_pmic;
         config.driver_data = s2mps11;
         for (i = 0; i < S2MPS11_REGULATOR_MAX; i++) {
                 if (!reg_np) {
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 596480022b0a..38a1257e76e1 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -471,7 +471,7 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
                 schedule_delayed_work(&tgt->sess_del_work, 0);
         else
                 schedule_delayed_work(&tgt->sess_del_work,
-                    jiffies - sess->expires);
+                    sess->expires - jiffies);
 }
 
 /* ha->hardware_lock supposed to be held on entry */
@@ -550,13 +550,14 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
         struct scsi_qla_host *vha = tgt->vha;
         struct qla_hw_data *ha = vha->hw;
         struct qla_tgt_sess *sess;
-        unsigned long flags;
+        unsigned long flags, elapsed;
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
         while (!list_empty(&tgt->del_sess_list)) {
                 sess = list_entry(tgt->del_sess_list.next, typeof(*sess),
                     del_list_entry);
-                if (time_after_eq(jiffies, sess->expires)) {
+                elapsed = jiffies;
+                if (time_after_eq(elapsed, sess->expires)) {
                         qlt_undelete_sess(sess);
 
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf004,
@@ -566,7 +567,7 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
                         ha->tgt.tgt_ops->put_sess(sess);
                 } else {
                         schedule_delayed_work(&tgt->sess_del_work,
-                            jiffies - sess->expires);
+                            sess->expires - elapsed);
                         break;
                 }
         }
@@ -4290,6 +4291,7 @@ int qlt_lport_register(struct qla_tgt_func_tmpl *qla_tgt_ops, u64 wwpn,
                 if (rc != 0) {
                         ha->tgt.tgt_ops = NULL;
                         ha->tgt.target_lport_ptr = NULL;
+                        scsi_host_put(host);
                 }
                 mutex_unlock(&qla_tgt_mutex);
                 return rc;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index 8f02bf66e20b..4964d2a2fc7d 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -446,7 +446,7 @@ int comedi_load_firmware(struct comedi_device *dev,
                 release_firmware(fw);
         }
 
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 EXPORT_SYMBOL_GPL(comedi_load_firmware);
 
diff --git a/drivers/staging/comedi/drivers/8255_pci.c b/drivers/staging/comedi/drivers/8255_pci.c
index 432e3f9c3301..c55f234b29e6 100644
--- a/drivers/staging/comedi/drivers/8255_pci.c
+++ b/drivers/staging/comedi/drivers/8255_pci.c
@@ -63,7 +63,8 @@ enum pci_8255_boardid {
         BOARD_ADLINK_PCI7296,
         BOARD_CB_PCIDIO24,
         BOARD_CB_PCIDIO24H,
-        BOARD_CB_PCIDIO48H,
+        BOARD_CB_PCIDIO48H_OLD,
+        BOARD_CB_PCIDIO48H_NEW,
         BOARD_CB_PCIDIO96H,
         BOARD_NI_PCIDIO96,
         BOARD_NI_PCIDIO96B,
@@ -106,11 +107,16 @@ static const struct pci_8255_boardinfo pci_8255_boards[] = {
                 .dio_badr       = 2,
                 .n_8255         = 1,
         },
-        [BOARD_CB_PCIDIO48H] = {
+        [BOARD_CB_PCIDIO48H_OLD] = {
                 .name           = "cb_pci-dio48h",
                 .dio_badr       = 1,
                 .n_8255         = 2,
         },
+        [BOARD_CB_PCIDIO48H_NEW] = {
+                .name           = "cb_pci-dio48h",
+                .dio_badr       = 2,
+                .n_8255         = 2,
+        },
         [BOARD_CB_PCIDIO96H] = {
                 .name           = "cb_pci-dio96h",
                 .dio_badr       = 2,
@@ -263,7 +269,10 @@ static DEFINE_PCI_DEVICE_TABLE(pci_8255_pci_table) = {
         { PCI_VDEVICE(ADLINK, 0x7296), BOARD_ADLINK_PCI7296 },
         { PCI_VDEVICE(CB, 0x0028), BOARD_CB_PCIDIO24 },
         { PCI_VDEVICE(CB, 0x0014), BOARD_CB_PCIDIO24H },
-        { PCI_VDEVICE(CB, 0x000b), BOARD_CB_PCIDIO48H },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, 0x0000, 0x0000),
+          .driver_data = BOARD_CB_PCIDIO48H_OLD },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, PCI_VENDOR_ID_CB, 0x000b),
+          .driver_data = BOARD_CB_PCIDIO48H_NEW },
         { PCI_VDEVICE(CB, 0x0017), BOARD_CB_PCIDIO96H },
         { PCI_VDEVICE(NI, 0x0160), BOARD_NI_PCIDIO96 },
         { PCI_VDEVICE(NI, 0x1630), BOARD_NI_PCIDIO96B },
diff --git a/drivers/staging/iio/magnetometer/hmc5843.c b/drivers/staging/iio/magnetometer/hmc5843.c
index 99421f90d189..0485d7f39867 100644
--- a/drivers/staging/iio/magnetometer/hmc5843.c
+++ b/drivers/staging/iio/magnetometer/hmc5843.c
@@ -451,7 +451,12 @@ done:
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE) |  \
                         BIT(IIO_CHAN_INFO_SAMP_FREQ),                   \
                 .scan_index = idx,                                      \
-                .scan_type = IIO_ST('s', 16, 16, IIO_BE),               \
+                .scan_type = {                                          \
+                        .sign = 's',                                    \
+                        .realbits = 16,                                 \
+                        .storagebits = 16,                              \
+                        .endianness = IIO_BE,                           \
+                },                                                      \
         }
 
 static const struct iio_chan_spec hmc5843_channels[] = {
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 6bd015ac9d68..96e4eee344ef 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -88,8 +88,9 @@ static int imx_drm_driver_unload(struct drm_device *drm)
 
         imx_drm_device_put();
 
-        drm_mode_config_cleanup(imxdrm->drm);
+        drm_vblank_cleanup(imxdrm->drm);
         drm_kms_helper_poll_fini(imxdrm->drm);
+        drm_mode_config_cleanup(imxdrm->drm);
 
         return 0;
 }
@@ -199,8 +200,8 @@ static void imx_drm_driver_preclose(struct drm_device *drm,
         if (!file->is_master)
                 return;
 
-        for (i = 0; i < 4; i++)
-                imx_drm_disable_vblank(drm , i);
+        for (i = 0; i < MAX_CRTC; i++)
+                imx_drm_disable_vblank(drm, i);
 }
 
 static const struct file_operations imx_drm_driver_fops = {
@@ -376,8 +377,6 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
         struct imx_drm_device *imxdrm = __imx_drm_device();
         int ret;
 
-        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
-                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
         ret = drm_mode_crtc_set_gamma_size(imx_drm_crtc->crtc, 256);
         if (ret)
                 return ret;
@@ -385,6 +384,9 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
         drm_crtc_helper_add(imx_drm_crtc->crtc,
                         imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
 
+        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
+                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
+
         drm_mode_group_reinit(imxdrm->drm);
 
         return 0;
@@ -428,11 +430,11 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
         ret = drm_mode_group_init_legacy_group(imxdrm->drm,
                         &imxdrm->drm->primary->mode_group);
         if (ret)
-                goto err_init;
+                goto err_kms;
 
         ret = drm_vblank_init(imxdrm->drm, MAX_CRTC);
         if (ret)
-                goto err_init;
+                goto err_kms;
 
         /*
          * with vblank_disable_allowed = true, vblank interrupt will be disabled
@@ -441,12 +443,19 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
          */
         imxdrm->drm->vblank_disable_allowed = true;
 
-        if (!imx_drm_device_get())
+        if (!imx_drm_device_get()) {
                 ret = -EINVAL;
+                goto err_vblank;
+        }
 
-        ret = 0;
+        mutex_unlock(&imxdrm->mutex);
+        return 0;
 
-err_init:
+err_vblank:
+        drm_vblank_cleanup(drm);
+err_kms:
+        drm_kms_helper_poll_fini(drm);
+        drm_mode_config_cleanup(drm);
         mutex_unlock(&imxdrm->mutex);
 
         return ret;
@@ -492,6 +501,15 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
 
         mutex_lock(&imxdrm->mutex);
 
+        /*
+         * The vblank arrays are dimensioned by MAX_CRTC - we can't
+         * pass IDs greater than this to those functions.
+         */
+        if (imxdrm->pipes >= MAX_CRTC) {
+                ret = -EINVAL;
+                goto err_busy;
+        }
+
         if (imxdrm->drm->open_count) {
                 ret = -EBUSY;
                 goto err_busy;
@@ -528,6 +546,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
         return 0;
 
 err_register:
+        list_del(&imx_drm_crtc->list);
         kfree(imx_drm_crtc);
 err_alloc:
 err_busy:
diff --git a/drivers/staging/imx-drm/imx-tve.c b/drivers/staging/imx-drm/imx-tve.c
index 680f4c8fa081..2c44fef8d58b 100644
--- a/drivers/staging/imx-drm/imx-tve.c
+++ b/drivers/staging/imx-drm/imx-tve.c
@@ -114,7 +114,6 @@ struct imx_tve {
         struct drm_encoder encoder;
         struct imx_drm_encoder *imx_drm_encoder;
         struct device *dev;
-        spinlock_t enable_lock; /* serializes tve_enable/disable */
         spinlock_t lock;        /* register lock */
         bool enabled;
         int mode;
@@ -146,10 +145,8 @@ __releases(&tve->lock)
 
 static void tve_enable(struct imx_tve *tve)
 {
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&tve->enable_lock, flags);
         if (!tve->enabled) {
                 tve->enabled = true;
                 clk_prepare_enable(tve->clk);
@@ -169,23 +166,18 @@ static void tve_enable(struct imx_tve *tve)
                              TVE_CD_SM_IEN |
                              TVE_CD_LM_IEN |
                              TVE_CD_MON_END_IEN);
-
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 
 static void tve_disable(struct imx_tve *tve)
 {
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&tve->enable_lock, flags);
         if (tve->enabled) {
                 tve->enabled = false;
                 ret = regmap_update_bits(tve->regmap, TVE_COM_CONF_REG,
                                          TVE_IPU_CLK_EN | TVE_EN, 0);
                 clk_disable_unprepare(tve->clk);
         }
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 
 static int tve_setup_tvout(struct imx_tve *tve)
@@ -601,7 +593,6 @@ static int imx_tve_probe(struct platform_device *pdev)
 
         tve->dev = &pdev->dev;
         spin_lock_init(&tve->lock);
-        spin_lock_init(&tve->enable_lock);
 
         ddc_node = of_parse_phandle(np, "ddc", 0);
         if (ddc_node) {
diff --git a/drivers/staging/imx-drm/ipu-v3/ipu-common.c b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
index 7a22ce619ed2..97ca6924dbb3 100644
--- a/drivers/staging/imx-drm/ipu-v3/ipu-common.c
+++ b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
@@ -996,35 +996,35 @@ static const struct ipu_platform_reg client_reg[] = {
         },
 };
 
+static DEFINE_MUTEX(ipu_client_id_mutex);
 static int ipu_client_id;
 
-static int ipu_add_subdevice_pdata(struct device *dev,
-                const struct ipu_platform_reg *reg)
-{
-        struct platform_device *pdev;
-
-        pdev = platform_device_register_data(dev, reg->name, ipu_client_id++,
-                        &reg->pdata, sizeof(struct ipu_platform_reg));
-
-        return PTR_ERR_OR_ZERO(pdev);
-}
-
 static int ipu_add_client_devices(struct ipu_soc *ipu)
 {
-        int ret;
-        int i;
+        struct device *dev = ipu->dev;
+        unsigned i;
+        int id, ret;
+
+        mutex_lock(&ipu_client_id_mutex);
+        id = ipu_client_id;
+        ipu_client_id += ARRAY_SIZE(client_reg);
+        mutex_unlock(&ipu_client_id_mutex);
 
         for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
                 const struct ipu_platform_reg *reg = &client_reg[i];
-                ret = ipu_add_subdevice_pdata(ipu->dev, reg);
-                if (ret)
+                struct platform_device *pdev;
+
+                pdev = platform_device_register_data(dev, reg->name,
+                        id++, &reg->pdata, sizeof(reg->pdata));
+
+                if (IS_ERR(pdev))
                         goto err_register;
         }
 
         return 0;
 
 err_register:
-        platform_device_unregister_children(to_platform_device(ipu->dev));
+        platform_device_unregister_children(to_platform_device(dev));
 
         return ret;
 }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index d70e9119e906..00867190413c 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -465,6 +465,7 @@ int iscsit_del_np(struct iscsi_np *np)
                  */
                 send_sig(SIGINT, np->np_thread, 1);
                 kthread_stop(np->np_thread);
+                np->np_thread = NULL;
         }
 
         np->np_transport->iscsit_free_np(np);
@@ -823,24 +824,22 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         if (((hdr->flags & ISCSI_FLAG_CMD_READ) ||
              (hdr->flags & ISCSI_FLAG_CMD_WRITE)) && !hdr->data_length) {
                 /*
-                 * Vmware ESX v3.0 uses a modified Cisco Initiator (v3.4.2)
-                 * that adds support for RESERVE/RELEASE.  There is a bug
-                 * add with this new functionality that sets R/W bits when
-                 * neither CDB carries any READ or WRITE datapayloads.
+                 * From RFC-3720 Section 10.3.1:
+                 *
+                 * "Either or both of R and W MAY be 1 when either the
+                 *  Expected Data Transfer Length and/or Bidirectional Read
+                 *  Expected Data Transfer Length are 0"
+                 *
+                 * For this case, go ahead and clear the unnecssary bits
+                 * to avoid any confusion with ->data_direction.
                  */
-                if ((hdr->cdb[0] == 0x16) || (hdr->cdb[0] == 0x17)) {
-                        hdr->flags &= ~ISCSI_FLAG_CMD_READ;
-                        hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
-                        goto done;
-                }
+                hdr->flags &= ~ISCSI_FLAG_CMD_READ;
+                hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
 
-                pr_err("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
+                pr_warn("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
                         " set when Expected Data Transfer Length is 0 for"
-                        " CDB: 0x%02x. Bad iSCSI Initiator.\n", hdr->cdb[0]);
-                return iscsit_add_reject_cmd(cmd,
-                                             ISCSI_REASON_BOOKMARK_INVALID, buf);
+                        " CDB: 0x%02x, Fixing up flags\n", hdr->cdb[0]);
         }
-done:
 
         if (!(hdr->flags & ISCSI_FLAG_CMD_READ) &&
             !(hdr->flags & ISCSI_FLAG_CMD_WRITE) && (hdr->data_length != 0)) {
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index e3318edb233d..1c0088fe9e99 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -474,7 +474,8 @@ static ssize_t __iscsi_##prefix##_store_##name(				\
                                                                         \
         if (!capable(CAP_SYS_ADMIN))                                    \
                 return -EPERM;                                          \
-                                                                        \
+        if (count >= sizeof(auth->name))                                \
+                return -EINVAL;                                         \
         snprintf(auth->name, sizeof(auth->name), "%s", page);           \
         if (!strncmp("NULL", auth->name, 4))                            \
                 auth->naf_flags &= ~flags;                              \
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 4eb93b2b6473..e29279e6b577 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1403,11 +1403,6 @@ old_sess_out:
 
 out:
         stop = kthread_should_stop();
-        if (!stop && signal_pending(current)) {
-                spin_lock_bh(&np->np_thread_lock);
-                stop = (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN);
-                spin_unlock_bh(&np->np_thread_lock);
-        }
         /* Wait for another socket.. */
         if (!stop)
                 return 1;
@@ -1415,7 +1410,6 @@ exit:
         iscsi_stop_login_thread_timer(np);
         spin_lock_bh(&np->np_thread_lock);
         np->np_thread_state = ISCSI_NP_THREAD_EXIT;
-        np->np_thread = NULL;
         spin_unlock_bh(&np->np_thread_lock);
 
         return 0;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 207b340498a3..d06de84b069b 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1106,6 +1106,11 @@ int se_dev_set_block_size(struct se_device *dev, u32 block_size)
         dev->dev_attrib.block_size = block_size;
         pr_debug("dev[%p]: SE Device block_size changed to %u\n",
                         dev, block_size);
+
+        if (dev->dev_attrib.max_bytes_per_io)
+                dev->dev_attrib.hw_max_sectors =
+                        dev->dev_attrib.max_bytes_per_io / block_size;
+
         return 0;
 }
 
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 0e34cda3271e..78241a53b555 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -66,9 +66,8 @@ static int fd_attach_hba(struct se_hba *hba, u32 host_id)
         pr_debug("CORE_HBA[%d] - TCM FILEIO HBA Driver %s on Generic"
                 " Target Core Stack %s\n", hba->hba_id, FD_VERSION,
                 TARGET_CORE_MOD_VERSION);
-        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic"
-                " MaxSectors: %u\n",
-                hba->hba_id, fd_host->fd_host_id, FD_MAX_SECTORS);
+        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic\n",
+                hba->hba_id, fd_host->fd_host_id);
 
         return 0;
 }
@@ -220,7 +219,8 @@ static int fd_configure_device(struct se_device *dev)
         }
 
         dev->dev_attrib.hw_block_size = fd_dev->fd_block_size;
-        dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
+        dev->dev_attrib.max_bytes_per_io = FD_MAX_BYTES;
+        dev->dev_attrib.hw_max_sectors = FD_MAX_BYTES / fd_dev->fd_block_size;
         dev->dev_attrib.hw_queue_depth = FD_MAX_DEVICE_QUEUE_DEPTH;
 
         if (fd_dev->fbd_flags & FDBD_HAS_BUFFERED_IO_WCE) {
diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
index 37ffc5bd2399..d7772c167685 100644
--- a/drivers/target/target_core_file.h
+++ b/drivers/target/target_core_file.h
@@ -7,7 +7,10 @@
 #define FD_DEVICE_QUEUE_DEPTH   32
 #define FD_MAX_DEVICE_QUEUE_DEPTH 128
 #define FD_BLOCKSIZE            512
-#define FD_MAX_SECTORS          2048
+/*
+ * Limited by the number of iovecs (2048) per vfs_[writev,readv] call
+ */
+#define FD_MAX_BYTES            8388608
 
 #define RRF_EMULATE_CDB         0x01
 #define RRF_GOT_LBA             0x02
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index f697f8baec54..2a573de19a9f 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -278,7 +278,6 @@ struct se_node_acl *core_tpg_check_initiator_node_acl(
         snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
         acl->se_tpg = tpg;
         acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
         acl->dynamic_node_acl = 1;
 
         tpg->se_tpg_tfo->set_default_node_attributes(acl);
@@ -406,7 +405,6 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
         snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
         acl->se_tpg = tpg;
         acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
 
         tpg->se_tpg_tfo->set_default_node_attributes(acl);
 
@@ -658,15 +656,9 @@ static int core_tpg_setup_virtual_lun0(struct se_portal_group *se_tpg)
         spin_lock_init(&lun->lun_sep_lock);
         init_completion(&lun->lun_ref_comp);
 
-        ret = percpu_ref_init(&lun->lun_ref, core_tpg_lun_ref_release);
-        if (ret < 0)
-                return ret;
-
         ret = core_tpg_post_addlun(se_tpg, lun, lun_access, dev);
-        if (ret < 0) {
-                percpu_ref_cancel_init(&lun->lun_ref);
+        if (ret < 0)
                 return ret;
-        }
 
         return 0;
 }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 268b62768f2b..34aacaaae14a 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -93,6 +93,7 @@ struct n_tty_data {
         size_t canon_head;
         size_t echo_head;
         size_t echo_commit;
+        size_t echo_mark;
         DECLARE_BITMAP(char_map, 256);
 
         /* private to n_tty_receive_overrun (single-threaded) */
@@ -336,6 +337,7 @@ static void reset_buffer_flags(struct n_tty_data *ldata)
 {
         ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
         ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
+        ldata->echo_mark = 0;
         ldata->line_start = 0;
 
         ldata->erasing = 0;
@@ -787,6 +789,7 @@ static void commit_echoes(struct tty_struct *tty)
         size_t head;
 
         head = ldata->echo_head;
+        ldata->echo_mark = head;
         old = ldata->echo_commit - ldata->echo_tail;
 
         /* Process committed echoes if the accumulated # of bytes
@@ -811,10 +814,11 @@ static void process_echoes(struct tty_struct *tty)
         size_t echoed;
 
         if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
-            ldata->echo_commit == ldata->echo_tail)
+            ldata->echo_mark == ldata->echo_tail)
                 return;
 
         mutex_lock(&ldata->output_lock);
+        ldata->echo_commit = ldata->echo_mark;
         echoed = __process_echoes(tty);
         mutex_unlock(&ldata->output_lock);
 
@@ -822,6 +826,7 @@ static void process_echoes(struct tty_struct *tty)
                 tty->ops->flush_chars(tty);
 }
 
+/* NB: echo_mark and echo_head should be equivalent here */
 static void flush_echoes(struct tty_struct *tty)
 {
         struct n_tty_data *ldata = tty->disc_data;
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 4658e3e0ec42..06525f10e364 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -96,7 +96,8 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
         if (offset == UART_LCR) {
                 int tries = 1000;
                 while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                 return;
                         dw8250_force_idle(p);
                         writeb(value, p->membase + (UART_LCR << p->regshift));
@@ -132,7 +133,8 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
         if (offset == UART_LCR) {
                 int tries = 1000;
                 while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                 return;
                         dw8250_force_idle(p);
                         writel(value, p->membase + (UART_LCR << p->regshift));
@@ -455,6 +457,8 @@ MODULE_DEVICE_TABLE(of, dw8250_of_match);
 static const struct acpi_device_id dw8250_acpi_match[] = {
         { "INT33C4", 0 },
         { "INT33C5", 0 },
+        { "INT3434", 0 },
+        { "INT3435", 0 },
         { "80860F0A", 0 },
         { },
 };
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index e46e9f3f19b9..f619ad5b5eae 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -240,6 +240,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                         continue;
                         }
 
+#ifdef SUPPORT_SYSRQ
                         /*
                          * uart_handle_sysrq_char() doesn't work if
                          * spinlocked, for some reason
@@ -253,6 +254,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                 }
                                 spin_lock(&port->lock);
                         }
+#endif
 
                         port->icount.rx++;
 
diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
index 22fad8ad5ac2..d8a55e87877f 100644
--- a/drivers/tty/tty_ldsem.c
+++ b/drivers/tty/tty_ldsem.c
@@ -86,11 +86,21 @@ static inline long ldsem_atomic_update(long delta, struct ld_semaphore *sem)
         return atomic_long_add_return(delta, (atomic_long_t *)&sem->count);
 }
 
+/*
+ * ldsem_cmpxchg() updates @*old with the last-known sem->count value.
+ * Returns 1 if count was successfully changed; @*old will have @new value.
+ * Returns 0 if count was not changed; @*old will have most recent sem->count
+ */
 static inline int ldsem_cmpxchg(long *old, long new, struct ld_semaphore *sem)
 {
-        long tmp = *old;
-        *old = atomic_long_cmpxchg(&sem->count, *old, new);
-        return *old == tmp;
+        long tmp = atomic_long_cmpxchg(&sem->count, *old, new);
+        if (tmp == *old) {
+                *old = new;
+                return 1;
+        } else {
+                *old = tmp;
+                return 0;
+        }
 }
 
 /*
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 5d8981c5235e..6e73f8cd60e5 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -642,6 +642,10 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                         : CI_ROLE_GADGET;
         }
 
+        /* only update vbus status for peripheral */
+        if (ci->role == CI_ROLE_GADGET)
+                ci_handle_vbus_change(ci);
+
         ret = ci_role_start(ci, ci->role);
         if (ret) {
                 dev_err(dev, "can't start %s role\n", ci_role(ci)->name);
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 59e6020ea753..526cd77563d8 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -88,7 +88,8 @@ static int host_start(struct ci_hdrc *ci)
         return ret;
 
 disable_reg:
-        regulator_disable(ci->platdata->reg_vbus);
+        if (ci->platdata->reg_vbus)
+                regulator_disable(ci->platdata->reg_vbus);
 
 put_hcd:
         usb_put_hcd(hcd);
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index b34c81969cba..69d20fbb38a2 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1795,9 +1795,6 @@ static int udc_start(struct ci_hdrc *ci)
         pm_runtime_no_callbacks(&ci->gadget.dev);
         pm_runtime_enable(&ci->gadget.dev);
 
-        /* Update ci->vbus_active */
-        ci_handle_vbus_change(ci);
-
         return retval;
 
 destroy_eps:
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 4d387596f3f0..0b23a8639311 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -854,13 +854,11 @@ static int wdm_manage_power(struct usb_interface *intf, int on)
 {
         /* need autopm_get/put here to ensure the usbcore sees the new value */
         int rv = usb_autopm_get_interface(intf);
-        if (rv < 0)
-                goto err;
 
         intf->needs_remote_wakeup = on;
-        usb_autopm_put_interface(intf);
-err:
-        return rv;
+        if (!rv)
+                usb_autopm_put_interface(intf);
+        return 0;
 }
 
 static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 74f9cf02da07..a49217ae3533 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -455,9 +455,6 @@ static int dwc3_probe(struct platform_device *pdev)
         if (IS_ERR(regs))
                 return PTR_ERR(regs);
 
-        usb_phy_set_suspend(dwc->usb2_phy, 0);
-        usb_phy_set_suspend(dwc->usb3_phy, 0);
-
         spin_lock_init(&dwc->lock);
         platform_set_drvdata(pdev, dwc);
 
@@ -488,6 +485,9 @@ static int dwc3_probe(struct platform_device *pdev)
                 goto err0;
         }
 
+        usb_phy_set_suspend(dwc->usb2_phy, 0);
+        usb_phy_set_suspend(dwc->usb3_phy, 0);
+
         ret = dwc3_event_buffers_setup(dwc);
         if (ret) {
                 dev_err(dwc->dev, "failed to setup event buffers\n");
@@ -569,6 +569,8 @@ err2:
         dwc3_event_buffers_cleanup(dwc);
 
 err1:
+        usb_phy_set_suspend(dwc->usb2_phy, 1);
+        usb_phy_set_suspend(dwc->usb3_phy, 1);
         dwc3_core_exit(dwc);
 
 err0:
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 418444ebb1b8..8c356af79409 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -136,23 +136,27 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
         struct ohci_hcd *ohci;
         int retval;
         struct usb_hcd *hcd = NULL;
-
-        if (pdev->num_resources != 2) {
-                pr_debug("hcd probe: invalid num_resources");
-                return -ENODEV;
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        int irq;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_dbg(dev, "hcd probe: missing memory resource\n");
+                return -ENXIO;
         }
 
-        if ((pdev->resource[0].flags != IORESOURCE_MEM)
-                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
-                pr_debug("hcd probe: invalid resource type\n");
-                return -ENODEV;
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_dbg(dev, "hcd probe: missing irq resource\n");
+                return irq;
         }
 
         hcd = usb_create_hcd(driver, &pdev->dev, "at91");
         if (!hcd)
                 return -ENOMEM;
-        hcd->rsrc_start = pdev->resource[0].start;
-        hcd->rsrc_len = resource_size(&pdev->resource[0]);
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
 
         if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
                 pr_debug("request_mem_region failed\n");
@@ -199,7 +203,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
         ohci->num_ports = board->ports;
         at91_start_hc(pdev);
 
-        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (retval == 0)
                 return retval;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index b8dffd59eb25..73f5208714a4 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -128,7 +128,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  * any other sleep) on Haswell machines with LPT and LPT-LP
                  * with the new Intel BIOS
                  */
-                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+                /* Limit the quirk to only known vendors, as this triggers
+                 * yet another BIOS bug on some other machines
+                 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
+                 */
+                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
+                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
         }
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                         pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 08e2f39027ec..2b41c636a52a 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -19,8 +19,9 @@ config AB8500_USB
           in host mode, low speed.
 
 config FSL_USB2_OTG
-        bool "Freescale USB OTG Transceiver Driver"
+        tristate "Freescale USB OTG Transceiver Driver"
         depends on USB_EHCI_FSL && USB_FSL_USB2 && PM_RUNTIME
+        depends on USB
         select USB_OTG
         select USB_PHY
         help
@@ -29,6 +30,7 @@ config FSL_USB2_OTG
 config ISP1301_OMAP
         tristate "Philips ISP1301 with OMAP OTG"
         depends on I2C && ARCH_OMAP_OTG
+        depends on USB
         select USB_PHY
         help
           If you say yes here you get support for the Philips ISP1301
diff --git a/drivers/usb/phy/phy-tegra-usb.c b/drivers/usb/phy/phy-tegra-usb.c
index 82232acf1ab6..bbe4f8e6e8d7 100644
--- a/drivers/usb/phy/phy-tegra-usb.c
+++ b/drivers/usb/phy/phy-tegra-usb.c
@@ -876,7 +876,7 @@ static int utmi_phy_probe(struct tegra_usb_phy *tegra_phy,
 
         tegra_phy->pad_regs = devm_ioremap(&pdev->dev, res->start,
                 resource_size(res));
-        if (!tegra_phy->regs) {
+        if (!tegra_phy->pad_regs) {
                 dev_err(&pdev->dev, "Failed to remap UTMI Pad regs\n");
                 return -ENOMEM;
         }
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 30e8a61552d4..bad57ce77ba5 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -127,7 +127,8 @@ static inline int twl6030_writeb(struct twl6030_usb *twl, u8 module,
 
 static inline u8 twl6030_readb(struct twl6030_usb *twl, u8 module, u8 address)
 {
-        u8 data, ret = 0;
+        u8 data;
+        int ret;
 
         ret = twl_i2c_read_u8(module, &data, address);
         if (ret >= 0)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 496b7e39d5be..cc7a24154490 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb);
 #define ZTE_PRODUCT_MF628                       0x0015
 #define ZTE_PRODUCT_MF626                       0x0031
 #define ZTE_PRODUCT_MC2718                      0xffe8
+#define ZTE_PRODUCT_AC2726                      0xfff1
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -1453,6 +1454,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
 
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
diff --git a/drivers/usb/serial/zte_ev.c b/drivers/usb/serial/zte_ev.c
index fca4c752a4ed..eae2c873b39f 100644
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -281,8 +281,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x19d2, 0xfffd) },
         { USB_DEVICE(0x19d2, 0xfffc) },
         { USB_DEVICE(0x19d2, 0xfffb) },
-        /* AC2726, AC8710_V3 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfff1, 0xff, 0xff, 0xff) },
+        /* AC8710_V3 */
         { USB_DEVICE(0x19d2, 0xfff6) },
         { USB_DEVICE(0x19d2, 0xfff7) },
         { USB_DEVICE(0x19d2, 0xfff8) },
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 55ea73f7c70b..4c02e2b94103 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -350,17 +350,19 @@ static enum bp_state increase_reservation(unsigned long nr_pages)
 
                 pfn = page_to_pfn(page);
 
-                set_phys_to_machine(pfn, frame_list[i]);
-
 #ifdef CONFIG_XEN_HAVE_PVMMU
-                /* Link back into the page tables if not highmem. */
-                if (xen_pv_domain() && !PageHighMem(page)) {
-                        int ret;
-                        ret = HYPERVISOR_update_va_mapping(
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
-                                mfn_pte(frame_list[i], PAGE_KERNEL),
-                                0);
-                        BUG_ON(ret);
+                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                        set_phys_to_machine(pfn, frame_list[i]);
+
+                        /* Link back into the page tables if not highmem. */
+                        if (!PageHighMem(page)) {
+                                int ret;
+                                ret = HYPERVISOR_update_va_mapping(
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                mfn_pte(frame_list[i], PAGE_KERNEL),
+                                                0);
+                                BUG_ON(ret);
+                        }
                 }
 #endif
 
@@ -378,7 +380,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
         enum bp_state state = BP_DONE;
         unsigned long  pfn, i;
         struct page   *page;
-        struct page   *scratch_page;
         int ret;
         struct xen_memory_reservation reservation = {
                 .address_bits = 0,
@@ -411,27 +412,29 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 
                 scrub_page(page);
 
+#ifdef CONFIG_XEN_HAVE_PVMMU
                 /*
                  * Ballooned out frames are effectively replaced with
                  * a scratch frame.  Ensure direct mappings and the
                  * p2m are consistent.
                  */
-                scratch_page = get_balloon_scratch_page();
-#ifdef CONFIG_XEN_HAVE_PVMMU
-                if (xen_pv_domain() && !PageHighMem(page)) {
-                        ret = HYPERVISOR_update_va_mapping(
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
-                                pfn_pte(page_to_pfn(scratch_page),
-                                        PAGE_KERNEL_RO), 0);
-                        BUG_ON(ret);
-                }
-#endif
                 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                         unsigned long p;
+                        struct page   *scratch_page = get_balloon_scratch_page();
+
+                        if (!PageHighMem(page)) {
+                                ret = HYPERVISOR_update_va_mapping(
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                pfn_pte(page_to_pfn(scratch_page),
+                                                        PAGE_KERNEL_RO), 0);
+                                BUG_ON(ret);
+                        }
                         p = page_to_pfn(scratch_page);
                         __set_phys_to_machine(pfn, pfn_to_mfn(p));
+
+                        put_balloon_scratch_page();
                 }
-                put_balloon_scratch_page();
+#endif
 
                 balloon_append(pfn_to_page(pfn));
         }
@@ -627,15 +630,17 @@ static int __init balloon_init(void)
         if (!xen_domain())
                 return -ENODEV;
 
-        for_each_online_cpu(cpu)
-        {
-                per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
-                if (per_cpu(balloon_scratch_page, cpu) == NULL) {
-                        pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
-                        return -ENOMEM;
+        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                for_each_online_cpu(cpu)
+                {
+                        per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
+                        if (per_cpu(balloon_scratch_page, cpu) == NULL) {
+                                pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
+                                return -ENOMEM;
+                        }
                 }
+                register_cpu_notifier(&balloon_cpu_notifier);
         }
-        register_cpu_notifier(&balloon_cpu_notifier);
 
         pr_info("Initialising balloon driver\n");
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 028387192b60..aa846a48f400 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1176,7 +1176,8 @@ static int gnttab_setup(void)
                 gnttab_shared.addr = xen_remap(xen_hvm_resume_frames,
                                                 PAGE_SIZE * max_nr_gframes);
                 if (gnttab_shared.addr == NULL) {
-                        pr_warn("Failed to ioremap gnttab share frames!\n");
+                        pr_warn("Failed to ioremap gnttab share frames (addr=0x%08lx)!\n",
+                                        xen_hvm_resume_frames);
                         return -ENOMEM;
                 }
         }
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 8e74590fa1bb..569a13b9e856 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -533,12 +533,17 @@ static void privcmd_close(struct vm_area_struct *vma)
 {
         struct page **pages = vma->vm_private_data;
         int numpgs = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        int rc;
 
         if (!xen_feature(XENFEAT_auto_translated_physmap) || !numpgs || !pages)
                 return;
 
-        xen_unmap_domain_mfn_range(vma, numpgs, pages);
-        free_xenballooned_pages(numpgs, pages);
+        rc = xen_unmap_domain_mfn_range(vma, numpgs, pages);
+        if (rc == 0)
+                free_xenballooned_pages(numpgs, pages);
+        else
+                pr_crit("unable to unmap MFN range: leaking %d pages. rc=%d\n",
+                        numpgs, rc);
         kfree(pages);
 }
 
diff --git a/fs/aio.c b/fs/aio.c
index 6efb7f6cb22e..062a5f6a1448 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -244,9 +244,14 @@ static void aio_free_ring(struct kioctx *ctx)
         int i;
 
         for (i = 0; i < ctx->nr_pages; i++) {
+                struct page *page;
                 pr_debug("pid(%d) [%d] page->count=%d\n", current->pid, i,
                                 page_count(ctx->ring_pages[i]));
-                put_page(ctx->ring_pages[i]);
+                page = ctx->ring_pages[i];
+                if (!page)
+                        continue;
+                ctx->ring_pages[i] = NULL;
+                put_page(page);
         }
 
         put_aio_ring_file(ctx);
@@ -280,18 +285,38 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
         unsigned long flags;
         int rc;
 
+        rc = 0;
+
+        /* Make sure the old page hasn't already been changed */
+        spin_lock(&mapping->private_lock);
+        ctx = mapping->private_data;
+        if (ctx) {
+                pgoff_t idx;
+                spin_lock_irqsave(&ctx->completion_lock, flags);
+                idx = old->index;
+                if (idx < (pgoff_t)ctx->nr_pages) {
+                        if (ctx->ring_pages[idx] != old)
+                                rc = -EAGAIN;
+                } else
+                        rc = -EINVAL;
+                spin_unlock_irqrestore(&ctx->completion_lock, flags);
+        } else
+                rc = -EINVAL;
+        spin_unlock(&mapping->private_lock);
+
+        if (rc != 0)
+                return rc;
+
         /* Writeback must be complete */
         BUG_ON(PageWriteback(old));
-        put_page(old);
+        get_page(new);
 
-        rc = migrate_page_move_mapping(mapping, new, old, NULL, mode);
+        rc = migrate_page_move_mapping(mapping, new, old, NULL, mode, 1);
         if (rc != MIGRATEPAGE_SUCCESS) {
-                get_page(old);
+                put_page(new);
                 return rc;
         }
 
-        get_page(new);
-
         /* We can potentially race against kioctx teardown here.  Use the
          * address_space's private data lock to protect the mapping's
          * private_data.
@@ -303,13 +328,24 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
                 spin_lock_irqsave(&ctx->completion_lock, flags);
                 migrate_page_copy(new, old);
                 idx = old->index;
-                if (idx < (pgoff_t)ctx->nr_pages)
-                        ctx->ring_pages[idx] = new;
+                if (idx < (pgoff_t)ctx->nr_pages) {
+                        /* And only do the move if things haven't changed */
+                        if (ctx->ring_pages[idx] == old)
+                                ctx->ring_pages[idx] = new;
+                        else
+                                rc = -EAGAIN;
+                } else
+                        rc = -EINVAL;
                 spin_unlock_irqrestore(&ctx->completion_lock, flags);
         } else
                 rc = -EBUSY;
         spin_unlock(&mapping->private_lock);
 
+        if (rc == MIGRATEPAGE_SUCCESS)
+                put_page(old);
+        else
+                put_page(new);
+
         return rc;
 }
 #endif
@@ -326,7 +362,7 @@ static int aio_setup_ring(struct kioctx *ctx)
         struct aio_ring *ring;
         unsigned nr_events = ctx->max_reqs;
         struct mm_struct *mm = current->mm;
-        unsigned long size, populate;
+        unsigned long size, unused;
         int nr_pages;
         int i;
         struct file *file;
@@ -347,6 +383,20 @@ static int aio_setup_ring(struct kioctx *ctx)
                 return -EAGAIN;
         }
 
+        ctx->aio_ring_file = file;
+        nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring))
+                        / sizeof(struct io_event);
+
+        ctx->ring_pages = ctx->internal_pages;
+        if (nr_pages > AIO_RING_PAGES) {
+                ctx->ring_pages = kcalloc(nr_pages, sizeof(struct page *),
+                                          GFP_KERNEL);
+                if (!ctx->ring_pages) {
+                        put_aio_ring_file(ctx);
+                        return -ENOMEM;
+                }
+        }
+
         for (i = 0; i < nr_pages; i++) {
                 struct page *page;
                 page = find_or_create_page(file->f_inode->i_mapping,
@@ -358,19 +408,14 @@ static int aio_setup_ring(struct kioctx *ctx)
                 SetPageUptodate(page);
                 SetPageDirty(page);
                 unlock_page(page);
+
+                ctx->ring_pages[i] = page;
         }
-        ctx->aio_ring_file = file;
-        nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring))
-                        / sizeof(struct io_event);
+        ctx->nr_pages = i;
 
-        ctx->ring_pages = ctx->internal_pages;
-        if (nr_pages > AIO_RING_PAGES) {
-                ctx->ring_pages = kcalloc(nr_pages, sizeof(struct page *),
-                                          GFP_KERNEL);
-                if (!ctx->ring_pages) {
-                        put_aio_ring_file(ctx);
-                        return -ENOMEM;
-                }
+        if (unlikely(i != nr_pages)) {
+                aio_free_ring(ctx);
+                return -EAGAIN;
         }
 
         ctx->mmap_size = nr_pages * PAGE_SIZE;
@@ -379,9 +424,9 @@ static int aio_setup_ring(struct kioctx *ctx)
         down_write(&mm->mmap_sem);
         ctx->mmap_base = do_mmap_pgoff(ctx->aio_ring_file, 0, ctx->mmap_size,
                                        PROT_READ | PROT_WRITE,
-                                       MAP_SHARED | MAP_POPULATE, 0, &populate);
+                                       MAP_SHARED, 0, &unused);
+        up_write(&mm->mmap_sem);
         if (IS_ERR((void *)ctx->mmap_base)) {
-                up_write(&mm->mmap_sem);
                 ctx->mmap_size = 0;
                 aio_free_ring(ctx);
                 return -EAGAIN;
@@ -389,27 +434,6 @@ static int aio_setup_ring(struct kioctx *ctx)
 
         pr_debug("mmap address: 0x%08lx\n", ctx->mmap_base);
 
-        /* We must do this while still holding mmap_sem for write, as we
-         * need to be protected against userspace attempting to mremap()
-         * or munmap() the ring buffer.
-         */
-        ctx->nr_pages = get_user_pages(current, mm, ctx->mmap_base, nr_pages,
-                                       1, 0, ctx->ring_pages, NULL);
-
-        /* Dropping the reference here is safe as the page cache will hold
-         * onto the pages for us.  It is also required so that page migration
-         * can unmap the pages and get the right reference count.
-         */
-        for (i = 0; i < ctx->nr_pages; i++)
-                put_page(ctx->ring_pages[i]);
-
-        up_write(&mm->mmap_sem);
-
-        if (unlikely(ctx->nr_pages != nr_pages)) {
-                aio_free_ring(ctx);
-                return -EAGAIN;
-        }
-
         ctx->user_id = ctx->mmap_base;
         ctx->nr_events = nr_events; /* trusted copy */
 
@@ -652,7 +676,8 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         aio_nr += ctx->max_reqs;
         spin_unlock(&aio_nr_lock);
 
-        percpu_ref_get(&ctx->users); /* io_setup() will drop this ref */
+        percpu_ref_get(&ctx->users);    /* io_setup() will drop this ref */
+        percpu_ref_get(&ctx->reqs);     /* free_ioctx_users() will drop this */
 
         err = ioctx_add_table(ctx, mm);
         if (err)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 1e561c059539..ec3ba43b9faa 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -210,9 +210,13 @@ static int readpage_nounlock(struct file *filp, struct page *page)
         if (err < 0) {
                 SetPageError(page);
                 goto out;
-        } else if (err < PAGE_CACHE_SIZE) {
+        } else {
+                if (err < PAGE_CACHE_SIZE) {
                 /* zero fill remainder of page */
-                zero_user_segment(page, err, PAGE_CACHE_SIZE);
+                        zero_user_segment(page, err, PAGE_CACHE_SIZE);
+                } else {
+                        flush_dcache_page(page);
+                }
         }
         SetPageUptodate(page);
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 9a8e396aed89..278fd2891288 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -978,7 +978,6 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
         struct ceph_mds_reply_inode *ininfo;
         struct ceph_vino vino;
         struct ceph_fs_client *fsc = ceph_sb_to_client(sb);
-        int i = 0;
         int err = 0;
 
         dout("fill_trace %p is_dentry %d is_target %d\n", req,
@@ -1039,6 +1038,29 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                 }
         }
 
+        if (rinfo->head->is_target) {
+                vino.ino = le64_to_cpu(rinfo->targeti.in->ino);
+                vino.snap = le64_to_cpu(rinfo->targeti.in->snapid);
+
+                in = ceph_get_inode(sb, vino);
+                if (IS_ERR(in)) {
+                        err = PTR_ERR(in);
+                        goto done;
+                }
+                req->r_target_inode = in;
+
+                err = fill_inode(in, &rinfo->targeti, NULL,
+                                session, req->r_request_started,
+                                (le32_to_cpu(rinfo->head->result) == 0) ?
+                                req->r_fmode : -1,
+                                &req->r_caps_reservation);
+                if (err < 0) {
+                        pr_err("fill_inode badness %p %llx.%llx\n",
+                                in, ceph_vinop(in));
+                        goto done;
+                }
+        }
+
         /*
          * ignore null lease/binding on snapdir ENOENT, or else we
          * will have trouble splicing in the virtual snapdir later
@@ -1108,7 +1130,6 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                              ceph_dentry(req->r_old_dentry)->offset);
 
                         dn = req->r_old_dentry;  /* use old_dentry */
-                        in = dn->d_inode;
                 }
 
                 /* null dentry? */
@@ -1130,44 +1151,28 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                 }
 
                 /* attach proper inode */
-                ininfo = rinfo->targeti.in;
-                vino.ino = le64_to_cpu(ininfo->ino);
-                vino.snap = le64_to_cpu(ininfo->snapid);
-                in = dn->d_inode;
-                if (!in) {
-                        in = ceph_get_inode(sb, vino);
-                        if (IS_ERR(in)) {
-                                pr_err("fill_trace bad get_inode "
-                                       "%llx.%llx\n", vino.ino, vino.snap);
-                                err = PTR_ERR(in);
-                                d_drop(dn);
-                                goto done;
-                        }
+                if (!dn->d_inode) {
+                        ihold(in);
                         dn = splice_dentry(dn, in, &have_lease, true);
                         if (IS_ERR(dn)) {
                                 err = PTR_ERR(dn);
                                 goto done;
                         }
                         req->r_dentry = dn;  /* may have spliced */
-                        ihold(in);
-                } else if (ceph_ino(in) == vino.ino &&
-                           ceph_snap(in) == vino.snap) {
-                        ihold(in);
-                } else {
+                } else if (dn->d_inode && dn->d_inode != in) {
                         dout(" %p links to %p %llx.%llx, not %llx.%llx\n",
-                             dn, in, ceph_ino(in), ceph_snap(in),
-                             vino.ino, vino.snap);
+                             dn, dn->d_inode, ceph_vinop(dn->d_inode),
+                             ceph_vinop(in));
                         have_lease = false;
-                        in = NULL;
                 }
 
                 if (have_lease)
                         update_dentry_lease(dn, rinfo->dlease, session,
                                             req->r_request_started);
                 dout(" final dn %p\n", dn);
-                i++;
-        } else if ((req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
-                   req->r_op == CEPH_MDS_OP_MKSNAP) && !req->r_aborted) {
+        } else if (!req->r_aborted &&
+                   (req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
+                    req->r_op == CEPH_MDS_OP_MKSNAP)) {
                 struct dentry *dn = req->r_dentry;
 
                 /* fill out a snapdir LOOKUPSNAP dentry */
@@ -1177,52 +1182,15 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                 ininfo = rinfo->targeti.in;
                 vino.ino = le64_to_cpu(ininfo->ino);
                 vino.snap = le64_to_cpu(ininfo->snapid);
-                in = ceph_get_inode(sb, vino);
-                if (IS_ERR(in)) {
-                        pr_err("fill_inode get_inode badness %llx.%llx\n",
-                               vino.ino, vino.snap);
-                        err = PTR_ERR(in);
-                        d_delete(dn);
-                        goto done;
-                }
                 dout(" linking snapped dir %p to dn %p\n", in, dn);
+                ihold(in);
                 dn = splice_dentry(dn, in, NULL, true);
                 if (IS_ERR(dn)) {
                         err = PTR_ERR(dn);
                         goto done;
                 }
                 req->r_dentry = dn;  /* may have spliced */
-                ihold(in);
-                rinfo->head->is_dentry = 1;  /* fool notrace handlers */
-        }
-
-        if (rinfo->head->is_target) {
-                vino.ino = le64_to_cpu(rinfo->targeti.in->ino);
-                vino.snap = le64_to_cpu(rinfo->targeti.in->snapid);
-
-                if (in == NULL || ceph_ino(in) != vino.ino ||
-                    ceph_snap(in) != vino.snap) {
-                        in = ceph_get_inode(sb, vino);
-                        if (IS_ERR(in)) {
-                                err = PTR_ERR(in);
-                                goto done;
-                        }
-                }
-                req->r_target_inode = in;
-
-                err = fill_inode(in,
-                                 &rinfo->targeti, NULL,
-                                 session, req->r_request_started,
-                                 (le32_to_cpu(rinfo->head->result) == 0) ?
-                                 req->r_fmode : -1,
-                                 &req->r_caps_reservation);
-                if (err < 0) {
-                        pr_err("fill_inode badness %p %llx.%llx\n",
-                               in, ceph_vinop(in));
-                        goto done;
-                }
         }
-
 done:
         dout("fill_trace done err=%d\n", err);
         return err;
@@ -1272,7 +1240,7 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
         struct qstr dname;
         struct dentry *dn;
         struct inode *in;
-        int err = 0, i;
+        int err = 0, ret, i;
         struct inode *snapdir = NULL;
         struct ceph_mds_request_head *rhead = req->r_request->front.iov_base;
         struct ceph_dentry_info *di;
@@ -1305,6 +1273,7 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
                         ceph_fill_dirfrag(parent->d_inode, rinfo->dir_dir);
         }
 
+        /* FIXME: release caps/leases if error occurs */
         for (i = 0; i < rinfo->dir_nr; i++) {
                 struct ceph_vino vino;
 
@@ -1329,9 +1298,10 @@ retry_lookup:
                                 err = -ENOMEM;
                                 goto out;
                         }
-                        err = ceph_init_dentry(dn);
-                        if (err < 0) {
+                        ret = ceph_init_dentry(dn);
+                        if (ret < 0) {
                                 dput(dn);
+                                err = ret;
                                 goto out;
                         }
                 } else if (dn->d_inode &&
@@ -1351,9 +1321,6 @@ retry_lookup:
                         spin_unlock(&parent->d_lock);
                 }
 
-                di = dn->d_fsdata;
-                di->offset = ceph_make_fpos(frag, i + r_readdir_offset);
-
                 /* inode */
                 if (dn->d_inode) {
                         in = dn->d_inode;
@@ -1366,26 +1333,39 @@ retry_lookup:
                                 err = PTR_ERR(in);
                                 goto out;
                         }
-                        dn = splice_dentry(dn, in, NULL, false);
-                        if (IS_ERR(dn))
-                                dn = NULL;
                 }
 
                 if (fill_inode(in, &rinfo->dir_in[i], NULL, session,
                                req->r_request_started, -1,
                                &req->r_caps_reservation) < 0) {
                         pr_err("fill_inode badness on %p\n", in);
+                        if (!dn->d_inode)
+                                iput(in);
+                        d_drop(dn);
                         goto next_item;
                 }
-                if (dn)
-                        update_dentry_lease(dn, rinfo->dir_dlease[i],
-                                            req->r_session,
-                                            req->r_request_started);
+
+                if (!dn->d_inode) {
+                        dn = splice_dentry(dn, in, NULL, false);
+                        if (IS_ERR(dn)) {
+                                err = PTR_ERR(dn);
+                                dn = NULL;
+                                goto next_item;
+                        }
+                }
+
+                di = dn->d_fsdata;
+                di->offset = ceph_make_fpos(frag, i + r_readdir_offset);
+
+                update_dentry_lease(dn, rinfo->dir_dlease[i],
+                                    req->r_session,
+                                    req->r_request_started);
 next_item:
                 if (dn)
                         dput(dn);
         }
-        req->r_did_prepopulate = true;
+        if (err == 0)
+                req->r_did_prepopulate = true;
 
 out:
         if (snapdir) {
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index b8e93a40a5d3..78c3c2097787 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -443,8 +443,11 @@ int pstore_register(struct pstore_info *psi)
                 pstore_get_records(0);
 
         kmsg_dump_register(&pstore_dumper);
-        pstore_register_console();
-        pstore_register_ftrace();
+
+        if ((psi->flags & PSTORE_FLAGS_FRAGILE) == 0) {
+                pstore_register_console();
+                pstore_register_ftrace();
+        }
 
         if (pstore_update_ms >= 0) {
                 pstore_timer.expires = jiffies +
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index b94f93685093..35e7d08fe629 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -609,7 +609,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
         struct sysfs_open_file *of;
-        bool has_read, has_write, has_mmap;
+        bool has_read, has_write;
         int error = -EACCES;
 
         /* need attr_sd for attr and ops, its parent for kobj */
@@ -621,7 +621,6 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = battr->read || battr->mmap;
                 has_write = battr->write || battr->mmap;
-                has_mmap = battr->mmap;
         } else {
                 const struct sysfs_ops *ops = sysfs_file_ops(attr_sd);
 
@@ -633,7 +632,6 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = ops->show;
                 has_write = ops->store;
-                has_mmap = false;
         }
 
         /* check perms and supported operations */
@@ -661,9 +659,9 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
          * open file has a separate mutex, it's okay as long as those don't
          * happen on the same file.  At this point, we can't easily give
          * each file a separate locking class.  Let's differentiate on
-         * whether the file has mmap or not for now.
+         * whether the file is bin or not for now.
          */
-        if (has_mmap)
+        if (sysfs_is_bin(attr_sd))
                 mutex_init(&of->mutex);
         else
                 mutex_init(&of->mutex);
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 3ef11b22e750..3b2c14b6f0fb 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -1635,7 +1635,7 @@ xfs_bmap_last_extent(
  * blocks at the end of the file which do not start at the previous data block,
  * we will try to align the new blocks at stripe unit boundaries.
  *
- * Returns 0 in bma->aeof if the file (fork) is empty as any new write will be
+ * Returns 1 in bma->aeof if the file (fork) is empty as any new write will be
  * at, or past the EOF.
  */
 STATIC int
@@ -1650,9 +1650,14 @@ xfs_bmap_isaeof(
         bma->aeof = 0;
         error = xfs_bmap_last_extent(NULL, bma->ip, whichfork, &rec,
                                      &is_empty);
-        if (error || is_empty)
+        if (error)
                 return error;
 
+        if (is_empty) {
+                bma->aeof = 1;
+                return 0;
+        }
+
         /*
          * Check if we are allocation or past the last extent, or at least into
          * the last delayed allocated extent.
@@ -3643,10 +3648,19 @@ xfs_bmap_btalloc(
         int             isaligned;
         int             tryagain;
         int             error;
+        int             stripe_align;
 
         ASSERT(ap->length);
 
         mp = ap->ip->i_mount;
+
+        /* stripe alignment for allocation is determined by mount parameters */
+        stripe_align = 0;
+        if (mp->m_swidth && (mp->m_flags & XFS_MOUNT_SWALLOC))
+                stripe_align = mp->m_swidth;
+        else if (mp->m_dalign)
+                stripe_align = mp->m_dalign;
+
         align = ap->userdata ? xfs_get_extsz_hint(ap->ip) : 0;
         if (unlikely(align)) {
                 error = xfs_bmap_extsize_align(mp, &ap->got, &ap->prev,
@@ -3655,6 +3669,8 @@ xfs_bmap_btalloc(
                 ASSERT(!error);
                 ASSERT(ap->length);
         }
+
+
         nullfb = *ap->firstblock == NULLFSBLOCK;
         fb_agno = nullfb ? NULLAGNUMBER : XFS_FSB_TO_AGNO(mp, *ap->firstblock);
         if (nullfb) {
@@ -3730,7 +3746,7 @@ xfs_bmap_btalloc(
          */
         if (!ap->flist->xbf_low && ap->aeof) {
                 if (!ap->offset) {
-                        args.alignment = mp->m_dalign;
+                        args.alignment = stripe_align;
                         atype = args.type;
                         isaligned = 1;
                         /*
@@ -3755,13 +3771,13 @@ xfs_bmap_btalloc(
                          * of minlen+alignment+slop doesn't go up
                          * between the calls.
                          */
-                        if (blen > mp->m_dalign && blen <= args.maxlen)
-                                nextminlen = blen - mp->m_dalign;
+                        if (blen > stripe_align && blen <= args.maxlen)
+                                nextminlen = blen - stripe_align;
                         else
                                 nextminlen = args.minlen;
-                        if (nextminlen + mp->m_dalign > args.minlen + 1)
+                        if (nextminlen + stripe_align > args.minlen + 1)
                                 args.minalignslop =
-                                        nextminlen + mp->m_dalign -
+                                        nextminlen + stripe_align -
                                         args.minlen - 1;
                         else
                                 args.minalignslop = 0;
@@ -3783,7 +3799,7 @@ xfs_bmap_btalloc(
                  */
                 args.type = atype;
                 args.fsbno = ap->blkno;
-                args.alignment = mp->m_dalign;
+                args.alignment = stripe_align;
                 args.minlen = nextminlen;
                 args.minalignslop = 0;
                 isaligned = 1;
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 5887e41c0323..1394106ed22d 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1187,7 +1187,12 @@ xfs_zero_remaining_bytes(
                 XFS_BUF_UNWRITE(bp);
                 XFS_BUF_READ(bp);
                 XFS_BUF_SET_ADDR(bp, xfs_fsb_to_db(ip, imap.br_startblock));
-                xfsbdstrat(mp, bp);
+
+                if (XFS_FORCED_SHUTDOWN(mp)) {
+                        error = XFS_ERROR(EIO);
+                        break;
+                }
+                xfs_buf_iorequest(bp);
                 error = xfs_buf_iowait(bp);
                 if (error) {
                         xfs_buf_ioerror_alert(bp,
@@ -1200,7 +1205,12 @@ xfs_zero_remaining_bytes(
                 XFS_BUF_UNDONE(bp);
                 XFS_BUF_UNREAD(bp);
                 XFS_BUF_WRITE(bp);
-                xfsbdstrat(mp, bp);
+
+                if (XFS_FORCED_SHUTDOWN(mp)) {
+                        error = XFS_ERROR(EIO);
+                        break;
+                }
+                xfs_buf_iorequest(bp);
                 error = xfs_buf_iowait(bp);
                 if (error) {
                         xfs_buf_ioerror_alert(bp,
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index c7f0b77dcb00..afe7645e4b2b 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -698,7 +698,11 @@ xfs_buf_read_uncached(
         bp->b_flags |= XBF_READ;
         bp->b_ops = ops;
 
-        xfsbdstrat(target->bt_mount, bp);
+        if (XFS_FORCED_SHUTDOWN(target->bt_mount)) {
+                xfs_buf_relse(bp);
+                return NULL;
+        }
+        xfs_buf_iorequest(bp);
         xfs_buf_iowait(bp);
         return bp;
 }
@@ -1089,7 +1093,7 @@ xfs_bioerror(
  * This is meant for userdata errors; metadata bufs come with
  * iodone functions attached, so that we can track down errors.
  */
-STATIC int
+int
 xfs_bioerror_relse(
         struct xfs_buf  *bp)
 {
@@ -1152,7 +1156,7 @@ xfs_bwrite(
         ASSERT(xfs_buf_islocked(bp));
 
         bp->b_flags |= XBF_WRITE;
-        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
+        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q | XBF_WRITE_FAIL);
 
         xfs_bdstrat_cb(bp);
 
@@ -1164,25 +1168,6 @@ xfs_bwrite(
         return error;
 }
 
-/*
- * Wrapper around bdstrat so that we can stop data from going to disk in case
- * we are shutting down the filesystem.  Typically user data goes thru this
- * path; one of the exceptions is the superblock.
- */
-void
-xfsbdstrat(
-        struct xfs_mount        *mp,
-        struct xfs_buf          *bp)
-{
-        if (XFS_FORCED_SHUTDOWN(mp)) {
-                trace_xfs_bdstrat_shut(bp, _RET_IP_);
-                xfs_bioerror_relse(bp);
-                return;
-        }
-
-        xfs_buf_iorequest(bp);
-}
-
 STATIC void
 _xfs_buf_ioend(
         xfs_buf_t               *bp,
@@ -1516,6 +1501,12 @@ xfs_wait_buftarg(
                         struct xfs_buf *bp;
                         bp = list_first_entry(&dispose, struct xfs_buf, b_lru);
                         list_del_init(&bp->b_lru);
+                        if (bp->b_flags & XBF_WRITE_FAIL) {
+                                xfs_alert(btp->bt_mount,
+"Corruption Alert: Buffer at block 0x%llx had permanent write failures!\n"
+"Please run xfs_repair to determine the extent of the problem.",
+                                        (long long)bp->b_bn);
+                        }
                         xfs_buf_rele(bp);
                 }
                 if (loop++ != 0)
@@ -1799,7 +1790,7 @@ __xfs_buf_delwri_submit(
 
         blk_start_plug(&plug);
         list_for_each_entry_safe(bp, n, io_list, b_list) {
-                bp->b_flags &= ~(_XBF_DELWRI_Q | XBF_ASYNC);
+                bp->b_flags &= ~(_XBF_DELWRI_Q | XBF_ASYNC | XBF_WRITE_FAIL);
                 bp->b_flags |= XBF_WRITE;
 
                 if (!wait) {
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index e65683361017..1cf21a4a9f22 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -45,6 +45,7 @@ typedef enum {
 #define XBF_ASYNC        (1 << 4) /* initiator will not wait for completion */
 #define XBF_DONE         (1 << 5) /* all pages in the buffer uptodate */
 #define XBF_STALE        (1 << 6) /* buffer has been staled, do not find it */
+#define XBF_WRITE_FAIL   (1 << 24)/* async writes have failed on this buffer */
 
 /* I/O hints for the BIO layer */
 #define XBF_SYNCIO       (1 << 10)/* treat this buffer as synchronous I/O */
@@ -70,6 +71,7 @@ typedef unsigned int xfs_buf_flags_t;
         { XBF_ASYNC,            "ASYNC" }, \
         { XBF_DONE,             "DONE" }, \
         { XBF_STALE,            "STALE" }, \
+        { XBF_WRITE_FAIL,       "WRITE_FAIL" }, \
         { XBF_SYNCIO,           "SYNCIO" }, \
         { XBF_FUA,              "FUA" }, \
         { XBF_FLUSH,            "FLUSH" }, \
@@ -80,6 +82,7 @@ typedef unsigned int xfs_buf_flags_t;
         { _XBF_DELWRI_Q,        "DELWRI_Q" }, \
         { _XBF_COMPOUND,        "COMPOUND" }
 
+
 /*
  * Internal state flags.
  */
@@ -269,9 +272,6 @@ extern void xfs_buf_unlock(xfs_buf_t *);
 
 /* Buffer Read and Write Routines */
 extern int xfs_bwrite(struct xfs_buf *bp);
-
-extern void xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
-
 extern void xfs_buf_ioend(xfs_buf_t *,  int);
 extern void xfs_buf_ioerror(xfs_buf_t *, int);
 extern void xfs_buf_ioerror_alert(struct xfs_buf *, const char *func);
@@ -282,6 +282,8 @@ extern void xfs_buf_iomove(xfs_buf_t *, size_t, size_t, void *,
 #define xfs_buf_zero(bp, off, len) \
             xfs_buf_iomove((bp), (off), (len), NULL, XBRW_ZERO)
 
+extern int xfs_bioerror_relse(struct xfs_buf *);
+
 static inline int xfs_buf_geterror(xfs_buf_t *bp)
 {
         return bp ? bp->b_error : ENOMEM;
@@ -301,7 +303,8 @@ extern void xfs_buf_terminate(void);
 
 #define XFS_BUF_ZEROFLAGS(bp) \
         ((bp)->b_flags &= ~(XBF_READ|XBF_WRITE|XBF_ASYNC| \
-                            XBF_SYNCIO|XBF_FUA|XBF_FLUSH))
+                            XBF_SYNCIO|XBF_FUA|XBF_FLUSH| \
+                            XBF_WRITE_FAIL))
 
 void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNSTALE(bp)     ((bp)->b_flags &= ~XBF_STALE)
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index a64f67ba25d3..2227b9b050bb 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -496,6 +496,14 @@ xfs_buf_item_unpin(
         }
 }
 
+/*
+ * Buffer IO error rate limiting. Limit it to no more than 10 messages per 30
+ * seconds so as to not spam logs too much on repeated detection of the same
+ * buffer being bad..
+ */
+
+DEFINE_RATELIMIT_STATE(xfs_buf_write_fail_rl_state, 30 * HZ, 10);
+
 STATIC uint
 xfs_buf_item_push(
         struct xfs_log_item     *lip,
@@ -524,6 +532,14 @@ xfs_buf_item_push(
 
         trace_xfs_buf_item_push(bip);
 
+        /* has a previous flush failed due to IO errors? */
+        if ((bp->b_flags & XBF_WRITE_FAIL) &&
+            ___ratelimit(&xfs_buf_write_fail_rl_state, "XFS:")) {
+                xfs_warn(bp->b_target->bt_mount,
+"Detected failing async write on buffer block 0x%llx. Retrying async write.\n",
+                         (long long)bp->b_bn);
+        }
+
         if (!xfs_buf_delwri_queue(bp, buffer_list))
                 rval = XFS_ITEM_FLUSHING;
         xfs_buf_unlock(bp);
@@ -1096,8 +1112,9 @@ xfs_buf_iodone_callbacks(
 
                 xfs_buf_ioerror(bp, 0); /* errno of 0 unsets the flag */
 
-                if (!XFS_BUF_ISSTALE(bp)) {
-                        bp->b_flags |= XBF_WRITE | XBF_ASYNC | XBF_DONE;
+                if (!(bp->b_flags & (XBF_STALE|XBF_WRITE_FAIL))) {
+                        bp->b_flags |= XBF_WRITE | XBF_ASYNC |
+                                       XBF_DONE | XBF_WRITE_FAIL;
                         xfs_buf_iorequest(bp);
                 } else {
                         xfs_buf_relse(bp);
diff --git a/fs/xfs/xfs_dir2_node.c b/fs/xfs/xfs_dir2_node.c
index 56369d4509d5..48c7d18f68c3 100644
--- a/fs/xfs/xfs_dir2_node.c
+++ b/fs/xfs/xfs_dir2_node.c
@@ -2067,12 +2067,12 @@ xfs_dir2_node_lookup(
  */
 int                                             /* error */
 xfs_dir2_node_removename(
-        xfs_da_args_t           *args)          /* operation arguments */
+        struct xfs_da_args      *args)          /* operation arguments */
 {
-        xfs_da_state_blk_t      *blk;           /* leaf block */
+        struct xfs_da_state_blk *blk;           /* leaf block */
         int                     error;          /* error return value */
         int                     rval;           /* operation return value */
-        xfs_da_state_t          *state;         /* btree cursor */
+        struct xfs_da_state     *state;         /* btree cursor */
 
         trace_xfs_dir2_node_removename(args);
 
@@ -2084,19 +2084,18 @@ xfs_dir2_node_removename(
         state->mp = args->dp->i_mount;
         state->blocksize = state->mp->m_dirblksize;
         state->node_ents = state->mp->m_dir_node_ents;
-        /*
-         * Look up the entry we're deleting, set up the cursor.
-         */
+
+        /* Look up the entry we're deleting, set up the cursor. */
         error = xfs_da3_node_lookup_int(state, &rval);
         if (error)
-                rval = error;
-        /*
-         * Didn't find it, upper layer screwed up.
-         */
+                goto out_free;
+
+        /* Didn't find it, upper layer screwed up. */
         if (rval != EEXIST) {
-                xfs_da_state_free(state);
-                return rval;
+                error = rval;
+                goto out_free;
         }
+
         blk = &state->path.blk[state->path.active - 1];
         ASSERT(blk->magic == XFS_DIR2_LEAFN_MAGIC);
         ASSERT(state->extravalid);
@@ -2107,7 +2106,7 @@ xfs_dir2_node_removename(
         error = xfs_dir2_leafn_remove(args, blk->bp, blk->index,
                 &state->extrablk, &rval);
         if (error)
-                return error;
+                goto out_free;
         /*
          * Fix the hash values up the btree.
          */
@@ -2122,6 +2121,7 @@ xfs_dir2_node_removename(
          */
         if (!error)
                 error = xfs_dir2_node_to_leaf(state);
+out_free:
         xfs_da_state_free(state);
         return error;
 }
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 27e0e544e963..104455b8046c 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -618,7 +618,8 @@ xfs_setattr_nonsize(
                 }
                 if (!gid_eq(igid, gid)) {
                         if (XFS_IS_QUOTA_RUNNING(mp) && XFS_IS_GQUOTA_ON(mp)) {
-                                ASSERT(!XFS_IS_PQUOTA_ON(mp));
+                                ASSERT(xfs_sb_version_has_pquotino(&mp->m_sb) ||
+                                       !XFS_IS_PQUOTA_ON(mp));
                                 ASSERT(mask & ATTR_GID);
                                 ASSERT(gdqp);
                                 olddquot2 = xfs_qm_vop_chown(tp, ip,
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b6b669df40f3..eae16920655b 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -193,7 +193,10 @@ xlog_bread_noalign(
         bp->b_io_length = nbblks;
         bp->b_error = 0;
 
-        xfsbdstrat(log->l_mp, bp);
+        if (XFS_FORCED_SHUTDOWN(log->l_mp))
+                return XFS_ERROR(EIO);
+
+        xfs_buf_iorequest(bp);
         error = xfs_buf_iowait(bp);
         if (error)
                 xfs_buf_ioerror_alert(bp, __func__);
@@ -4397,7 +4400,13 @@ xlog_do_recover(
         XFS_BUF_READ(bp);
         XFS_BUF_UNASYNC(bp);
         bp->b_ops = &xfs_sb_buf_ops;
-        xfsbdstrat(log->l_mp, bp);
+
+        if (XFS_FORCED_SHUTDOWN(log->l_mp)) {
+                xfs_buf_relse(bp);
+                return XFS_ERROR(EIO);
+        }
+
+        xfs_buf_iorequest(bp);
         error = xfs_buf_iowait(bp);
         if (error) {
                 xfs_buf_ioerror_alert(bp, __func__);
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 14a4996cfec6..dd88f0e27bd8 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -134,8 +134,6 @@ xfs_qm_dqpurge(
 {
         struct xfs_mount        *mp = dqp->q_mount;
         struct xfs_quotainfo    *qi = mp->m_quotainfo;
-        struct xfs_dquot        *gdqp = NULL;
-        struct xfs_dquot        *pdqp = NULL;
 
         xfs_dqlock(dqp);
         if ((dqp->dq_flags & XFS_DQ_FREEING) || dqp->q_nrefs != 0) {
@@ -143,21 +141,6 @@ xfs_qm_dqpurge(
                 return EAGAIN;
         }
 
-        /*
-         * If this quota has a hint attached, prepare for releasing it now.
-         */
-        gdqp = dqp->q_gdquot;
-        if (gdqp) {
-                xfs_dqlock(gdqp);
-                dqp->q_gdquot = NULL;
-        }
-
-        pdqp = dqp->q_pdquot;
-        if (pdqp) {
-                xfs_dqlock(pdqp);
-                dqp->q_pdquot = NULL;
-        }
-
         dqp->dq_flags |= XFS_DQ_FREEING;
 
         xfs_dqflock(dqp);
@@ -206,11 +189,47 @@ xfs_qm_dqpurge(
         XFS_STATS_DEC(xs_qm_dquot_unused);
 
         xfs_qm_dqdestroy(dqp);
+        return 0;
+}
+
+/*
+ * Release the group or project dquot pointers the user dquots maybe carrying
+ * around as a hint, and proceed to purge the user dquot cache if requested.
+*/
+STATIC int
+xfs_qm_dqpurge_hints(
+        struct xfs_dquot        *dqp,
+        void                    *data)
+{
+        struct xfs_dquot        *gdqp = NULL;
+        struct xfs_dquot        *pdqp = NULL;
+        uint                    flags = *((uint *)data);
+
+        xfs_dqlock(dqp);
+        if (dqp->dq_flags & XFS_DQ_FREEING) {
+                xfs_dqunlock(dqp);
+                return EAGAIN;
+        }
+
+        /* If this quota has a hint attached, prepare for releasing it now */
+        gdqp = dqp->q_gdquot;
+        if (gdqp)
+                dqp->q_gdquot = NULL;
+
+        pdqp = dqp->q_pdquot;
+        if (pdqp)
+                dqp->q_pdquot = NULL;
+
+        xfs_dqunlock(dqp);
 
         if (gdqp)
-                xfs_qm_dqput(gdqp);
+                xfs_qm_dqrele(gdqp);
         if (pdqp)
-                xfs_qm_dqput(pdqp);
+                xfs_qm_dqrele(pdqp);
+
+        if (flags & XFS_QMOPT_UQUOTA)
+                return xfs_qm_dqpurge(dqp, NULL);
+
         return 0;
 }
 
@@ -222,8 +241,18 @@ xfs_qm_dqpurge_all(
         struct xfs_mount        *mp,
         uint                    flags)
 {
-        if (flags & XFS_QMOPT_UQUOTA)
-                xfs_qm_dquot_walk(mp, XFS_DQ_USER, xfs_qm_dqpurge, NULL);
+        /*
+         * We have to release group/project dquot hint(s) from the user dquot
+         * at first if they are there, otherwise we would run into an infinite
+         * loop while walking through radix tree to purge other type of dquots
+         * since their refcount is not zero if the user dquot refers to them
+         * as hint.
+         *
+         * Call the special xfs_qm_dqpurge_hints() will end up go through the
+         * general xfs_qm_dqpurge() against user dquot cache if requested.
+         */
+        xfs_qm_dquot_walk(mp, XFS_DQ_USER, xfs_qm_dqpurge_hints, &flags);
+
         if (flags & XFS_QMOPT_GQUOTA)
                 xfs_qm_dquot_walk(mp, XFS_DQ_GROUP, xfs_qm_dqpurge, NULL);
         if (flags & XFS_QMOPT_PQUOTA)
@@ -2082,24 +2111,21 @@ xfs_qm_vop_create_dqattach(
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
         ASSERT(XFS_IS_QUOTA_RUNNING(mp));
 
-        if (udqp) {
+        if (udqp && XFS_IS_UQUOTA_ON(mp)) {
                 ASSERT(ip->i_udquot == NULL);
-                ASSERT(XFS_IS_UQUOTA_ON(mp));
                 ASSERT(ip->i_d.di_uid == be32_to_cpu(udqp->q_core.d_id));
 
                 ip->i_udquot = xfs_qm_dqhold(udqp);
                 xfs_trans_mod_dquot(tp, udqp, XFS_TRANS_DQ_ICOUNT, 1);
         }
-        if (gdqp) {
+        if (gdqp && XFS_IS_GQUOTA_ON(mp)) {
                 ASSERT(ip->i_gdquot == NULL);
-                ASSERT(XFS_IS_GQUOTA_ON(mp));
                 ASSERT(ip->i_d.di_gid == be32_to_cpu(gdqp->q_core.d_id));
                 ip->i_gdquot = xfs_qm_dqhold(gdqp);
                 xfs_trans_mod_dquot(tp, gdqp, XFS_TRANS_DQ_ICOUNT, 1);
         }
-        if (pdqp) {
+        if (pdqp && XFS_IS_PQUOTA_ON(mp)) {
                 ASSERT(ip->i_pdquot == NULL);
-                ASSERT(XFS_IS_PQUOTA_ON(mp));
                 ASSERT(xfs_get_projid(ip) == be32_to_cpu(pdqp->q_core.d_id));
 
                 ip->i_pdquot = xfs_qm_dqhold(pdqp);
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index c035d11b7734..647b6f1d8923 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -314,7 +314,18 @@ xfs_trans_read_buf_map(
                         ASSERT(bp->b_iodone == NULL);
                         XFS_BUF_READ(bp);
                         bp->b_ops = ops;
-                        xfsbdstrat(tp->t_mountp, bp);
+
+                        /*
+                         * XXX(hch): clean up the error handling here to be less
+                         * of a mess..
+                         */
+                        if (XFS_FORCED_SHUTDOWN(mp)) {
+                                trace_xfs_bdstrat_shut(bp, _RET_IP_);
+                                xfs_bioerror_relse(bp);
+                        } else {
+                                xfs_buf_iorequest(bp);
+                        }
+
                         error = xfs_buf_iowait(bp);
                         if (error) {
                                 xfs_buf_ioerror_alert(bp, __func__);
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index f330d28e4d0e..db0923458940 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -217,7 +217,7 @@ static inline int pmd_same(pmd_t pmd_a, pmd_t pmd_b)
 #endif
 
 #ifndef pte_accessible
-# define pte_accessible(pte)            ((void)(pte),1)
+# define pte_accessible(mm, pte)        ((void)(pte), 1)
 #endif
 
 #ifndef flush_tlb_fix_spurious_fault
@@ -599,11 +599,10 @@ static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd)
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
         barrier();
 #endif
-        if (pmd_none(pmdval))
+        if (pmd_none(pmdval) || pmd_trans_huge(pmdval))
                 return 1;
         if (unlikely(pmd_bad(pmdval))) {
-                if (!pmd_trans_huge(pmdval))
-                        pmd_clear_bad(pmd);
+                pmd_clear_bad(pmd);
                 return 1;
         }
         return 0;
diff --git a/include/asm-generic/preempt.h b/include/asm-generic/preempt.h
index ddf2b420ac8f..1cd3f5d767a8 100644
--- a/include/asm-generic/preempt.h
+++ b/include/asm-generic/preempt.h
@@ -3,13 +3,11 @@
 
 #include <linux/thread_info.h>
 
-/*
- * We mask the PREEMPT_NEED_RESCHED bit so as not to confuse all current users
- * that think a non-zero value indicates we cannot preempt.
- */
+#define PREEMPT_ENABLED (0)
+
 static __always_inline int preempt_count(void)
 {
-        return current_thread_info()->preempt_count & ~PREEMPT_NEED_RESCHED;
+        return current_thread_info()->preempt_count;
 }
 
 static __always_inline int *preempt_count_ptr(void)
@@ -17,11 +15,6 @@ static __always_inline int *preempt_count_ptr(void)
         return &current_thread_info()->preempt_count;
 }
 
-/*
- * We now loose PREEMPT_NEED_RESCHED and cause an extra reschedule; however the
- * alternative is loosing a reschedule. Better schedule too often -- also this
- * should be a very rare operation.
- */
 static __always_inline void preempt_count_set(int pc)
 {
         *preempt_count_ptr() = pc;
@@ -41,28 +34,17 @@ static __always_inline void preempt_count_set(int pc)
         task_thread_info(p)->preempt_count = PREEMPT_ENABLED; \
 } while (0)
 
-/*
- * We fold the NEED_RESCHED bit into the preempt count such that
- * preempt_enable() can decrement and test for needing to reschedule with a
- * single instruction.
- *
- * We invert the actual bit, so that when the decrement hits 0 we know we both
- * need to resched (the bit is cleared) and can resched (no preempt count).
- */
-
 static __always_inline void set_preempt_need_resched(void)
 {
-        *preempt_count_ptr() &= ~PREEMPT_NEED_RESCHED;
 }
 
 static __always_inline void clear_preempt_need_resched(void)
 {
-        *preempt_count_ptr() |= PREEMPT_NEED_RESCHED;
 }
 
 static __always_inline bool test_preempt_need_resched(void)
 {
-        return !(*preempt_count_ptr() & PREEMPT_NEED_RESCHED);
+        return false;
 }
 
 /*
@@ -81,7 +63,12 @@ static __always_inline void __preempt_count_sub(int val)
 
 static __always_inline bool __preempt_count_dec_and_test(void)
 {
-        return !--*preempt_count_ptr();
+        /*
+         * Because of load-store architectures cannot do per-cpu atomic
+         * operations; we cannot use PREEMPT_NEED_RESCHED because it might get
+         * lost.
+         */
+        return !--*preempt_count_ptr() && tif_need_resched();
 }
 
 /*
@@ -89,7 +76,7 @@ static __always_inline bool __preempt_count_dec_and_test(void)
  */
 static __always_inline bool should_resched(void)
 {
-        return unlikely(!*preempt_count_ptr());
+        return unlikely(!preempt_count() && tif_need_resched());
 }
 
 #ifdef CONFIG_PREEMPT
diff --git a/include/linux/lockref.h b/include/linux/lockref.h
index c8929c3832db..4bfde0e99ed5 100644
--- a/include/linux/lockref.h
+++ b/include/linux/lockref.h
@@ -19,7 +19,7 @@
 
 #define USE_CMPXCHG_LOCKREF \
         (IS_ENABLED(CONFIG_ARCH_USE_CMPXCHG_LOCKREF) && \
-         IS_ENABLED(CONFIG_SMP) && !BLOATED_SPINLOCKS)
+         IS_ENABLED(CONFIG_SMP) && SPINLOCK_SIZE <= 4)
 
 struct lockref {
         union {
diff --git a/include/linux/math64.h b/include/linux/math64.h
index 69ed5f5e9f6e..c45c089bfdac 100644
--- a/include/linux/math64.h
+++ b/include/linux/math64.h
@@ -133,4 +133,34 @@ __iter_div_u64_rem(u64 dividend, u32 divisor, u64 *remainder)
         return ret;
 }
 
+#if defined(CONFIG_ARCH_SUPPORTS_INT128) && defined(__SIZEOF_INT128__)
+
+#ifndef mul_u64_u32_shr
+static inline u64 mul_u64_u32_shr(u64 a, u32 mul, unsigned int shift)
+{
+        return (u64)(((unsigned __int128)a * mul) >> shift);
+}
+#endif /* mul_u64_u32_shr */
+
+#else
+
+#ifndef mul_u64_u32_shr
+static inline u64 mul_u64_u32_shr(u64 a, u32 mul, unsigned int shift)
+{
+        u32 ah, al;
+        u64 ret;
+
+        al = a;
+        ah = a >> 32;
+
+        ret = ((u64)al * mul) >> shift;
+        if (ah)
+                ret += ((u64)ah * mul) << (32 - shift);
+
+        return ret;
+}
+#endif /* mul_u64_u32_shr */
+
+#endif
+
 #endif /* _LINUX_MATH64_H */
diff --git a/include/linux/migrate.h b/include/linux/migrate.h
index f5096b58b20d..f015c059e159 100644
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -55,7 +55,8 @@ extern int migrate_huge_page_move_mapping(struct address_space *mapping,
                                   struct page *newpage, struct page *page);
 extern int migrate_page_move_mapping(struct address_space *mapping,
                 struct page *newpage, struct page *page,
-                struct buffer_head *head, enum migrate_mode mode);
+                struct buffer_head *head, enum migrate_mode mode,
+                int extra_count);
 #else
 
 static inline void putback_lru_pages(struct list_head *l) {}
@@ -90,10 +91,19 @@ static inline int migrate_huge_page_move_mapping(struct address_space *mapping,
 #endif /* CONFIG_MIGRATION */
 
 #ifdef CONFIG_NUMA_BALANCING
+extern bool pmd_trans_migrating(pmd_t pmd);
+extern void wait_migrate_huge_page(struct anon_vma *anon_vma, pmd_t *pmd);
 extern int migrate_misplaced_page(struct page *page,
                                   struct vm_area_struct *vma, int node);
 extern bool migrate_ratelimited(int node);
 #else
+static inline bool pmd_trans_migrating(pmd_t pmd)
+{
+        return false;
+}
+static inline void wait_migrate_huge_page(struct anon_vma *anon_vma, pmd_t *pmd)
+{
+}
 static inline int migrate_misplaced_page(struct page *page,
                                          struct vm_area_struct *vma, int node)
 {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 1cedd000cf29..35527173cf50 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1317,7 +1317,7 @@ static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long a
 #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
 
 #if USE_SPLIT_PTE_PTLOCKS
-#if BLOATED_SPINLOCKS
+#if ALLOC_SPLIT_PTLOCKS
 extern bool ptlock_alloc(struct page *page);
 extern void ptlock_free(struct page *page);
 
@@ -1325,7 +1325,7 @@ static inline spinlock_t *ptlock_ptr(struct page *page)
 {
         return page->ptl;
 }
-#else /* BLOATED_SPINLOCKS */
+#else /* ALLOC_SPLIT_PTLOCKS */
 static inline bool ptlock_alloc(struct page *page)
 {
         return true;
@@ -1339,7 +1339,7 @@ static inline spinlock_t *ptlock_ptr(struct page *page)
 {
         return &page->ptl;
 }
-#endif /* BLOATED_SPINLOCKS */
+#endif /* ALLOC_SPLIT_PTLOCKS */
 
 static inline spinlock_t *pte_lockptr(struct mm_struct *mm, pmd_t *pmd)
 {
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index bd299418a934..290901a8c1de 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -26,6 +26,7 @@ struct address_space;
 #define USE_SPLIT_PTE_PTLOCKS   (NR_CPUS >= CONFIG_SPLIT_PTLOCK_CPUS)
 #define USE_SPLIT_PMD_PTLOCKS   (USE_SPLIT_PTE_PTLOCKS && \
                 IS_ENABLED(CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK))
+#define ALLOC_SPLIT_PTLOCKS     (SPINLOCK_SIZE > BITS_PER_LONG/8)
 
 /*
  * Each physical page in the system has a struct page associated with
@@ -155,7 +156,7 @@ struct page {
                                                  * system if PG_buddy is set.
                                                  */
 #if USE_SPLIT_PTE_PTLOCKS
-#if BLOATED_SPINLOCKS
+#if ALLOC_SPLIT_PTLOCKS
                 spinlock_t *ptl;
 #else
                 spinlock_t ptl;
@@ -443,6 +444,14 @@ struct mm_struct {
         /* numa_scan_seq prevents two threads setting pte_numa */
         int numa_scan_seq;
 #endif
+#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
+        /*
+         * An operation with batched TLB flushing is going on. Anything that
+         * can move process memory needs to flush the TLB when moving a
+         * PROT_NONE or PROT_NUMA mapped page.
+         */
+        bool tlb_flush_pending;
+#endif
         struct uprobes_state uprobes_state;
 };
 
@@ -459,4 +468,45 @@ static inline cpumask_t *mm_cpumask(struct mm_struct *mm)
         return mm->cpu_vm_mask_var;
 }
 
+#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
+/*
+ * Memory barriers to keep this state in sync are graciously provided by
+ * the page table locks, outside of which no page table modifications happen.
+ * The barriers below prevent the compiler from re-ordering the instructions
+ * around the memory barriers that are already present in the code.
+ */
+static inline bool mm_tlb_flush_pending(struct mm_struct *mm)
+{
+        barrier();
+        return mm->tlb_flush_pending;
+}
+static inline void set_tlb_flush_pending(struct mm_struct *mm)
+{
+        mm->tlb_flush_pending = true;
+
+        /*
+         * Guarantee that the tlb_flush_pending store does not leak into the
+         * critical section updating the page tables
+         */
+        smp_mb__before_spinlock();
+}
+/* Clearing is done after a TLB flush, which also provides a barrier. */
+static inline void clear_tlb_flush_pending(struct mm_struct *mm)
+{
+        barrier();
+        mm->tlb_flush_pending = false;
+}
+#else
+static inline bool mm_tlb_flush_pending(struct mm_struct *mm)
+{
+        return false;
+}
+static inline void set_tlb_flush_pending(struct mm_struct *mm)
+{
+}
+static inline void clear_tlb_flush_pending(struct mm_struct *mm)
+{
+}
+#endif
+
 #endif /* _LINUX_MM_TYPES_H */
diff --git a/include/linux/pstore.h b/include/linux/pstore.h
index abd437d0a8a7..ece0c6bbfcc5 100644
--- a/include/linux/pstore.h
+++ b/include/linux/pstore.h
@@ -51,6 +51,7 @@ struct pstore_info {
         char            *buf;
         size_t          bufsize;
         struct mutex    read_mutex;     /* serialize open/read/close */
+        int             flags;
         int             (*open)(struct pstore_info *psi);
         int             (*close)(struct pstore_info *psi);
         ssize_t         (*read)(u64 *id, enum pstore_type_id *type,
@@ -70,6 +71,8 @@ struct pstore_info {
         void            *data;
 };
 
+#define PSTORE_FLAGS_FRAGILE    1
+
 #ifdef CONFIG_PSTORE
 extern int pstore_register(struct pstore_info *);
 extern bool pstore_cannot_block_path(enum kmsg_dump_reason reason);
diff --git a/include/linux/reboot.h b/include/linux/reboot.h
index 8e00f9f6f963..9e7db9e73cc1 100644
--- a/include/linux/reboot.h
+++ b/include/linux/reboot.h
@@ -43,6 +43,7 @@ extern int unregister_reboot_notifier(struct notifier_block *);
  * Architecture-specific implementations of sys_reboot commands.
  */
 
+extern void migrate_to_reboot_cpu(void);
 extern void machine_restart(char *cmd);
 extern void machine_halt(void);
 extern void machine_power_off(void);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 768b037dfacb..53f97eb8dbc7 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -440,8 +440,6 @@ struct task_cputime {
                 .sum_exec_runtime = 0,                          \
         }
 
-#define PREEMPT_ENABLED         (PREEMPT_NEED_RESCHED)
-
 #ifdef CONFIG_PREEMPT_COUNT
 #define PREEMPT_DISABLED        (1 + PREEMPT_ENABLED)
 #else
@@ -932,7 +930,8 @@ struct pipe_inode_info;
 struct uts_namespace;
 
 struct load_weight {
-        unsigned long weight, inv_weight;
+        unsigned long weight;
+        u32 inv_weight;
 };
 
 struct sched_avg {
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 45412a6afa69..321301c0a643 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -517,10 +517,6 @@ struct se_node_acl {
         u32                     acl_index;
 #define MAX_ACL_TAG_SIZE 64
         char                    acl_tag[MAX_ACL_TAG_SIZE];
-        u64                     num_cmds;
-        u64                     read_bytes;
-        u64                     write_bytes;
-        spinlock_t              stats_lock;
         /* Used for PR SPEC_I_PT=1 and REGISTER_AND_MOVE */
         atomic_t                acl_pr_ref_count;
         struct se_dev_entry     **device_list;
@@ -624,6 +620,7 @@ struct se_dev_attrib {
         u32             unmap_granularity;
         u32             unmap_granularity_alignment;
         u32             max_write_same_len;
+        u32             max_bytes_per_io;
         struct se_device *da_dev;
         struct config_group da_group;
 };
diff --git a/include/uapi/drm/vmwgfx_drm.h b/include/uapi/drm/vmwgfx_drm.h
index bcb0912afe7a..f854ca4a1372 100644
--- a/include/uapi/drm/vmwgfx_drm.h
+++ b/include/uapi/drm/vmwgfx_drm.h
@@ -75,6 +75,7 @@
 #define DRM_VMW_PARAM_FIFO_CAPS        4
 #define DRM_VMW_PARAM_MAX_FB_SIZE      5
 #define DRM_VMW_PARAM_FIFO_HW_VERSION  6
+#define DRM_VMW_PARAM_MAX_SURF_MEMORY  7
 
 /**
  * struct drm_vmw_getparam_arg
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index e1802d6153ae..959d454f76a1 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -679,6 +679,7 @@ enum perf_event_type {
          *
          *      { u64                   weight;   } && PERF_SAMPLE_WEIGHT
          *      { u64                   data_src; } && PERF_SAMPLE_DATA_SRC
+         *      { u64                   transaction; } && PERF_SAMPLE_TRANSACTION
          * };
          */
         PERF_RECORD_SAMPLE                      = 9,
diff --git a/include/xen/interface/io/blkif.h b/include/xen/interface/io/blkif.h
index 65e12099ef89..ae665ac59c36 100644
--- a/include/xen/interface/io/blkif.h
+++ b/include/xen/interface/io/blkif.h
@@ -146,7 +146,7 @@ struct blkif_request_segment_aligned {
 struct blkif_request_rw {
         uint8_t        nr_segments;  /* number of segments                   */
         blkif_vdev_t   handle;       /* only for read/write requests         */
-#ifdef CONFIG_X86_64
+#ifndef CONFIG_X86_32
         uint32_t       _pad1;        /* offsetof(blkif_request,u.rw.id) == 8 */
 #endif
         uint64_t       id;           /* private guest value, echoed in resp  */
@@ -163,7 +163,7 @@ struct blkif_request_discard {
         uint8_t        flag;         /* BLKIF_DISCARD_SECURE or zero.        */
 #define BLKIF_DISCARD_SECURE (1<<0)  /* ignored if discard-secure=0          */
         blkif_vdev_t   _pad1;        /* only for read/write requests         */
-#ifdef CONFIG_X86_64
+#ifndef CONFIG_X86_32
         uint32_t       _pad2;        /* offsetof(blkif_req..,u.discard.id)==8*/
 #endif
         uint64_t       id;           /* private guest value, echoed in resp  */
@@ -175,7 +175,7 @@ struct blkif_request_discard {
 struct blkif_request_other {
         uint8_t      _pad1;
         blkif_vdev_t _pad2;        /* only for read/write requests         */
-#ifdef CONFIG_X86_64
+#ifndef CONFIG_X86_32
         uint32_t     _pad3;        /* offsetof(blkif_req..,u.other.id)==8*/
 #endif
         uint64_t     id;           /* private guest value, echoed in resp  */
@@ -184,7 +184,7 @@ struct blkif_request_other {
 struct blkif_request_indirect {
         uint8_t        indirect_op;
         uint16_t       nr_segments;
-#ifdef CONFIG_X86_64
+#ifndef CONFIG_X86_32
         uint32_t       _pad1;        /* offsetof(blkif_...,u.indirect.id) == 8 */
 #endif
         uint64_t       id;
@@ -192,7 +192,7 @@ struct blkif_request_indirect {
         blkif_vdev_t   handle;
         uint16_t       _pad2;
         grant_ref_t    indirect_grefs[BLKIF_MAX_INDIRECT_PAGES_PER_REQUEST];
-#ifdef CONFIG_X86_64
+#ifndef CONFIG_X86_32
         uint32_t      _pad3;         /* make it 64 byte aligned */
 #else
         uint64_t      _pad3;         /* make it 64 byte aligned */
diff --git a/init/Kconfig b/init/Kconfig
index 79383d3aa5dc..4e5d96ab2034 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -809,6 +809,12 @@ config GENERIC_SCHED_CLOCK
 config ARCH_SUPPORTS_NUMA_BALANCING
         bool
 
+#
+# For architectures that know their GCC __int128 support is sound
+#
+config ARCH_SUPPORTS_INT128
+        bool
+
 # For architectures that (ab)use NUMA to represent different memory regions
 # all cpu-local but of different latencies, such as SuperH.
 #
diff --git a/kernel/Makefile b/kernel/Makefile
index bbaf7d59c1bb..bc010ee272b6 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -137,9 +137,10 @@ $(obj)/timeconst.h: $(obj)/hz.bc $(src)/timeconst.bc FORCE
 ###############################################################################
 ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
 X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509)
-X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509
-X509_CERTIFICATES := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \
+X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += $(objtree)/signing_key.x509
+X509_CERTIFICATES-raw := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \
                                 $(or $(realpath $(CERT)),$(CERT))))
+X509_CERTIFICATES := $(subst $(realpath $(objtree))/,,$(X509_CERTIFICATES-raw))
 
 ifeq ($(X509_CERTIFICATES),)
 $(warning *** No X.509 certificates found ***)
@@ -164,9 +165,9 @@ $(obj)/x509_certificate_list: $(X509_CERTIFICATES) $(obj)/.x509.list
 targets += $(obj)/.x509.list
 $(obj)/.x509.list:
         @echo $(X509_CERTIFICATES) >$@
+endif
 
 clean-files := x509_certificate_list .x509.list
-endif
 
 ifeq ($(CONFIG_MODULE_SIG),y)
 ###############################################################################
diff --git a/kernel/bounds.c b/kernel/bounds.c
index 5253204afdca..9fd4246b04b8 100644
--- a/kernel/bounds.c
+++ b/kernel/bounds.c
@@ -22,6 +22,6 @@ void foo(void)
 #ifdef CONFIG_SMP
         DEFINE(NR_CPUS_BITS, ilog2(CONFIG_NR_CPUS));
 #endif
-        DEFINE(BLOATED_SPINLOCKS, sizeof(spinlock_t) > sizeof(int));
+        DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t));
         /* End of constants */
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 72348dc192c1..f5744010a8d2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1396,6 +1396,8 @@ event_sched_out(struct perf_event *event,
         if (event->state != PERF_EVENT_STATE_ACTIVE)
                 return;
 
+        perf_pmu_disable(event->pmu);
+
         event->state = PERF_EVENT_STATE_INACTIVE;
         if (event->pending_disable) {
                 event->pending_disable = 0;
@@ -1412,6 +1414,8 @@ event_sched_out(struct perf_event *event,
                 ctx->nr_freq--;
         if (event->attr.exclusive || !cpuctx->active_oncpu)
                 cpuctx->exclusive = 0;
+
+        perf_pmu_enable(event->pmu);
 }
 
 static void
@@ -1652,6 +1656,7 @@ event_sched_in(struct perf_event *event,
                  struct perf_event_context *ctx)
 {
         u64 tstamp = perf_event_time(event);
+        int ret = 0;
 
         if (event->state <= PERF_EVENT_STATE_OFF)
                 return 0;
@@ -1674,10 +1679,13 @@ event_sched_in(struct perf_event *event,
          */
         smp_wmb();
 
+        perf_pmu_disable(event->pmu);
+
         if (event->pmu->add(event, PERF_EF_START)) {
                 event->state = PERF_EVENT_STATE_INACTIVE;
                 event->oncpu = -1;
-                return -EAGAIN;
+                ret = -EAGAIN;
+                goto out;
         }
 
         event->tstamp_running += tstamp - event->tstamp_stopped;
@@ -1693,7 +1701,10 @@ event_sched_in(struct perf_event *event,
         if (event->attr.exclusive)
                 cpuctx->exclusive = 1;
 
-        return 0;
+out:
+        perf_pmu_enable(event->pmu);
+
+        return ret;
 }
 
 static int
@@ -2743,6 +2754,8 @@ static void perf_adjust_freq_unthr_context(struct perf_event_context *ctx,
                 if (!event_filter_match(event))
                         continue;
 
+                perf_pmu_disable(event->pmu);
+
                 hwc = &event->hw;
 
                 if (hwc->interrupts == MAX_INTERRUPTS) {
@@ -2752,7 +2765,7 @@ static void perf_adjust_freq_unthr_context(struct perf_event_context *ctx,
                 }
 
                 if (!event->attr.freq || !event->attr.sample_freq)
-                        continue;
+                        goto next;
 
                 /*
                  * stop the event and update event->count
@@ -2774,6 +2787,8 @@ static void perf_adjust_freq_unthr_context(struct perf_event_context *ctx,
                         perf_adjust_period(event, period, delta, false);
 
                 event->pmu->start(event, delta > 0 ? PERF_EF_RELOAD : 0);
+        next:
+                perf_pmu_enable(event->pmu);
         }
 
         perf_pmu_enable(ctx->pmu);
diff --git a/kernel/fork.c b/kernel/fork.c
index 728d5be9548c..5721f0e3f2da 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -537,6 +537,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
         spin_lock_init(&mm->page_table_lock);
         mm_init_aio(mm);
         mm_init_owner(mm, p);
+        clear_tlb_flush_pending(mm);
 
         if (likely(!mm_alloc_pgd(mm))) {
                 mm->def_flags = 0;
diff --git a/kernel/kexec.c b/kernel/kexec.c
index d0d8fca54065..9c970167e402 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1680,6 +1680,7 @@ int kernel_kexec(void)
         {
                 kexec_in_progress = true;
                 kernel_restart_prepare(NULL);
+                migrate_to_reboot_cpu();
                 printk(KERN_EMERG "Starting new kernel\n");
                 machine_shutdown();
         }
diff --git a/kernel/reboot.c b/kernel/reboot.c
index f813b3474646..662c83fc16b7 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -104,7 +104,7 @@ int unregister_reboot_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_reboot_notifier);
 
-static void migrate_to_reboot_cpu(void)
+void migrate_to_reboot_cpu(void)
 {
         /* The boot cpu is always logical cpu 0 */
         int cpu = reboot_cpu;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index e85cda20ab2b..a88f4a485c5e 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4902,6 +4902,7 @@ DEFINE_PER_CPU(struct sched_domain *, sd_asym);
 static void update_top_cache_domain(int cpu)
 {
         struct sched_domain *sd;
+        struct sched_domain *busy_sd = NULL;
         int id = cpu;
         int size = 1;
 
@@ -4909,9 +4910,9 @@ static void update_top_cache_domain(int cpu)
         if (sd) {
                 id = cpumask_first(sched_domain_span(sd));
                 size = cpumask_weight(sched_domain_span(sd));
-                sd = sd->parent; /* sd_busy */
+                busy_sd = sd->parent; /* sd_busy */
         }
-        rcu_assign_pointer(per_cpu(sd_busy, cpu), sd);
+        rcu_assign_pointer(per_cpu(sd_busy, cpu), busy_sd);
 
         rcu_assign_pointer(per_cpu(sd_llc, cpu), sd);
         per_cpu(sd_llc_size, cpu) = size;
@@ -5112,6 +5113,7 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
                  * die on a /0 trap.
                  */
                 sg->sgp->power = SCHED_POWER_SCALE * cpumask_weight(sg_span);
+                sg->sgp->power_orig = sg->sgp->power;
 
                 /*
                  * Make sure the first group of this domain contains the
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fd773ade1a31..c7395d97e4cb 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -178,59 +178,61 @@ void sched_init_granularity(void)
         update_sysctl();
 }
 
-#if BITS_PER_LONG == 32
-# define WMULT_CONST    (~0UL)
-#else
-# define WMULT_CONST    (1UL << 32)
-#endif
-
+#define WMULT_CONST     (~0U)
 #define WMULT_SHIFT     32
 
-/*
- * Shift right and round:
- */
-#define SRR(x, y) (((x) + (1UL << ((y) - 1))) >> (y))
+static void __update_inv_weight(struct load_weight *lw)
+{
+        unsigned long w;
+
+        if (likely(lw->inv_weight))
+                return;
+
+        w = scale_load_down(lw->weight);
+
+        if (BITS_PER_LONG > 32 && unlikely(w >= WMULT_CONST))
+                lw->inv_weight = 1;
+        else if (unlikely(!w))
+                lw->inv_weight = WMULT_CONST;
+        else
+                lw->inv_weight = WMULT_CONST / w;
+}
 
 /*
- * delta *= weight / lw
+ * delta_exec * weight / lw.weight
+ *   OR
+ * (delta_exec * (weight * lw->inv_weight)) >> WMULT_SHIFT
+ *
+ * Either weight := NICE_0_LOAD and lw \e prio_to_wmult[], in which case
+ * we're guaranteed shift stays positive because inv_weight is guaranteed to
+ * fit 32 bits, and NICE_0_LOAD gives another 10 bits; therefore shift >= 22.
+ *
+ * Or, weight =< lw.weight (because lw.weight is the runqueue weight), thus
+ * weight/lw.weight <= 1, and therefore our shift will also be positive.
  */
-static unsigned long
-calc_delta_mine(unsigned long delta_exec, unsigned long weight,
-                struct load_weight *lw)
+static u64 __calc_delta(u64 delta_exec, unsigned long weight, struct load_weight *lw)
 {
-        u64 tmp;
-
-        /*
-         * weight can be less than 2^SCHED_LOAD_RESOLUTION for task group sched
-         * entities since MIN_SHARES = 2. Treat weight as 1 if less than
-         * 2^SCHED_LOAD_RESOLUTION.
-         */
-        if (likely(weight > (1UL << SCHED_LOAD_RESOLUTION)))
-                tmp = (u64)delta_exec * scale_load_down(weight);
-        else
-                tmp = (u64)delta_exec;
+        u64 fact = scale_load_down(weight);
+        int shift = WMULT_SHIFT;
 
-        if (!lw->inv_weight) {
-                unsigned long w = scale_load_down(lw->weight);
+        __update_inv_weight(lw);
 
-                if (BITS_PER_LONG > 32 && unlikely(w >= WMULT_CONST))
-                        lw->inv_weight = 1;
-                else if (unlikely(!w))
-                        lw->inv_weight = WMULT_CONST;
-                else
-                        lw->inv_weight = WMULT_CONST / w;
+        if (unlikely(fact >> 32)) {
+                while (fact >> 32) {
+                        fact >>= 1;
+                        shift--;
+                }
         }
 
-        /*
-         * Check whether we'd overflow the 64-bit multiplication:
-         */
-        if (unlikely(tmp > WMULT_CONST))
-                tmp = SRR(SRR(tmp, WMULT_SHIFT/2) * lw->inv_weight,
-                        WMULT_SHIFT/2);
-        else
-                tmp = SRR(tmp * lw->inv_weight, WMULT_SHIFT);
+        /* hint to use a 32x32->64 mul */
+        fact = (u64)(u32)fact * lw->inv_weight;
+
+        while (fact >> 32) {
+                fact >>= 1;
+                shift--;
+        }
 
-        return (unsigned long)min(tmp, (u64)(unsigned long)LONG_MAX);
+        return mul_u64_u32_shr(delta_exec, fact, shift);
 }
 
 
@@ -443,7 +445,7 @@ find_matching_se(struct sched_entity **se, struct sched_entity **pse)
 #endif  /* CONFIG_FAIR_GROUP_SCHED */
 
 static __always_inline
-void account_cfs_rq_runtime(struct cfs_rq *cfs_rq, unsigned long delta_exec);
+void account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec);
 
 /**************************************************************
  * Scheduling class tree data structure manipulation methods:
@@ -612,11 +614,10 @@ int sched_proc_update_handler(struct ctl_table *table, int write,
 /*
  * delta /= w
  */
-static inline unsigned long
-calc_delta_fair(unsigned long delta, struct sched_entity *se)
+static inline u64 calc_delta_fair(u64 delta, struct sched_entity *se)
 {
         if (unlikely(se->load.weight != NICE_0_LOAD))
-                delta = calc_delta_mine(delta, NICE_0_LOAD, &se->load);
+                delta = __calc_delta(delta, NICE_0_LOAD, &se->load);
 
         return delta;
 }
@@ -665,7 +666,7 @@ static u64 sched_slice(struct cfs_rq *cfs_rq, struct sched_entity *se)
                         update_load_add(&lw, se->load.weight);
                         load = &lw;
                 }
-                slice = calc_delta_mine(slice, se->load.weight, load);
+                slice = __calc_delta(slice, se->load.weight, load);
         }
         return slice;
 }
@@ -703,47 +704,32 @@ void init_task_runnable_average(struct task_struct *p)
 #endif
 
 /*
- * Update the current task's runtime statistics. Skip current tasks that
- * are not in our scheduling class.
+ * Update the current task's runtime statistics.
  */
-static inline void
-__update_curr(struct cfs_rq *cfs_rq, struct sched_entity *curr,
-              unsigned long delta_exec)
-{
-        unsigned long delta_exec_weighted;
-
-        schedstat_set(curr->statistics.exec_max,
-                      max((u64)delta_exec, curr->statistics.exec_max));
-
-        curr->sum_exec_runtime += delta_exec;
-        schedstat_add(cfs_rq, exec_clock, delta_exec);
-        delta_exec_weighted = calc_delta_fair(delta_exec, curr);
-
-        curr->vruntime += delta_exec_weighted;
-        update_min_vruntime(cfs_rq);
-}
-
 static void update_curr(struct cfs_rq *cfs_rq)
 {
         struct sched_entity *curr = cfs_rq->curr;
         u64 now = rq_clock_task(rq_of(cfs_rq));
-        unsigned long delta_exec;
+        u64 delta_exec;
 
         if (unlikely(!curr))
                 return;
 
-        /*
-         * Get the amount of time the current task was running
-         * since the last time we changed load (this cannot
-         * overflow on 32 bits):
-         */
-        delta_exec = (unsigned long)(now - curr->exec_start);
-        if (!delta_exec)
+        delta_exec = now - curr->exec_start;
+        if (unlikely((s64)delta_exec <= 0))
                 return;
 
-        __update_curr(cfs_rq, curr, delta_exec);
         curr->exec_start = now;
 
+        schedstat_set(curr->statistics.exec_max,
+                      max(delta_exec, curr->statistics.exec_max));
+
+        curr->sum_exec_runtime += delta_exec;
+        schedstat_add(cfs_rq, exec_clock, delta_exec);
+
+        curr->vruntime += calc_delta_fair(delta_exec, curr);
+        update_min_vruntime(cfs_rq);
+
         if (entity_is_task(curr)) {
                 struct task_struct *curtask = task_of(curr);
 
@@ -1752,6 +1738,13 @@ void task_numa_work(struct callback_head *work)
                     (vma->vm_file && (vma->vm_flags & (VM_READ|VM_WRITE)) == (VM_READ)))
                         continue;
 
+                /*
+                 * Skip inaccessible VMAs to avoid any confusion between
+                 * PROT_NONE and NUMA hinting ptes
+                 */
+                if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)))
+                        continue;
+
                 do {
                         start = max(start, vma->vm_start);
                         end = ALIGN(start + (pages << PAGE_SHIFT), HPAGE_SIZE);
@@ -3015,8 +3008,7 @@ static void expire_cfs_rq_runtime(struct cfs_rq *cfs_rq)
         }
 }
 
-static void __account_cfs_rq_runtime(struct cfs_rq *cfs_rq,
-                                     unsigned long delta_exec)
+static void __account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec)
 {
         /* dock delta_exec before expiring quota (as it could span periods) */
         cfs_rq->runtime_remaining -= delta_exec;
@@ -3034,7 +3026,7 @@ static void __account_cfs_rq_runtime(struct cfs_rq *cfs_rq,
 }
 
 static __always_inline
-void account_cfs_rq_runtime(struct cfs_rq *cfs_rq, unsigned long delta_exec)
+void account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec)
 {
         if (!cfs_bandwidth_used() || !cfs_rq->runtime_enabled)
                 return;
@@ -3574,8 +3566,7 @@ static inline u64 cfs_rq_clock_task(struct cfs_rq *cfs_rq)
         return rq_clock_task(rq_of(cfs_rq));
 }
 
-static void account_cfs_rq_runtime(struct cfs_rq *cfs_rq,
-                                     unsigned long delta_exec) {}
+static void account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec) {}
 static void check_cfs_rq_runtime(struct cfs_rq *cfs_rq) {}
 static void check_enqueue_throttle(struct cfs_rq *cfs_rq) {}
 static __always_inline void return_cfs_rq_runtime(struct cfs_rq *cfs_rq) {}
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 7d57275fc396..1c4065575fa2 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -901,6 +901,13 @@ inc_rt_prio_smp(struct rt_rq *rt_rq, int prio, int prev_prio)
 {
         struct rq *rq = rq_of_rt_rq(rt_rq);
 
+#ifdef CONFIG_RT_GROUP_SCHED
+        /*
+         * Change rq's cpupri only if rt_rq is the top queue.
+         */
+        if (&rq->rt != rt_rq)
+                return;
+#endif
         if (rq->online && prio < prev_prio)
                 cpupri_set(&rq->rd->cpupri, rq->cpu, prio);
 }
@@ -910,6 +917,13 @@ dec_rt_prio_smp(struct rt_rq *rt_rq, int prio, int prev_prio)
 {
         struct rq *rq = rq_of_rt_rq(rt_rq);
 
+#ifdef CONFIG_RT_GROUP_SCHED
+        /*
+         * Change rq's cpupri only if rt_rq is the top queue.
+         */
+        if (&rq->rt != rt_rq)
+                return;
+#endif
         if (rq->online && rt_rq->highest_prio.curr != prev_prio)
                 cpupri_set(&rq->rd->cpupri, rq->cpu, rt_rq->highest_prio.curr);
 }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 0e9f9eaade2f..72a0f81dc5a8 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -775,7 +775,7 @@ static int ftrace_profile_init(void)
         int cpu;
         int ret = 0;
 
-        for_each_online_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 ret = ftrace_profile_init_cpu(cpu);
                 if (ret)
                         break;
diff --git a/kernel/user.c b/kernel/user.c
index a3a0dbfda329..c006131beb77 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -51,9 +51,9 @@ struct user_namespace init_user_ns = {
         .owner = GLOBAL_ROOT_UID,
         .group = GLOBAL_ROOT_GID,
         .proc_inum = PROC_USER_INIT_INO,
-#ifdef CONFIG_KEYS_KERBEROS_CACHE
-        .krb_cache_register_sem =
-        __RWSEM_INITIALIZER(init_user_ns.krb_cache_register_sem),
+#ifdef CONFIG_PERSISTENT_KEYRINGS
+        .persistent_keyring_register_sem =
+        __RWSEM_INITIALIZER(init_user_ns.persistent_keyring_register_sem),
 #endif
 };
 EXPORT_SYMBOL_GPL(init_user_ns);
diff --git a/mm/Kconfig b/mm/Kconfig
index eb69f352401d..723bbe04a0b0 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -543,7 +543,7 @@ config ZSWAP
 
 config MEM_SOFT_DIRTY
         bool "Track memory changes"
-        depends on CHECKPOINT_RESTORE && HAVE_ARCH_SOFT_DIRTY
+        depends on CHECKPOINT_RESTORE && HAVE_ARCH_SOFT_DIRTY && PROC_FS
         select PROC_PAGE_MONITOR
         help
           This option enables memory changes tracking by introducing a
diff --git a/mm/compaction.c b/mm/compaction.c
index 805165bcd3dd..f58bcd016f43 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -134,6 +134,10 @@ static void update_pageblock_skip(struct compact_control *cc,
                         bool migrate_scanner)
 {
         struct zone *zone = cc->zone;
+
+        if (cc->ignore_skip_hint)
+                return;
+
         if (!page)
                 return;
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 33a5dc492810..7de1bf85f683 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -882,6 +882,10 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 ret = 0;
                 goto out_unlock;
         }
+
+        /* mmap_sem prevents this happening but warn if that changes */
+        WARN_ON(pmd_trans_migrating(pmd));
+
         if (unlikely(pmd_trans_splitting(pmd))) {
                 /* split huge page running from under us */
                 spin_unlock(src_ptl);
@@ -1243,6 +1247,10 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
         if ((flags & FOLL_DUMP) && is_huge_zero_pmd(*pmd))
                 return ERR_PTR(-EFAULT);
 
+        /* Full NUMA hinting faults to serialise migration in fault paths */
+        if ((flags & FOLL_NUMA) && pmd_numa(*pmd))
+                goto out;
+
         page = pmd_page(*pmd);
         VM_BUG_ON(!PageHead(page));
         if (flags & FOLL_TOUCH) {
@@ -1295,6 +1303,17 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         if (unlikely(!pmd_same(pmd, *pmdp)))
                 goto out_unlock;
 
+        /*
+         * If there are potential migrations, wait for completion and retry
+         * without disrupting NUMA hinting information. Do not relock and
+         * check_same as the page may no longer be mapped.
+         */
+        if (unlikely(pmd_trans_migrating(*pmdp))) {
+                spin_unlock(ptl);
+                wait_migrate_huge_page(vma->anon_vma, pmdp);
+                goto out;
+        }
+
         page = pmd_page(pmd);
         BUG_ON(is_huge_zero_page(page));
         page_nid = page_to_nid(page);
@@ -1323,23 +1342,22 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 /* If the page was locked, there are no parallel migrations */
                 if (page_locked)
                         goto clear_pmdnuma;
+        }
 
-                /*
-                 * Otherwise wait for potential migrations and retry. We do
-                 * relock and check_same as the page may no longer be mapped.
-                 * As the fault is being retried, do not account for it.
-                 */
+        /* Migration could have started since the pmd_trans_migrating check */
+        if (!page_locked) {
                 spin_unlock(ptl);
                 wait_on_page_locked(page);
                 page_nid = -1;
                 goto out;
         }
 
-        /* Page is misplaced, serialise migrations and parallel THP splits */
+        /*
+         * Page is misplaced. Page lock serialises migrations. Acquire anon_vma
+         * to serialises splits
+         */
         get_page(page);
         spin_unlock(ptl);
-        if (!page_locked)
-                lock_page(page);
         anon_vma = page_lock_anon_vma_read(page);
 
         /* Confirm the PMD did not change while page_table_lock was released */
@@ -1351,6 +1369,13 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 goto out_unlock;
         }
 
+        /* Bail if we fail to protect against THP splits for any reason */
+        if (unlikely(!anon_vma)) {
+                put_page(page);
+                page_nid = -1;
+                goto clear_pmdnuma;
+        }
+
         /*
          * Migrate the THP to the requested node, returns with page unlocked
          * and pmd_numa cleared.
@@ -1517,6 +1542,8 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                 ret = 1;
                 if (!prot_numa) {
                         entry = pmdp_get_and_clear(mm, addr, pmd);
+                        if (pmd_numa(entry))
+                                entry = pmd_mknonnuma(entry);
                         entry = pmd_modify(entry, newprot);
                         ret = HPAGE_PMD_NR;
                         BUG_ON(pmd_write(entry));
@@ -1531,7 +1558,7 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                          */
                         if (!is_huge_zero_page(page) &&
                             !pmd_numa(*pmd)) {
-                                entry = pmdp_get_and_clear(mm, addr, pmd);
+                                entry = *pmd;
                                 entry = pmd_mknuma(entry);
                                 ret = HPAGE_PMD_NR;
                         }
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index b7c171602ba1..db08af92c6fc 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1505,10 +1505,16 @@ static int soft_offline_huge_page(struct page *page, int flags)
                 if (ret > 0)
                         ret = -EIO;
         } else {
-                set_page_hwpoison_huge_page(hpage);
-                dequeue_hwpoisoned_huge_page(hpage);
-                atomic_long_add(1 << compound_order(hpage),
-                                &num_poisoned_pages);
+                /* overcommit hugetlb page will be freed to buddy */
+                if (PageHuge(page)) {
+                        set_page_hwpoison_huge_page(hpage);
+                        dequeue_hwpoisoned_huge_page(hpage);
+                        atomic_long_add(1 << compound_order(hpage),
+                                        &num_poisoned_pages);
+                } else {
+                        SetPageHWPoison(page);
+                        atomic_long_inc(&num_poisoned_pages);
+                }
         }
         return ret;
 }
diff --git a/mm/memory.c b/mm/memory.c
index 5d9025f3b3e1..6768ce9e57d2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4271,7 +4271,7 @@ void copy_user_huge_page(struct page *dst, struct page *src,
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
 
-#if USE_SPLIT_PTE_PTLOCKS && BLOATED_SPINLOCKS
+#if USE_SPLIT_PTE_PTLOCKS && ALLOC_SPLIT_PTLOCKS
 bool ptlock_alloc(struct page *page)
 {
         spinlock_t *ptl;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index eca4a3129129..0cd2c4d4e270 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1197,14 +1197,16 @@ static struct page *new_vma_page(struct page *page, unsigned long private, int *
                         break;
                 vma = vma->vm_next;
         }
+
+        if (PageHuge(page)) {
+                if (vma)
+                        return alloc_huge_page_noerr(vma, address, 1);
+                else
+                        return NULL;
+        }
         /*
-         * queue_pages_range() confirms that @page belongs to some vma,
-         * so vma shouldn't be NULL.
+         * if !vma, alloc_page_vma() will use task or system default policy
          */
-        BUG_ON(!vma);
-
-        if (PageHuge(page))
-                return alloc_huge_page_noerr(vma, address, 1);
         return alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
 }
 #else
@@ -1318,7 +1320,7 @@ static long do_mbind(unsigned long start, unsigned long len,
                 if (nr_failed && (flags & MPOL_MF_STRICT))
                         err = -EIO;
         } else
-                putback_lru_pages(&pagelist);
+                putback_movable_pages(&pagelist);
 
         up_write(&mm->mmap_sem);
  mpol_out:
diff --git a/mm/migrate.c b/mm/migrate.c
index bb940045fe85..9194375b2307 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -36,6 +36,7 @@
 #include <linux/hugetlb_cgroup.h>
 #include <linux/gfp.h>
 #include <linux/balloon_compaction.h>
+#include <linux/mmu_notifier.h>
 
 #include <asm/tlbflush.h>
 
@@ -316,14 +317,15 @@ static inline bool buffer_migrate_lock_buffers(struct buffer_head *head,
  */
 int migrate_page_move_mapping(struct address_space *mapping,
                 struct page *newpage, struct page *page,
-                struct buffer_head *head, enum migrate_mode mode)
+                struct buffer_head *head, enum migrate_mode mode,
+                int extra_count)
 {
-        int expected_count = 0;
+        int expected_count = 1 + extra_count;
         void **pslot;
 
         if (!mapping) {
                 /* Anonymous page without mapping */
-                if (page_count(page) != 1)
+                if (page_count(page) != expected_count)
                         return -EAGAIN;
                 return MIGRATEPAGE_SUCCESS;
         }
@@ -333,7 +335,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
         pslot = radix_tree_lookup_slot(&mapping->page_tree,
                                         page_index(page));
 
-        expected_count = 2 + page_has_private(page);
+        expected_count += 1 + page_has_private(page);
         if (page_count(page) != expected_count ||
                 radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
                 spin_unlock_irq(&mapping->tree_lock);
@@ -583,7 +585,7 @@ int migrate_page(struct address_space *mapping,
 
         BUG_ON(PageWriteback(page));    /* Writeback must be complete */
 
-        rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode);
+        rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0);
 
         if (rc != MIGRATEPAGE_SUCCESS)
                 return rc;
@@ -610,7 +612,7 @@ int buffer_migrate_page(struct address_space *mapping,
 
         head = page_buffers(page);
 
-        rc = migrate_page_move_mapping(mapping, newpage, page, head, mode);
+        rc = migrate_page_move_mapping(mapping, newpage, page, head, mode, 0);
 
         if (rc != MIGRATEPAGE_SUCCESS)
                 return rc;
@@ -1654,6 +1656,18 @@ int numamigrate_isolate_page(pg_data_t *pgdat, struct page *page)
         return 1;
 }
 
+bool pmd_trans_migrating(pmd_t pmd)
+{
+        struct page *page = pmd_page(pmd);
+        return PageLocked(page);
+}
+
+void wait_migrate_huge_page(struct anon_vma *anon_vma, pmd_t *pmd)
+{
+        struct page *page = pmd_page(*pmd);
+        wait_on_page_locked(page);
+}
+
 /*
  * Attempt to migrate a misplaced page to the specified destination
  * node. Caller is expected to have an elevated reference count on
@@ -1716,12 +1730,14 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                                 struct page *page, int node)
 {
         spinlock_t *ptl;
-        unsigned long haddr = address & HPAGE_PMD_MASK;
         pg_data_t *pgdat = NODE_DATA(node);
         int isolated = 0;
         struct page *new_page = NULL;
         struct mem_cgroup *memcg = NULL;
         int page_lru = page_is_file_cache(page);
+        unsigned long mmun_start = address & HPAGE_PMD_MASK;
+        unsigned long mmun_end = mmun_start + HPAGE_PMD_SIZE;
+        pmd_t orig_entry;
 
         /*
          * Rate-limit the amount of data that is being migrated to a node.
@@ -1744,6 +1760,9 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                 goto out_fail;
         }
 
+        if (mm_tlb_flush_pending(mm))
+                flush_tlb_range(vma, mmun_start, mmun_end);
+
         /* Prepare a page as a migration target */
         __set_page_locked(new_page);
         SetPageSwapBacked(new_page);
@@ -1755,9 +1774,12 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
         WARN_ON(PageLRU(new_page));
 
         /* Recheck the target PMD */
+        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
         ptl = pmd_lock(mm, pmd);
-        if (unlikely(!pmd_same(*pmd, entry))) {
+        if (unlikely(!pmd_same(*pmd, entry) || page_count(page) != 2)) {
+fail_putback:
                 spin_unlock(ptl);
+                mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 
                 /* Reverse changes made by migrate_page_copy() */
                 if (TestClearPageActive(new_page))
@@ -1774,7 +1796,8 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                 putback_lru_page(page);
                 mod_zone_page_state(page_zone(page),
                          NR_ISOLATED_ANON + page_lru, -HPAGE_PMD_NR);
-                goto out_fail;
+
+                goto out_unlock;
         }
 
         /*
@@ -1786,16 +1809,35 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
          */
         mem_cgroup_prepare_migration(page, new_page, &memcg);
 
+        orig_entry = *pmd;
         entry = mk_pmd(new_page, vma->vm_page_prot);
-        entry = pmd_mknonnuma(entry);
-        entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
         entry = pmd_mkhuge(entry);
+        entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
 
-        pmdp_clear_flush(vma, haddr, pmd);
-        set_pmd_at(mm, haddr, pmd, entry);
-        page_add_new_anon_rmap(new_page, vma, haddr);
+        /*
+         * Clear the old entry under pagetable lock and establish the new PTE.
+         * Any parallel GUP will either observe the old page blocking on the
+         * page lock, block on the page table lock or observe the new page.
+         * The SetPageUptodate on the new page and page_add_new_anon_rmap
+         * guarantee the copy is visible before the pagetable update.
+         */
+        flush_cache_range(vma, mmun_start, mmun_end);
+        page_add_new_anon_rmap(new_page, vma, mmun_start);
+        pmdp_clear_flush(vma, mmun_start, pmd);
+        set_pmd_at(mm, mmun_start, pmd, entry);
+        flush_tlb_range(vma, mmun_start, mmun_end);
         update_mmu_cache_pmd(vma, address, &entry);
+
+        if (page_count(page) != 2) {
+                set_pmd_at(mm, mmun_start, pmd, orig_entry);
+                flush_tlb_range(vma, mmun_start, mmun_end);
+                update_mmu_cache_pmd(vma, address, &entry);
+                page_remove_rmap(new_page);
+                goto fail_putback;
+        }
+
         page_remove_rmap(page);
+
         /*
          * Finish the charge transaction under the page table lock to
          * prevent split_huge_page() from dividing up the charge
@@ -1803,6 +1845,7 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
          */
         mem_cgroup_end_migration(memcg, page, new_page, true);
         spin_unlock(ptl);
+        mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 
         unlock_page(new_page);
         unlock_page(page);
@@ -1820,10 +1863,15 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
 out_fail:
         count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
 out_dropref:
-        entry = pmd_mknonnuma(entry);
-        set_pmd_at(mm, haddr, pmd, entry);
-        update_mmu_cache_pmd(vma, address, &entry);
+        ptl = pmd_lock(mm, pmd);
+        if (pmd_same(*pmd, entry)) {
+                entry = pmd_mknonnuma(entry);
+                set_pmd_at(mm, mmun_start, pmd, entry);
+                update_mmu_cache_pmd(vma, address, &entry);
+        }
+        spin_unlock(ptl);
 
+out_unlock:
         unlock_page(page);
         put_page(page);
         return 0;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 26667971c824..bb53a6591aea 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -52,17 +52,21 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                         pte_t ptent;
                         bool updated = false;
 
-                        ptent = ptep_modify_prot_start(mm, addr, pte);
                         if (!prot_numa) {
+                                ptent = ptep_modify_prot_start(mm, addr, pte);
+                                if (pte_numa(ptent))
+                                        ptent = pte_mknonnuma(ptent);
                                 ptent = pte_modify(ptent, newprot);
                                 updated = true;
                         } else {
                                 struct page *page;
 
+                                ptent = *pte;
                                 page = vm_normal_page(vma, addr, oldpte);
                                 if (page) {
                                         if (!pte_numa(oldpte)) {
                                                 ptent = pte_mknuma(ptent);
+                                                set_pte_at(mm, addr, pte, ptent);
                                                 updated = true;
                                         }
                                 }
@@ -79,7 +83,10 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
 
                         if (updated)
                                 pages++;
-                        ptep_modify_prot_commit(mm, addr, pte, ptent);
+
+                        /* Only !prot_numa always clears the pte */
+                        if (!prot_numa)
+                                ptep_modify_prot_commit(mm, addr, pte, ptent);
                 } else if (IS_ENABLED(CONFIG_MIGRATION) && !pte_file(oldpte)) {
                         swp_entry_t entry = pte_to_swp_entry(oldpte);
 
@@ -181,6 +188,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
         BUG_ON(addr >= end);
         pgd = pgd_offset(mm, addr);
         flush_cache_range(vma, addr, end);
+        set_tlb_flush_pending(mm);
         do {
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
@@ -192,6 +200,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
         /* Only flush the TLB if we actually modified any entries: */
         if (pages)
                 flush_tlb_range(vma, start, end);
+        clear_tlb_flush_pending(mm);
 
         return pages;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 580a5f075ed0..5248fe070aa4 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1816,7 +1816,7 @@ static void zlc_clear_zones_full(struct zonelist *zonelist)
 
 static bool zone_local(struct zone *local_zone, struct zone *zone)
 {
-        return node_distance(local_zone->node, zone->node) == LOCAL_DISTANCE;
+        return local_zone->node == zone->node;
 }
 
 static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone)
@@ -1913,18 +1913,17 @@ zonelist_scan:
                  * page was allocated in should have no effect on the
                  * time the page has in memory before being reclaimed.
                  *
-                 * When zone_reclaim_mode is enabled, try to stay in
-                 * local zones in the fastpath.  If that fails, the
-                 * slowpath is entered, which will do another pass
-                 * starting with the local zones, but ultimately fall
-                 * back to remote zones that do not partake in the
-                 * fairness round-robin cycle of this zonelist.
+                 * Try to stay in local zones in the fastpath.  If
+                 * that fails, the slowpath is entered, which will do
+                 * another pass starting with the local zones, but
+                 * ultimately fall back to remote zones that do not
+                 * partake in the fairness round-robin cycle of this
+                 * zonelist.
                  */
                 if (alloc_flags & ALLOC_WMARK_LOW) {
                         if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
                                 continue;
-                        if (zone_reclaim_mode &&
-                            !zone_local(preferred_zone, zone))
+                        if (!zone_local(preferred_zone, zone))
                                 continue;
                 }
                 /*
@@ -2390,7 +2389,7 @@ static void prepare_slowpath(gfp_t gfp_mask, unsigned int order,
                  * thrash fairness information for zones that are not
                  * actually part of this zonelist's round-robin cycle.
                  */
-                if (zone_reclaim_mode && !zone_local(preferred_zone, zone))
+                if (!zone_local(preferred_zone, zone))
                         continue;
                 mod_zone_page_state(zone, NR_ALLOC_BATCH,
                                     high_wmark_pages(zone) -
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index cbb38545d9d6..a8b919925934 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -110,9 +110,10 @@ int pmdp_clear_flush_young(struct vm_area_struct *vma,
 pte_t ptep_clear_flush(struct vm_area_struct *vma, unsigned long address,
                        pte_t *ptep)
 {
+        struct mm_struct *mm = (vma)->vm_mm;
         pte_t pte;
-        pte = ptep_get_and_clear((vma)->vm_mm, address, ptep);
-        if (pte_accessible(pte))
+        pte = ptep_get_and_clear(mm, address, ptep);
+        if (pte_accessible(mm, pte))
                 flush_tlb_page(vma, address);
         return pte;
 }
@@ -191,6 +192,9 @@ pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp)
 void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
                      pmd_t *pmdp)
 {
+        pmd_t entry = *pmdp;
+        if (pmd_numa(entry))
+                entry = pmd_mknonnuma(entry);
         set_pmd_at(vma->vm_mm, address, pmdp, pmd_mknotpresent(*pmdp));
         flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
 }
diff --git a/mm/rmap.c b/mm/rmap.c
index 55c8b8dc9ffb..068522d8502a 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -600,7 +600,11 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
         spinlock_t *ptl;
 
         if (unlikely(PageHuge(page))) {
+                /* when pud is not present, pte will be NULL */
                 pte = huge_pte_offset(mm, address);
+                if (!pte)
+                        return NULL;
+
                 ptl = huge_pte_lockptr(page_hstate(page), mm, pte);
                 goto check;
         }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index ca15f32821fb..36b1443f9ae4 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1161,6 +1161,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                                                  neigh->parms->reachable_time :
                                                  0)));
                 neigh->nud_state = new;
+                notify = 1;
         }
 
         if (lladdr != neigh->ha) {
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index f13bd91d9a56..a313c3fbeb46 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -423,6 +423,7 @@ static void synproxy_tg4_destroy(const struct xt_tgdtor_param *par)
 static struct xt_target synproxy_tg4_reg __read_mostly = {
         .name           = "SYNPROXY",
         .family         = NFPROTO_IPV4,
+        .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
         .target         = synproxy_tg4,
         .targetsize     = sizeof(struct xt_synproxy_info),
         .checkentry     = synproxy_tg4_check,
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index fff5ba1a33b7..4a5e94ac314a 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -72,7 +72,7 @@ static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         const struct nft_reject *priv = nft_expr_priv(expr);
 
-        if (nla_put_be32(skb, NFTA_REJECT_TYPE, priv->type))
+        if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
                 goto nla_put_failure;
 
         switch (priv->type) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 62c19fdd102d..f140048334ce 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1600,20 +1600,15 @@ static void flush_stack(struct sock **stack, unsigned int count,
 }
 
 /* For TCP sockets, sk_rx_dst is protected by socket lock
- * For UDP, we use sk_dst_lock to guard against concurrent changes.
+ * For UDP, we use xchg() to guard against concurrent changes.
  */
 static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
 {
         struct dst_entry *old;
 
-        spin_lock(&sk->sk_dst_lock);
-        old = sk->sk_rx_dst;
-        if (likely(old != dst)) {
-                dst_hold(dst);
-                sk->sk_rx_dst = dst;
-                dst_release(old);
-        }
-        spin_unlock(&sk->sk_dst_lock);
+        dst_hold(dst);
+        old = xchg(&sk->sk_rx_dst, dst);
+        dst_release(old);
 }
 
 /*
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index f78f41aca8e9..a0d17270117c 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -446,6 +446,7 @@ static void synproxy_tg6_destroy(const struct xt_tgdtor_param *par)
 static struct xt_target synproxy_tg6_reg __read_mostly = {
         .name           = "SYNPROXY",
         .family         = NFPROTO_IPV6,
+        .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
         .target         = synproxy_tg6,
         .targetsize     = sizeof(struct xt_synproxy_info),
         .checkentry     = synproxy_tg6_check,
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index 53c452efb40b..5e68b94ee640 100644
--- a/net/sctp/probe.c
+++ b/net/sctp/probe.c
@@ -38,6 +38,7 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
+MODULE_SOFTDEP("pre: sctp");
 MODULE_AUTHOR("Wei Yongjun <yjwei@cn.fujitsu.com>");
 MODULE_DESCRIPTION("SCTP snooper");
 MODULE_LICENSE("GPL");
@@ -182,6 +183,20 @@ static struct jprobe sctp_recv_probe = {
         .entry  = jsctp_sf_eat_sack,
 };
 
+static __init int sctp_setup_jprobe(void)
+{
+        int ret = register_jprobe(&sctp_recv_probe);
+
+        if (ret) {
+                if (request_module("sctp"))
+                        goto out;
+                ret = register_jprobe(&sctp_recv_probe);
+        }
+
+out:
+        return ret;
+}
+
 static __init int sctpprobe_init(void)
 {
         int ret = -ENOMEM;
@@ -202,7 +217,7 @@ static __init int sctpprobe_init(void)
                          &sctpprobe_fops))
                 goto free_kfifo;
 
-        ret = register_jprobe(&sctp_recv_probe);
+        ret = sctp_setup_jprobe();
         if (ret)
                 goto remove_proc;
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index a0ca162e5bd5..a427623ee574 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -718,7 +718,9 @@ static int unix_autobind(struct socket *sock)
         int err;
         unsigned int retries = 0;
 
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err)
+                return err;
 
         err = 0;
         if (u->addr)
@@ -877,7 +879,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         addr_len = err;
 
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err)
+                goto out;
 
         err = -EINVAL;
         if (u->addr)
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 6e03b465e44e..a2104671f51d 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1937,6 +1937,8 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
                 case SNDRV_PCM_STATE_DISCONNECTED:
                         err = -EBADFD;
                         goto _endloop;
+                case SNDRV_PCM_STATE_PAUSED:
+                        continue;
                 }
                 if (!tout) {
                         snd_printd("%s write error (DMA or IRQ trouble?)\n",
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 27aa14007cbd..956871d8b3d2 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -3433,6 +3433,10 @@ static void check_probe_mask(struct azx *chip, int dev)
  * white/black-list for enable_msi
  */
 static struct snd_pci_quirk msi_black_list[] = {
+        SND_PCI_QUIRK(0x103c, 0x2191, "HP", 0), /* AMD Hudson */
+        SND_PCI_QUIRK(0x103c, 0x2192, "HP", 0), /* AMD Hudson */
+        SND_PCI_QUIRK(0x103c, 0x21f7, "HP", 0), /* AMD Hudson */
+        SND_PCI_QUIRK(0x103c, 0x21fa, "HP", 0), /* AMD Hudson */
         SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
         SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
         SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 34de5dc2fe9b..c5646941539a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4247,12 +4247,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0606, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0610, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0614, "Dell Inspiron 3135", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_MONO_SPEAKERS),
         SND_PCI_QUIRK(0x1028, 0x061f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0629, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS),
+        SND_PCI_QUIRK(0x1028, 0x063e, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x063f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0640, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
index 8697cedccd21..1ead3c977a51 100644
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -648,7 +648,7 @@ static int atmel_ssc_prepare(struct snd_pcm_substream *substream,
 
         dma_params = ssc_p->dma_params[dir];
 
-        ssc_writel(ssc_p->ssc->regs, CR, dma_params->mask->ssc_enable);
+        ssc_writel(ssc_p->ssc->regs, CR, dma_params->mask->ssc_disable);
         ssc_writel(ssc_p->ssc->regs, IDR, dma_params->mask->ssc_error);
 
         pr_debug("%s enabled SSC_SR=0x%08x\n",
@@ -657,6 +657,33 @@ static int atmel_ssc_prepare(struct snd_pcm_substream *substream,
         return 0;
 }
 
+static int atmel_ssc_trigger(struct snd_pcm_substream *substream,
+                             int cmd, struct snd_soc_dai *dai)
+{
+        struct atmel_ssc_info *ssc_p = &ssc_info[dai->id];
+        struct atmel_pcm_dma_params *dma_params;
+        int dir;
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                dir = 0;
+        else
+                dir = 1;
+
+        dma_params = ssc_p->dma_params[dir];
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                ssc_writel(ssc_p->ssc->regs, CR, dma_params->mask->ssc_enable);
+                break;
+        default:
+                ssc_writel(ssc_p->ssc->regs, CR, dma_params->mask->ssc_disable);
+                break;
+        }
+
+        return 0;
+}
 
 #ifdef CONFIG_PM
 static int atmel_ssc_suspend(struct snd_soc_dai *cpu_dai)
@@ -731,6 +758,7 @@ static const struct snd_soc_dai_ops atmel_ssc_dai_ops = {
         .startup        = atmel_ssc_startup,
         .shutdown       = atmel_ssc_shutdown,
         .prepare        = atmel_ssc_prepare,
+        .trigger        = atmel_ssc_trigger,
         .hw_params      = atmel_ssc_hw_params,
         .set_fmt        = atmel_ssc_set_dai_fmt,
         .set_clkdiv     = atmel_ssc_set_dai_clkdiv,
diff --git a/sound/soc/atmel/sam9x5_wm8731.c b/sound/soc/atmel/sam9x5_wm8731.c
index 1b372283bd01..7d6a9055874b 100644
--- a/sound/soc/atmel/sam9x5_wm8731.c
+++ b/sound/soc/atmel/sam9x5_wm8731.c
@@ -109,7 +109,7 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev)
         dai->stream_name = "WM8731 PCM";
         dai->codec_dai_name = "wm8731-hifi";
         dai->init = sam9x5_wm8731_init;
-        dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+        dai->dai_fmt = SND_SOC_DAIFMT_DSP_A | SND_SOC_DAIFMT_NB_NF
                 | SND_SOC_DAIFMT_CBM_CFM;
 
         ret = snd_soc_of_parse_card_name(card, "atmel,model");
diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
index 99b359e19d35..0ab2dc296474 100644
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -1012,7 +1012,7 @@ static const struct snd_soc_dapm_route wm5110_dapm_routes[] = {
         { "AEC Loopback", "HPOUT3L", "OUT3L" },
         { "AEC Loopback", "HPOUT3R", "OUT3R" },
         { "HPOUT3L", NULL, "OUT3L" },
-        { "HPOUT3R", NULL, "OUT3L" },
+        { "HPOUT3R", NULL, "OUT3R" },
 
         { "AEC Loopback", "SPKOUTL", "OUT4L" },
         { "SPKOUTLN", NULL, "OUT4L" },
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index 3938fb1c203e..53bbfac6a83a 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -1444,7 +1444,7 @@ static int wm8904_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 
         switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
         case SND_SOC_DAIFMT_DSP_B:
-                aif1 |= WM8904_AIF_LRCLK_INV;
+                aif1 |= 0x3 | WM8904_AIF_LRCLK_INV;
         case SND_SOC_DAIFMT_DSP_A:
                 aif1 |= 0x3;
                 break;
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 543c5c2631b6..0f17ed3e29f4 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -2439,7 +2439,20 @@ static void wm8962_configure_bclk(struct snd_soc_codec *codec)
         snd_soc_update_bits(codec, WM8962_CLOCKING_4,
                             WM8962_SYSCLK_RATE_MASK, clocking4);
 
+        /* DSPCLK_DIV can be only generated correctly after enabling SYSCLK.
+         * So we here provisionally enable it and then disable it afterward
+         * if current bias_level hasn't reached SND_SOC_BIAS_ON.
+         */
+        if (codec->dapm.bias_level != SND_SOC_BIAS_ON)
+                snd_soc_update_bits(codec, WM8962_CLOCKING2,
+                                WM8962_SYSCLK_ENA_MASK, WM8962_SYSCLK_ENA);
+
         dspclk = snd_soc_read(codec, WM8962_CLOCKING1);
+
+        if (codec->dapm.bias_level != SND_SOC_BIAS_ON)
+                snd_soc_update_bits(codec, WM8962_CLOCKING2,
+                                WM8962_SYSCLK_ENA_MASK, 0);
+
         if (dspclk < 0) {
                 dev_err(codec->dev, "Failed to read DSPCLK: %d\n", dspclk);
                 return;
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 46ec0e9744d4..4fbcab63e61f 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1474,13 +1474,17 @@ static int wm_adsp2_ena(struct wm_adsp *dsp)
                 return ret;
 
         /* Wait for the RAM to start, should be near instantaneous */
-        count = 0;
-        do {
+        for (count = 0; count < 10; ++count) {
                 ret = regmap_read(dsp->regmap, dsp->base + ADSP2_STATUS1,
                                   &val);
                 if (ret != 0)
                         return ret;
-        } while (!(val & ADSP2_RAM_RDY) && ++count < 10);
+
+                if (val & ADSP2_RAM_RDY)
+                        break;
+
+                msleep(1);
+        }
 
         if (!(val & ADSP2_RAM_RDY)) {
                 adsp_err(dsp, "Failed to start DSP RAM\n");
diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
index 61e48852b9e8..3fd76bc391de 100644
--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -130,8 +130,6 @@ static int imx_wm8962_set_bias_level(struct snd_soc_card *card,
                 break;
         }
 
-        dapm->bias_level = level;
-
         return 0;
 }
 
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index 0b18f654b413..3920a5e8125f 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -473,17 +473,17 @@ static struct snd_soc_dai_driver kirkwood_i2s_dai_extclk[2] = {
         .playback = {
                 .channels_min = 1,
                 .channels_max = 2,
-                .rates = SNDRV_PCM_RATE_8000_192000 |
-                         SNDRV_PCM_RATE_CONTINUOUS |
-                         SNDRV_PCM_RATE_KNOT,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
+                .rate_min = 5512,
+                .rate_max = 192000,
                 .formats = KIRKWOOD_I2S_FORMATS,
         },
         .capture = {
                 .channels_min = 1,
                 .channels_max = 2,
-                .rates = SNDRV_PCM_RATE_8000_192000 |
-                         SNDRV_PCM_RATE_CONTINUOUS |
-                         SNDRV_PCM_RATE_KNOT,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
+                .rate_min = 5512,
+                .rate_max = 192000,
                 .formats = KIRKWOOD_I2S_FORMATS,
         },
         .ops = &kirkwood_i2s_dai_ops,
@@ -494,17 +494,17 @@ static struct snd_soc_dai_driver kirkwood_i2s_dai_extclk[2] = {
         .playback = {
                 .channels_min = 1,
                 .channels_max = 2,
-                .rates = SNDRV_PCM_RATE_8000_192000 |
-                         SNDRV_PCM_RATE_CONTINUOUS |
-                         SNDRV_PCM_RATE_KNOT,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
+                .rate_min = 5512,
+                .rate_max = 192000,
                 .formats = KIRKWOOD_SPDIF_FORMATS,
         },
         .capture = {
                 .channels_min = 1,
                 .channels_max = 2,
-                .rates = SNDRV_PCM_RATE_8000_192000 |
-                         SNDRV_PCM_RATE_CONTINUOUS |
-                         SNDRV_PCM_RATE_KNOT,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
+                .rate_min = 5512,
+                .rate_max = 192000,
                 .formats = KIRKWOOD_SPDIF_FORMATS,
         },
         .ops = &kirkwood_i2s_dai_ops,
diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
index cbc9c96ce1f4..41949af3baae 100644
--- a/sound/soc/soc-generic-dmaengine-pcm.c
+++ b/sound/soc/soc-generic-dmaengine-pcm.c
@@ -305,6 +305,20 @@ static void dmaengine_pcm_request_chan_of(struct dmaengine_pcm *pcm,
         }
 }
 
+static void dmaengine_pcm_release_chan(struct dmaengine_pcm *pcm)
+{
+        unsigned int i;
+
+        for (i = SNDRV_PCM_STREAM_PLAYBACK; i <= SNDRV_PCM_STREAM_CAPTURE;
+             i++) {
+                if (!pcm->chan[i])
+                        continue;
+                dma_release_channel(pcm->chan[i]);
+                if (pcm->flags & SND_DMAENGINE_PCM_FLAG_HALF_DUPLEX)
+                        break;
+        }
+}
+
 /**
  * snd_dmaengine_pcm_register - Register a dmaengine based PCM device
  * @dev: The parent device for the PCM device
@@ -315,6 +329,7 @@ int snd_dmaengine_pcm_register(struct device *dev,
         const struct snd_dmaengine_pcm_config *config, unsigned int flags)
 {
         struct dmaengine_pcm *pcm;
+        int ret;
 
         pcm = kzalloc(sizeof(*pcm), GFP_KERNEL);
         if (!pcm)
@@ -326,11 +341,20 @@ int snd_dmaengine_pcm_register(struct device *dev,
         dmaengine_pcm_request_chan_of(pcm, dev);
 
         if (flags & SND_DMAENGINE_PCM_FLAG_NO_RESIDUE)
-                return snd_soc_add_platform(dev, &pcm->platform,
+                ret = snd_soc_add_platform(dev, &pcm->platform,
                                 &dmaengine_no_residue_pcm_platform);
         else
-                return snd_soc_add_platform(dev, &pcm->platform,
+                ret = snd_soc_add_platform(dev, &pcm->platform,
                                 &dmaengine_pcm_platform);
+        if (ret)
+                goto err_free_dma;
+
+        return 0;
+
+err_free_dma:
+        dmaengine_pcm_release_chan(pcm);
+        kfree(pcm);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_register);
 
@@ -345,7 +369,6 @@ void snd_dmaengine_pcm_unregister(struct device *dev)
 {
         struct snd_soc_platform *platform;
         struct dmaengine_pcm *pcm;
-        unsigned int i;
 
         platform = snd_soc_lookup_platform(dev);
         if (!platform)
@@ -353,15 +376,8 @@ void snd_dmaengine_pcm_unregister(struct device *dev)
 
         pcm = soc_platform_to_pcm(platform);
 
-        for (i = SNDRV_PCM_STREAM_PLAYBACK; i <= SNDRV_PCM_STREAM_CAPTURE; i++) {
-                if (pcm->chan[i]) {
-                        dma_release_channel(pcm->chan[i]);
-                        if (pcm->flags & SND_DMAENGINE_PCM_FLAG_HALF_DUPLEX)
-                                break;
-                }
-        }
-
         snd_soc_remove_platform(platform);
+        dmaengine_pcm_release_chan(pcm);
         kfree(pcm);
 }
 EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_unregister);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 11a90cd027fa..891b9a9bcbf8 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -600,12 +600,13 @@ static int soc_pcm_hw_free(struct snd_pcm_substream *substream)
         struct snd_soc_platform *platform = rtd->platform;
         struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
         struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        struct snd_soc_codec *codec = rtd->codec;
+        bool playback = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
 
         mutex_lock_nested(&rtd->pcm_mutex, rtd->pcm_subclass);
 
         /* apply codec digital mute */
-        if (!codec->active)
+        if ((playback && codec_dai->playback_active == 1) ||
+            (!playback && codec_dai->capture_active == 1))
                 snd_soc_dai_digital_mute(codec_dai, 1, substream->stream);
 
         /* free any machine hw params */
diff --git a/sound/soc/tegra/tegra20_i2s.c b/sound/soc/tegra/tegra20_i2s.c
index 364bf6a907e1..8c819f811470 100644
--- a/sound/soc/tegra/tegra20_i2s.c
+++ b/sound/soc/tegra/tegra20_i2s.c
@@ -74,7 +74,7 @@ static int tegra20_i2s_set_fmt(struct snd_soc_dai *dai,
                                 unsigned int fmt)
 {
         struct tegra20_i2s *i2s = snd_soc_dai_get_drvdata(dai);
-        unsigned int mask, val;
+        unsigned int mask = 0, val = 0;
 
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
         case SND_SOC_DAIFMT_NB_NF:
@@ -83,10 +83,10 @@ static int tegra20_i2s_set_fmt(struct snd_soc_dai *dai,
                 return -EINVAL;
         }
 
-        mask = TEGRA20_I2S_CTRL_MASTER_ENABLE;
+        mask |= TEGRA20_I2S_CTRL_MASTER_ENABLE;
         switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
         case SND_SOC_DAIFMT_CBS_CFS:
-                val = TEGRA20_I2S_CTRL_MASTER_ENABLE;
+                val |= TEGRA20_I2S_CTRL_MASTER_ENABLE;
                 break;
         case SND_SOC_DAIFMT_CBM_CFM:
                 break;
diff --git a/sound/soc/tegra/tegra20_spdif.c b/sound/soc/tegra/tegra20_spdif.c
index 08bc6931c7c7..8c7c1028e579 100644
--- a/sound/soc/tegra/tegra20_spdif.c
+++ b/sound/soc/tegra/tegra20_spdif.c
@@ -67,15 +67,15 @@ static int tegra20_spdif_hw_params(struct snd_pcm_substream *substream,
 {
         struct device *dev = dai->dev;
         struct tegra20_spdif *spdif = snd_soc_dai_get_drvdata(dai);
-        unsigned int mask, val;
+        unsigned int mask = 0, val = 0;
         int ret, spdifclock;
 
-        mask = TEGRA20_SPDIF_CTRL_PACK |
-               TEGRA20_SPDIF_CTRL_BIT_MODE_MASK;
+        mask |= TEGRA20_SPDIF_CTRL_PACK |
+                TEGRA20_SPDIF_CTRL_BIT_MODE_MASK;
         switch (params_format(params)) {
         case SNDRV_PCM_FORMAT_S16_LE:
-                val = TEGRA20_SPDIF_CTRL_PACK |
-                      TEGRA20_SPDIF_CTRL_BIT_MODE_16BIT;
+                val |= TEGRA20_SPDIF_CTRL_PACK |
+                       TEGRA20_SPDIF_CTRL_BIT_MODE_16BIT;
                 break;
         default:
                 return -EINVAL;
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index 231a785b3921..02247fee1cf7 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -118,7 +118,7 @@ static int tegra30_i2s_set_fmt(struct snd_soc_dai *dai,
                                 unsigned int fmt)
 {
         struct tegra30_i2s *i2s = snd_soc_dai_get_drvdata(dai);
-        unsigned int mask, val;
+        unsigned int mask = 0, val = 0;
 
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
         case SND_SOC_DAIFMT_NB_NF:
@@ -127,10 +127,10 @@ static int tegra30_i2s_set_fmt(struct snd_soc_dai *dai,
                 return -EINVAL;
         }
 
-        mask = TEGRA30_I2S_CTRL_MASTER_ENABLE;
+        mask |= TEGRA30_I2S_CTRL_MASTER_ENABLE;
         switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
         case SND_SOC_DAIFMT_CBS_CFS:
-                val = TEGRA30_I2S_CTRL_MASTER_ENABLE;
+                val |= TEGRA30_I2S_CTRL_MASTER_ENABLE;
                 break;
         case SND_SOC_DAIFMT_CBM_CFM:
                 break;
diff --git a/tools/power/cpupower/utils/cpupower-set.c b/tools/power/cpupower/utils/cpupower-set.c
index dc4de3762111..bcf1d2f0b791 100644
--- a/tools/power/cpupower/utils/cpupower-set.c
+++ b/tools/power/cpupower/utils/cpupower-set.c
@@ -18,9 +18,9 @@
 #include "helpers/bitmask.h"
 
 static struct option set_opts[] = {
-        { .name = "perf-bias",  .has_arg = optional_argument,   .flag = NULL,   .val = 'b'},
-        { .name = "sched-mc",   .has_arg = optional_argument,   .flag = NULL,   .val = 'm'},
-        { .name = "sched-smt",  .has_arg = optional_argument,   .flag = NULL,   .val = 's'},
+        { .name = "perf-bias",  .has_arg = required_argument,   .flag = NULL,   .val = 'b'},
+        { .name = "sched-mc",   .has_arg = required_argument,   .flag = NULL,   .val = 'm'},
+        { .name = "sched-smt",  .has_arg = required_argument,   .flag = NULL,   .val = 's'},
         { },
 };