800 files changed, 8233 insertions, 5000 deletions

diff --git a/Documentation/ABI/testing/sysfs-tty b/Documentation/ABI/testing/sysfs-tty
index a2ccec35ffce..ad22fb0ee765 100644
--- a/Documentation/ABI/testing/sysfs-tty
+++ b/Documentation/ABI/testing/sysfs-tty
@@ -3,8 +3,7 @@ Date:		Nov 2010
 Contact:        Kay Sievers <kay.sievers@vrfy.org>
 Description:
                  Shows the list of currently configured
-                 tty devices used for the console,
-                 like 'tty1 ttyS0'.
+                 console devices, like 'tty1 ttyS0'.
                  The last entry in the file is the active
                  device connected to /dev/console.
                  The file supports poll() to detect virtual
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index a8d01005f480..10a93696e55a 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -82,7 +82,19 @@ Most of the hard work is done for the driver in the PCI layer.  It simply
 has to request that the PCI layer set up the MSI capability for this
 device.
 
-4.2.1 pci_enable_msi_range
+4.2.1 pci_enable_msi
+
+int pci_enable_msi(struct pci_dev *dev)
+
+A successful call allocates ONE interrupt to the device, regardless
+of how many MSIs the device supports.  The device is switched from
+pin-based interrupt mode to MSI mode.  The dev->irq number is changed
+to a new number which represents the message signaled interrupt;
+consequently, this function should be called before the driver calls
+request_irq(), because an MSI is delivered via a vector that is
+different from the vector of a pin-based interrupt.
+
+4.2.2 pci_enable_msi_range
 
 int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
 
@@ -147,6 +159,11 @@ static int foo_driver_enable_msi(struct pci_dev *pdev, int nvec)
         return pci_enable_msi_range(pdev, nvec, nvec);
 }
 
+Note, unlike pci_enable_msi_exact() function, which could be also used to
+enable a particular number of MSI-X interrupts, pci_enable_msi_range()
+returns either a negative errno or 'nvec' (not negative errno or 0 - as
+pci_enable_msi_exact() does).
+
 4.2.1.3 Single MSI mode
 
 The most notorious example of the request type described above is
@@ -158,7 +175,27 @@ static int foo_driver_enable_single_msi(struct pci_dev *pdev)
         return pci_enable_msi_range(pdev, 1, 1);
 }
 
-4.2.2 pci_disable_msi
+Note, unlike pci_enable_msi() function, which could be also used to
+enable the single MSI mode, pci_enable_msi_range() returns either a
+negative errno or 1 (not negative errno or 0 - as pci_enable_msi()
+does).
+
+4.2.3 pci_enable_msi_exact
+
+int pci_enable_msi_exact(struct pci_dev *dev, int nvec)
+
+This variation on pci_enable_msi_range() call allows a device driver to
+request exactly 'nvec' MSIs.
+
+If this function returns a negative number, it indicates an error and
+the driver should not attempt to request any more MSI interrupts for
+this device.
+
+By contrast with pci_enable_msi_range() function, pci_enable_msi_exact()
+returns zero in case of success, which indicates MSI interrupts have been
+successfully allocated.
+
+4.2.4 pci_disable_msi
 
 void pci_disable_msi(struct pci_dev *dev)
 
@@ -172,7 +209,7 @@ on any interrupt for which it previously called request_irq().
 Failure to do so results in a BUG_ON(), leaving the device with
 MSI enabled and thus leaking its vector.
 
-4.2.3 pci_msi_vec_count
+4.2.4 pci_msi_vec_count
 
 int pci_msi_vec_count(struct pci_dev *dev)
 
@@ -257,8 +294,8 @@ possible, likely up to the limit returned by pci_msix_vec_count() function:
 
 static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 {
-        return pci_enable_msi_range(adapter->pdev, adapter->msix_entries,
-                                    1, nvec);
+        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
+                                     1, nvec);
 }
 
 Note the value of 'minvec' parameter is 1.  As 'minvec' is inclusive,
@@ -269,8 +306,8 @@ In this case the function could look like this:
 
 static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 {
-        return pci_enable_msi_range(adapter->pdev, adapter->msix_entries,
-                                    FOO_DRIVER_MINIMUM_NVEC, nvec);
+        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
+                                     FOO_DRIVER_MINIMUM_NVEC, nvec);
 }
 
 4.3.1.2 Exact number of MSI-X interrupts
@@ -282,10 +319,15 @@ parameters:
 
 static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 {
-        return pci_enable_msi_range(adapter->pdev, adapter->msix_entries,
-                                    nvec, nvec);
+        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
+                                     nvec, nvec);
 }
 
+Note, unlike pci_enable_msix_exact() function, which could be also used to
+enable a particular number of MSI-X interrupts, pci_enable_msix_range()
+returns either a negative errno or 'nvec' (not negative errno or 0 - as
+pci_enable_msix_exact() does).
+
 4.3.1.3 Specific requirements to the number of MSI-X interrupts
 
 As noted above, there could be devices that can not operate with just any
@@ -332,7 +374,64 @@ Note how pci_enable_msix_range() return value is analized for a fallback -
 any error code other than -ENOSPC indicates a fatal error and should not
 be retried.
 
-4.3.2 pci_disable_msix
+4.3.2 pci_enable_msix_exact
+
+int pci_enable_msix_exact(struct pci_dev *dev,
+                          struct msix_entry *entries, int nvec)
+
+This variation on pci_enable_msix_range() call allows a device driver to
+request exactly 'nvec' MSI-Xs.
+
+If this function returns a negative number, it indicates an error and
+the driver should not attempt to allocate any more MSI-X interrupts for
+this device.
+
+By contrast with pci_enable_msix_range() function, pci_enable_msix_exact()
+returns zero in case of success, which indicates MSI-X interrupts have been
+successfully allocated.
+
+Another version of a routine that enables MSI-X mode for a device with
+specific requirements described in chapter 4.3.1.3 might look like this:
+
+/*
+ * Assume 'minvec' and 'maxvec' are non-zero
+ */
+static int foo_driver_enable_msix(struct foo_adapter *adapter,
+                                  int minvec, int maxvec)
+{
+        int rc;
+
+        minvec = roundup_pow_of_two(minvec);
+        maxvec = rounddown_pow_of_two(maxvec);
+
+        if (minvec > maxvec)
+                return -ERANGE;
+
+retry:
+        rc = pci_enable_msix_exact(adapter->pdev,
+                                   adapter->msix_entries, maxvec);
+
+        /*
+         * -ENOSPC is the only error code allowed to be analyzed
+         */
+        if (rc == -ENOSPC) {
+                if (maxvec == 1)
+                        return -ENOSPC;
+
+                maxvec /= 2;
+
+                if (minvec > maxvec)
+                        return -ENOSPC;
+
+                goto retry;
+        } else if (rc < 0) {
+                return rc;
+        }
+
+        return maxvec;
+}
+
+4.3.3 pci_disable_msix
 
 void pci_disable_msix(struct pci_dev *dev)
 
diff --git a/Documentation/device-mapper/cache.txt b/Documentation/device-mapper/cache.txt
index e6b72d355151..68c0f517c60e 100644
--- a/Documentation/device-mapper/cache.txt
+++ b/Documentation/device-mapper/cache.txt
@@ -124,12 +124,11 @@ the default being 204800 sectors (or 100MB).
 Updating on-disk metadata
 -------------------------
 
-On-disk metadata is committed every time a REQ_SYNC or REQ_FUA bio is
-written.  If no such requests are made then commits will occur every
-second.  This means the cache behaves like a physical disk that has a
-write cache (the same is true of the thin-provisioning target).  If
-power is lost you may lose some recent writes.  The metadata should
-always be consistent in spite of any crash.
+On-disk metadata is committed every time a FLUSH or FUA bio is written.
+If no such requests are made then commits will occur every second.  This
+means the cache behaves like a physical disk that has a volatile write
+cache.  If power is lost you may lose some recent writes.  The metadata
+should always be consistent in spite of any crash.
 
 The 'dirty' state for a cache block changes far too frequently for us
 to keep updating it on the fly.  So we treat it as a hint.  In normal
diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
index 8a7a3d46e0da..05a27e9442bd 100644
--- a/Documentation/device-mapper/thin-provisioning.txt
+++ b/Documentation/device-mapper/thin-provisioning.txt
@@ -116,6 +116,35 @@ Resuming a device with a new table itself triggers an event so the
 userspace daemon can use this to detect a situation where a new table
 already exceeds the threshold.
 
+A low water mark for the metadata device is maintained in the kernel and
+will trigger a dm event if free space on the metadata device drops below
+it.
+
+Updating on-disk metadata
+-------------------------
+
+On-disk metadata is committed every time a FLUSH or FUA bio is written.
+If no such requests are made then commits will occur every second.  This
+means the thin-provisioning target behaves like a physical disk that has
+a volatile write cache.  If power is lost you may lose some recent
+writes.  The metadata should always be consistent in spite of any crash.
+
+If data space is exhausted the pool will either error or queue IO
+according to the configuration (see: error_if_no_space).  If metadata
+space is exhausted or a metadata operation fails: the pool will error IO
+until the pool is taken offline and repair is performed to 1) fix any
+potential inconsistencies and 2) clear the flag that imposes repair.
+Once the pool's metadata device is repaired it may be resized, which
+will allow the pool to return to normal operation.  Note that if a pool
+is flagged as needing repair, the pool's data and metadata devices
+cannot be resized until repair is performed.  It should also be noted
+that when the pool's metadata space is exhausted the current metadata
+transaction is aborted.  Given that the pool will cache IO whose
+completion may have already been acknowledged to upper IO layers
+(e.g. filesystem) it is strongly suggested that consistency checks
+(e.g. fsck) be performed on those layers when repair of the pool is
+required.
+
 Thin provisioning
 -----------------
 
@@ -258,10 +287,9 @@ ii) Status
         should register for the event and then check the target's status.
 
     held metadata root:
-        The location, in sectors, of the metadata root that has been
+        The location, in blocks, of the metadata root that has been
         'held' for userspace read access.  '-' indicates there is no
-        held root.  This feature is not yet implemented so '-' is
-        always returned.
+        held root.
 
     discard_passdown|no_discard_passdown
         Whether or not discards are actually being passed down to the
diff --git a/Documentation/devicetree/bindings/arm/omap/omap.txt b/Documentation/devicetree/bindings/arm/omap/omap.txt
index 34dc40cffdfd..af9b4a0d902b 100644
--- a/Documentation/devicetree/bindings/arm/omap/omap.txt
+++ b/Documentation/devicetree/bindings/arm/omap/omap.txt
@@ -91,7 +91,7 @@ Boards:
   compatible = "ti,omap3-beagle", "ti,omap3"
 
 - OMAP3 Tobi with Overo : Commercial expansion board with daughter board
-  compatible = "ti,omap3-tobi", "ti,omap3-overo", "ti,omap3"
+  compatible = "gumstix,omap3-overo-tobi", "gumstix,omap3-overo", "ti,omap3"
 
 - OMAP4 SDP : Software Development Board
   compatible = "ti,omap4-sdp", "ti,omap4430"
diff --git a/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt b/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
index a6a352c2771e..5992dceec7af 100644
--- a/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
+++ b/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
@@ -21,9 +21,9 @@ Required Properties:
     must appear in the same order as the output clocks.
   - #clock-cells: Must be 1
   - clock-output-names: The name of the clocks as free-form strings
-  - renesas,indices: Indices of the gate clocks into the group (0 to 31)
+  - renesas,clock-indices: Indices of the gate clocks into the group (0 to 31)
 
-The clocks, clock-output-names and renesas,indices properties contain one
+The clocks, clock-output-names and renesas,clock-indices properties contain one
 entry per gate clock. The MSTP groups are sparsely populated. Unimplemented
 gate clocks must not be declared.
 
diff --git a/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt b/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt
index 68b83ecc3850..ee9be9961524 100644
--- a/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt
+++ b/Documentation/devicetree/bindings/dma/fsl-imx-sdma.txt
@@ -1,12 +1,16 @@
 * Freescale Smart Direct Memory Access (SDMA) Controller for i.MX
 
 Required properties:
-- compatible : Should be "fsl,imx31-sdma", "fsl,imx31-to1-sdma",
-  "fsl,imx31-to2-sdma", "fsl,imx35-sdma", "fsl,imx35-to1-sdma",
-  "fsl,imx35-to2-sdma", "fsl,imx51-sdma", "fsl,imx53-sdma" or
-  "fsl,imx6q-sdma". The -to variants should be preferred since they
-  allow to determnine the correct ROM script addresses needed for
-  the driver to work without additional firmware.
+- compatible : Should be one of
+      "fsl,imx25-sdma"
+      "fsl,imx31-sdma", "fsl,imx31-to1-sdma", "fsl,imx31-to2-sdma"
+      "fsl,imx35-sdma", "fsl,imx35-to1-sdma", "fsl,imx35-to2-sdma"
+      "fsl,imx51-sdma"
+      "fsl,imx53-sdma"
+      "fsl,imx6q-sdma"
+  The -to variants should be preferred since they allow to determnine the
+  correct ROM script addresses needed for the driver to work without additional
+  firmware.
 - reg : Should contain SDMA registers location and length
 - interrupts : Should contain SDMA interrupt
 - #dma-cells : Must be <3>.
diff --git a/Documentation/devicetree/bindings/net/opencores-ethoc.txt b/Documentation/devicetree/bindings/net/opencores-ethoc.txt
new file mode 100644
index 000000000000..2dc127c30d9b
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/opencores-ethoc.txt
@@ -0,0 +1,22 @@
+* OpenCores MAC 10/100 Mbps
+
+Required properties:
+- compatible: Should be "opencores,ethoc".
+- reg: two memory regions (address and length),
+  first region is for the device registers and descriptor rings,
+  second is for the device packet memory.
+- interrupts: interrupt for the device.
+
+Optional properties:
+- clocks: phandle to refer to the clk used as per
+  Documentation/devicetree/bindings/clock/clock-bindings.txt
+
+Examples:
+
+        enet0: ethoc@fd030000 {
+                compatible = "opencores,ethoc";
+                reg = <0xfd030000 0x4000 0xfd800000 0x4000>;
+                interrupts = <1>;
+                local-mac-address = [00 50 c2 13 6f 00];
+                clocks = <&osc>;
+        };
diff --git a/Documentation/devicetree/bindings/net/sti-dwmac.txt b/Documentation/devicetree/bindings/net/sti-dwmac.txt
new file mode 100644
index 000000000000..3dd3d0bf112f
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/sti-dwmac.txt
@@ -0,0 +1,58 @@
+STMicroelectronics SoC DWMAC glue layer controller
+
+The device node has following properties.
+
+Required properties:
+ - compatible   : Can be "st,stih415-dwmac", "st,stih416-dwmac" or
+   "st,stid127-dwmac".
+ - reg          : Offset of the glue configuration register map in system
+   configuration regmap pointed by st,syscon property and size.
+
+ - reg-names    : Should be "sti-ethconf".
+
+ - st,syscon    : Should be phandle to system configuration node which
+   encompases this glue registers.
+
+ - st,tx-retime-src: On STi Parts for Giga bit speeds, 125Mhz clocks can be
+   wired up in from different sources. One via TXCLK pin and other via CLK_125
+   pin. This wiring is totally board dependent. However the retiming glue
+   logic should be configured accordingly. Possible values for this property
+
+           "txclk" - if 125Mhz clock is wired up via txclk line.
+           "clk_125" - if 125Mhz clock is wired up via clk_125 line.
+
+   This property is only valid for Giga bit setup( GMII, RGMII), and it is
+   un-used for non-giga bit (MII and RMII) setups. Also note that internal
+   clockgen can not generate stable 125Mhz clock.
+
+ - st,ext-phyclk: This boolean property indicates who is generating the clock
+  for tx and rx. This property is only valid for RMII case where the clock can
+  be generated from the MAC or PHY.
+
+ - clock-names: should be "sti-ethclk".
+ - clocks: Should point to ethernet clockgen which can generate phyclk.
+
+
+Example:
+
+ethernet0: dwmac@fe810000 {
+        device_type     = "network";
+        compatible      = "st,stih416-dwmac", "snps,dwmac", "snps,dwmac-3.710";
+        reg             = <0xfe810000 0x8000>, <0x8bc 0x4>;
+        reg-names       = "stmmaceth", "sti-ethconf";
+        interrupts      = <0 133 0>, <0 134 0>, <0 135 0>;
+        interrupt-names = "macirq", "eth_wake_irq", "eth_lpi";
+        phy-mode        = "mii";
+
+        st,syscon       = <&syscfg_rear>;
+
+        snps,pbl        = <32>;
+        snps,mixed-burst;
+
+        resets          = <&softreset STIH416_ETH0_SOFTRESET>;
+        reset-names     = "stmmaceth";
+        pinctrl-0       = <&pinctrl_mii0>;
+        pinctrl-names   = "default";
+        clocks          = <&CLK_S_GMAC0_PHY>;
+        clock-names     = "stmmaceth";
+};
diff --git a/Documentation/devicetree/bindings/pinctrl/brcm,capri-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/brcm,bcm11351-pinctrl.txt
index 9e9e9ef9f852..c119debe6bab 100644
--- a/Documentation/devicetree/bindings/pinctrl/brcm,capri-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/brcm,bcm11351-pinctrl.txt
@@ -1,4 +1,4 @@
-Broadcom Capri Pin Controller
+Broadcom BCM281xx Pin Controller
 
 This is a pin controller for the Broadcom BCM281xx SoC family, which includes
 BCM11130, BCM11140, BCM11351, BCM28145, and BCM28155 SoCs.
@@ -7,14 +7,14 @@ BCM11130, BCM11140, BCM11351, BCM28145, and BCM28155 SoCs.
 
 Required Properties:
 
-- compatible:   Must be "brcm,capri-pinctrl".
+- compatible:   Must be "brcm,bcm11351-pinctrl"
 - reg:          Base address of the PAD Controller register block and the size
                 of the block.
 
 For example, the following is the bare minimum node:
 
         pinctrl@35004800 {
-                compatible = "brcm,capri-pinctrl";
+                compatible = "brcm,bcm11351-pinctrl";
                 reg = <0x35004800 0x430>;
         };
 
@@ -119,7 +119,7 @@ Optional Properties (for HDMI pins):
 Example:
 // pin controller node
 pinctrl@35004800 {
-        compatible = "brcm,capri-pinctrl";
+        compatible = "brcmbcm11351-pinctrl";
         reg = <0x35004800 0x430>;
 
         // pin configuration node
diff --git a/Documentation/networking/3c505.txt b/Documentation/networking/3c505.txt
deleted file mode 100644
index 72f38b13101d..000000000000
--- a/Documentation/networking/3c505.txt
+++ /dev/null
@@ -1,45 +0,0 @@
-The 3Com Etherlink Plus (3c505) driver.
-
-This driver now uses DMA.  There is currently no support for PIO operation.
-The default DMA channel is 6; this is _not_ autoprobed, so you must
-make sure you configure it correctly.  If loading the driver as a
-module, you can do this with "modprobe 3c505 dma=n".  If the driver is
-linked statically into the kernel, you must either use an "ether="
-statement on the command line, or change the definition of ELP_DMA in 3c505.h.
-
-The driver will warn you if it has to fall back on the compiled in
-default DMA channel. 
-
-If no base address is given at boot time, the driver will autoprobe
-ports 0x300, 0x280 and 0x310 (in that order).  If no IRQ is given, the driver
-will try to probe for it.
-
-The driver can be used as a loadable module.
-
-Theoretically, one instance of the driver can now run multiple cards,
-in the standard way (when loading a module, say "modprobe 3c505
-io=0x300,0x340 irq=10,11 dma=6,7" or whatever).  I have not tested
-this, though.
-
-The driver may now support revision 2 hardware; the dependency on
-being able to read the host control register has been removed.  This
-is also untested, since I don't have a suitable card.
-
-Known problems:
- I still see "DMA upload timed out" messages from time to time.  These
-seem to be fairly non-fatal though.
- The card is old and slow.
-
-To do:
- Improve probe/setup code
- Test multicast and promiscuous operation
-
-Authors:
- The driver is mainly written by Craig Southeren, email
- <craigs@ineluki.apana.org.au>.
- Parts of the driver (adapting the driver to 1.1.4+ kernels,
- IRQ/address detection, some changes) and this README by
- Juha Laiho <jlaiho@ichaos.nullnet.fi>.
- DMA mode, more fixes, etc, by Philip Blundell <pjb27@cam.ac.uk>
- Multicard support, Software configurable DMA, etc., by
- Christopher Collins <ccollins@pcug.org.au>
diff --git a/Documentation/networking/can.txt b/Documentation/networking/can.txt
index f3089d423515..0cbe6ec22d6f 100644
--- a/Documentation/networking/can.txt
+++ b/Documentation/networking/can.txt
@@ -554,12 +554,6 @@ solution for a couple of reasons:
   not specified in the struct can_frame and therefore it is only valid in
   CANFD_MTU sized CAN FD frames.
 
-  As long as the payload length is <=8 the received CAN frames from CAN FD
-  capable CAN devices can be received and read by legacy sockets too. When
-  user-generated CAN FD frames have a payload length <=8 these can be send
-  by legacy CAN network interfaces too. Sending CAN FD frames with payload
-  length > 8 to a legacy CAN network interface returns an -EMSGSIZE error.
-
   Implementation hint for new CAN applications:
 
   To build a CAN FD aware application use struct canfd_frame as basic CAN
diff --git a/MAINTAINERS b/MAINTAINERS
index fb08dcececf1..b7befe758429 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -73,7 +73,8 @@ Descriptions of section entries:
         L: Mailing list that is relevant to this area
         W: Web-page with status/info
         Q: Patchwork web based patch tracking system site
-        T: SCM tree type and location.  Type is one of: git, hg, quilt, stgit, topgit.
+        T: SCM tree type and location.
+           Type is one of: git, hg, quilt, stgit, topgit
         S: Status, one of the following:
            Supported:   Someone is actually paid to look after this.
            Maintained:  Someone actually looks after it.
@@ -473,7 +474,7 @@ F:	net/rxrpc/af_rxrpc.c
 
 AGPGART DRIVER
 M:      David Airlie <airlied@linux.ie>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6.git
+T:      git git://people.freedesktop.org/~airlied/linux (part of drm maint)
 S:      Maintained
 F:      drivers/char/agp/
 F:      include/linux/agp*
@@ -538,7 +539,7 @@ F:	arch/alpha/
 ALTERA UART/JTAG UART SERIAL DRIVERS
 M:      Tobias Klauser <tklauser@distanz.ch>
 L:      linux-serial@vger.kernel.org
-L:      nios2-dev@sopc.et.ntust.edu.tw (moderated for non-subscribers)
+L:      nios2-dev@lists.rocketboards.org (moderated for non-subscribers)
 S:      Maintained
 F:      drivers/tty/serial/altera_uart.c
 F:      drivers/tty/serial/altera_jtaguart.c
@@ -1612,11 +1613,11 @@ S:	Maintained
 F:      drivers/net/wireless/atmel*
 
 ATTO EXPRESSSAS SAS/SATA RAID SCSI DRIVER
-M:      Bradley Grove <linuxdrivers@attotech.com>
-L:      linux-scsi@vger.kernel.org
-W:      http://www.attotech.com
-S:      Supported
-F:      drivers/scsi/esas2r
+M:      Bradley Grove <linuxdrivers@attotech.com>
+L:      linux-scsi@vger.kernel.org
+W:      http://www.attotech.com
+S:      Supported
+F:      drivers/scsi/esas2r
 
 AUDIT SUBSYSTEM
 M:      Eric Paris <eparis@redhat.com>
@@ -1860,6 +1861,7 @@ F:	drivers/net/ethernet/broadcom/bnx2x/
 
 BROADCOM BCM281XX/BCM11XXX ARM ARCHITECTURE
 M:      Christian Daudt <bcm@fixthebug.org>
+M:      Matt Porter <mporter@linaro.org>
 L:      bcm-kernel-feedback-list@broadcom.com
 T:      git git://git.github.com/broadcom/bcm11351
 S:      Maintained
@@ -2158,7 +2160,7 @@ F:	Documentation/zh_CN/
 
 CHIPIDEA USB HIGH SPEED DUAL ROLE CONTROLLER
 M:      Peter Chen <Peter.Chen@freescale.com>
-T:      git://github.com/hzpeterchen/linux-usb.git
+T:      git git://github.com/hzpeterchen/linux-usb.git
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/chipidea/
@@ -2178,9 +2180,9 @@ S:	Supported
 F:      drivers/net/ethernet/cisco/enic/
 
 CISCO VIC LOW LATENCY NIC DRIVER
-M:      Upinder Malhi <umalhi@cisco.com>
-S:      Supported
-F:      drivers/infiniband/hw/usnic
+M:      Upinder Malhi <umalhi@cisco.com>
+S:      Supported
+F:      drivers/infiniband/hw/usnic
 
 CIRRUS LOGIC EP93XX ETHERNET DRIVER
 M:      Hartley Sweeten <hsweeten@visionengravers.com>
@@ -2377,20 +2379,20 @@ F:	drivers/cpufreq/arm_big_little.c
 F:      drivers/cpufreq/arm_big_little_dt.c
 
 CPUIDLE DRIVER - ARM BIG LITTLE
-M:      Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
-M:      Daniel Lezcano <daniel.lezcano@linaro.org>
-L:      linux-pm@vger.kernel.org
-L:      linux-arm-kernel@lists.infradead.org
-T:      git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
-S:      Maintained
-F:      drivers/cpuidle/cpuidle-big_little.c
+M:      Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+M:      Daniel Lezcano <daniel.lezcano@linaro.org>
+L:      linux-pm@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
+S:      Maintained
+F:      drivers/cpuidle/cpuidle-big_little.c
 
 CPUIDLE DRIVERS
 M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 M:      Daniel Lezcano <daniel.lezcano@linaro.org>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
-T:      git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
 F:      drivers/cpuidle/*
 F:      include/linux/cpuidle.h
 
@@ -2408,8 +2410,10 @@ F:	tools/power/cpupower/
 
 CPUSETS
 M:      Li Zefan <lizefan@huawei.com>
+L:      cgroups@vger.kernel.org
 W:      http://www.bullopensource.org/cpuset/
 W:      http://oss.sgi.com/projects/cpusets/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git
 S:      Maintained
 F:      Documentation/cgroups/cpusets.txt
 F:      include/linux/cpuset.h
@@ -2455,9 +2459,9 @@ S:	Maintained
 F:      sound/pci/cs5535audio/
 
 CW1200 WLAN driver
-M:     Solomon Peachy <pizza@shaftnet.org>
-S:     Maintained
-F:     drivers/net/wireless/cw1200/
+M:      Solomon Peachy <pizza@shaftnet.org>
+S:      Maintained
+F:      drivers/net/wireless/cw1200/
 
 CX18 VIDEO4LINUX DRIVER
 M:      Andy Walls <awalls@md.metrocast.net>
@@ -2608,9 +2612,9 @@ DC395x SCSI driver
 M:      Oliver Neukum <oliver@neukum.org>
 M:      Ali Akcaagac <aliakc@web.de>
 M:      Jamie Lenehan <lenehan@twibble.org>
-W:      http://twibble.org/dist/dc395x/
 L:      dc395x@twibble.org
-L:      http://lists.twibble.org/mailman/listinfo/dc395x/
+W:      http://twibble.org/dist/dc395x/
+W:      http://lists.twibble.org/mailman/listinfo/dc395x/
 S:      Maintained
 F:      Documentation/scsi/dc395x.txt
 F:      drivers/scsi/dc395x.*
@@ -2845,12 +2849,22 @@ F:	lib/kobj*
 DRM DRIVERS
 M:      David Airlie <airlied@linux.ie>
 L:      dri-devel@lists.freedesktop.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6.git
+T:      git git://people.freedesktop.org/~airlied/linux
 S:      Maintained
 F:      drivers/gpu/drm/
 F:      include/drm/
 F:      include/uapi/drm/
 
+RADEON DRM DRIVERS
+M:      Alex Deucher <alexander.deucher@amd.com>
+M:      Christian König <christian.koenig@amd.com>
+L:      dri-devel@lists.freedesktop.org
+T:      git git://people.freedesktop.org/~agd5f/linux
+S:      Supported
+F:      drivers/gpu/drm/radeon/
+F:      include/drm/radeon*
+F:      include/uapi/drm/radeon*
+
 INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
 M:      Daniel Vetter <daniel.vetter@ffwll.ch>
 M:      Jani Nikula <jani.nikula@linux.intel.com>
@@ -3082,6 +3096,8 @@ F:	fs/ecryptfs/
 
 EDAC-CORE
 M:      Doug Thompson <dougthompson@xmission.com>
+M:      Borislav Petkov <bp@alien8.de>
+M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Supported
@@ -3324,6 +3340,17 @@ S:	Maintained
 F:      include/linux/netfilter_bridge/
 F:      net/bridge/
 
+ETHERNET PHY LIBRARY
+M:      Florian Fainelli <f.fainelli@gmail.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      include/linux/phy.h
+F:      include/linux/phy_fixed.h
+F:      drivers/net/phy/
+F:      Documentation/networking/phy.txt
+F:      drivers/of/of_mdio.c
+F:      drivers/of/of_net.c
+
 EXT2 FILE SYSTEM
 M:      Jan Kara <jack@suse.cz>
 L:      linux-ext4@vger.kernel.org
@@ -4534,6 +4561,7 @@ F:	Documentation/networking/ixgbevf.txt
 F:      Documentation/networking/i40e.txt
 F:      Documentation/networking/i40evf.txt
 F:      drivers/net/ethernet/intel/
+F:      drivers/net/ethernet/intel/*/
 
 INTEL-MID GPIO DRIVER
 M:      David Cohen <david.a.cohen@linux.intel.com>
@@ -4890,7 +4918,7 @@ F:	drivers/staging/ktap/
 KCONFIG
 M:      "Yann E. MORIN" <yann.morin.1998@free.fr>
 L:      linux-kbuild@vger.kernel.org
-T:      git://gitorious.org/linux-kconfig/linux-kconfig
+T:      git git://gitorious.org/linux-kconfig/linux-kconfig
 S:      Maintained
 F:      Documentation/kbuild/kconfig-language.txt
 F:      scripts/kconfig/
@@ -5447,11 +5475,11 @@ S:	Maintained
 F:      drivers/media/tuners/m88ts2022*
 
 MA901 MASTERKIT USB FM RADIO DRIVER
-M:      Alexey Klimov <klimov.linux@gmail.com>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Maintained
-F:      drivers/media/radio/radio-ma901.c
+M:      Alexey Klimov <klimov.linux@gmail.com>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Maintained
+F:      drivers/media/radio/radio-ma901.c
 
 MAC80211
 M:      Johannes Berg <johannes@sipsolutions.net>
@@ -5487,6 +5515,11 @@ W:	http://www.kernel.org/doc/man-pages
 L:      linux-man@vger.kernel.org
 S:      Maintained
 
+MARVELL ARMADA DRM SUPPORT
+M:      Russell King <rmk+kernel@arm.linux.org.uk>
+S:      Maintained
+F:      drivers/gpu/drm/armada/
+
 MARVELL GIGABIT ETHERNET DRIVERS (skge/sky2)
 M:      Mirko Lindner <mlindner@marvell.com>
 M:      Stephen Hemminger <stephen@networkplumber.org>
@@ -5607,7 +5640,7 @@ F:	drivers/scsi/megaraid/
 
 MELLANOX ETHERNET DRIVER (mlx4_en)
 M:      Amir Vadai <amirv@mellanox.com>
-L:      netdev@vger.kernel.org
+L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
@@ -5648,7 +5681,7 @@ F:	include/linux/mtd/
 F:      include/uapi/mtd/
 
 MEN A21 WATCHDOG DRIVER
-M:      Johannes Thumshirn <johannes.thumshirn@men.de>
+M:      Johannes Thumshirn <johannes.thumshirn@men.de>
 L:      linux-watchdog@vger.kernel.org
 S:      Supported
 F:      drivers/watchdog/mena21_wdt.c
@@ -5704,20 +5737,20 @@ L:	linux-rdma@vger.kernel.org
 W:      http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-T:      git://openfabrics.org/~eli/connect-ib.git
+T:      git git://openfabrics.org/~eli/connect-ib.git
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx5/core/
 F:      include/linux/mlx5/
 
 Mellanox MLX5 IB driver
-M:      Eli Cohen <eli@mellanox.com>
-L:      linux-rdma@vger.kernel.org
-W:      http://www.mellanox.com
-Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-T:      git://openfabrics.org/~eli/connect-ib.git
-S:      Supported
-F:      include/linux/mlx5/
-F:      drivers/infiniband/hw/mlx5/
+M:      Eli Cohen <eli@mellanox.com>
+L:      linux-rdma@vger.kernel.org
+W:      http://www.mellanox.com
+Q:      http://patchwork.kernel.org/project/linux-rdma/list/
+T:      git git://openfabrics.org/~eli/connect-ib.git
+S:      Supported
+F:      include/linux/mlx5/
+F:      drivers/infiniband/hw/mlx5/
 
 MODULE SUPPORT
 M:      Rusty Russell <rusty@rustcorp.com.au>
@@ -6142,6 +6175,12 @@ S:	Supported
 F:      drivers/block/nvme*
 F:      include/linux/nvme.h
 
+NXP TDA998X DRM DRIVER
+M:      Russell King <rmk+kernel@arm.linux.org.uk>
+S:      Supported
+F:      drivers/gpu/drm/i2c/tda998x_drv.c
+F:      include/drm/i2c/tda998x.h
+
 OMAP SUPPORT
 M:      Tony Lindgren <tony@atomide.com>
 L:      linux-omap@vger.kernel.org
@@ -8429,8 +8468,8 @@ TARGET SUBSYSTEM
 M:      Nicholas A. Bellinger <nab@linux-iscsi.org>
 L:      linux-scsi@vger.kernel.org
 L:      target-devel@vger.kernel.org
-L:      http://groups.google.com/group/linux-iscsi-target-dev
 W:      http://www.linux-iscsi.org
+W:      http://groups.google.com/group/linux-iscsi-target-dev
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending.git master
 S:      Supported
 F:      drivers/target/
@@ -8671,17 +8710,17 @@ S:	Maintained
 F:      drivers/media/radio/radio-raremono.c
 
 THERMAL
-M:      Zhang Rui <rui.zhang@intel.com>
-M:      Eduardo Valentin <eduardo.valentin@ti.com>
-L:      linux-pm@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal.git
-Q:      https://patchwork.kernel.org/project/linux-pm/list/
-S:      Supported
-F:      drivers/thermal/
-F:      include/linux/thermal.h
-F:      include/linux/cpu_cooling.h
-F:      Documentation/devicetree/bindings/thermal/
+M:      Zhang Rui <rui.zhang@intel.com>
+M:      Eduardo Valentin <eduardo.valentin@ti.com>
+L:      linux-pm@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal.git
+Q:      https://patchwork.kernel.org/project/linux-pm/list/
+S:      Supported
+F:      drivers/thermal/
+F:      include/linux/thermal.h
+F:      include/linux/cpu_cooling.h
+F:      Documentation/devicetree/bindings/thermal/
 
 THINGM BLINK(1) USB RGB LED DRIVER
 M:      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
@@ -9715,7 +9754,6 @@ F:	drivers/xen/*swiotlb*
 XFS FILESYSTEM
 P:      Silicon Graphics Inc
 M:      Dave Chinner <david@fromorbit.com>
-M:      Ben Myers <bpm@sgi.com>
 M:      xfs@oss.sgi.com
 L:      xfs@oss.sgi.com
 W:      http://oss.sgi.com/projects/xfs
@@ -9784,7 +9822,7 @@ ZR36067 VIDEO FOR LINUX DRIVER
 L:      mjpeg-users@lists.sourceforge.net
 L:      linux-media@vger.kernel.org
 W:      http://mjpeg.sourceforge.net/driver-zoran/
-T:      Mercurial http://linuxtv.org/hg/v4l-dvb
+T:      hg http://linuxtv.org/hg/v4l-dvb
 S:      Odd Fixes
 F:      drivers/media/pci/zoran/
 
diff --git a/Makefile b/Makefile
index 893d6f0e875b..1a2628ee5d91 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc6
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
@@ -605,10 +605,11 @@ endif
 ifdef CONFIG_CC_STACKPROTECTOR_REGULAR
   stackp-flag := -fstack-protector
   ifeq ($(call cc-option, $(stackp-flag)),)
-    $(warning Cannot use CONFIG_CC_STACKPROTECTOR: \
-              -fstack-protector not supported by compiler))
+    $(warning Cannot use CONFIG_CC_STACKPROTECTOR_REGULAR: \
+             -fstack-protector not supported by compiler)
   endif
-else ifdef CONFIG_CC_STACKPROTECTOR_STRONG
+else
+ifdef CONFIG_CC_STACKPROTECTOR_STRONG
   stackp-flag := -fstack-protector-strong
   ifeq ($(call cc-option, $(stackp-flag)),)
     $(warning Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: \
@@ -618,6 +619,7 @@ else
   # Force off for distro compilers that enable stack protector by default.
   stackp-flag := $(call cc-option, -fno-stack-protector)
 endif
+endif
 KBUILD_CFLAGS += $(stackp-flag)
 
 # This warning generated too much noise in a regular build.
diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c
index 6b58c1de7577..400c663b21c2 100644
--- a/arch/arc/mm/cache_arc700.c
+++ b/arch/arc/mm/cache_arc700.c
@@ -282,7 +282,7 @@ static inline void __cache_line_loop(unsigned long paddr, unsigned long vaddr,
 #else
         /* if V-P const for loop, PTAG can be written once outside loop */
         if (full_page_op)
-                write_aux_reg(ARC_REG_DC_PTAG, paddr);
+                write_aux_reg(aux_tag, paddr);
 #endif
 
         while (num_lines-- > 0) {
@@ -296,7 +296,7 @@ static inline void __cache_line_loop(unsigned long paddr, unsigned long vaddr,
                 write_aux_reg(aux_cmd, vaddr);
                 vaddr += L1_CACHE_BYTES;
 #else
-                write_aux_reg(aux, paddr);
+                write_aux_reg(aux_cmd, paddr);
                 paddr += L1_CACHE_BYTES;
 #endif
         }
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index e25419817791..15949459611f 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1578,6 +1578,7 @@ config BL_SWITCHER_DUMMY_IF
 
 choice
         prompt "Memory split"
+        depends on MMU
         default VMSPLIT_3G
         help
           Select the desired split between kernel and user memory.
@@ -1595,6 +1596,7 @@ endchoice
 
 config PAGE_OFFSET
         hex
+        default PHYS_OFFSET if !MMU
         default 0x40000000 if VMSPLIT_1G
         default 0x80000000 if VMSPLIT_2G
         default 0xC0000000
@@ -1903,6 +1905,7 @@ config XEN
         depends on ARM && AEABI && OF
         depends on CPU_V7 && !CPU_V6
         depends on !GENERIC_ATOMIC64
+        depends on MMU
         select ARM_PSCI
         select SWIOTLB_XEN
         select ARCH_DMA_ADDR_T_64BIT
diff --git a/arch/arm/boot/compressed/.gitignore b/arch/arm/boot/compressed/.gitignore
index 47279aa96a6a..0714e0334e33 100644
--- a/arch/arm/boot/compressed/.gitignore
+++ b/arch/arm/boot/compressed/.gitignore
@@ -1,4 +1,5 @@
 ashldi3.S
+bswapsdi2.S
 font.c
 lib1funcs.S
 hyp-stub.S
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 6d1e43d46187..032030361bef 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -209,7 +209,8 @@ dtb-$(CONFIG_ARCH_OMAP2PLUS) += omap2420-h4.dtb \
         omap3-n900.dtb \
         omap3-n9.dtb \
         omap3-n950.dtb \
-        omap3-tobi.dtb \
+        omap3-overo-tobi.dtb \
+        omap3-overo-storm-tobi.dtb \
         omap3-gta04.dtb \
         omap3-igep0020.dtb \
         omap3-igep0030.dtb \
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 4718ec4a4dbf..486880b74831 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -121,7 +121,7 @@
                 ti,model = "AM335x-EVMSK";
                 ti,audio-codec = <&tlv320aic3106>;
                 ti,mcasp-controller = <&mcasp1>;
-                ti,codec-clock-rate = <24576000>;
+                ti,codec-clock-rate = <24000000>;
                 ti,audio-routing =
                         "Headphone Jack",       "HPLOUT",
                         "Headphone Jack",       "HPROUT";
@@ -256,6 +256,12 @@
                 >;
         };
 
+        mmc1_pins: pinmux_mmc1_pins {
+                pinctrl-single,pins = <
+                        0x160 (PIN_INPUT | MUX_MODE7) /* spi0_cs1.gpio0_6 */
+                >;
+        };
+
         mcasp1_pins: mcasp1_pins {
                 pinctrl-single,pins = <
                         0x10c (PIN_INPUT_PULLDOWN | MUX_MODE4) /* mii1_crs.mcasp1_aclkx */
@@ -456,6 +462,9 @@
         status = "okay";
         vmmc-supply = <&vmmc_reg>;
         bus-width = <4>;
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc1_pins>;
+        cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
 };
 
 &sham {
diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
index 66609684d41b..9480cf891f8c 100644
--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
@@ -23,6 +23,7 @@
                 gpio0 = &gpio0;
                 gpio1 = &gpio1;
                 gpio2 = &gpio2;
+                eth3 = &eth3;
         };
 
         cpus {
@@ -291,7 +292,7 @@
                                 interrupts = <91>;
                         };
 
-                        ethernet@34000 {
+                        eth3: ethernet@34000 {
                                 compatible = "marvell,armada-370-neta";
                                 reg = <0x34000 0x4000>;
                                 interrupts = <14>;
diff --git a/arch/arm/boot/dts/bcm11351.dtsi b/arch/arm/boot/dts/bcm11351.dtsi
index e491b82f8d67..792fde1b7f75 100644
--- a/arch/arm/boot/dts/bcm11351.dtsi
+++ b/arch/arm/boot/dts/bcm11351.dtsi
@@ -147,7 +147,7 @@
         };
 
         pinctrl@35004800 {
-                compatible = "brcm,capri-pinctrl";
+                compatible = "brcm,bcm11351-pinctrl";
                 reg = <0x35004800 0x430>;
         };
 
diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
index 2b76524f4aa7..187fd46b7b5e 100644
--- a/arch/arm/boot/dts/dove.dtsi
+++ b/arch/arm/boot/dts/dove.dtsi
@@ -379,15 +379,6 @@
                                 #clock-cells = <1>;
                         };
 
-                        pmu_intc: pmu-interrupt-ctrl@d0050 {
-                                compatible = "marvell,dove-pmu-intc";
-                                interrupt-controller;
-                                #interrupt-cells = <1>;
-                                reg = <0xd0050 0x8>;
-                                interrupts = <33>;
-                                marvell,#interrupts = <7>;
-                        };
-
                         pinctrl: pin-ctrl@d0200 {
                                 compatible = "marvell,dove-pinctrl";
                                 reg = <0xd0200 0x10>;
@@ -610,8 +601,6 @@
                         rtc: real-time-clock@d8500 {
                                 compatible = "marvell,orion-rtc";
                                 reg = <0xd8500 0x20>;
-                                interrupt-parent = <&pmu_intc>;
-                                interrupts = <5>;
                         };
 
                         gpio2: gpio-ctrl@e8400 {
diff --git a/arch/arm/boot/dts/imx6dl-hummingboard.dts b/arch/arm/boot/dts/imx6dl-hummingboard.dts
index fd8fc7cd53f3..5bfae54fb780 100644
--- a/arch/arm/boot/dts/imx6dl-hummingboard.dts
+++ b/arch/arm/boot/dts/imx6dl-hummingboard.dts
@@ -52,12 +52,6 @@
                 };
         };
 
-        codec: spdif-transmitter {
-                compatible = "linux,spdif-dit";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_hummingboard_spdif>;
-        };
-
         sound-spdif {
                 compatible = "fsl,imx-audio-spdif";
                 model = "imx-spdif";
@@ -111,7 +105,7 @@
                 };
 
                 pinctrl_hummingboard_spdif: hummingboard-spdif {
-                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x1b0b0>;
+                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x13091>;
                 };
 
                 pinctrl_hummingboard_usbh1_vbus: hummingboard-usbh1-vbus {
@@ -142,6 +136,8 @@
 };
 
 &spdif {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_hummingboard_spdif>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
index 64daa3b311f6..c2a24888a276 100644
--- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
@@ -46,12 +46,6 @@
                 };
         };
 
-        codec: spdif-transmitter {
-                compatible = "linux,spdif-dit";
-                pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_cubox_i_spdif>;
-        };
-
         sound-spdif {
                 compatible = "fsl,imx-audio-spdif";
                 model = "imx-spdif";
@@ -89,7 +83,7 @@
                 };
 
                 pinctrl_cubox_i_spdif: cubox-i-spdif {
-                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x1b0b0>;
+                        fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x13091>;
                 };
 
                 pinctrl_cubox_i_usbh1_vbus: cubox-i-usbh1-vbus {
@@ -121,6 +115,8 @@
 };
 
 &spdif {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_cubox_i_spdif>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/keystone-clocks.dtsi b/arch/arm/boot/dts/keystone-clocks.dtsi
index 2363593e1050..ef58d1c24313 100644
--- a/arch/arm/boot/dts/keystone-clocks.dtsi
+++ b/arch/arm/boot/dts/keystone-clocks.dtsi
@@ -612,7 +612,7 @@ clocks {
                 compatible = "ti,keystone,psc-clock";
                 clocks = <&chipclk13>;
                 clock-output-names = "vcp-3";
-                reg = <0x0235000a8 0xb00>, <0x02350060 0x400>;
+                reg = <0x023500a8 0xb00>, <0x02350060 0x400>;
                 reg-names = "control", "domain";
                 domain-id = <24>;
         };
diff --git a/arch/arm/boot/dts/omap3-gta04.dts b/arch/arm/boot/dts/omap3-gta04.dts
index b9b55c95a566..d3b253bbc885 100644
--- a/arch/arm/boot/dts/omap3-gta04.dts
+++ b/arch/arm/boot/dts/omap3-gta04.dts
@@ -13,7 +13,7 @@
 
 / {
         model = "OMAP3 GTA04";
-        compatible = "ti,omap3-gta04", "ti,omap3";
+        compatible = "ti,omap3-gta04", "ti,omap36xx", "ti,omap3";
 
         cpus {
                 cpu@0 {
@@ -32,7 +32,7 @@
                 aux-button {
                         label = "aux";
                         linux,code = <169>;
-                        gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
+                        gpios = <&gpio1 7 GPIO_ACTIVE_HIGH>;
                         gpio-key,wakeup;
                 };
         };
@@ -92,6 +92,8 @@
         bmp085@77 {
                 compatible = "bosch,bmp085";
                 reg = <0x77>;
+                interrupt-parent = <&gpio4>;
+                interrupts = <17 IRQ_TYPE_EDGE_RISING>;
         };
 
         /* leds */
@@ -141,8 +143,8 @@
         pinctrl-names = "default";
         pinctrl-0 = <&mmc1_pins>;
         vmmc-supply = <&vmmc1>;
-        vmmc_aux-supply = <&vsim>;
         bus-width = <4>;
+        ti,non-removable;
 };
 
 &mmc2 {
diff --git a/arch/arm/boot/dts/omap3-igep0020.dts b/arch/arm/boot/dts/omap3-igep0020.dts
index 25a2b5f652fd..f2779ac75872 100644
--- a/arch/arm/boot/dts/omap3-igep0020.dts
+++ b/arch/arm/boot/dts/omap3-igep0020.dts
@@ -14,7 +14,7 @@
 
 / {
         model = "IGEPv2 (TI OMAP AM/DM37x)";
-        compatible = "isee,omap3-igep0020", "ti,omap3";
+        compatible = "isee,omap3-igep0020", "ti,omap36xx", "ti,omap3";
 
         leds {
                 pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/omap3-igep0030.dts b/arch/arm/boot/dts/omap3-igep0030.dts
index 145c58cfc8ac..2793749eb1ba 100644
--- a/arch/arm/boot/dts/omap3-igep0030.dts
+++ b/arch/arm/boot/dts/omap3-igep0030.dts
@@ -13,7 +13,7 @@
 
 / {
         model = "IGEP COM MODULE (TI OMAP AM/DM37x)";
-        compatible = "isee,omap3-igep0030", "ti,omap3";
+        compatible = "isee,omap3-igep0030", "ti,omap36xx", "ti,omap3";
 
         leds {
                 pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/omap3-n9.dts b/arch/arm/boot/dts/omap3-n9.dts
index 39828ce464ee..9938b5dc1909 100644
--- a/arch/arm/boot/dts/omap3-n9.dts
+++ b/arch/arm/boot/dts/omap3-n9.dts
@@ -14,5 +14,5 @@
 
 / {
         model = "Nokia N9";
-        compatible = "nokia,omap3-n9", "ti,omap3";
+        compatible = "nokia,omap3-n9", "ti,omap36xx", "ti,omap3";
 };
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 6fc85f963530..0bf40c90faba 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2013 Pavel Machek <pavel@ucw.cz>
- * Copyright 2013 Aaro Koskinen <aaro.koskinen@iki.fi>
+ * Copyright (C) 2013-2014 Aaro Koskinen <aaro.koskinen@iki.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 (or later) as
@@ -13,7 +13,7 @@
 
 / {
         model = "Nokia N900";
-        compatible = "nokia,omap3-n900", "ti,omap3";
+        compatible = "nokia,omap3-n900", "ti,omap3430", "ti,omap3";
 
         cpus {
                 cpu@0 {
diff --git a/arch/arm/boot/dts/omap3-n950.dts b/arch/arm/boot/dts/omap3-n950.dts
index b076a526b999..261c5589bfa3 100644
--- a/arch/arm/boot/dts/omap3-n950.dts
+++ b/arch/arm/boot/dts/omap3-n950.dts
@@ -14,5 +14,5 @@
 
 / {
         model = "Nokia N950";
-        compatible = "nokia,omap3-n950", "ti,omap3";
+        compatible = "nokia,omap3-n950", "ti,omap36xx", "ti,omap3";
 };
diff --git a/arch/arm/boot/dts/omap3-overo-storm-tobi.dts b/arch/arm/boot/dts/omap3-overo-storm-tobi.dts
new file mode 100644
index 000000000000..966b5c9cd96a
--- /dev/null
+++ b/arch/arm/boot/dts/omap3-overo-storm-tobi.dts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2012 Florian Vaussard, EPFL Mobots group
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * Tobi expansion board is manufactured by Gumstix Inc.
+ */
+
+/dts-v1/;
+
+#include "omap36xx.dtsi"
+#include "omap3-overo-tobi-common.dtsi"
+
+/ {
+        model = "OMAP36xx/AM37xx/DM37xx Gumstix Overo on Tobi";
+        compatible = "gumstix,omap3-overo-tobi", "gumstix,omap3-overo", "ti,omap36xx", "ti,omap3";
+};
+
diff --git a/arch/arm/boot/dts/omap3-tobi.dts b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
index 7e4ad2aec37a..4edc013a91c1 100644
--- a/arch/arm/boot/dts/omap3-tobi.dts
+++ b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
@@ -13,9 +13,6 @@
 #include "omap3-overo.dtsi"
 
 / {
-        model = "TI OMAP3 Gumstix Overo on Tobi";
-        compatible = "ti,omap3-tobi", "ti,omap3-overo", "ti,omap3";
-
         leds {
                 compatible = "gpio-leds";
                 heartbeat {
diff --git a/arch/arm/boot/dts/omap3-overo-tobi.dts b/arch/arm/boot/dts/omap3-overo-tobi.dts
new file mode 100644
index 000000000000..de5653e1b5ca
--- /dev/null
+++ b/arch/arm/boot/dts/omap3-overo-tobi.dts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2012 Florian Vaussard, EPFL Mobots group
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * Tobi expansion board is manufactured by Gumstix Inc.
+ */
+
+/dts-v1/;
+
+#include "omap34xx.dtsi"
+#include "omap3-overo-tobi-common.dtsi"
+
+/ {
+        model = "OMAP35xx Gumstix Overo on Tobi";
+        compatible = "gumstix,omap3-overo-tobi", "gumstix,omap3-overo", "ti,omap3430", "ti,omap3";
+};
+
diff --git a/arch/arm/boot/dts/omap3-overo.dtsi b/arch/arm/boot/dts/omap3-overo.dtsi
index a461d2fd1fb0..597099907f8e 100644
--- a/arch/arm/boot/dts/omap3-overo.dtsi
+++ b/arch/arm/boot/dts/omap3-overo.dtsi
@@ -9,9 +9,6 @@
 /*
  * The Gumstix Overo must be combined with an expansion board.
  */
-/dts-v1/;
-
-#include "omap34xx.dtsi"
 
 / {
         pwmleds {
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 10666ca8aee1..d4d2763f4794 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -426,7 +426,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <29>;
                 };
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index 64961595e8d6..79fd412005b0 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -383,7 +383,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <29>;
                 };
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index 320335abfccd..c463fd730c91 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -346,7 +346,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <29>;
                 };
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 9ff09484847b..6f25cf559ad0 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -454,7 +454,7 @@
                 rtc: rtc@01c20d00 {
                         compatible = "allwinner,sun7i-a20-rtc";
                         reg = <0x01c20d00 0x20>;
-                        interrupts = <0 24 1>;
+                        interrupts = <0 24 4>;
                 };
 
                 sid: eeprom@01c23800 {
@@ -463,7 +463,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <0 29 4>;
                 };
@@ -596,10 +596,10 @@
                 hstimer@01c60000 {
                         compatible = "allwinner,sun7i-a20-hstimer";
                         reg = <0x01c60000 0x1000>;
-                        interrupts = <0 81 1>,
-                                     <0 82 1>,
-                                     <0 83 1>,
-                                     <0 84 1>;
+                        interrupts = <0 81 4>,
+                                     <0 82 4>,
+                                     <0 83 4>,
+                                     <0 84 4>;
                         clocks = <&ahb_gates 28>;
                 };
 
diff --git a/arch/arm/boot/dts/tegra114.dtsi b/arch/arm/boot/dts/tegra114.dtsi
index 389e987ec281..44ec401ec366 100644
--- a/arch/arm/boot/dts/tegra114.dtsi
+++ b/arch/arm/boot/dts/tegra114.dtsi
@@ -57,6 +57,8 @@
                         resets = <&tegra_car 27>;
                         reset-names = "dc";
 
+                        nvidia,head = <0>;
+
                         rgb {
                                 status = "disabled";
                         };
@@ -72,6 +74,8 @@
                         resets = <&tegra_car 26>;
                         reset-names = "dc";
 
+                        nvidia,head = <1>;
+
                         rgb {
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
index 480ecda3416b..48d2a7f4d0c0 100644
--- a/arch/arm/boot/dts/tegra20.dtsi
+++ b/arch/arm/boot/dts/tegra20.dtsi
@@ -94,6 +94,8 @@
                         resets = <&tegra_car 27>;
                         reset-names = "dc";
 
+                        nvidia,head = <0>;
+
                         rgb {
                                 status = "disabled";
                         };
@@ -109,6 +111,8 @@
                         resets = <&tegra_car 26>;
                         reset-names = "dc";
 
+                        nvidia,head = <1>;
+
                         rgb {
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi
index 9104224124ee..1e156d9d0506 100644
--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi
+++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi
@@ -28,7 +28,7 @@
         compatible = "nvidia,cardhu", "nvidia,tegra30";
 
         aliases {
-                rtc0 = "/i2c@7000d000/tps6586x@34";
+                rtc0 = "/i2c@7000d000/tps65911@2d";
                 rtc1 = "/rtc@7000e000";
         };
 
diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
index ed8e7700b46d..19a84e933f4e 100644
--- a/arch/arm/boot/dts/tegra30.dtsi
+++ b/arch/arm/boot/dts/tegra30.dtsi
@@ -170,6 +170,8 @@
                         resets = <&tegra_car 27>;
                         reset-names = "dc";
 
+                        nvidia,head = <0>;
+
                         rgb {
                                 status = "disabled";
                         };
@@ -185,6 +187,8 @@
                         resets = <&tegra_car 26>;
                         reset-names = "dc";
 
+                        nvidia,head = <1>;
+
                         rgb {
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/testcases/tests.dtsi b/arch/arm/boot/dts/testcases/tests.dtsi
deleted file mode 100644
index 3f123ecc9dd7..000000000000
--- a/arch/arm/boot/dts/testcases/tests.dtsi
+++ /dev/null
@@ -1,2 +0,0 @@
-/include/ "tests-phandle.dtsi"
-/include/ "tests-interrupts.dtsi"
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index f43907c40c93..65f657711323 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -1,4 +1,4 @@
-/include/ "versatile-ab.dts"
+#include <versatile-ab.dts>
 
 / {
         model = "ARM Versatile PB";
@@ -47,4 +47,4 @@
         };
 };
 
-/include/ "testcases/tests.dtsi"
+#include <testcases.dtsi>
diff --git a/arch/arm/configs/tegra_defconfig b/arch/arm/configs/tegra_defconfig
index 00fe9e9710fd..27d69b558c5d 100644
--- a/arch/arm/configs/tegra_defconfig
+++ b/arch/arm/configs/tegra_defconfig
@@ -204,7 +204,10 @@ CONFIG_MMC_BLOCK_MINORS=16
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index e9a49fe0284e..8b8b61685a34 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -212,6 +212,7 @@ extern void copy_to_user_page(struct vm_area_struct *, struct page *,
 static inline void __flush_icache_all(void)
 {
         __flush_icache_preferred();
+        dsb();
 }
 
 /*
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 8756e4bcdba0..4afb376d9c7c 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -30,14 +30,15 @@
  */
 #define UL(x) _AC(x, UL)
 
+/* PAGE_OFFSET - the virtual address of the start of the kernel image */
+#define PAGE_OFFSET             UL(CONFIG_PAGE_OFFSET)
+
 #ifdef CONFIG_MMU
 
 /*
- * PAGE_OFFSET - the virtual address of the start of the kernel image
  * TASK_SIZE - the maximum size of a user space task.
  * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area
  */
-#define PAGE_OFFSET             UL(CONFIG_PAGE_OFFSET)
 #define TASK_SIZE               (UL(CONFIG_PAGE_OFFSET) - UL(SZ_16M))
 #define TASK_UNMAPPED_BASE      ALIGN(TASK_SIZE / 3, SZ_16M)
 
@@ -104,10 +105,6 @@
 #define END_MEM                 (UL(CONFIG_DRAM_BASE) + CONFIG_DRAM_SIZE)
 #endif
 
-#ifndef PAGE_OFFSET
-#define PAGE_OFFSET             PLAT_PHYS_OFFSET
-#endif
-
 /*
  * The module can be at any place in ram in nommu mode.
  */
diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
index 03243f7eeddf..85c60adc8b60 100644
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -120,13 +120,16 @@
 /*
  * 2nd stage PTE definitions for LPAE.
  */
-#define L_PTE_S2_MT_UNCACHED     (_AT(pteval_t, 0x5) << 2) /* MemAttr[3:0] */
-#define L_PTE_S2_MT_WRITETHROUGH (_AT(pteval_t, 0xa) << 2) /* MemAttr[3:0] */
-#define L_PTE_S2_MT_WRITEBACK    (_AT(pteval_t, 0xf) << 2) /* MemAttr[3:0] */
-#define L_PTE_S2_RDONLY          (_AT(pteval_t, 1) << 6)   /* HAP[1]   */
-#define L_PTE_S2_RDWR            (_AT(pteval_t, 3) << 6)   /* HAP[2:1] */
+#define L_PTE_S2_MT_UNCACHED            (_AT(pteval_t, 0x0) << 2) /* strongly ordered */
+#define L_PTE_S2_MT_WRITETHROUGH        (_AT(pteval_t, 0xa) << 2) /* normal inner write-through */
+#define L_PTE_S2_MT_WRITEBACK           (_AT(pteval_t, 0xf) << 2) /* normal inner write-back */
+#define L_PTE_S2_MT_DEV_SHARED          (_AT(pteval_t, 0x1) << 2) /* device */
+#define L_PTE_S2_MT_MASK                (_AT(pteval_t, 0xf) << 2)
 
-#define L_PMD_S2_RDWR            (_AT(pmdval_t, 3) << 6)   /* HAP[2:1] */
+#define L_PTE_S2_RDONLY                 (_AT(pteval_t, 1) << 6)   /* HAP[1]   */
+#define L_PTE_S2_RDWR                   (_AT(pteval_t, 3) << 6)   /* HAP[2:1] */
+
+#define L_PMD_S2_RDWR                   (_AT(pmdval_t, 3) << 6)   /* HAP[2:1] */
 
 /*
  * Hyp-mode PL2 PTE definitions for LPAE.
diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h
index ef3c6072aa45..ac4bfae26702 100644
--- a/arch/arm/include/asm/spinlock.h
+++ b/arch/arm/include/asm/spinlock.h
@@ -37,18 +37,9 @@
 
 static inline void dsb_sev(void)
 {
-#if __LINUX_ARM_ARCH__ >= 7
-        __asm__ __volatile__ (
-                "dsb ishst\n"
-                SEV
-        );
-#else
-        __asm__ __volatile__ (
-                "mcr p15, 0, %0, c7, c10, 4\n"
-                SEV
-                : : "r" (0)
-        );
-#endif
+
+        dsb(ishst);
+        __asm__(SEV);
 }
 
 /*
diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
index 47cd974e57ea..c96ecacb2021 100644
--- a/arch/arm/kernel/head-common.S
+++ b/arch/arm/kernel/head-common.S
@@ -177,6 +177,18 @@ __lookup_processor_type_data:
         .long   __proc_info_end
         .size   __lookup_processor_type_data, . - __lookup_processor_type_data
 
+__error_lpae:
+#ifdef CONFIG_DEBUG_LL
+        adr     r0, str_lpae
+        bl      printascii
+        b       __error
+str_lpae: .asciz "\nError: Kernel with LPAE support, but CPU does not support LPAE.\n"
+#else
+        b       __error
+#endif
+        .align
+ENDPROC(__error_lpae)
+
 __error_p:
 #ifdef CONFIG_DEBUG_LL
         adr     r0, str_p1
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 914616e0bdcd..f5f381d91556 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -102,7 +102,7 @@ ENTRY(stext)
         and     r3, r3, #0xf                    @ extract VMSA support
         cmp     r3, #5                          @ long-descriptor translation table format?
  THUMB( it      lo )                            @ force fixup-able long branch encoding
-        blo     __error_p                       @ only classic page table format
+        blo     __error_lpae                    @ only classic page table format
 #endif
 
 #ifndef CONFIG_XIP_KERNEL
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index b0df9761de6d..1e8b030dbefd 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -731,7 +731,7 @@ static void __init request_standard_resources(const struct machine_desc *mdesc)
         kernel_data.end     = virt_to_phys(_end - 1);
 
         for_each_memblock(memory, region) {
-                res = memblock_virt_alloc_low(sizeof(*res), 0);
+                res = memblock_virt_alloc(sizeof(*res), 0);
                 res->name  = "System RAM";
                 res->start = __pfn_to_phys(memblock_region_memory_base_pfn(region));
                 res->end = __pfn_to_phys(memblock_region_memory_end_pfn(region)) - 1;
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 1d8248ea5669..bd18bb8b2770 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -878,7 +878,8 @@ static int hyp_init_cpu_pm_notifier(struct notifier_block *self,
                                     unsigned long cmd,
                                     void *v)
 {
-        if (cmd == CPU_PM_EXIT) {
+        if (cmd == CPU_PM_EXIT &&
+            __hyp_get_vectors() == hyp_default_vectors) {
                 cpu_init_hyp_mode(NULL);
                 return NOTIFY_OK;
         }
diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
index ddc15539bad2..0d68d4073068 100644
--- a/arch/arm/kvm/interrupts.S
+++ b/arch/arm/kvm/interrupts.S
@@ -220,6 +220,10 @@ after_vfp_restore:
  * in Hyp mode (see init_hyp_mode in arch/arm/kvm/arm.c).  Return values are
  * passed in r0 and r1.
  *
+ * A function pointer with a value of 0xffffffff has a special meaning,
+ * and is used to implement __hyp_get_vectors in the same way as in
+ * arch/arm/kernel/hyp_stub.S.
+ *
  * The calling convention follows the standard AAPCS:
  *   r0 - r3: caller save
  *   r12:     caller save
@@ -363,6 +367,11 @@ hyp_hvc:
 host_switch_to_hyp:
         pop     {r0, r1, r2}
 
+        /* Check for __hyp_get_vectors */
+        cmp     r0, #-1
+        mrceq   p15, 4, r0, c12, c0, 0  @ get HVBAR
+        beq     1f
+
         push    {lr}
         mrs     lr, SPSR
         push    {lr}
@@ -378,7 +387,7 @@ THUMB(	orr	lr, #1)
         pop     {lr}
         msr     SPSR_csxf, lr
         pop     {lr}
-        eret
+1:      eret
 
 guest_trap:
         load_vcpu                       @ Load VCPU pointer to r0
diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index befcaf5d0574..ec419649320f 100644
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -101,11 +101,9 @@ obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o
 obj-$(CONFIG_SOC_IMX6Q) += clk-imx6q.o mach-imx6q.o
 obj-$(CONFIG_SOC_IMX6SL) += clk-imx6sl.o mach-imx6sl.o
 
-ifeq ($(CONFIG_PM),y)
 obj-$(CONFIG_SOC_IMX6Q) += pm-imx6q.o headsmp.o
 # i.MX6SL reuses i.MX6Q code
 obj-$(CONFIG_SOC_IMX6SL) += pm-imx6q.o headsmp.o
-endif
 
 # i.MX5 based machines
 obj-$(CONFIG_MACH_MX51_BABBAGE) += mach-mx51_babbage.o
diff --git a/arch/arm/mach-imx/common.h b/arch/arm/mach-imx/common.h
index 59c3b9b26bb4..baf439dc22d8 100644
--- a/arch/arm/mach-imx/common.h
+++ b/arch/arm/mach-imx/common.h
@@ -144,13 +144,11 @@ void imx6q_set_chicken_bit(void);
 void imx_cpu_die(unsigned int cpu);
 int imx_cpu_kill(unsigned int cpu);
 
-#ifdef CONFIG_PM
 void imx6q_pm_init(void);
 void imx6q_pm_set_ccm_base(void __iomem *base);
+#ifdef CONFIG_PM
 void imx5_pm_init(void);
 #else
-static inline void imx6q_pm_init(void) {}
-static inline void imx6q_pm_set_ccm_base(void __iomem *base) {}
 static inline void imx5_pm_init(void) {}
 #endif
 
diff --git a/arch/arm/mach-omap1/board-nokia770.c b/arch/arm/mach-omap1/board-nokia770.c
index 91449c5cb70f..85089d821982 100644
--- a/arch/arm/mach-omap1/board-nokia770.c
+++ b/arch/arm/mach-omap1/board-nokia770.c
@@ -156,6 +156,7 @@ static struct omap_usb_config nokia770_usb_config __initdata = {
         .register_dev   = 1,
         .hmc_mode       = 16,
         .pins[0]        = 6,
+        .extcon         = "tahvo-usb",
 };
 
 #if defined(CONFIG_MMC_OMAP) || defined(CONFIG_MMC_OMAP_MODULE)
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index e2ce4f8366a7..0af7ca02314d 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -50,6 +50,7 @@ config SOC_OMAP5
         bool "TI OMAP5"
         depends on ARCH_MULTI_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select ARM_CPU_SUSPEND if PM
         select ARM_GIC
         select CPU_V7
@@ -63,6 +64,7 @@ config SOC_AM33XX
         bool "TI AM33XX"
         depends on ARCH_MULTI_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select ARM_CPU_SUSPEND if PM
         select CPU_V7
         select MULTI_IRQ_HANDLER
@@ -72,6 +74,7 @@ config SOC_AM43XX
         depends on ARCH_MULTI_V7
         select CPU_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select MULTI_IRQ_HANDLER
         select ARM_GIC
         select MACH_OMAP_GENERIC
@@ -80,6 +83,7 @@ config SOC_DRA7XX
         bool "TI DRA7XX"
         depends on ARCH_MULTI_V7
         select ARCH_OMAP2PLUS
+        select ARCH_HAS_OPP
         select ARM_CPU_SUSPEND if PM
         select ARM_GIC
         select CPU_V7
@@ -268,9 +272,6 @@ config MACH_OMAP_3430SDP
         default y
         select OMAP_PACKAGE_CBB
 
-config MACH_NOKIA_N800
-       bool
-
 config MACH_NOKIA_N810
        bool
 
@@ -281,7 +282,6 @@ config MACH_NOKIA_N8X0
         bool "Nokia N800/N810"
         depends on SOC_OMAP2420
         default y
-        select MACH_NOKIA_N800
         select MACH_NOKIA_N810
         select MACH_NOKIA_N810_WIMAX
         select OMAP_PACKAGE_ZAC
diff --git a/arch/arm/mach-omap2/cclock3xxx_data.c b/arch/arm/mach-omap2/cclock3xxx_data.c
index 3b05aea56d1f..11ed9152e665 100644
--- a/arch/arm/mach-omap2/cclock3xxx_data.c
+++ b/arch/arm/mach-omap2/cclock3xxx_data.c
@@ -433,7 +433,9 @@ static const struct clk_ops dpll4_m5x2_ck_ops = {
         .enable         = &omap2_dflt_clk_enable,
         .disable        = &omap2_dflt_clk_disable,
         .is_enabled     = &omap2_dflt_clk_is_enabled,
+        .set_rate       = &omap3_clkoutx2_set_rate,
         .recalc_rate    = &omap3_clkoutx2_recalc,
+        .round_rate     = &omap3_clkoutx2_round_rate,
 };
 
 static const struct clk_ops dpll4_m5x2_ck_3630_ops = {
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index 4c158c838d40..01fc710c8181 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -23,6 +23,8 @@
 #include "prm.h"
 #include "clockdomain.h"
 
+#define MAX_CPUS        2
+
 /* Machine specific information */
 struct idle_statedata {
         u32 cpu_state;
@@ -48,11 +50,11 @@ static struct idle_statedata omap4_idle_data[] = {
         },
 };
 
-static struct powerdomain *mpu_pd, *cpu_pd[NR_CPUS];
-static struct clockdomain *cpu_clkdm[NR_CPUS];
+static struct powerdomain *mpu_pd, *cpu_pd[MAX_CPUS];
+static struct clockdomain *cpu_clkdm[MAX_CPUS];
 
 static atomic_t abort_barrier;
-static bool cpu_done[NR_CPUS];
+static bool cpu_done[MAX_CPUS];
 static struct idle_statedata *state_ptr = &omap4_idle_data[0];
 
 /* Private functions */
diff --git a/arch/arm/mach-omap2/dpll3xxx.c b/arch/arm/mach-omap2/dpll3xxx.c
index 3185ced807c9..3c418ea54bbe 100644
--- a/arch/arm/mach-omap2/dpll3xxx.c
+++ b/arch/arm/mach-omap2/dpll3xxx.c
@@ -623,6 +623,32 @@ void omap3_dpll_deny_idle(struct clk_hw_omap *clk)
 
 /* Clock control for DPLL outputs */
 
+/* Find the parent DPLL for the given clkoutx2 clock */
+static struct clk_hw_omap *omap3_find_clkoutx2_dpll(struct clk_hw *hw)
+{
+        struct clk_hw_omap *pclk = NULL;
+        struct clk *parent;
+
+        /* Walk up the parents of clk, looking for a DPLL */
+        do {
+                do {
+                        parent = __clk_get_parent(hw->clk);
+                        hw = __clk_get_hw(parent);
+                } while (hw && (__clk_get_flags(hw->clk) & CLK_IS_BASIC));
+                if (!hw)
+                        break;
+                pclk = to_clk_hw_omap(hw);
+        } while (pclk && !pclk->dpll_data);
+
+        /* clk does not have a DPLL as a parent?  error in the clock data */
+        if (!pclk) {
+                WARN_ON(1);
+                return NULL;
+        }
+
+        return pclk;
+}
+
 /**
  * omap3_clkoutx2_recalc - recalculate DPLL X2 output virtual clock rate
  * @clk: DPLL output struct clk
@@ -637,27 +663,14 @@ unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
         unsigned long rate;
         u32 v;
         struct clk_hw_omap *pclk = NULL;
-        struct clk *parent;
 
         if (!parent_rate)
                 return 0;
 
-        /* Walk up the parents of clk, looking for a DPLL */
-        do {
-                do {
-                        parent = __clk_get_parent(hw->clk);
-                        hw = __clk_get_hw(parent);
-                } while (hw && (__clk_get_flags(hw->clk) & CLK_IS_BASIC));
-                if (!hw)
-                        break;
-                pclk = to_clk_hw_omap(hw);
-        } while (pclk && !pclk->dpll_data);
+        pclk = omap3_find_clkoutx2_dpll(hw);
 
-        /* clk does not have a DPLL as a parent?  error in the clock data */
-        if (!pclk) {
-                WARN_ON(1);
+        if (!pclk)
                 return 0;
-        }
 
         dd = pclk->dpll_data;
 
@@ -672,6 +685,55 @@ unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
         return rate;
 }
 
+int omap3_clkoutx2_set_rate(struct clk_hw *hw, unsigned long rate,
+                                        unsigned long parent_rate)
+{
+        return 0;
+}
+
+long omap3_clkoutx2_round_rate(struct clk_hw *hw, unsigned long rate,
+                unsigned long *prate)
+{
+        const struct dpll_data *dd;
+        u32 v;
+        struct clk_hw_omap *pclk = NULL;
+
+        if (!*prate)
+                return 0;
+
+        pclk = omap3_find_clkoutx2_dpll(hw);
+
+        if (!pclk)
+                return 0;
+
+        dd = pclk->dpll_data;
+
+        /* TYPE J does not have a clkoutx2 */
+        if (dd->flags & DPLL_J_TYPE) {
+                *prate = __clk_round_rate(__clk_get_parent(pclk->hw.clk), rate);
+                return *prate;
+        }
+
+        WARN_ON(!dd->enable_mask);
+
+        v = omap2_clk_readl(pclk, dd->control_reg) & dd->enable_mask;
+        v >>= __ffs(dd->enable_mask);
+
+        /* If in bypass, the rate is fixed to the bypass rate*/
+        if (v != OMAP3XXX_EN_DPLL_LOCKED)
+                return *prate;
+
+        if (__clk_get_flags(hw->clk) & CLK_SET_RATE_PARENT) {
+                unsigned long best_parent;
+
+                best_parent = (rate / 2);
+                *prate = __clk_round_rate(__clk_get_parent(hw->clk),
+                                best_parent);
+        }
+
+        return *prate * 2;
+}
+
 /* OMAP3/4 non-CORE DPLL clkops */
 const struct clk_hw_omap_ops clkhwops_omap3_dpll = {
         .allow_idle     = omap3_dpll_allow_idle,
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index d24926e6340f..ab43755364f5 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -1339,7 +1339,7 @@ static void __maybe_unused gpmc_read_timings_dt(struct device_node *np,
                 of_property_read_bool(np, "gpmc,time-para-granularity");
 }
 
-#ifdef CONFIG_MTD_NAND
+#if IS_ENABLED(CONFIG_MTD_NAND)
 
 static const char * const nand_xfer_types[] = {
         [NAND_OMAP_PREFETCH_POLLED]             = "prefetch-polled",
@@ -1429,7 +1429,7 @@ static int gpmc_probe_nand_child(struct platform_device *pdev,
 }
 #endif
 
-#ifdef CONFIG_MTD_ONENAND
+#if IS_ENABLED(CONFIG_MTD_ONENAND)
 static int gpmc_probe_onenand_child(struct platform_device *pdev,
                                  struct device_node *child)
 {
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index d408b15b4fbf..af432b191255 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -179,15 +179,6 @@ static struct map_desc omap34xx_io_desc[] __initdata = {
                 .length         = L4_EMU_34XX_SIZE,
                 .type           = MT_DEVICE
         },
-#if defined(CONFIG_DEBUG_LL) &&                                                 \
-        (defined(CONFIG_MACH_OMAP_ZOOM2) || defined(CONFIG_MACH_OMAP_ZOOM3))
-        {
-                .virtual        = ZOOM_UART_VIRT,
-                .pfn            = __phys_to_pfn(ZOOM_UART_BASE),
-                .length         = SZ_1M,
-                .type           = MT_DEVICE
-        },
-#endif
 };
 #endif
 
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 42d81885c700..1f33f5db10d5 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1947,29 +1947,31 @@ static int _ocp_softreset(struct omap_hwmod *oh)
                 goto dis_opt_clks;
 
         _write_sysconfig(v, oh);
-        ret = _clear_softreset(oh, &v);
-        if (ret)
-                goto dis_opt_clks;
-
-        _write_sysconfig(v, oh);
 
         if (oh->class->sysc->srst_udelay)
                 udelay(oh->class->sysc->srst_udelay);
 
         c = _wait_softreset_complete(oh);
-        if (c == MAX_MODULE_SOFTRESET_WAIT)
+        if (c == MAX_MODULE_SOFTRESET_WAIT) {
                 pr_warning("omap_hwmod: %s: softreset failed (waited %d usec)\n",
                            oh->name, MAX_MODULE_SOFTRESET_WAIT);
-        else
+                ret = -ETIMEDOUT;
+                goto dis_opt_clks;
+        } else {
                 pr_debug("omap_hwmod: %s: softreset in %d usec\n", oh->name, c);
+        }
+
+        ret = _clear_softreset(oh, &v);
+        if (ret)
+                goto dis_opt_clks;
+
+        _write_sysconfig(v, oh);
 
         /*
          * XXX add _HWMOD_STATE_WEDGED for modules that don't come back from
          * _wait_target_ready() or _reset()
          */
 
-        ret = (c == MAX_MODULE_SOFTRESET_WAIT) ? -ETIMEDOUT : 0;
-
 dis_opt_clks:
         if (oh->flags & HWMOD_CONTROL_OPT_CLKS_IN_RESET)
                 _disable_optional_clocks(oh);
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index 18f333c440db..810c205d668b 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1365,11 +1365,10 @@ static struct omap_hwmod_class_sysconfig dra7xx_spinlock_sysc = {
         .rev_offs       = 0x0000,
         .sysc_offs      = 0x0010,
         .syss_offs      = 0x0014,
-        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
-                           SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
-                           SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
-        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
-                           SIDLE_SMART_WKUP),
+        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_ENAWAKEUP |
+                           SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
+                           SYSS_HAS_RESET_STATUS),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
         .sysc_fields    = &omap_hwmod_sysc_type1,
 };
 
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 3d5b24dcd9a4..c33e07e2f0d4 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -22,6 +22,8 @@
 #include "common-board-devices.h"
 #include "dss-common.h"
 #include "control.h"
+#include "omap-secure.h"
+#include "soc.h"
 
 struct pdata_init {
         const char *compatible;
@@ -169,6 +171,22 @@ static void __init am3517_evm_legacy_init(void)
         omap_ctrl_writel(v, AM35XX_CONTROL_IP_SW_RESET);
         omap_ctrl_readl(AM35XX_CONTROL_IP_SW_RESET); /* OCP barrier */
 }
+
+static void __init nokia_n900_legacy_init(void)
+{
+        hsmmc2_internal_input_clk();
+
+        if (omap_type() == OMAP2_DEVICE_TYPE_SEC) {
+                if (IS_ENABLED(CONFIG_ARM_ERRATA_430973)) {
+                        pr_info("RX-51: Enabling ARM errata 430973 workaround\n");
+                        /* set IBE to 1 */
+                        rx51_secure_update_aux_cr(BIT(6), 0);
+                } else {
+                        pr_warning("RX-51: Not enabling ARM errata 430973 workaround\n");
+                        pr_warning("Thumb binaries may crash randomly without this workaround\n");
+                }
+        }
+}
 #endif /* CONFIG_ARCH_OMAP3 */
 
 #ifdef CONFIG_ARCH_OMAP4
@@ -239,6 +257,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 #endif
 #ifdef CONFIG_ARCH_OMAP3
         OF_DEV_AUXDATA("ti,omap3-padconf", 0x48002030, "48002030.pinmux", &pcs_pdata),
+        OF_DEV_AUXDATA("ti,omap3-padconf", 0x480025a0, "480025a0.pinmux", &pcs_pdata),
         OF_DEV_AUXDATA("ti,omap3-padconf", 0x48002a00, "48002a00.pinmux", &pcs_pdata),
         /* Only on am3517 */
         OF_DEV_AUXDATA("ti,davinci_mdio", 0x5c030000, "davinci_mdio.0", NULL),
@@ -259,7 +278,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 static struct pdata_init pdata_quirks[] __initdata = {
 #ifdef CONFIG_ARCH_OMAP3
         { "compulab,omap3-sbc-t3730", omap3_sbc_t3730_legacy_init, },
-        { "nokia,omap3-n900", hsmmc2_internal_input_clk, },
+        { "nokia,omap3-n900", nokia_n900_legacy_init, },
         { "nokia,omap3-n9", hsmmc2_internal_input_clk, },
         { "nokia,omap3-n950", hsmmc2_internal_input_clk, },
         { "isee,omap3-igep0020", omap3_igep0020_legacy_init, },
diff --git a/arch/arm/mach-omap2/prminst44xx.c b/arch/arm/mach-omap2/prminst44xx.c
index 6334b96b4097..280f3c58abe5 100644
--- a/arch/arm/mach-omap2/prminst44xx.c
+++ b/arch/arm/mach-omap2/prminst44xx.c
@@ -183,11 +183,11 @@ void omap4_prminst_global_warm_sw_reset(void)
                                         OMAP4_PRM_RSTCTRL_OFFSET);
         v |= OMAP4430_RST_GLOBAL_WARM_SW_MASK;
         omap4_prminst_write_inst_reg(v, OMAP4430_PRM_PARTITION,
-                                 OMAP4430_PRM_DEVICE_INST,
+                                 dev_inst,
                                  OMAP4_PRM_RSTCTRL_OFFSET);
 
         /* OCP barrier */
         v = omap4_prminst_read_inst_reg(OMAP4430_PRM_PARTITION,
-                                    OMAP4430_PRM_DEVICE_INST,
+                                    dev_inst,
                                     OMAP4_PRM_RSTCTRL_OFFSET);
 }
diff --git a/arch/arm/mach-pxa/mioa701.c b/arch/arm/mach-pxa/mioa701.c
index f70583fee59f..29997bde277d 100644
--- a/arch/arm/mach-pxa/mioa701.c
+++ b/arch/arm/mach-pxa/mioa701.c
@@ -38,6 +38,7 @@
 #include <linux/mtd/physmap.h>
 #include <linux/usb/gpio_vbus.h>
 #include <linux/reboot.h>
+#include <linux/regulator/fixed.h>
 #include <linux/regulator/max1586.h>
 #include <linux/slab.h>
 #include <linux/i2c/pxa-i2c.h>
@@ -714,6 +715,10 @@ static struct gpio global_gpios[] = {
         { GPIO56_MT9M111_nOE, GPIOF_OUT_INIT_LOW, "Camera nOE" },
 };
 
+static struct regulator_consumer_supply fixed_5v0_consumers[] = {
+        REGULATOR_SUPPLY("power", "pwm-backlight"),
+};
+
 static void __init mioa701_machine_init(void)
 {
         int rc;
@@ -753,6 +758,10 @@ static void __init mioa701_machine_init(void)
         pxa_set_i2c_info(&i2c_pdata);
         pxa27x_set_i2c_power_info(NULL);
         pxa_set_camera_info(&mioa701_pxacamera_platform_data);
+
+        regulator_register_always_on(0, "fixed-5.0V", fixed_5v0_consumers,
+                                     ARRAY_SIZE(fixed_5v0_consumers),
+                                     5000000);
 }
 
 static void mioa701_machine_exit(void)
diff --git a/arch/arm/mach-sa1100/include/mach/collie.h b/arch/arm/mach-sa1100/include/mach/collie.h
index f33679d2d3ee..50e1d850ee2e 100644
--- a/arch/arm/mach-sa1100/include/mach/collie.h
+++ b/arch/arm/mach-sa1100/include/mach/collie.h
@@ -13,6 +13,8 @@
 #ifndef __ASM_ARCH_COLLIE_H
 #define __ASM_ARCH_COLLIE_H
 
+#include "hardware.h" /* Gives GPIO_MAX */
+
 extern void locomolcd_power(int on);
 
 #define COLLIE_SCOOP_GPIO_BASE  (GPIO_MAX + 1)
diff --git a/arch/arm/mach-tegra/pm.c b/arch/arm/mach-tegra/pm.c
index 4ae0286b468d..f55b05a29b55 100644
--- a/arch/arm/mach-tegra/pm.c
+++ b/arch/arm/mach-tegra/pm.c
@@ -24,6 +24,7 @@
 #include <linux/cpu_pm.h>
 #include <linux/suspend.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/clk/tegra.h>
 
 #include <asm/smp_plat.h>
diff --git a/arch/arm/mach-tegra/tegra.c b/arch/arm/mach-tegra/tegra.c
index 303a285d80fd..6191603379e1 100644
--- a/arch/arm/mach-tegra/tegra.c
+++ b/arch/arm/mach-tegra/tegra.c
@@ -73,10 +73,20 @@ u32 tegra_uart_config[3] = {
 static void __init tegra_init_cache(void)
 {
 #ifdef CONFIG_CACHE_L2X0
+        static const struct of_device_id pl310_ids[] __initconst = {
+                { .compatible = "arm,pl310-cache",  },
+                {}
+        };
+
+        struct device_node *np;
         int ret;
         void __iomem *p = IO_ADDRESS(TEGRA_ARM_PERIF_BASE) + 0x3000;
         u32 aux_ctrl, cache_type;
 
+        np = of_find_matching_node(NULL, pl310_ids);
+        if (!np)
+                return;
+
         cache_type = readl(p + L2X0_CACHE_TYPE);
         aux_ctrl = (cache_type & 0x700) << (17-8);
         aux_ctrl |= 0x7C400001;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 1a77450e728a..11b3914660d2 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1358,7 +1358,7 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
         *handle = DMA_ERROR_CODE;
         size = PAGE_ALIGN(size);
 
-        if (gfp & GFP_ATOMIC)
+        if (!(gfp & __GFP_WAIT))
                 return __iommu_alloc_atomic(dev, size, handle);
 
         /*
diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 2b3a56414271..ef69152f9b52 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -264,6 +264,9 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
                         note_page(st, addr, 3, pmd_val(*pmd));
                 else
                         walk_pte(st, pmd, addr);
+
+                if (SECTION_SIZE < PMD_SIZE && pmd_large(pmd[1]))
+                        note_page(st, addr + SECTION_SIZE, 3, pmd_val(pmd[1]));
         }
 }
 
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index d5a982d15a88..7ea641b7aa7d 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -38,6 +38,7 @@ static inline pmd_t *pmd_off_k(unsigned long virt)
 
 struct mem_type {
         pteval_t prot_pte;
+        pteval_t prot_pte_s2;
         pmdval_t prot_l1;
         pmdval_t prot_sect;
         unsigned int domain;
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4f08c133cc25..a623cb3ad012 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -232,12 +232,16 @@ __setup("noalign", noalign_setup);
 #endif /* ifdef CONFIG_CPU_CP15 / else */
 
 #define PROT_PTE_DEVICE         L_PTE_PRESENT|L_PTE_YOUNG|L_PTE_DIRTY|L_PTE_XN
+#define PROT_PTE_S2_DEVICE      PROT_PTE_DEVICE
 #define PROT_SECT_DEVICE        PMD_TYPE_SECT|PMD_SECT_AP_WRITE
 
 static struct mem_type mem_types[] = {
         [MT_DEVICE] = {           /* Strongly ordered / ARMv6 shared device */
                 .prot_pte       = PROT_PTE_DEVICE | L_PTE_MT_DEV_SHARED |
                                   L_PTE_SHARED,
+                .prot_pte_s2    = s2_policy(PROT_PTE_S2_DEVICE) |
+                                  s2_policy(L_PTE_S2_MT_DEV_SHARED) |
+                                  L_PTE_SHARED,
                 .prot_l1        = PMD_TYPE_TABLE,
                 .prot_sect      = PROT_SECT_DEVICE | PMD_SECT_S,
                 .domain         = DOMAIN_IO,
@@ -508,7 +512,8 @@ static void __init build_mem_type_table(void)
         cp = &cache_policies[cachepolicy];
         vecs_pgprot = kern_pgprot = user_pgprot = cp->pte;
         s2_pgprot = cp->pte_s2;
-        hyp_device_pgprot = s2_device_pgprot = mem_types[MT_DEVICE].prot_pte;
+        hyp_device_pgprot = mem_types[MT_DEVICE].prot_pte;
+        s2_device_pgprot = mem_types[MT_DEVICE].prot_pte_s2;
 
         /*
          * ARMv6 and above have extended page tables.
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 45dc29f85d56..32b3558321c4 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -208,7 +208,6 @@ __v6_setup:
         mcr     p15, 0, r0, c7, c14, 0          @ clean+invalidate D cache
         mcr     p15, 0, r0, c7, c5, 0           @ invalidate I cache
         mcr     p15, 0, r0, c7, c15, 0          @ clean+invalidate cache
-        mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
 #ifdef CONFIG_MMU
         mcr     p15, 0, r0, c8, c7, 0           @ invalidate I + D TLBs
         mcr     p15, 0, r0, c2, c0, 2           @ TTB control register
@@ -218,6 +217,8 @@ __v6_setup:
         ALT_UP(orr      r8, r8, #TTB_FLAGS_UP)
         mcr     p15, 0, r8, c2, c0, 1           @ load TTB1
 #endif /* CONFIG_MMU */
+        mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer and
+                                                @ complete invalidations
         adr     r5, v6_crval
         ldmia   r5, {r5, r6}
  ARM_BE8(orr    r6, r6, #1 << 25)               @ big-endian page tables
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index bd1781979a39..74f6033e76dd 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -351,7 +351,6 @@ __v7_setup:
 
 4:      mov     r10, #0
         mcr     p15, 0, r10, c7, c5, 0          @ I+BTB cache invalidate
-        dsb
 #ifdef CONFIG_MMU
         mcr     p15, 0, r10, c8, c7, 0          @ invalidate I + D TLBs
         v7_ttb_setup r10, r4, r8, r5            @ TTBCR, TTBRx setup
@@ -360,6 +359,7 @@ __v7_setup:
         mcr     p15, 0, r5, c10, c2, 0          @ write PRRR
         mcr     p15, 0, r6, c10, c2, 1          @ write NMRR
 #endif
+        dsb                                     @ Complete invalidations
 #ifndef CONFIG_ARM_THUMBEE
         mrc     p15, 0, r0, c0, c1, 0           @ read ID_PFR0 for ThumbEE
         and     r0, r0, #(0xf << 12)            @ ThumbEE enabled field
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
index 13fb0b3efc5f..453a179469a3 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -16,6 +16,8 @@
 #ifndef __ASM_PERCPU_H
 #define __ASM_PERCPU_H
 
+#ifdef CONFIG_SMP
+
 static inline void set_my_cpu_offset(unsigned long off)
 {
         asm volatile("msr tpidr_el1, %0" :: "r" (off) : "memory");
@@ -36,6 +38,12 @@ static inline unsigned long __my_cpu_offset(void)
 }
 #define __my_cpu_offset __my_cpu_offset()
 
+#else   /* !CONFIG_SMP */
+
+#define set_my_cpu_offset(x)    do { } while (0)
+
+#endif /* CONFIG_SMP */
+
 #include <asm-generic/percpu.h>
 
 #endif /* __ASM_PERCPU_H */
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index b524dcd17243..aa3917c8b623 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -136,11 +136,11 @@ extern struct page *empty_zero_page;
 /*
  * The following only work if pte_present(). Undefined behaviour otherwise.
  */
-#define pte_present(pte)        (pte_val(pte) & (PTE_VALID | PTE_PROT_NONE))
-#define pte_dirty(pte)          (pte_val(pte) & PTE_DIRTY)
-#define pte_young(pte)          (pte_val(pte) & PTE_AF)
-#define pte_special(pte)        (pte_val(pte) & PTE_SPECIAL)
-#define pte_write(pte)          (pte_val(pte) & PTE_WRITE)
+#define pte_present(pte)        (!!(pte_val(pte) & (PTE_VALID | PTE_PROT_NONE)))
+#define pte_dirty(pte)          (!!(pte_val(pte) & PTE_DIRTY))
+#define pte_young(pte)          (!!(pte_val(pte) & PTE_AF))
+#define pte_special(pte)        (!!(pte_val(pte) & PTE_SPECIAL))
+#define pte_write(pte)          (!!(pte_val(pte) & PTE_WRITE))
 #define pte_exec(pte)           (!(pte_val(pte) & PTE_UXN))
 
 #define pte_valid_user(pte) \
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index c3b6c63ea5fb..38f0558f0c0a 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -48,7 +48,11 @@ int unwind_frame(struct stackframe *frame)
 
         frame->sp = fp + 0x10;
         frame->fp = *(unsigned long *)(fp);
-        frame->pc = *(unsigned long *)(fp + 8);
+        /*
+         * -4 here because we care about the PC at time of bl,
+         * not where the return will go.
+         */
+        frame->pc = *(unsigned long *)(fp + 8) - 4;
 
         return 0;
 }
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index 3b47c36e10ff..2c56012cb2d2 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -694,6 +694,24 @@ __hyp_panic_str:
 
         .align  2
 
+/*
+ * u64 kvm_call_hyp(void *hypfn, ...);
+ *
+ * This is not really a variadic function in the classic C-way and care must
+ * be taken when calling this to ensure parameters are passed in registers
+ * only, since the stack will change between the caller and the callee.
+ *
+ * Call the function with the first argument containing a pointer to the
+ * function you wish to call in Hyp mode, and subsequent arguments will be
+ * passed as x0, x1, and x2 (a maximum of 3 arguments in addition to the
+ * function pointer can be passed).  The function being called must be mapped
+ * in Hyp mode (see init_hyp_mode in arch/arm/kvm/arm.c).  Return values are
+ * passed in r0 and r1.
+ *
+ * A function pointer with a value of 0 has a special meaning, and is
+ * used to implement __hyp_get_vectors in the same way as in
+ * arch/arm64/kernel/hyp_stub.S.
+ */
 ENTRY(kvm_call_hyp)
         hvc     #0
         ret
@@ -737,7 +755,12 @@ el1_sync:					// Guest trapped into EL2
         pop     x2, x3
         pop     x0, x1
 
-        push    lr, xzr
+        /* Check for __hyp_get_vectors */
+        cbnz    x0, 1f
+        mrs     x0, vbar_el2
+        b       2f
+
+1:      push    lr, xzr
 
         /*
          * Compute the function address in EL2, and shuffle the parameters.
@@ -750,7 +773,7 @@ el1_sync:					// Guest trapped into EL2
         blr     lr
 
         pop     lr, xzr
-        eret
+2:      eret
 
 el1_trap:
         /*
diff --git a/arch/avr32/Makefile b/arch/avr32/Makefile
index 22fb66590dcd..dba48a5d5bb9 100644
--- a/arch/avr32/Makefile
+++ b/arch/avr32/Makefile
@@ -11,7 +11,7 @@ all: uImage vmlinux.elf
 
 KBUILD_DEFCONFIG        := atstk1002_defconfig
 
-KBUILD_CFLAGS   += -pipe -fno-builtin -mno-pic
+KBUILD_CFLAGS   += -pipe -fno-builtin -mno-pic -D__linux__
 KBUILD_AFLAGS   += -mrelax -mno-pic
 KBUILD_CFLAGS_MODULE += -mno-relax
 LDFLAGS_vmlinux += --relax
diff --git a/arch/avr32/boards/mimc200/fram.c b/arch/avr32/boards/mimc200/fram.c
index 9764a1a1073e..c1466a872b9c 100644
--- a/arch/avr32/boards/mimc200/fram.c
+++ b/arch/avr32/boards/mimc200/fram.c
@@ -11,6 +11,7 @@
 #define FRAM_VERSION    "1.0"
 
 #include <linux/miscdevice.h>
+#include <linux/module.h>
 #include <linux/proc_fs.h>
 #include <linux/mm.h>
 #include <linux/io.h>
diff --git a/arch/avr32/include/asm/Kbuild b/arch/avr32/include/asm/Kbuild
index cfb9fe1b8df9..c7c64a63c29f 100644
--- a/arch/avr32/include/asm/Kbuild
+++ b/arch/avr32/include/asm/Kbuild
@@ -17,5 +17,6 @@ generic-y       += scatterlist.h
 generic-y       += sections.h
 generic-y       += topology.h
 generic-y       += trace_clock.h
+generic-y += vga.h
 generic-y       += xor.h
 generic-y       += hash.h
diff --git a/arch/avr32/include/asm/io.h b/arch/avr32/include/asm/io.h
index fc6483f83ccc..4f5ec2bb7172 100644
--- a/arch/avr32/include/asm/io.h
+++ b/arch/avr32/include/asm/io.h
@@ -295,6 +295,8 @@ extern void __iounmap(void __iomem *addr);
 #define iounmap(addr)                           \
         __iounmap(addr)
 
+#define ioremap_wc ioremap_nocache
+
 #define cached(addr) P1SEGADDR(addr)
 #define uncached(addr) P2SEGADDR(addr)
 
diff --git a/arch/c6x/include/asm/cache.h b/arch/c6x/include/asm/cache.h
index 09c5a0f5f4d1..86648c083bb4 100644
--- a/arch/c6x/include/asm/cache.h
+++ b/arch/c6x/include/asm/cache.h
@@ -12,6 +12,7 @@
 #define _ASM_C6X_CACHE_H
 
 #include <linux/irqflags.h>
+#include <linux/init.h>
 
 /*
  * Cache line size
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 7cc8c364924d..6fb9e813a910 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,4 +1,4 @@
-
+generic-y += barrier.h
 generic-y += bitsperlong.h
 generic-y += clkdev.h
 generic-y += cputime.h
@@ -6,6 +6,7 @@ generic-y += device.h
 generic-y += emergency-restart.h
 generic-y += errno.h
 generic-y += exec.h
+generic-y += hash.h
 generic-y += hw_irq.h
 generic-y += ioctl.h
 generic-y += ipcbuf.h
@@ -18,6 +19,7 @@ generic-y += local.h
 generic-y += mman.h
 generic-y += mutex.h
 generic-y += percpu.h
+generic-y += preempt.h
 generic-y += resource.h
 generic-y += scatterlist.h
 generic-y += sections.h
@@ -31,5 +33,3 @@ generic-y += trace_clock.h
 generic-y += types.h
 generic-y += word-at-a-time.h
 generic-y += xor.h
-generic-y += preempt.h
-generic-y += hash.h
diff --git a/arch/m68k/include/asm/barrier.h b/arch/m68k/include/asm/barrier.h
deleted file mode 100644
index 15c5f77c1614..000000000000
--- a/arch/m68k/include/asm/barrier.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef _M68K_BARRIER_H
-#define _M68K_BARRIER_H
-
-#define nop()           do { asm volatile ("nop"); barrier(); } while (0)
-
-#include <asm-generic/barrier.h>
-
-#endif /* _M68K_BARRIER_H */
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 014f288fc813..9d38b73989eb 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             349
+#define NR_syscalls             351
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 625f321001dc..b932dd470041 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -354,5 +354,7 @@
 #define __NR_process_vm_writev  346
 #define __NR_kcmp               347
 #define __NR_finit_module       348
+#define __NR_sched_setattr      349
+#define __NR_sched_getattr      350
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 3f04ea0ab802..b6223dc41d82 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -369,4 +369,6 @@ ENTRY(sys_call_table)
         .long sys_process_vm_writev
         .long sys_kcmp
         .long sys_finit_module
+        .long sys_sched_setattr
+        .long sys_sched_getattr         /* 350 */
 
diff --git a/arch/powerpc/include/asm/compat.h b/arch/powerpc/include/asm/compat.h
index 84fdf6857c31..a613d2c82fd9 100644
--- a/arch/powerpc/include/asm/compat.h
+++ b/arch/powerpc/include/asm/compat.h
@@ -200,10 +200,11 @@ static inline void __user *arch_compat_alloc_user_space(long len)
 
         /*
          * We can't access below the stack pointer in the 32bit ABI and
-         * can access 288 bytes in the 64bit ABI
+         * can access 288 bytes in the 64bit big-endian ABI,
+         * or 512 bytes with the new ELFv2 little-endian ABI.
          */
         if (!is_32bit_task())
-                usp -= 288;
+                usp -= USER_REDZONE_SIZE;
 
         return (void __user *) (usp - len);
 }
diff --git a/arch/powerpc/include/asm/eeh.h b/arch/powerpc/include/asm/eeh.h
index 9e39ceb1d19f..d4dd41fb951b 100644
--- a/arch/powerpc/include/asm/eeh.h
+++ b/arch/powerpc/include/asm/eeh.h
@@ -172,10 +172,20 @@ struct eeh_ops {
 };
 
 extern struct eeh_ops *eeh_ops;
-extern int eeh_subsystem_enabled;
+extern bool eeh_subsystem_enabled;
 extern raw_spinlock_t confirm_error_lock;
 extern int eeh_probe_mode;
 
+static inline bool eeh_enabled(void)
+{
+        return eeh_subsystem_enabled;
+}
+
+static inline void eeh_set_enable(bool mode)
+{
+        eeh_subsystem_enabled = mode;
+}
+
 #define EEH_PROBE_MODE_DEV      (1<<0)  /* From PCI device      */
 #define EEH_PROBE_MODE_DEVTREE  (1<<1)  /* From device tree     */
 
@@ -246,7 +256,7 @@ void eeh_remove_device(struct pci_dev *);
  * If this macro yields TRUE, the caller relays to eeh_check_failure()
  * which does further tests out of line.
  */
-#define EEH_POSSIBLE_ERROR(val, type)   ((val) == (type)~0 && eeh_subsystem_enabled)
+#define EEH_POSSIBLE_ERROR(val, type)   ((val) == (type)~0 && eeh_enabled())
 
 /*
  * Reads from a device which has been isolated by EEH will return
@@ -257,6 +267,13 @@ void eeh_remove_device(struct pci_dev *);
 
 #else /* !CONFIG_EEH */
 
+static inline bool eeh_enabled(void)
+{
+        return false;
+}
+
+static inline void eeh_set_enable(bool mode) { }
+
 static inline int eeh_init(void)
 {
         return 0;
diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h
index d750336b171d..623f2971ce0e 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -127,7 +127,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
                                             unsigned long addr, pte_t *ptep)
 {
 #ifdef CONFIG_PPC64
-        return __pte(pte_update(mm, addr, ptep, ~0UL, 1));
+        return __pte(pte_update(mm, addr, ptep, ~0UL, 0, 1));
 #else
         return __pte(pte_update(ptep, ~0UL, 0));
 #endif
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index 40157e2ca691..ed82142a3251 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -816,8 +816,8 @@ int64_t opal_pci_next_error(uint64_t phb_id, uint64_t *first_frozen_pe,
 int64_t opal_pci_poll(uint64_t phb_id);
 int64_t opal_return_cpu(void);
 
-int64_t opal_xscom_read(uint32_t gcid, uint32_t pcb_addr, __be64 *val);
-int64_t opal_xscom_write(uint32_t gcid, uint32_t pcb_addr, uint64_t val);
+int64_t opal_xscom_read(uint32_t gcid, uint64_t pcb_addr, __be64 *val);
+int64_t opal_xscom_write(uint32_t gcid, uint64_t pcb_addr, uint64_t val);
 
 int64_t opal_lpc_write(uint32_t chip_id, enum OpalLPCAddressType addr_type,
                        uint32_t addr, uint32_t data, uint32_t sz);
diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h
index bc141c950b1e..eb9261024f51 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -195,6 +195,7 @@ extern void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
 static inline unsigned long pte_update(struct mm_struct *mm,
                                        unsigned long addr,
                                        pte_t *ptep, unsigned long clr,
+                                       unsigned long set,
                                        int huge)
 {
 #ifdef PTE_ATOMIC_UPDATES
@@ -205,14 +206,15 @@ static inline unsigned long pte_update(struct mm_struct *mm,
         andi.   %1,%0,%6\n\
         bne-    1b \n\
         andc    %1,%0,%4 \n\
+        or      %1,%1,%7\n\
         stdcx.  %1,0,%3 \n\
         bne-    1b"
         : "=&r" (old), "=&r" (tmp), "=m" (*ptep)
-        : "r" (ptep), "r" (clr), "m" (*ptep), "i" (_PAGE_BUSY)
+        : "r" (ptep), "r" (clr), "m" (*ptep), "i" (_PAGE_BUSY), "r" (set)
         : "cc" );
 #else
         unsigned long old = pte_val(*ptep);
-        *ptep = __pte(old & ~clr);
+        *ptep = __pte((old & ~clr) | set);
 #endif
         /* huge pages use the old page table lock */
         if (!huge)
@@ -231,9 +233,9 @@ static inline int __ptep_test_and_clear_young(struct mm_struct *mm,
 {
         unsigned long old;
 
-        if ((pte_val(*ptep) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
+        if ((pte_val(*ptep) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
                 return 0;
-        old = pte_update(mm, addr, ptep, _PAGE_ACCESSED, 0);
+        old = pte_update(mm, addr, ptep, _PAGE_ACCESSED, 0, 0);
         return (old & _PAGE_ACCESSED) != 0;
 }
 #define __HAVE_ARCH_PTEP_TEST_AND_CLEAR_YOUNG
@@ -252,7 +254,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
         if ((pte_val(*ptep) & _PAGE_RW) == 0)
                 return;
 
-        pte_update(mm, addr, ptep, _PAGE_RW, 0);
+        pte_update(mm, addr, ptep, _PAGE_RW, 0, 0);
 }
 
 static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
@@ -261,7 +263,7 @@ static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
         if ((pte_val(*ptep) & _PAGE_RW) == 0)
                 return;
 
-        pte_update(mm, addr, ptep, _PAGE_RW, 1);
+        pte_update(mm, addr, ptep, _PAGE_RW, 0, 1);
 }
 
 /*
@@ -284,14 +286,14 @@ static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
 static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
                                        unsigned long addr, pte_t *ptep)
 {
-        unsigned long old = pte_update(mm, addr, ptep, ~0UL, 0);
+        unsigned long old = pte_update(mm, addr, ptep, ~0UL, 0, 0);
         return __pte(old);
 }
 
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr,
                              pte_t * ptep)
 {
-        pte_update(mm, addr, ptep, ~0UL, 0);
+        pte_update(mm, addr, ptep, ~0UL, 0, 0);
 }
 
 
@@ -506,7 +508,9 @@ extern int pmdp_set_access_flags(struct vm_area_struct *vma,
 
 extern unsigned long pmd_hugepage_update(struct mm_struct *mm,
                                          unsigned long addr,
-                                         pmd_t *pmdp, unsigned long clr);
+                                         pmd_t *pmdp,
+                                         unsigned long clr,
+                                         unsigned long set);
 
 static inline int __pmdp_test_and_clear_young(struct mm_struct *mm,
                                               unsigned long addr, pmd_t *pmdp)
@@ -515,7 +519,7 @@ static inline int __pmdp_test_and_clear_young(struct mm_struct *mm,
 
         if ((pmd_val(*pmdp) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
                 return 0;
-        old = pmd_hugepage_update(mm, addr, pmdp, _PAGE_ACCESSED);
+        old = pmd_hugepage_update(mm, addr, pmdp, _PAGE_ACCESSED, 0);
         return ((old & _PAGE_ACCESSED) != 0);
 }
 
@@ -542,7 +546,7 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm, unsigned long addr,
         if ((pmd_val(*pmdp) & _PAGE_RW) == 0)
                 return;
 
-        pmd_hugepage_update(mm, addr, pmdp, _PAGE_RW);
+        pmd_hugepage_update(mm, addr, pmdp, _PAGE_RW, 0);
 }
 
 #define __HAVE_ARCH_PMDP_SPLITTING_FLUSH
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index f83b6f3e1b39..3ebb188c3ff5 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -75,12 +75,34 @@ static inline pte_t pte_mknuma(pte_t pte)
         return pte;
 }
 
+#define ptep_set_numa ptep_set_numa
+static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pte_t *ptep)
+{
+        if ((pte_val(*ptep) & _PAGE_PRESENT) == 0)
+                VM_BUG_ON(1);
+
+        pte_update(mm, addr, ptep, _PAGE_PRESENT, _PAGE_NUMA, 0);
+        return;
+}
+
 #define pmd_numa pmd_numa
 static inline int pmd_numa(pmd_t pmd)
 {
         return pte_numa(pmd_pte(pmd));
 }
 
+#define pmdp_set_numa pmdp_set_numa
+static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pmd_t *pmdp)
+{
+        if ((pmd_val(*pmdp) & _PAGE_PRESENT) == 0)
+                VM_BUG_ON(1);
+
+        pmd_hugepage_update(mm, addr, pmdp, _PAGE_PRESENT, _PAGE_NUMA);
+        return;
+}
+
 #define pmd_mknonnuma pmd_mknonnuma
 static inline pmd_t pmd_mknonnuma(pmd_t pmd)
 {
diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
index becc08e6a65c..279b80f3bb29 100644
--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -28,11 +28,23 @@
 
 #ifdef __powerpc64__
 
+/*
+ * Size of redzone that userspace is allowed to use below the stack
+ * pointer.  This is 288 in the 64-bit big-endian ELF ABI, and 512 in
+ * the new ELFv2 little-endian ABI, so we allow the larger amount.
+ *
+ * For kernel code we allow a 288-byte redzone, in order to conserve
+ * kernel stack space; gcc currently only uses 288 bytes, and will
+ * hopefully allow explicit control of the redzone size in future.
+ */
+#define USER_REDZONE_SIZE       512
+#define KERNEL_REDZONE_SIZE     288
+
 #define STACK_FRAME_OVERHEAD    112     /* size of minimum stack frame */
 #define STACK_FRAME_LR_SAVE     2       /* Location of LR in stack frame */
 #define STACK_FRAME_REGS_MARKER ASM_CONST(0x7265677368657265)
 #define STACK_INT_FRAME_SIZE    (sizeof(struct pt_regs) + \
-                                        STACK_FRAME_OVERHEAD + 288)
+                                 STACK_FRAME_OVERHEAD + KERNEL_REDZONE_SIZE)
 #define STACK_FRAME_MARKER      12
 
 /* Size of dummy stack frame allocated when calling signal handler. */
@@ -41,6 +53,8 @@
 
 #else /* __powerpc64__ */
 
+#define USER_REDZONE_SIZE       0
+#define KERNEL_REDZONE_SIZE     0
 #define STACK_FRAME_OVERHEAD    16      /* size of minimum stack frame */
 #define STACK_FRAME_LR_SAVE     1       /* Location of LR in stack frame */
 #define STACK_FRAME_REGS_MARKER ASM_CONST(0x72656773)
diff --git a/arch/powerpc/include/asm/vdso.h b/arch/powerpc/include/asm/vdso.h
index 0d9cecddf8a4..c53f5f6d1761 100644
--- a/arch/powerpc/include/asm/vdso.h
+++ b/arch/powerpc/include/asm/vdso.h
@@ -4,11 +4,11 @@
 #ifdef __KERNEL__
 
 /* Default link addresses for the vDSOs */
-#define VDSO32_LBASE    0x100000
-#define VDSO64_LBASE    0x100000
+#define VDSO32_LBASE    0x0
+#define VDSO64_LBASE    0x0
 
 /* Default map addresses for 32bit vDSO */
-#define VDSO32_MBASE    VDSO32_LBASE
+#define VDSO32_MBASE    0x100000
 
 #define VDSO_VERSION_STRING     LINUX_2.6.15
 
diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
index 11c1d069d920..7a13f378ca2c 100644
--- a/arch/powerpc/kernel/crash_dump.c
+++ b/arch/powerpc/kernel/crash_dump.c
@@ -98,17 +98,19 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
                         size_t csize, unsigned long offset, int userbuf)
 {
         void  *vaddr;
+        phys_addr_t paddr;
 
         if (!csize)
                 return 0;
 
         csize = min_t(size_t, csize, PAGE_SIZE);
+        paddr = pfn << PAGE_SHIFT;
 
-        if ((min_low_pfn < pfn) && (pfn < max_pfn)) {
-                vaddr = __va(pfn << PAGE_SHIFT);
+        if (memblock_is_region_memory(paddr, csize)) {
+                vaddr = __va(paddr);
                 csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf);
         } else {
-                vaddr = __ioremap(pfn << PAGE_SHIFT, PAGE_SIZE, 0);
+                vaddr = __ioremap(paddr, PAGE_SIZE, 0);
                 csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf);
                 iounmap(vaddr);
         }
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 148db72a8c43..e7b76a6bf150 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -28,6 +28,7 @@
 #include <linux/pci.h>
 #include <linux/proc_fs.h>
 #include <linux/rbtree.h>
+#include <linux/reboot.h>
 #include <linux/seq_file.h>
 #include <linux/spinlock.h>
 #include <linux/export.h>
@@ -89,7 +90,7 @@
 /* Platform dependent EEH operations */
 struct eeh_ops *eeh_ops = NULL;
 
-int eeh_subsystem_enabled;
+bool eeh_subsystem_enabled = false;
 EXPORT_SYMBOL(eeh_subsystem_enabled);
 
 /*
@@ -364,7 +365,7 @@ int eeh_dev_check_failure(struct eeh_dev *edev)
 
         eeh_stats.total_mmio_ffs++;
 
-        if (!eeh_subsystem_enabled)
+        if (!eeh_enabled())
                 return 0;
 
         if (!edev) {
@@ -747,6 +748,17 @@ int __exit eeh_ops_unregister(const char *name)
         return -EEXIST;
 }
 
+static int eeh_reboot_notifier(struct notifier_block *nb,
+                               unsigned long action, void *unused)
+{
+        eeh_set_enable(false);
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block eeh_reboot_nb = {
+        .notifier_call = eeh_reboot_notifier,
+};
+
 /**
  * eeh_init - EEH initialization
  *
@@ -778,6 +790,14 @@ int eeh_init(void)
         if (machine_is(powernv) && cnt++ <= 0)
                 return ret;
 
+        /* Register reboot notifier */
+        ret = register_reboot_notifier(&eeh_reboot_nb);
+        if (ret) {
+                pr_warn("%s: Failed to register notifier (%d)\n",
+                        __func__, ret);
+                return ret;
+        }
+
         /* call platform initialization function */
         if (!eeh_ops) {
                 pr_warning("%s: Platform EEH operation not found\n",
@@ -822,7 +842,7 @@ int eeh_init(void)
                         return ret;
         }
 
-        if (eeh_subsystem_enabled)
+        if (eeh_enabled())
                 pr_info("EEH: PCI Enhanced I/O Error Handling Enabled\n");
         else
                 pr_warning("EEH: No capable adapters found\n");
@@ -897,7 +917,7 @@ void eeh_add_device_late(struct pci_dev *dev)
         struct device_node *dn;
         struct eeh_dev *edev;
 
-        if (!dev || !eeh_subsystem_enabled)
+        if (!dev || !eeh_enabled())
                 return;
 
         pr_debug("EEH: Adding device %s\n", pci_name(dev));
@@ -1005,7 +1025,7 @@ void eeh_remove_device(struct pci_dev *dev)
 {
         struct eeh_dev *edev;
 
-        if (!dev || !eeh_subsystem_enabled)
+        if (!dev || !eeh_enabled())
                 return;
         edev = pci_dev_to_eeh_dev(dev);
 
@@ -1045,7 +1065,7 @@ void eeh_remove_device(struct pci_dev *dev)
 
 static int proc_eeh_show(struct seq_file *m, void *v)
 {
-        if (0 == eeh_subsystem_enabled) {
+        if (!eeh_enabled()) {
                 seq_printf(m, "EEH Subsystem is globally disabled\n");
                 seq_printf(m, "eeh_total_mmio_ffs=%llu\n", eeh_stats.total_mmio_ffs);
         } else {
diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
index 9b27b293a922..b0ded97ee4e1 100644
--- a/arch/powerpc/kernel/ftrace.c
+++ b/arch/powerpc/kernel/ftrace.c
@@ -74,6 +74,7 @@ ftrace_modify_code(unsigned long ip, unsigned int old, unsigned int new)
  */
 static int test_24bit_addr(unsigned long ip, unsigned long addr)
 {
+        addr = ppc_function_entry((void *)addr);
 
         /* use the create_branch to verify that this offset can be branched */
         return create_branch((unsigned int *)ip, addr, 0);
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index 879f09620f83..7c6bb4b17b49 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -57,11 +57,14 @@ _GLOBAL(call_do_softirq)
         mtlr    r0
         blr
 
+/*
+ * void call_do_irq(struct pt_regs *regs, struct thread_info *irqtp);
+ */
 _GLOBAL(call_do_irq)
         mflr    r0
         stw     r0,4(r1)
         lwz     r10,THREAD+KSP_LIMIT(r2)
-        addi    r11,r3,THREAD_INFO_GAP
+        addi    r11,r4,THREAD_INFO_GAP
         stwu    r1,THREAD_SIZE-STACK_FRAME_OVERHEAD(r4)
         mr      r1,r4
         stw     r10,8(r1)
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 8d4c247f1738..af064d28b365 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1048,6 +1048,15 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
         flush_altivec_to_thread(src);
         flush_vsx_to_thread(src);
         flush_spe_to_thread(src);
+        /*
+         * Flush TM state out so we can copy it.  __switch_to_tm() does this
+         * flush but it removes the checkpointed state from the current CPU and
+         * transitions the CPU out of TM mode.  Hence we need to call
+         * tm_recheckpoint_new_task() (on the same task) to restore the
+         * checkpointed state back and the TM mode.
+         */
+        __switch_to_tm(src);
+        tm_recheckpoint_new_task(src);
 
         *dst = *src;
 
diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S
index 1482327cfeba..d88736fbece6 100644
--- a/arch/powerpc/kernel/reloc_64.S
+++ b/arch/powerpc/kernel/reloc_64.S
@@ -81,6 +81,7 @@ _GLOBAL(relocate)
 
 6:      blr
 
+.balign 8
 p_dyn:  .llong  __dynamic_start - 0b
 p_rela: .llong  __rela_dyn_start - 0b
 p_st:   .llong  _stext - 0b
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index e35bf773df7a..8d253c29649b 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -65,8 +65,8 @@ struct rt_sigframe {
         struct siginfo __user *pinfo;
         void __user *puc;
         struct siginfo info;
-        /* 64 bit ABI allows for 288 bytes below sp before decrementing it. */
-        char abigap[288];
+        /* New 64 bit little-endian ABI allows redzone of 512 bytes below sp */
+        char abigap[USER_REDZONE_SIZE];
 } __attribute__ ((aligned (16)));
 
 static const char fmt32[] = KERN_INFO \
diff --git a/arch/powerpc/kernel/vdso32/vdso32_wrapper.S b/arch/powerpc/kernel/vdso32/vdso32_wrapper.S
index 79683d0393f5..6ac107ac402a 100644
--- a/arch/powerpc/kernel/vdso32/vdso32_wrapper.S
+++ b/arch/powerpc/kernel/vdso32/vdso32_wrapper.S
@@ -6,7 +6,7 @@
         .globl vdso32_start, vdso32_end
         .balign PAGE_SIZE
 vdso32_start:
-        .incbin "arch/powerpc/kernel/vdso32/vdso32.so"
+        .incbin "arch/powerpc/kernel/vdso32/vdso32.so.dbg"
         .balign PAGE_SIZE
 vdso32_end:
 
diff --git a/arch/powerpc/kernel/vdso64/vdso64_wrapper.S b/arch/powerpc/kernel/vdso64/vdso64_wrapper.S
index 8df9e2463007..df60fca6a13d 100644
--- a/arch/powerpc/kernel/vdso64/vdso64_wrapper.S
+++ b/arch/powerpc/kernel/vdso64/vdso64_wrapper.S
@@ -6,7 +6,7 @@
         .globl vdso64_start, vdso64_end
         .balign PAGE_SIZE
 vdso64_start:
-        .incbin "arch/powerpc/kernel/vdso64/vdso64.so"
+        .incbin "arch/powerpc/kernel/vdso64/vdso64.so.dbg"
         .balign PAGE_SIZE
 vdso64_end:
 
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 65b7b65e8708..62bf5e8e78da 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -510,7 +510,8 @@ int pmdp_set_access_flags(struct vm_area_struct *vma, unsigned long address,
 }
 
 unsigned long pmd_hugepage_update(struct mm_struct *mm, unsigned long addr,
-                                  pmd_t *pmdp, unsigned long clr)
+                                  pmd_t *pmdp, unsigned long clr,
+                                  unsigned long set)
 {
 
         unsigned long old, tmp;
@@ -526,14 +527,15 @@ unsigned long pmd_hugepage_update(struct mm_struct *mm, unsigned long addr,
                 andi.   %1,%0,%6\n\
                 bne-    1b \n\
                 andc    %1,%0,%4 \n\
+                or      %1,%1,%7\n\
                 stdcx.  %1,0,%3 \n\
                 bne-    1b"
         : "=&r" (old), "=&r" (tmp), "=m" (*pmdp)
-        : "r" (pmdp), "r" (clr), "m" (*pmdp), "i" (_PAGE_BUSY)
+        : "r" (pmdp), "r" (clr), "m" (*pmdp), "i" (_PAGE_BUSY), "r" (set)
         : "cc" );
 #else
         old = pmd_val(*pmdp);
-        *pmdp = __pmd(old & ~clr);
+        *pmdp = __pmd((old & ~clr) | set);
 #endif
         if (old & _PAGE_HASHPTE)
                 hpte_do_hugepage_flush(mm, addr, pmdp);
@@ -708,7 +710,7 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
 void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
                      pmd_t *pmdp)
 {
-        pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_PRESENT);
+        pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_PRESENT, 0);
 }
 
 /*
@@ -835,7 +837,7 @@ pmd_t pmdp_get_and_clear(struct mm_struct *mm,
         unsigned long old;
         pgtable_t *pgtable_slot;
 
-        old = pmd_hugepage_update(mm, addr, pmdp, ~0UL);
+        old = pmd_hugepage_update(mm, addr, pmdp, ~0UL, 0);
         old_pmd = __pmd(old);
         /*
          * We have pmd == none and we are holding page_table_lock.
diff --git a/arch/powerpc/mm/subpage-prot.c b/arch/powerpc/mm/subpage-prot.c
index a770df2dae70..6c0b1f5f8d2c 100644
--- a/arch/powerpc/mm/subpage-prot.c
+++ b/arch/powerpc/mm/subpage-prot.c
@@ -78,7 +78,7 @@ static void hpte_flush_range(struct mm_struct *mm, unsigned long addr,
         pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
         arch_enter_lazy_mmu_mode();
         for (; npages > 0; --npages) {
-                pte_update(mm, addr, pte, 0, 0);
+                pte_update(mm, addr, pte, 0, 0, 0);
                 addr += PAGE_SIZE;
                 ++pte;
         }
diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
index e1e71618b70c..253fefe3d1a0 100644
--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
+++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
@@ -44,7 +44,8 @@ static int ioda_eeh_event(struct notifier_block *nb,
 
         /* We simply send special EEH event */
         if ((changed_evts & OPAL_EVENT_PCI_ERROR) &&
-            (events & OPAL_EVENT_PCI_ERROR))
+            (events & OPAL_EVENT_PCI_ERROR) &&
+            eeh_enabled())
                 eeh_send_failure_event(NULL);
 
         return 0;
@@ -113,6 +114,7 @@ DEFINE_SIMPLE_ATTRIBUTE(ioda_eeh_inbB_dbgfs_ops, ioda_eeh_inbB_dbgfs_get,
                         ioda_eeh_inbB_dbgfs_set, "0x%llx\n");
 #endif /* CONFIG_DEBUG_FS */
 
+
 /**
  * ioda_eeh_post_init - Chip dependent post initialization
  * @hose: PCI controller
@@ -220,6 +222,22 @@ static int ioda_eeh_set_option(struct eeh_pe *pe, int option)
         return ret;
 }
 
+static void ioda_eeh_phb_diag(struct pci_controller *hose)
+{
+        struct pnv_phb *phb = hose->private_data;
+        long rc;
+
+        rc = opal_pci_get_phb_diag_data2(phb->opal_id, phb->diag.blob,
+                                         PNV_PCI_DIAG_BUF_SIZE);
+        if (rc != OPAL_SUCCESS) {
+                pr_warning("%s: Failed to get diag-data for PHB#%x (%ld)\n",
+                            __func__, hose->global_number, rc);
+                return;
+        }
+
+        pnv_pci_dump_phb_diag_data(hose, phb->diag.blob);
+}
+
 /**
  * ioda_eeh_get_state - Retrieve the state of PE
  * @pe: EEH PE
@@ -271,6 +289,9 @@ static int ioda_eeh_get_state(struct eeh_pe *pe)
                         result |= EEH_STATE_DMA_ACTIVE;
                         result |= EEH_STATE_MMIO_ENABLED;
                         result |= EEH_STATE_DMA_ENABLED;
+                } else if (!(pe->state & EEH_PE_ISOLATED)) {
+                        eeh_pe_state_mark(pe, EEH_PE_ISOLATED);
+                        ioda_eeh_phb_diag(hose);
                 }
 
                 return result;
@@ -314,6 +335,15 @@ static int ioda_eeh_get_state(struct eeh_pe *pe)
                            __func__, fstate, hose->global_number, pe_no);
         }
 
+        /* Dump PHB diag-data for frozen PE */
+        if (result != EEH_STATE_NOT_SUPPORT &&
+            (result & (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE)) !=
+            (EEH_STATE_MMIO_ACTIVE | EEH_STATE_DMA_ACTIVE) &&
+            !(pe->state & EEH_PE_ISOLATED)) {
+                eeh_pe_state_mark(pe, EEH_PE_ISOLATED);
+                ioda_eeh_phb_diag(hose);
+        }
+
         return result;
 }
 
@@ -489,8 +519,7 @@ static int ioda_eeh_bridge_reset(struct pci_controller *hose,
 static int ioda_eeh_reset(struct eeh_pe *pe, int option)
 {
         struct pci_controller *hose = pe->phb;
-        struct eeh_dev *edev;
-        struct pci_dev *dev;
+        struct pci_bus *bus;
         int ret;
 
         /*
@@ -519,73 +548,17 @@ static int ioda_eeh_reset(struct eeh_pe *pe, int option)
         if (pe->type & EEH_PE_PHB) {
                 ret = ioda_eeh_phb_reset(hose, option);
         } else {
-                if (pe->type & EEH_PE_DEVICE) {
-                        /*
-                         * If it's device PE, we didn't refer to the parent
-                         * PCI bus yet. So we have to figure it out indirectly.
-                         */
-                        edev = list_first_entry(&pe->edevs,
-                                        struct eeh_dev, list);
-                        dev = eeh_dev_to_pci_dev(edev);
-                        dev = dev->bus->self;
-                } else {
-                        /*
-                         * If it's bus PE, the parent PCI bus is already there
-                         * and just pick it up.
-                         */
-                        dev = pe->bus->self;
-                }
-
-                /*
-                 * Do reset based on the fact that the direct upstream bridge
-                 * is root bridge (port) or not.
-                 */
-                if (dev->bus->number == 0)
+                bus = eeh_pe_bus_get(pe);
+                if (pci_is_root_bus(bus))
                         ret = ioda_eeh_root_reset(hose, option);
                 else
-                        ret = ioda_eeh_bridge_reset(hose, dev, option);
+                        ret = ioda_eeh_bridge_reset(hose, bus->self, option);
         }
 
         return ret;
 }
 
 /**
- * ioda_eeh_get_log - Retrieve error log
- * @pe: EEH PE
- * @severity: Severity level of the log
- * @drv_log: buffer to store the log
- * @len: space of the log buffer
- *
- * The function is used to retrieve error log from P7IOC.
- */
-static int ioda_eeh_get_log(struct eeh_pe *pe, int severity,
-                            char *drv_log, unsigned long len)
-{
-        s64 ret;
-        unsigned long flags;
-        struct pci_controller *hose = pe->phb;
-        struct pnv_phb *phb = hose->private_data;
-
-        spin_lock_irqsave(&phb->lock, flags);
-
-        ret = opal_pci_get_phb_diag_data2(phb->opal_id,
-                        phb->diag.blob, PNV_PCI_DIAG_BUF_SIZE);
-        if (ret) {
-                spin_unlock_irqrestore(&phb->lock, flags);
-                pr_warning("%s: Can't get log for PHB#%x-PE#%x (%lld)\n",
-                           __func__, hose->global_number, pe->addr, ret);
-                return -EIO;
-        }
-
-        /* The PHB diag-data is always indicative */
-        pnv_pci_dump_phb_diag_data(hose, phb->diag.blob);
-
-        spin_unlock_irqrestore(&phb->lock, flags);
-
-        return 0;
-}
-
-/**
  * ioda_eeh_configure_bridge - Configure the PCI bridges for the indicated PE
  * @pe: EEH PE
  *
@@ -666,22 +639,6 @@ static void ioda_eeh_hub_diag(struct pci_controller *hose)
         }
 }
 
-static void ioda_eeh_phb_diag(struct pci_controller *hose)
-{
-        struct pnv_phb *phb = hose->private_data;
-        long rc;
-
-        rc = opal_pci_get_phb_diag_data2(phb->opal_id, phb->diag.blob,
-                                         PNV_PCI_DIAG_BUF_SIZE);
-        if (rc != OPAL_SUCCESS) {
-                pr_warning("%s: Failed to get diag-data for PHB#%x (%ld)\n",
-                            __func__, hose->global_number, rc);
-                return;
-        }
-
-        pnv_pci_dump_phb_diag_data(hose, phb->diag.blob);
-}
-
 static int ioda_eeh_get_phb_pe(struct pci_controller *hose,
                                struct eeh_pe **pe)
 {
@@ -855,6 +812,20 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
                 }
 
                 /*
+                 * EEH core will try recover from fenced PHB or
+                 * frozen PE. In the time for frozen PE, EEH core
+                 * enable IO path for that before collecting logs,
+                 * but it ruins the site. So we have to dump the
+                 * log in advance here.
+                 */
+                if ((ret == EEH_NEXT_ERR_FROZEN_PE  ||
+                    ret == EEH_NEXT_ERR_FENCED_PHB) &&
+                    !((*pe)->state & EEH_PE_ISOLATED)) {
+                        eeh_pe_state_mark(*pe, EEH_PE_ISOLATED);
+                        ioda_eeh_phb_diag(hose);
+                }
+
+                /*
                  * If we have no errors on the specific PHB or only
                  * informative error there, we continue poking it.
                  * Otherwise, we need actions to be taken by upper
@@ -872,7 +843,6 @@ struct pnv_eeh_ops ioda_eeh_ops = {
         .set_option             = ioda_eeh_set_option,
         .get_state              = ioda_eeh_get_state,
         .reset                  = ioda_eeh_reset,
-        .get_log                = ioda_eeh_get_log,
         .configure_bridge       = ioda_eeh_configure_bridge,
         .next_error             = ioda_eeh_next_error
 };
diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
index a79fddc5e74e..a59788e83b8b 100644
--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
@@ -145,7 +145,7 @@ static int powernv_eeh_dev_probe(struct pci_dev *dev, void *flag)
          * Enable EEH explicitly so that we will do EEH check
          * while accessing I/O stuff
          */
-        eeh_subsystem_enabled = 1;
+        eeh_set_enable(true);
 
         /* Save memory bars */
         eeh_save_bars(edev);
diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c
index 4fbf276ac99e..4cd2ea6c0dbe 100644
--- a/arch/powerpc/platforms/powernv/opal-xscom.c
+++ b/arch/powerpc/platforms/powernv/opal-xscom.c
@@ -71,11 +71,11 @@ static int opal_xscom_err_xlate(int64_t rc)
         }
 }
 
-static u64 opal_scom_unmangle(u64 reg)
+static u64 opal_scom_unmangle(u64 addr)
 {
         /*
          * XSCOM indirect addresses have the top bit set. Additionally
-         * the reset of the top 3 nibbles is always 0.
+         * the rest of the top 3 nibbles is always 0.
          *
          * Because the debugfs interface uses signed offsets and shifts
          * the address left by 3, we basically cannot use the top 4 bits
@@ -86,10 +86,13 @@ static u64 opal_scom_unmangle(u64 reg)
          * conversion here. To leave room for further xscom address
          * expansion, we only clear out the top byte
          *
+         * For in-kernel use, we also support the real indirect bit, so
+         * we test for any of the top 5 bits
+         *
          */
-        if (reg & (1ull << 59))
-                reg = (reg & ~(0xffull << 56)) | (1ull << 63);
-        return reg;
+        if (addr & (0x1full << 59))
+                addr = (addr & ~(0xffull << 56)) | (1ull << 63);
+        return addr;
 }
 
 static int opal_scom_read(scom_map_t map, u64 reg, u64 *value)
@@ -98,8 +101,8 @@ static int opal_scom_read(scom_map_t map, u64 reg, u64 *value)
         int64_t rc;
         __be64 v;
 
-        reg = opal_scom_unmangle(reg);
-        rc = opal_xscom_read(m->chip, m->addr + reg, (__be64 *)__pa(&v));
+        reg = opal_scom_unmangle(m->addr + reg);
+        rc = opal_xscom_read(m->chip, reg, (__be64 *)__pa(&v));
         *value = be64_to_cpu(v);
         return opal_xscom_err_xlate(rc);
 }
@@ -109,8 +112,8 @@ static int opal_scom_write(scom_map_t map, u64 reg, u64 value)
         struct opal_scom_map *m = map;
         int64_t rc;
 
-        reg = opal_scom_unmangle(reg);
-        rc = opal_xscom_write(m->chip, m->addr + reg, value);
+        reg = opal_scom_unmangle(m->addr + reg);
+        rc = opal_xscom_write(m->chip, reg, value);
         return opal_xscom_err_xlate(rc);
 }
 
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index 95633d79ef5d..8518817dcdfd 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -134,57 +134,72 @@ static void pnv_pci_dump_p7ioc_diag_data(struct pci_controller *hose,
         pr_info("P7IOC PHB#%d Diag-data (Version: %d)\n\n",
                 hose->global_number, common->version);
 
-        pr_info("  brdgCtl:              %08x\n", data->brdgCtl);
-
-        pr_info("  portStatusReg:        %08x\n", data->portStatusReg);
-        pr_info("  rootCmplxStatus:      %08x\n", data->rootCmplxStatus);
-        pr_info("  busAgentStatus:       %08x\n", data->busAgentStatus);
-
-        pr_info("  deviceStatus:         %08x\n", data->deviceStatus);
-        pr_info("  slotStatus:           %08x\n", data->slotStatus);
-        pr_info("  linkStatus:           %08x\n", data->linkStatus);
-        pr_info("  devCmdStatus:         %08x\n", data->devCmdStatus);
-        pr_info("  devSecStatus:         %08x\n", data->devSecStatus);
-
-        pr_info("  rootErrorStatus:      %08x\n", data->rootErrorStatus);
-        pr_info("  uncorrErrorStatus:    %08x\n", data->uncorrErrorStatus);
-        pr_info("  corrErrorStatus:      %08x\n", data->corrErrorStatus);
-        pr_info("  tlpHdr1:              %08x\n", data->tlpHdr1);
-        pr_info("  tlpHdr2:              %08x\n", data->tlpHdr2);
-        pr_info("  tlpHdr3:              %08x\n", data->tlpHdr3);
-        pr_info("  tlpHdr4:              %08x\n", data->tlpHdr4);
-        pr_info("  sourceId:             %08x\n", data->sourceId);
-        pr_info("  errorClass:           %016llx\n", data->errorClass);
-        pr_info("  correlator:           %016llx\n", data->correlator);
-        pr_info("  p7iocPlssr:           %016llx\n", data->p7iocPlssr);
-        pr_info("  p7iocCsr:             %016llx\n", data->p7iocCsr);
-        pr_info("  lemFir:               %016llx\n", data->lemFir);
-        pr_info("  lemErrorMask:         %016llx\n", data->lemErrorMask);
-        pr_info("  lemWOF:               %016llx\n", data->lemWOF);
-        pr_info("  phbErrorStatus:       %016llx\n", data->phbErrorStatus);
-        pr_info("  phbFirstErrorStatus:  %016llx\n", data->phbFirstErrorStatus);
-        pr_info("  phbErrorLog0:         %016llx\n", data->phbErrorLog0);
-        pr_info("  phbErrorLog1:         %016llx\n", data->phbErrorLog1);
-        pr_info("  mmioErrorStatus:      %016llx\n", data->mmioErrorStatus);
-        pr_info("  mmioFirstErrorStatus: %016llx\n", data->mmioFirstErrorStatus);
-        pr_info("  mmioErrorLog0:        %016llx\n", data->mmioErrorLog0);
-        pr_info("  mmioErrorLog1:        %016llx\n", data->mmioErrorLog1);
-        pr_info("  dma0ErrorStatus:      %016llx\n", data->dma0ErrorStatus);
-        pr_info("  dma0FirstErrorStatus: %016llx\n", data->dma0FirstErrorStatus);
-        pr_info("  dma0ErrorLog0:        %016llx\n", data->dma0ErrorLog0);
-        pr_info("  dma0ErrorLog1:        %016llx\n", data->dma0ErrorLog1);
-        pr_info("  dma1ErrorStatus:      %016llx\n", data->dma1ErrorStatus);
-        pr_info("  dma1FirstErrorStatus: %016llx\n", data->dma1FirstErrorStatus);
-        pr_info("  dma1ErrorLog0:        %016llx\n", data->dma1ErrorLog0);
-        pr_info("  dma1ErrorLog1:        %016llx\n", data->dma1ErrorLog1);
+        if (data->brdgCtl)
+                pr_info("  brdgCtl:     %08x\n",
+                        data->brdgCtl);
+        if (data->portStatusReg || data->rootCmplxStatus ||
+            data->busAgentStatus)
+                pr_info("  UtlSts:      %08x %08x %08x\n",
+                        data->portStatusReg, data->rootCmplxStatus,
+                        data->busAgentStatus);
+        if (data->deviceStatus || data->slotStatus   ||
+            data->linkStatus   || data->devCmdStatus ||
+            data->devSecStatus)
+                pr_info("  RootSts:     %08x %08x %08x %08x %08x\n",
+                        data->deviceStatus, data->slotStatus,
+                        data->linkStatus, data->devCmdStatus,
+                        data->devSecStatus);
+        if (data->rootErrorStatus   || data->uncorrErrorStatus ||
+            data->corrErrorStatus)
+                pr_info("  RootErrSts:  %08x %08x %08x\n",
+                        data->rootErrorStatus, data->uncorrErrorStatus,
+                        data->corrErrorStatus);
+        if (data->tlpHdr1 || data->tlpHdr2 ||
+            data->tlpHdr3 || data->tlpHdr4)
+                pr_info("  RootErrLog:  %08x %08x %08x %08x\n",
+                        data->tlpHdr1, data->tlpHdr2,
+                        data->tlpHdr3, data->tlpHdr4);
+        if (data->sourceId || data->errorClass ||
+            data->correlator)
+                pr_info("  RootErrLog1: %08x %016llx %016llx\n",
+                        data->sourceId, data->errorClass,
+                        data->correlator);
+        if (data->p7iocPlssr || data->p7iocCsr)
+                pr_info("  PhbSts:      %016llx %016llx\n",
+                        data->p7iocPlssr, data->p7iocCsr);
+        if (data->lemFir || data->lemErrorMask ||
+            data->lemWOF)
+                pr_info("  Lem:         %016llx %016llx %016llx\n",
+                        data->lemFir, data->lemErrorMask,
+                        data->lemWOF);
+        if (data->phbErrorStatus || data->phbFirstErrorStatus ||
+            data->phbErrorLog0   || data->phbErrorLog1)
+                pr_info("  PhbErr:      %016llx %016llx %016llx %016llx\n",
+                        data->phbErrorStatus, data->phbFirstErrorStatus,
+                        data->phbErrorLog0, data->phbErrorLog1);
+        if (data->mmioErrorStatus || data->mmioFirstErrorStatus ||
+            data->mmioErrorLog0   || data->mmioErrorLog1)
+                pr_info("  OutErr:      %016llx %016llx %016llx %016llx\n",
+                        data->mmioErrorStatus, data->mmioFirstErrorStatus,
+                        data->mmioErrorLog0, data->mmioErrorLog1);
+        if (data->dma0ErrorStatus || data->dma0FirstErrorStatus ||
+            data->dma0ErrorLog0   || data->dma0ErrorLog1)
+                pr_info("  InAErr:      %016llx %016llx %016llx %016llx\n",
+                        data->dma0ErrorStatus, data->dma0FirstErrorStatus,
+                        data->dma0ErrorLog0, data->dma0ErrorLog1);
+        if (data->dma1ErrorStatus || data->dma1FirstErrorStatus ||
+            data->dma1ErrorLog0   || data->dma1ErrorLog1)
+                pr_info("  InBErr:      %016llx %016llx %016llx %016llx\n",
+                        data->dma1ErrorStatus, data->dma1FirstErrorStatus,
+                        data->dma1ErrorLog0, data->dma1ErrorLog1);
 
         for (i = 0; i < OPAL_P7IOC_NUM_PEST_REGS; i++) {
                 if ((data->pestA[i] >> 63) == 0 &&
                     (data->pestB[i] >> 63) == 0)
                         continue;
 
-                pr_info("  PE[%3d] PESTA:        %016llx\n", i, data->pestA[i]);
-                pr_info("          PESTB:        %016llx\n", data->pestB[i]);
+                pr_info("  PE[%3d] A/B: %016llx %016llx\n",
+                        i, data->pestA[i], data->pestB[i]);
         }
 }
 
@@ -197,62 +212,77 @@ static void pnv_pci_dump_phb3_diag_data(struct pci_controller *hose,
         data = (struct OpalIoPhb3ErrorData*)common;
         pr_info("PHB3 PHB#%d Diag-data (Version: %d)\n\n",
                 hose->global_number, common->version);
-
-        pr_info("  brdgCtl:              %08x\n", data->brdgCtl);
-
-        pr_info("  portStatusReg:        %08x\n", data->portStatusReg);
-        pr_info("  rootCmplxStatus:      %08x\n", data->rootCmplxStatus);
-        pr_info("  busAgentStatus:       %08x\n", data->busAgentStatus);
-
-        pr_info("  deviceStatus:         %08x\n", data->deviceStatus);
-        pr_info("  slotStatus:           %08x\n", data->slotStatus);
-        pr_info("  linkStatus:           %08x\n", data->linkStatus);
-        pr_info("  devCmdStatus:         %08x\n", data->devCmdStatus);
-        pr_info("  devSecStatus:         %08x\n", data->devSecStatus);
-
-        pr_info("  rootErrorStatus:      %08x\n", data->rootErrorStatus);
-        pr_info("  uncorrErrorStatus:    %08x\n", data->uncorrErrorStatus);
-        pr_info("  corrErrorStatus:      %08x\n", data->corrErrorStatus);
-        pr_info("  tlpHdr1:              %08x\n", data->tlpHdr1);
-        pr_info("  tlpHdr2:              %08x\n", data->tlpHdr2);
-        pr_info("  tlpHdr3:              %08x\n", data->tlpHdr3);
-        pr_info("  tlpHdr4:              %08x\n", data->tlpHdr4);
-        pr_info("  sourceId:             %08x\n", data->sourceId);
-        pr_info("  errorClass:           %016llx\n", data->errorClass);
-        pr_info("  correlator:           %016llx\n", data->correlator);
-
-        pr_info("  nFir:                 %016llx\n", data->nFir);
-        pr_info("  nFirMask:             %016llx\n", data->nFirMask);
-        pr_info("  nFirWOF:              %016llx\n", data->nFirWOF);
-        pr_info("  PhbPlssr:             %016llx\n", data->phbPlssr);
-        pr_info("  PhbCsr:               %016llx\n", data->phbCsr);
-        pr_info("  lemFir:               %016llx\n", data->lemFir);
-        pr_info("  lemErrorMask:         %016llx\n", data->lemErrorMask);
-        pr_info("  lemWOF:               %016llx\n", data->lemWOF);
-        pr_info("  phbErrorStatus:       %016llx\n", data->phbErrorStatus);
-        pr_info("  phbFirstErrorStatus:  %016llx\n", data->phbFirstErrorStatus);
-        pr_info("  phbErrorLog0:         %016llx\n", data->phbErrorLog0);
-        pr_info("  phbErrorLog1:         %016llx\n", data->phbErrorLog1);
-        pr_info("  mmioErrorStatus:      %016llx\n", data->mmioErrorStatus);
-        pr_info("  mmioFirstErrorStatus: %016llx\n", data->mmioFirstErrorStatus);
-        pr_info("  mmioErrorLog0:        %016llx\n", data->mmioErrorLog0);
-        pr_info("  mmioErrorLog1:        %016llx\n", data->mmioErrorLog1);
-        pr_info("  dma0ErrorStatus:      %016llx\n", data->dma0ErrorStatus);
-        pr_info("  dma0FirstErrorStatus: %016llx\n", data->dma0FirstErrorStatus);
-        pr_info("  dma0ErrorLog0:        %016llx\n", data->dma0ErrorLog0);
-        pr_info("  dma0ErrorLog1:        %016llx\n", data->dma0ErrorLog1);
-        pr_info("  dma1ErrorStatus:      %016llx\n", data->dma1ErrorStatus);
-        pr_info("  dma1FirstErrorStatus: %016llx\n", data->dma1FirstErrorStatus);
-        pr_info("  dma1ErrorLog0:        %016llx\n", data->dma1ErrorLog0);
-        pr_info("  dma1ErrorLog1:        %016llx\n", data->dma1ErrorLog1);
+        if (data->brdgCtl)
+                pr_info("  brdgCtl:     %08x\n",
+                        data->brdgCtl);
+        if (data->portStatusReg || data->rootCmplxStatus ||
+            data->busAgentStatus)
+                pr_info("  UtlSts:      %08x %08x %08x\n",
+                        data->portStatusReg, data->rootCmplxStatus,
+                        data->busAgentStatus);
+        if (data->deviceStatus || data->slotStatus   ||
+            data->linkStatus   || data->devCmdStatus ||
+            data->devSecStatus)
+                pr_info("  RootSts:     %08x %08x %08x %08x %08x\n",
+                        data->deviceStatus, data->slotStatus,
+                        data->linkStatus, data->devCmdStatus,
+                        data->devSecStatus);
+        if (data->rootErrorStatus || data->uncorrErrorStatus ||
+            data->corrErrorStatus)
+                pr_info("  RootErrSts:  %08x %08x %08x\n",
+                        data->rootErrorStatus, data->uncorrErrorStatus,
+                        data->corrErrorStatus);
+        if (data->tlpHdr1 || data->tlpHdr2 ||
+            data->tlpHdr3 || data->tlpHdr4)
+                pr_info("  RootErrLog:  %08x %08x %08x %08x\n",
+                        data->tlpHdr1, data->tlpHdr2,
+                        data->tlpHdr3, data->tlpHdr4);
+        if (data->sourceId || data->errorClass ||
+            data->correlator)
+                pr_info("  RootErrLog1: %08x %016llx %016llx\n",
+                        data->sourceId, data->errorClass,
+                        data->correlator);
+        if (data->nFir || data->nFirMask ||
+            data->nFirWOF)
+                pr_info("  nFir:        %016llx %016llx %016llx\n",
+                        data->nFir, data->nFirMask,
+                        data->nFirWOF);
+        if (data->phbPlssr || data->phbCsr)
+                pr_info("  PhbSts:      %016llx %016llx\n",
+                        data->phbPlssr, data->phbCsr);
+        if (data->lemFir || data->lemErrorMask ||
+            data->lemWOF)
+                pr_info("  Lem:         %016llx %016llx %016llx\n",
+                        data->lemFir, data->lemErrorMask,
+                        data->lemWOF);
+        if (data->phbErrorStatus || data->phbFirstErrorStatus ||
+            data->phbErrorLog0   || data->phbErrorLog1)
+                pr_info("  PhbErr:      %016llx %016llx %016llx %016llx\n",
+                        data->phbErrorStatus, data->phbFirstErrorStatus,
+                        data->phbErrorLog0, data->phbErrorLog1);
+        if (data->mmioErrorStatus || data->mmioFirstErrorStatus ||
+            data->mmioErrorLog0   || data->mmioErrorLog1)
+                pr_info("  OutErr:      %016llx %016llx %016llx %016llx\n",
+                        data->mmioErrorStatus, data->mmioFirstErrorStatus,
+                        data->mmioErrorLog0, data->mmioErrorLog1);
+        if (data->dma0ErrorStatus || data->dma0FirstErrorStatus ||
+            data->dma0ErrorLog0   || data->dma0ErrorLog1)
+                pr_info("  InAErr:      %016llx %016llx %016llx %016llx\n",
+                        data->dma0ErrorStatus, data->dma0FirstErrorStatus,
+                        data->dma0ErrorLog0, data->dma0ErrorLog1);
+        if (data->dma1ErrorStatus || data->dma1FirstErrorStatus ||
+            data->dma1ErrorLog0   || data->dma1ErrorLog1)
+                pr_info("  InBErr:      %016llx %016llx %016llx %016llx\n",
+                        data->dma1ErrorStatus, data->dma1FirstErrorStatus,
+                        data->dma1ErrorLog0, data->dma1ErrorLog1);
 
         for (i = 0; i < OPAL_PHB3_NUM_PEST_REGS; i++) {
                 if ((data->pestA[i] >> 63) == 0 &&
                     (data->pestB[i] >> 63) == 0)
                         continue;
 
-                pr_info("  PE[%3d] PESTA:        %016llx\n", i, data->pestA[i]);
-                pr_info("          PESTB:        %016llx\n", data->pestB[i]);
+                pr_info("  PE[%3d] A/B: %016llx %016llx\n",
+                        i, data->pestA[i], data->pestB[i]);
         }
 }
 
diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
index 9ef3cc8ebc11..8a8f0472d98f 100644
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -265,7 +265,7 @@ static void *pseries_eeh_of_probe(struct device_node *dn, void *flag)
                         enable = 1;
 
                 if (enable) {
-                        eeh_subsystem_enabled = 1;
+                        eeh_set_enable(true);
                         eeh_add_to_parent_pe(edev);
 
                         pr_debug("%s: EEH enabled on %s PHB#%d-PE#%x, config addr#%x\n",
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index 82789e79e539..0ea99e3d4815 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -35,12 +35,7 @@
 #include "offline_states.h"
 
 /* This version can't take the spinlock, because it never returns */
-static struct rtas_args rtas_stop_self_args = {
-        .token = RTAS_UNKNOWN_SERVICE,
-        .nargs = 0,
-        .nret = 1,
-        .rets = &rtas_stop_self_args.args[0],
-};
+static int rtas_stop_self_token = RTAS_UNKNOWN_SERVICE;
 
 static DEFINE_PER_CPU(enum cpu_state_vals, preferred_offline_state) =
                                                         CPU_STATE_OFFLINE;
@@ -93,15 +88,20 @@ void set_default_offline_state(int cpu)
 
 static void rtas_stop_self(void)
 {
-        struct rtas_args *args = &rtas_stop_self_args;
+        struct rtas_args args = {
+                .token = cpu_to_be32(rtas_stop_self_token),
+                .nargs = 0,
+                .nret = 1,
+                .rets = &args.args[0],
+        };
 
         local_irq_disable();
 
-        BUG_ON(args->token == RTAS_UNKNOWN_SERVICE);
+        BUG_ON(rtas_stop_self_token == RTAS_UNKNOWN_SERVICE);
 
         printk("cpu %u (hwid %u) Ready to die...\n",
                smp_processor_id(), hard_smp_processor_id());
-        enter_rtas(__pa(args));
+        enter_rtas(__pa(&args));
 
         panic("Alas, I survived.\n");
 }
@@ -392,10 +392,10 @@ static int __init pseries_cpu_hotplug_init(void)
                 }
         }
 
-        rtas_stop_self_args.token = rtas_token("stop-self");
+        rtas_stop_self_token = rtas_token("stop-self");
         qcss_tok = rtas_token("query-cpu-stopped-state");
 
-        if (rtas_stop_self_args.token == RTAS_UNKNOWN_SERVICE ||
+        if (rtas_stop_self_token == RTAS_UNKNOWN_SERVICE ||
                         qcss_tok == RTAS_UNKNOWN_SERVICE) {
                 printk(KERN_INFO "CPU Hotplug not supported by firmware "
                                 "- disabling.\n");
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index 70670a2d9cf2..c413ec158ff5 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -113,7 +113,8 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
 {
         struct device_node *dn, *pdn;
         struct pci_bus *bus;
-        const __be32 *pcie_link_speed_stats;
+        u32 pcie_link_speed_stats[2];
+        int rc;
 
         bus = bridge->bus;
 
@@ -122,38 +123,45 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
                 return 0;
 
         for (pdn = dn; pdn != NULL; pdn = of_get_next_parent(pdn)) {
-                pcie_link_speed_stats = of_get_property(pdn,
-                        "ibm,pcie-link-speed-stats", NULL);
-                if (pcie_link_speed_stats)
+                rc = of_property_read_u32_array(pdn,
+                                "ibm,pcie-link-speed-stats",
+                                &pcie_link_speed_stats[0], 2);
+                if (!rc)
                         break;
         }
 
         of_node_put(pdn);
 
-        if (!pcie_link_speed_stats) {
+        if (rc) {
                 pr_err("no ibm,pcie-link-speed-stats property\n");
                 return 0;
         }
 
-        switch (be32_to_cpup(pcie_link_speed_stats)) {
+        switch (pcie_link_speed_stats[0]) {
         case 0x01:
                 bus->max_bus_speed = PCIE_SPEED_2_5GT;
                 break;
         case 0x02:
                 bus->max_bus_speed = PCIE_SPEED_5_0GT;
                 break;
+        case 0x04:
+                bus->max_bus_speed = PCIE_SPEED_8_0GT;
+                break;
         default:
                 bus->max_bus_speed = PCI_SPEED_UNKNOWN;
                 break;
         }
 
-        switch (be32_to_cpup(pcie_link_speed_stats)) {
+        switch (pcie_link_speed_stats[1]) {
         case 0x01:
                 bus->cur_bus_speed = PCIE_SPEED_2_5GT;
                 break;
         case 0x02:
                 bus->cur_bus_speed = PCIE_SPEED_5_0GT;
                 break;
+        case 0x04:
+                bus->cur_bus_speed = PCIE_SPEED_8_0GT;
+                break;
         default:
                 bus->cur_bus_speed = PCI_SPEED_UNKNOWN;
                 break;
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 59c8efce1b99..0248949a756d 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1421,5 +1421,5 @@ ENTRY(sys_sched_setattr_wrapper)
 ENTRY(sys_sched_getattr_wrapper)
         lgfr    %r2,%r2                 # pid_t
         llgtr   %r3,%r3                 # const char __user *
-        llgfr   %r3,%r3                 # unsigned int
+        llgfr   %r4,%r4                 # unsigned int
         jg      sys_sched_getattr
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 60c11a629d96..f91c03119804 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -206,11 +206,13 @@ static void dma_cleanup_tables(struct zpci_dev *zdev)
         zdev->dma_table = NULL;
 }
 
-static unsigned long __dma_alloc_iommu(struct zpci_dev *zdev, unsigned long start,
-                                   int size)
+static unsigned long __dma_alloc_iommu(struct zpci_dev *zdev,
+                                       unsigned long start, int size)
 {
-        unsigned long boundary_size = 0x1000000;
+        unsigned long boundary_size;
 
+        boundary_size = ALIGN(dma_get_seg_boundary(&zdev->pdev->dev) + 1,
+                              PAGE_SIZE) >> PAGE_SHIFT;
         return iommu_area_alloc(zdev->iommu_bitmap, zdev->iommu_pages,
                                 start, size, 0, boundary_size, 0);
 }
diff --git a/arch/sh/include/cpu-sh2/cpu/cache.h b/arch/sh/include/cpu-sh2/cpu/cache.h
index 673515bc4135..aa1b2b9088a7 100644
--- a/arch/sh/include/cpu-sh2/cpu/cache.h
+++ b/arch/sh/include/cpu-sh2/cpu/cache.h
@@ -18,7 +18,7 @@
 #define SH_CACHE_ASSOC          8
 
 #if defined(CONFIG_CPU_SUBTYPE_SH7619)
-#define CCR             0xffffffec
+#define SH_CCR          0xffffffec
 
 #define CCR_CACHE_CE    0x01    /* Cache enable */
 #define CCR_CACHE_WT    0x02    /* CCR[bit1=1,bit2=1] */
diff --git a/arch/sh/include/cpu-sh2a/cpu/cache.h b/arch/sh/include/cpu-sh2a/cpu/cache.h
index defb0baa5a06..b27ce92cb600 100644
--- a/arch/sh/include/cpu-sh2a/cpu/cache.h
+++ b/arch/sh/include/cpu-sh2a/cpu/cache.h
@@ -17,8 +17,8 @@
 #define SH_CACHE_COMBINED       4
 #define SH_CACHE_ASSOC          8
 
-#define CCR             0xfffc1000 /* CCR1 */
-#define CCR2            0xfffc1004
+#define SH_CCR          0xfffc1000 /* CCR1 */
+#define SH_CCR2         0xfffc1004
 
 /*
  * Most of the SH-2A CCR1 definitions resemble the SH-4 ones. All others not
diff --git a/arch/sh/include/cpu-sh3/cpu/cache.h b/arch/sh/include/cpu-sh3/cpu/cache.h
index bee2d81c56bf..29700fd88c75 100644
--- a/arch/sh/include/cpu-sh3/cpu/cache.h
+++ b/arch/sh/include/cpu-sh3/cpu/cache.h
@@ -17,7 +17,7 @@
 #define SH_CACHE_COMBINED       4
 #define SH_CACHE_ASSOC          8
 
-#define CCR             0xffffffec      /* Address of Cache Control Register */
+#define SH_CCR          0xffffffec      /* Address of Cache Control Register */
 
 #define CCR_CACHE_CE    0x01    /* Cache Enable */
 #define CCR_CACHE_WT    0x02    /* Write-Through (for P0,U0,P3) (else writeback) */
diff --git a/arch/sh/include/cpu-sh4/cpu/cache.h b/arch/sh/include/cpu-sh4/cpu/cache.h
index 7bfb9e8b069c..92c4cd119b66 100644
--- a/arch/sh/include/cpu-sh4/cpu/cache.h
+++ b/arch/sh/include/cpu-sh4/cpu/cache.h
@@ -17,7 +17,7 @@
 #define SH_CACHE_COMBINED       4
 #define SH_CACHE_ASSOC          8
 
-#define CCR             0xff00001c      /* Address of Cache Control Register */
+#define SH_CCR          0xff00001c      /* Address of Cache Control Register */
 #define CCR_CACHE_OCE   0x0001  /* Operand Cache Enable */
 #define CCR_CACHE_WT    0x0002  /* Write-Through (for P0,U0,P3) (else writeback)*/
 #define CCR_CACHE_CB    0x0004  /* Copy-Back (for P1) (else writethrough) */
diff --git a/arch/sh/kernel/cpu/init.c b/arch/sh/kernel/cpu/init.c
index ecf83cd158dc..0d7360d549c1 100644
--- a/arch/sh/kernel/cpu/init.c
+++ b/arch/sh/kernel/cpu/init.c
@@ -112,7 +112,7 @@ static void cache_init(void)
         unsigned long ccr, flags;
 
         jump_to_uncached();
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
 
         /*
          * At this point we don't know whether the cache is enabled or not - a
@@ -189,7 +189,7 @@ static void cache_init(void)
 
         l2_cache_init();
 
-        __raw_writel(flags, CCR);
+        __raw_writel(flags, SH_CCR);
         back_to_cached();
 }
 #else
diff --git a/arch/sh/mm/cache-debugfs.c b/arch/sh/mm/cache-debugfs.c
index 115725198038..777e50f33c00 100644
--- a/arch/sh/mm/cache-debugfs.c
+++ b/arch/sh/mm/cache-debugfs.c
@@ -36,7 +36,7 @@ static int cache_seq_show(struct seq_file *file, void *iter)
          */
         jump_to_uncached();
 
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
         if ((ccr & CCR_CACHE_ENABLE) == 0) {
                 back_to_cached();
 
diff --git a/arch/sh/mm/cache-sh2.c b/arch/sh/mm/cache-sh2.c
index defcf719f2e8..a74259f2f981 100644
--- a/arch/sh/mm/cache-sh2.c
+++ b/arch/sh/mm/cache-sh2.c
@@ -63,9 +63,9 @@ static void sh2__flush_invalidate_region(void *start, int size)
         local_irq_save(flags);
         jump_to_uncached();
 
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
         ccr |= CCR_CACHE_INVALIDATE;
-        __raw_writel(ccr, CCR);
+        __raw_writel(ccr, SH_CCR);
 
         back_to_cached();
         local_irq_restore(flags);
diff --git a/arch/sh/mm/cache-sh2a.c b/arch/sh/mm/cache-sh2a.c
index 949e2d3138a0..ee87d081259b 100644
--- a/arch/sh/mm/cache-sh2a.c
+++ b/arch/sh/mm/cache-sh2a.c
@@ -134,7 +134,8 @@ static void sh2a__flush_invalidate_region(void *start, int size)
 
         /* If there are too many pages then just blow the cache */
         if (((end - begin) >> PAGE_SHIFT) >= MAX_OCACHE_PAGES) {
-                __raw_writel(__raw_readl(CCR) | CCR_OCACHE_INVALIDATE, CCR);
+                __raw_writel(__raw_readl(SH_CCR) | CCR_OCACHE_INVALIDATE,
+                             SH_CCR);
         } else {
                 for (v = begin; v < end; v += L1_CACHE_BYTES)
                         sh2a_invalidate_line(CACHE_OC_ADDRESS_ARRAY, v);
@@ -167,7 +168,8 @@ static void sh2a_flush_icache_range(void *args)
         /* I-Cache invalidate */
         /* If there are too many pages then just blow the cache */
         if (((end - start) >> PAGE_SHIFT) >= MAX_ICACHE_PAGES) {
-                __raw_writel(__raw_readl(CCR) | CCR_ICACHE_INVALIDATE, CCR);
+                __raw_writel(__raw_readl(SH_CCR) | CCR_ICACHE_INVALIDATE,
+                             SH_CCR);
         } else {
                 for (v = start; v < end; v += L1_CACHE_BYTES)
                         sh2a_invalidate_line(CACHE_IC_ADDRESS_ARRAY, v);
diff --git a/arch/sh/mm/cache-sh4.c b/arch/sh/mm/cache-sh4.c
index 0e529285b28d..51d8f7f31d1d 100644
--- a/arch/sh/mm/cache-sh4.c
+++ b/arch/sh/mm/cache-sh4.c
@@ -133,9 +133,9 @@ static void flush_icache_all(void)
         jump_to_uncached();
 
         /* Flush I-cache */
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
         ccr |= CCR_CACHE_ICI;
-        __raw_writel(ccr, CCR);
+        __raw_writel(ccr, SH_CCR);
 
         /*
          * back_to_cached() will take care of the barrier for us, don't add
diff --git a/arch/sh/mm/cache-shx3.c b/arch/sh/mm/cache-shx3.c
index c0adbee97b5f..24c58b7dc022 100644
--- a/arch/sh/mm/cache-shx3.c
+++ b/arch/sh/mm/cache-shx3.c
@@ -19,7 +19,7 @@ void __init shx3_cache_init(void)
 {
         unsigned int ccr;
 
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
 
         /*
          * If we've got cache aliases, resolve them in hardware.
@@ -40,5 +40,5 @@ void __init shx3_cache_init(void)
         ccr |= CCR_CACHE_IBE;
 #endif
 
-        writel_uncached(ccr, CCR);
+        writel_uncached(ccr, SH_CCR);
 }
diff --git a/arch/sh/mm/cache.c b/arch/sh/mm/cache.c
index 616966a96cba..097c2cdd117f 100644
--- a/arch/sh/mm/cache.c
+++ b/arch/sh/mm/cache.c
@@ -285,8 +285,8 @@ void __init cpu_cache_init(void)
 {
         unsigned int cache_disabled = 0;
 
-#ifdef CCR
-        cache_disabled = !(__raw_readl(CCR) & CCR_CACHE_ENABLE);
+#ifdef SH_CCR
+        cache_disabled = !(__raw_readl(SH_CCR) & CCR_CACHE_ENABLE);
 #endif
 
         compute_alias(&boot_cpu_data.icache);
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index c51efdcd07a2..7d8b7e94b93b 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -27,7 +27,7 @@ config SPARC
         select RTC_DRV_M48T59
         select HAVE_DMA_ATTRS
         select HAVE_DMA_API_DEBUG
-        select HAVE_ARCH_JUMP_LABEL
+        select HAVE_ARCH_JUMP_LABEL if SPARC64
         select GENERIC_IRQ_SHOW
         select ARCH_WANT_IPC_PARSE_VERSION
         select GENERIC_PCI_IOMAP
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index 869023abe5a4..cfbe53c17b0d 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -14,6 +14,7 @@
 #include <linux/pagemap.h>
 #include <linux/vmalloc.h>
 #include <linux/kdebug.h>
+#include <linux/export.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/log2.h>
@@ -62,6 +63,7 @@ extern unsigned long last_valid_pfn;
 static pgd_t *srmmu_swapper_pg_dir;
 
 const struct sparc32_cachetlb_ops *sparc32_cachetlb_ops;
+EXPORT_SYMBOL(sparc32_cachetlb_ops);
 
 #ifdef CONFIG_SMP
 const struct sparc32_cachetlb_ops *local_ops;
diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
index 90a21f430117..4dbf967da50d 100644
--- a/arch/x86/boot/compressed/aslr.c
+++ b/arch/x86/boot/compressed/aslr.c
@@ -111,7 +111,7 @@ struct mem_vector {
 };
 
 #define MEM_AVOID_MAX 5
-struct mem_vector mem_avoid[MEM_AVOID_MAX];
+static struct mem_vector mem_avoid[MEM_AVOID_MAX];
 
 static bool mem_contains(struct mem_vector *region, struct mem_vector *item)
 {
@@ -180,7 +180,7 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size,
 }
 
 /* Does this memory vector overlap a known avoided area? */
-bool mem_avoid_overlap(struct mem_vector *img)
+static bool mem_avoid_overlap(struct mem_vector *img)
 {
         int i;
 
@@ -192,8 +192,9 @@ bool mem_avoid_overlap(struct mem_vector *img)
         return false;
 }
 
-unsigned long slots[CONFIG_RANDOMIZE_BASE_MAX_OFFSET / CONFIG_PHYSICAL_ALIGN];
-unsigned long slot_max = 0;
+static unsigned long slots[CONFIG_RANDOMIZE_BASE_MAX_OFFSET /
+                           CONFIG_PHYSICAL_ALIGN];
+static unsigned long slot_max;
 
 static void slots_append(unsigned long addr)
 {
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 3d6b9f81cc68..acd86c850414 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -134,6 +134,7 @@ extern void efi_setup_page_tables(void);
 extern void __init old_map_region(efi_memory_desc_t *md);
 extern void __init runtime_code_page_mkexec(void);
 extern void __init efi_runtime_mkexec(void);
+extern void __init efi_apply_memmap_quirks(void);
 
 struct efi_setup_data {
         u64 fw_vendor;
diff --git a/arch/x86/include/asm/tsc.h b/arch/x86/include/asm/tsc.h
index 57ae63cd6ee2..94605c0e9cee 100644
--- a/arch/x86/include/asm/tsc.h
+++ b/arch/x86/include/asm/tsc.h
@@ -66,6 +66,6 @@ extern void tsc_save_sched_clock_state(void);
 extern void tsc_restore_sched_clock_state(void);
 
 /* MSR based TSC calibration for Intel Atom SoC platforms */
-int try_msr_calibrate_tsc(unsigned long *fast_calibrate);
+unsigned long try_msr_calibrate_tsc(void);
 
 #endif /* _ASM_X86_TSC_H */
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index b88645191fe5..79f9f848bee4 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1192,6 +1192,9 @@ static void x86_pmu_del(struct perf_event *event, int flags)
         for (i = 0; i < cpuc->n_events; i++) {
                 if (event == cpuc->event_list[i]) {
 
+                        if (i >= cpuc->n_events - cpuc->n_added)
+                                --cpuc->n_added;
+
                         if (x86_pmu.put_event_constraints)
                                 x86_pmu.put_event_constraints(cpuc, event);
 
@@ -1521,6 +1524,8 @@ static int __init init_hw_perf_events(void)
 
         pr_cont("%s PMU driver.\n", x86_pmu.name);
 
+        x86_pmu.attr_rdpmc = 1; /* enable userspace RDPMC usage by default */
+
         for (quirk = x86_pmu.quirks; quirk; quirk = quirk->next)
                 quirk->func();
 
@@ -1534,7 +1539,6 @@ static int __init init_hw_perf_events(void)
                 __EVENT_CONSTRAINT(0, (1ULL << x86_pmu.num_counters) - 1,
                                    0, x86_pmu.num_counters, 0, 0);
 
-        x86_pmu.attr_rdpmc = 1; /* enable userspace RDPMC usage by default */
         x86_pmu_format_group.attrs = x86_pmu.format_attrs;
 
         if (x86_pmu.event_attrs)
@@ -1820,9 +1824,12 @@ static ssize_t set_attr_rdpmc(struct device *cdev,
         if (ret)
                 return ret;
 
+        if (x86_pmu.attr_rdpmc_broken)
+                return -ENOTSUPP;
+
         if (!!val != !!x86_pmu.attr_rdpmc) {
                 x86_pmu.attr_rdpmc = !!val;
-                smp_call_function(change_rdpmc, (void *)val, 1);
+                on_each_cpu(change_rdpmc, (void *)val, 1);
         }
 
         return count;
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index c1a861829d81..4972c244d0bc 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -409,6 +409,7 @@ struct x86_pmu {
         /*
          * sysfs attrs
          */
+        int             attr_rdpmc_broken;
         int             attr_rdpmc;
         struct attribute **format_attrs;
         struct attribute **event_attrs;
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 0fa4f242f050..aa333d966886 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1361,10 +1361,8 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
         intel_pmu_disable_all();
         handled = intel_pmu_drain_bts_buffer();
         status = intel_pmu_get_status();
-        if (!status) {
-                intel_pmu_enable_all(0);
-                return handled;
-        }
+        if (!status)
+                goto done;
 
         loops = 0;
 again:
@@ -2310,10 +2308,7 @@ __init int intel_pmu_init(void)
         if (version > 1)
                 x86_pmu.num_counters_fixed = max((int)edx.split.num_counters_fixed, 3);
 
-        /*
-         * v2 and above have a perf capabilities MSR
-         */
-        if (version > 1) {
+        if (boot_cpu_has(X86_FEATURE_PDCM)) {
                 u64 capabilities;
 
                 rdmsrl(MSR_IA32_PERF_CAPABILITIES, capabilities);
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 29c248799ced..c88f7f4b03ee 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -501,8 +501,11 @@ static struct extra_reg snbep_uncore_cbox_extra_regs[] = {
         SNBEP_CBO_EVENT_EXTRA_REG(SNBEP_CBO_PMON_CTL_TID_EN,
                                   SNBEP_CBO_PMON_CTL_TID_EN, 0x1),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0334, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4334, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0534, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4534, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0934, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4934, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x4134, 0xffff, 0x6),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0135, 0xffff, 0x8),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0335, 0xffff, 0x8),
@@ -1178,10 +1181,15 @@ static struct extra_reg ivt_uncore_cbox_extra_regs[] = {
         SNBEP_CBO_EVENT_EXTRA_REG(SNBEP_CBO_PMON_CTL_TID_EN,
                                   SNBEP_CBO_PMON_CTL_TID_EN, 0x1),
         SNBEP_CBO_EVENT_EXTRA_REG(0x1031, 0x10ff, 0x2),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x1134, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4134, 0xffff, 0xc),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x5134, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0334, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4334, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0534, 0xffff, 0x4),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4534, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0934, 0xffff, 0x4),
-        SNBEP_CBO_EVENT_EXTRA_REG(0x4134, 0xffff, 0xc),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x4934, 0xffff, 0xc),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0135, 0xffff, 0x10),
         SNBEP_CBO_EVENT_EXTRA_REG(0x0335, 0xffff, 0x10),
         SNBEP_CBO_EVENT_EXTRA_REG(0x2135, 0xffff, 0x10),
diff --git a/arch/x86/kernel/cpu/perf_event_p6.c b/arch/x86/kernel/cpu/perf_event_p6.c
index b1e2fe115323..7c1a0c07b607 100644
--- a/arch/x86/kernel/cpu/perf_event_p6.c
+++ b/arch/x86/kernel/cpu/perf_event_p6.c
@@ -231,31 +231,49 @@ static __initconst const struct x86_pmu p6_pmu = {
 
 };
 
+static __init void p6_pmu_rdpmc_quirk(void)
+{
+        if (boot_cpu_data.x86_mask < 9) {
+                /*
+                 * PPro erratum 26; fixed in stepping 9 and above.
+                 */
+                pr_warn("Userspace RDPMC support disabled due to a CPU erratum\n");
+                x86_pmu.attr_rdpmc_broken = 1;
+                x86_pmu.attr_rdpmc = 0;
+        }
+}
+
 __init int p6_pmu_init(void)
 {
+        x86_pmu = p6_pmu;
+
         switch (boot_cpu_data.x86_model) {
-        case 1:
-        case 3:  /* Pentium Pro */
-        case 5:
-        case 6:  /* Pentium II */
-        case 7:
-        case 8:
-        case 11: /* Pentium III */
-        case 9:
-        case 13:
-                /* Pentium M */
+        case  1: /* Pentium Pro */
+                x86_add_quirk(p6_pmu_rdpmc_quirk);
+                break;
+
+        case  3: /* Pentium II - Klamath */
+        case  5: /* Pentium II - Deschutes */
+        case  6: /* Pentium II - Mendocino */
                 break;
+
+        case  7: /* Pentium III - Katmai */
+        case  8: /* Pentium III - Coppermine */
+        case 10: /* Pentium III Xeon */
+        case 11: /* Pentium III - Tualatin */
+                break;
+
+        case  9: /* Pentium M - Banias */
+        case 13: /* Pentium M - Dothan */
+                break;
+
         default:
-                pr_cont("unsupported p6 CPU model %d ",
-                        boot_cpu_data.x86_model);
+                pr_cont("unsupported p6 CPU model %d ", boot_cpu_data.x86_model);
                 return -ENODEV;
         }
 
-        x86_pmu = p6_pmu;
-
         memcpy(hw_cache_event_ids, p6_hw_cache_event_ids,
                 sizeof(hw_cache_event_ids));
 
-
         return 0;
 }
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 81ba27679f18..f36bd42d6f0c 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -544,6 +544,10 @@ ENDPROC(early_idt_handlers)
         /* This is global to keep gas from relaxing the jumps */
 ENTRY(early_idt_handler)
         cld
+
+        cmpl $2,(%esp)          # X86_TRAP_NMI
+        je is_nmi               # Ignore NMI
+
         cmpl $2,%ss:early_recursion_flag
         je hlt_loop
         incl %ss:early_recursion_flag
@@ -594,8 +598,9 @@ ex_entry:
         pop %edx
         pop %ecx
         pop %eax
-        addl $8,%esp            /* drop vector number and error code */
         decl %ss:early_recursion_flag
+is_nmi:
+        addl $8,%esp            /* drop vector number and error code */
         iret
 ENDPROC(early_idt_handler)
 
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index e1aabdb314c8..a468c0a65c42 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -343,6 +343,9 @@ early_idt_handlers:
 ENTRY(early_idt_handler)
         cld
 
+        cmpl $2,(%rsp)          # X86_TRAP_NMI
+        je is_nmi               # Ignore NMI
+
         cmpl $2,early_recursion_flag(%rip)
         jz  1f
         incl early_recursion_flag(%rip)
@@ -405,8 +408,9 @@ ENTRY(early_idt_handler)
         popq %rdx
         popq %rcx
         popq %rax
-        addq $16,%rsp           # drop vector number and error code
         decl early_recursion_flag(%rip)
+is_nmi:
+        addq $16,%rsp           # drop vector number and error code
         INTERRUPT_RETURN
 ENDPROC(early_idt_handler)
 
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 4eabc160696f..679cef0791cd 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -279,5 +279,7 @@ void arch_crash_save_vmcoreinfo(void)
         VMCOREINFO_SYMBOL(node_data);
         VMCOREINFO_LENGTH(node_data, MAX_NUMNODES);
 #endif
+        vmcoreinfo_append_str("KERNELOFFSET=%lx\n",
+                              (unsigned long)&_text - __START_KERNEL);
 }
 
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 872079a67e4d..f7d0672481fd 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -100,8 +100,10 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
         flag |= __GFP_ZERO;
 again:
         page = NULL;
-        if (!(flag & GFP_ATOMIC))
+        /* CMA can be used only in the context which permits sleeping */
+        if (flag & __GFP_WAIT)
                 page = dma_alloc_from_contiguous(dev, count, get_order(size));
+        /* fallback */
         if (!page)
                 page = alloc_pages_node(dev_to_node(dev), flag, get_order(size));
         if (!page)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 06853e670354..ce72964b2f46 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1239,14 +1239,8 @@ void __init setup_arch(char **cmdline_p)
         register_refined_jiffies(CLOCK_TICK_RATE);
 
 #ifdef CONFIG_EFI
-        /* Once setup is done above, unmap the EFI memory map on
-         * mismatched firmware/kernel archtectures since there is no
-         * support for runtime services.
-         */
-        if (efi_enabled(EFI_BOOT) && !efi_is_native()) {
-                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
-                efi_unmap_memmap();
-        }
+        if (efi_enabled(EFI_BOOT))
+                efi_apply_memmap_quirks();
 #endif
 }
 
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index acb3b606613e..cfbe99f88830 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -653,13 +653,10 @@ unsigned long native_calibrate_tsc(void)
 
         /* Calibrate TSC using MSR for Intel Atom SoCs */
         local_irq_save(flags);
-        i = try_msr_calibrate_tsc(&fast_calibrate);
+        fast_calibrate = try_msr_calibrate_tsc();
         local_irq_restore(flags);
-        if (i >= 0) {
-                if (i == 0)
-                        pr_warn("Fast TSC calibration using MSR failed\n");
+        if (fast_calibrate)
                 return fast_calibrate;
-        }
 
         local_irq_save(flags);
         fast_calibrate = quick_pit_calibrate();
diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
index 8b5434f4389f..92ae6acac8a7 100644
--- a/arch/x86/kernel/tsc_msr.c
+++ b/arch/x86/kernel/tsc_msr.c
@@ -53,7 +53,7 @@ static struct freq_desc freq_desc_tables[] = {
         /* TNG */
         { 6, 0x4a, 1, { 0, FREQ_100, FREQ_133, 0, 0, 0, 0, 0 } },
         /* VLV2 */
-        { 6, 0x37, 1, { 0, FREQ_100, FREQ_133, FREQ_166, 0, 0, 0, 0 } },
+        { 6, 0x37, 1, { FREQ_83, FREQ_100, FREQ_133, FREQ_166, 0, 0, 0, 0 } },
         /* ANN */
         { 6, 0x5a, 1, { FREQ_83, FREQ_100, FREQ_133, FREQ_100, 0, 0, 0, 0 } },
 };
@@ -77,21 +77,18 @@ static int match_cpu(u8 family, u8 model)
 
 /*
  * Do MSR calibration only for known/supported CPUs.
- * Return values:
- * -1: CPU is unknown/unsupported for MSR based calibration
- *  0: CPU is known/supported, but calibration failed
- *  1: CPU is known/supported, and calibration succeeded
+ *
+ * Returns the calibration value or 0 if MSR calibration failed.
  */
-int try_msr_calibrate_tsc(unsigned long *fast_calibrate)
+unsigned long try_msr_calibrate_tsc(void)
 {
-        int cpu_index;
         u32 lo, hi, ratio, freq_id, freq;
+        unsigned long res;
+        int cpu_index;
 
         cpu_index = match_cpu(boot_cpu_data.x86, boot_cpu_data.x86_model);
         if (cpu_index < 0)
-                return -1;
-
-        *fast_calibrate = 0;
+                return 0;
 
         if (freq_desc_tables[cpu_index].msr_plat) {
                 rdmsr(MSR_PLATFORM_INFO, lo, hi);
@@ -103,7 +100,7 @@ int try_msr_calibrate_tsc(unsigned long *fast_calibrate)
         pr_info("Maximum core-clock to bus-clock ratio: 0x%x\n", ratio);
 
         if (!ratio)
-                return 0;
+                goto fail;
 
         /* Get FSB FREQ ID */
         rdmsr(MSR_FSB_FREQ, lo, hi);
@@ -112,16 +109,19 @@ int try_msr_calibrate_tsc(unsigned long *fast_calibrate)
         pr_info("Resolved frequency ID: %u, frequency: %u KHz\n",
                                 freq_id, freq);
         if (!freq)
-                return 0;
+                goto fail;
 
         /* TSC frequency = maximum resolved freq * maximum resolved bus ratio */
-        *fast_calibrate = freq * ratio;
-        pr_info("TSC runs at %lu KHz\n", *fast_calibrate);
+        res = freq * ratio;
+        pr_info("TSC runs at %lu KHz\n", res);
 
 #ifdef CONFIG_X86_LOCAL_APIC
         lapic_timer_frequency = (freq * 1000) / HZ;
         pr_info("lapic_timer_frequency = %d\n", lapic_timer_frequency);
 #endif
+        return res;
 
-        return 1;
+fail:
+        pr_warn("Fast TSC calibration using MSR failed\n");
+        return 0;
 }
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index e50425d0f5f7..9b531351a587 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2672,6 +2672,7 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write,
                         break;
                 }
 
+                drop_large_spte(vcpu, iterator.sptep);
                 if (!is_shadow_present_pte(*iterator.sptep)) {
                         u64 base_addr = iterator.addr;
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a06f101ef64b..392752834751 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6688,7 +6688,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                 else if (is_page_fault(intr_info))
                         return enable_ept;
                 else if (is_no_device(intr_info) &&
-                         !(nested_read_cr0(vmcs12) & X86_CR0_TS))
+                         !(vmcs12->guest_cr0 & X86_CR0_TS))
                         return 0;
                 return vmcs12->exception_bitmap &
                                 (1u << (intr_info & INTR_INFO_VECTOR_MASK));
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 39c28f09dfd5..2b8578432d5b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6186,7 +6186,7 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
                 frag->len -= len;
         }
 
-        if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) {
+        if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) {
                 vcpu->mmio_needed = 0;
 
                 /* FIXME: return into emulator if single-stepping.  */
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 6dea040cc3a1..a10c8c792161 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1020,13 +1020,17 @@ static inline bool smap_violation(int error_code, struct pt_regs *regs)
  * This routine handles page faults.  It determines the address,
  * and the problem, and then passes it off to one of the appropriate
  * routines.
+ *
+ * This function must have noinline because both callers
+ * {,trace_}do_page_fault() have notrace on. Having this an actual function
+ * guarantees there's a function trace entry.
  */
-static void __kprobes
-__do_page_fault(struct pt_regs *regs, unsigned long error_code)
+static void __kprobes noinline
+__do_page_fault(struct pt_regs *regs, unsigned long error_code,
+                unsigned long address)
 {
         struct vm_area_struct *vma;
         struct task_struct *tsk;
-        unsigned long address;
         struct mm_struct *mm;
         int fault;
         unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
@@ -1034,9 +1038,6 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
         tsk = current;
         mm = tsk->mm;
 
-        /* Get the faulting address: */
-        address = read_cr2();
-
         /*
          * Detect and handle instructions that would cause a page fault for
          * both a tracked kernel page and a userspace page.
@@ -1248,32 +1249,50 @@ good_area:
         up_read(&mm->mmap_sem);
 }
 
-dotraplinkage void __kprobes
+dotraplinkage void __kprobes notrace
 do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
+        unsigned long address = read_cr2(); /* Get the faulting address */
         enum ctx_state prev_state;
 
+        /*
+         * We must have this function tagged with __kprobes, notrace and call
+         * read_cr2() before calling anything else. To avoid calling any kind
+         * of tracing machinery before we've observed the CR2 value.
+         *
+         * exception_{enter,exit}() contain all sorts of tracepoints.
+         */
+
         prev_state = exception_enter();
-        __do_page_fault(regs, error_code);
+        __do_page_fault(regs, error_code, address);
         exception_exit(prev_state);
 }
 
-static void trace_page_fault_entries(struct pt_regs *regs,
+#ifdef CONFIG_TRACING
+static void trace_page_fault_entries(unsigned long address, struct pt_regs *regs,
                                      unsigned long error_code)
 {
         if (user_mode(regs))
-                trace_page_fault_user(read_cr2(), regs, error_code);
+                trace_page_fault_user(address, regs, error_code);
         else
-                trace_page_fault_kernel(read_cr2(), regs, error_code);
+                trace_page_fault_kernel(address, regs, error_code);
 }
 
-dotraplinkage void __kprobes
+dotraplinkage void __kprobes notrace
 trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
+        /*
+         * The exception_enter and tracepoint processing could
+         * trigger another page faults (user space callchain
+         * reading) and destroy the original cr2 value, so read
+         * the faulting address now.
+         */
+        unsigned long address = read_cr2();
         enum ctx_state prev_state;
 
         prev_state = exception_enter();
-        trace_page_fault_entries(regs, error_code);
-        __do_page_fault(regs, error_code);
+        trace_page_fault_entries(address, regs, error_code);
+        __do_page_fault(regs, error_code, address);
         exception_exit(prev_state);
 }
+#endif /* CONFIG_TRACING */
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 1a201ac7cef8..b97acecf3fd9 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -52,6 +52,7 @@
 #include <asm/tlbflush.h>
 #include <asm/x86_init.h>
 #include <asm/rtc.h>
+#include <asm/uv/uv.h>
 
 #define EFI_DEBUG
 
@@ -1210,3 +1211,22 @@ static int __init parse_efi_cmdline(char *str)
         return 0;
 }
 early_param("efi", parse_efi_cmdline);
+
+void __init efi_apply_memmap_quirks(void)
+{
+        /*
+         * Once setup is done earlier, unmap the EFI memory map on mismatched
+         * firmware/kernel architectures since there is no support for runtime
+         * services.
+         */
+        if (!efi_is_native()) {
+                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
+                efi_unmap_memmap();
+        }
+
+        /*
+         * UV doesn't support the new EFI pagetable mapping yet.
+         */
+        if (is_uv_system())
+                set_bit(EFI_OLD_MEMMAP, &x86_efi_facility);
+}
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index ba56e11cbf77..c87ae7c6e5f9 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -20,6 +20,7 @@ config XTENSA
         select HAVE_FUNCTION_TRACER
         select HAVE_IRQ_TIME_ACCOUNTING
         select HAVE_PERF_EVENTS
+        select COMMON_CLK
         help
           Xtensa processors are 32-bit RISC machines designed by Tensilica
           primarily for embedded systems.  These processors are both
@@ -80,7 +81,6 @@ choice
 config XTENSA_VARIANT_FSF
         bool "fsf - default (not generic) configuration"
         select MMU
-        select HAVE_XTENSA_GPIO32
 
 config XTENSA_VARIANT_DC232B
         bool "dc232b - Diamond 232L Standard Core Rev.B (LE)"
@@ -135,7 +135,6 @@ config HAVE_SMP
 config SMP
         bool "Enable Symmetric multi-processing support"
         depends on HAVE_SMP
-        select USE_GENERIC_SMP_HELPERS
         select GENERIC_SMP_IDLE_THREAD
         help
           Enabled SMP Software; allows more than one CPU/CORE
diff --git a/arch/xtensa/boot/dts/xtfpga.dtsi b/arch/xtensa/boot/dts/xtfpga.dtsi
index 46b4f5eab421..e7370b11348e 100644
--- a/arch/xtensa/boot/dts/xtfpga.dtsi
+++ b/arch/xtensa/boot/dts/xtfpga.dtsi
@@ -35,6 +35,13 @@
                 interrupt-controller;
         };
 
+        clocks {
+                osc: main-oscillator {
+                        #clock-cells = <0>;
+                        compatible = "fixed-clock";
+                };
+        };
+
         serial0: serial@fd050020 {
                 device_type = "serial";
                 compatible = "ns16550a";
@@ -42,9 +49,7 @@
                 reg = <0xfd050020 0x20>;
                 reg-shift = <2>;
                 interrupts = <0 1>; /* external irq 0 */
-                /* Filled in by platform_setup from FPGA register
-                 * clock-frequency = <100000000>;
-                 */
+                clocks = <&osc>;
         };
 
         enet0: ethoc@fd030000 {
@@ -52,5 +57,6 @@
                 reg = <0xfd030000 0x4000 0xfd800000 0x4000>;
                 interrupts = <1 1>; /* external irq 1 */
                 local-mac-address = [00 50 c2 13 6f 00];
+                clocks = <&osc>;
         };
 };
diff --git a/arch/xtensa/include/asm/io.h b/arch/xtensa/include/asm/io.h
index 2a042d430c25..74944207167e 100644
--- a/arch/xtensa/include/asm/io.h
+++ b/arch/xtensa/include/asm/io.h
@@ -25,7 +25,7 @@
 
 #ifdef CONFIG_MMU
 
-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && CONFIG_OF
+#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
 extern unsigned long xtensa_kio_paddr;
 
 static inline unsigned long xtensa_get_kio_paddr(void)
diff --git a/arch/xtensa/include/asm/traps.h b/arch/xtensa/include/asm/traps.h
index 8c194f6af45e..677bfcf4ee5d 100644
--- a/arch/xtensa/include/asm/traps.h
+++ b/arch/xtensa/include/asm/traps.h
@@ -23,25 +23,37 @@ void secondary_trap_init(void);
 
 static inline void spill_registers(void)
 {
-
+#if XCHAL_NUM_AREGS > 16
         __asm__ __volatile__ (
-                "movi   a14, "__stringify((1 << PS_EXCM_BIT) | LOCKLEVEL)"\n\t"
-                "mov    a12, a0\n\t"
-                "rsr    a13, sar\n\t"
-                "xsr    a14, ps\n\t"
-                "movi   a0, _spill_registers\n\t"
-                "rsync\n\t"
-                "callx0 a0\n\t"
-                "mov    a0, a12\n\t"
-                "wsr    a13, sar\n\t"
-                "wsr    a14, ps\n\t"
-                : :
-#if defined(CONFIG_FRAME_POINTER)
-                : "a2", "a3", "a4",       "a11", "a12", "a13", "a14", "a15",
+                "       call12  1f\n"
+                "       _j      2f\n"
+                "       retw\n"
+                "       .align  4\n"
+                "1:\n"
+                "       _entry  a1, 48\n"
+                "       addi    a12, a0, 3\n"
+#if XCHAL_NUM_AREGS > 32
+                "       .rept   (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n"
+                "       _entry  a1, 48\n"
+                "       mov     a12, a0\n"
+                "       .endr\n"
+#endif
+                "       _entry  a1, 48\n"
+#if XCHAL_NUM_AREGS % 12 == 0
+                "       mov     a8, a8\n"
+#elif XCHAL_NUM_AREGS % 12 == 4
+                "       mov     a12, a12\n"
+#elif XCHAL_NUM_AREGS % 12 == 8
+                "       mov     a4, a4\n"
+#endif
+                "       retw\n"
+                "2:\n"
+                : : : "a12", "a13", "memory");
 #else
-                : "a2", "a3", "a4", "a7", "a11", "a12", "a13", "a14", "a15",
+        __asm__ __volatile__ (
+                "       mov     a12, a12\n"
+                : : : "memory");
 #endif
-                  "memory");
 }
 
 #endif /* _XTENSA_TRAPS_H */
diff --git a/arch/xtensa/include/asm/vectors.h b/arch/xtensa/include/asm/vectors.h
index 5791b45d5a5d..f74ddfbb92ef 100644
--- a/arch/xtensa/include/asm/vectors.h
+++ b/arch/xtensa/include/asm/vectors.h
@@ -25,7 +25,7 @@
 #define XCHAL_KIO_DEFAULT_PADDR         0xf0000000
 #define XCHAL_KIO_SIZE                  0x10000000
 
-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && CONFIG_OF
+#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
 #define XCHAL_KIO_PADDR                 xtensa_get_kio_paddr()
 #else
 #define XCHAL_KIO_PADDR                 XCHAL_KIO_DEFAULT_PADDR
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index 51940fec6990..b9395529f02d 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -734,7 +734,12 @@ __SYSCALL(332, sys_finit_module, 3)
 #define __NR_accept4                            333
 __SYSCALL(333, sys_accept4, 4)
 
-#define __NR_syscall_count                      334
+#define __NR_sched_setattr                      334
+__SYSCALL(334, sys_sched_setattr, 2)
+#define __NR_sched_getattr                      335
+__SYSCALL(335, sys_sched_getattr, 3)
+
+#define __NR_syscall_count                      336
 
 /*
  * sysxtensa syscall handler
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index 21dbe6bdb8ed..ef7f4990722b 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1081,196 +1081,53 @@ ENTRY(fast_syscall_spill_registers)
 
         rsr     a0, sar
         s32i    a3, a2, PT_AREG3
-        s32i    a4, a2, PT_AREG4
-        s32i    a0, a2, PT_AREG5        # store SAR to PT_AREG5
+        s32i    a0, a2, PT_SAR
 
-        /* The spill routine might clobber a7, a11, and a15. */
+        /* The spill routine might clobber a4, a7, a8, a11, a12, and a15. */
 
+        s32i    a4, a2, PT_AREG4
         s32i    a7, a2, PT_AREG7
+        s32i    a8, a2, PT_AREG8
         s32i    a11, a2, PT_AREG11
+        s32i    a12, a2, PT_AREG12
         s32i    a15, a2, PT_AREG15
 
-        call0   _spill_registers        # destroys a3, a4, and SAR
-
-        /* Advance PC, restore registers and SAR, and return from exception. */
-
-        l32i    a3, a2, PT_AREG5
-        l32i    a4, a2, PT_AREG4
-        l32i    a0, a2, PT_AREG0
-        wsr     a3, sar
-        l32i    a3, a2, PT_AREG3
-
-        /* Restore clobbered registers. */
-
-        l32i    a7, a2, PT_AREG7
-        l32i    a11, a2, PT_AREG11
-        l32i    a15, a2, PT_AREG15
-
-        movi    a2, 0
-        rfe
-
-ENDPROC(fast_syscall_spill_registers)
-
-/* Fixup handler.
- *
- * We get here if the spill routine causes an exception, e.g. tlb miss.
- * We basically restore WINDOWBASE and WINDOWSTART to the condition when
- * we entered the spill routine and jump to the user exception handler.
- *
- * a0: value of depc, original value in depc
- * a2: trashed, original value in EXC_TABLE_DOUBLE_SAVE
- * a3: exctable, original value in excsave1
- */
-
-ENTRY(fast_syscall_spill_registers_fixup)
-
-        rsr     a2, windowbase  # get current windowbase (a2 is saved)
-        xsr     a0, depc        # restore depc and a0
-        ssl     a2              # set shift (32 - WB)
-
-        /* We need to make sure the current registers (a0-a3) are preserved.
-         * To do this, we simply set the bit for the current window frame
-         * in WS, so that the exception handlers save them to the task stack.
-         */
-
-        xsr     a3, excsave1    # get spill-mask
-        slli    a3, a3, 1       # shift left by one
-
-        slli    a2, a3, 32-WSBITS
-        src     a2, a3, a2      # a2 = xxwww1yyxxxwww1yy......
-        wsr     a2, windowstart # set corrected windowstart
-
-        srli    a3, a3, 1
-        rsr     a2, excsave1
-        l32i    a2, a2, EXC_TABLE_DOUBLE_SAVE   # restore a2
-        xsr     a2, excsave1
-        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE   # save a3
-        l32i    a3, a2, EXC_TABLE_PARAM # original WB (in user task)
-        xsr     a2, excsave1
-
-        /* Return to the original (user task) WINDOWBASE.
-         * We leave the following frame behind:
-         * a0, a1, a2   same
-         * a3:          trashed (saved in EXC_TABLE_DOUBLE_SAVE)
-         * depc:        depc (we have to return to that address)
-         * excsave_1:   exctable
-         */
-
-        wsr     a3, windowbase
-        rsync
-
-        /* We are now in the original frame when we entered _spill_registers:
-         *  a0: return address
-         *  a1: used, stack pointer
-         *  a2: kernel stack pointer
-         *  a3: available
-         *  depc: exception address
-         *  excsave: exctable
-         * Note: This frame might be the same as above.
-         */
-
-        /* Setup stack pointer. */
-
-        addi    a2, a2, -PT_USER_SIZE
-        s32i    a0, a2, PT_AREG0
-
-        /* Make sure we return to this fixup handler. */
-
-        movi    a3, fast_syscall_spill_registers_fixup_return
-        s32i    a3, a2, PT_DEPC         # setup depc
-
-        /* Jump to the exception handler. */
-
-        rsr     a3, excsave1
-        rsr     a0, exccause
-        addx4   a0, a0, a3                      # find entry in table
-        l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
-        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
-        jx      a0
-
-ENDPROC(fast_syscall_spill_registers_fixup)
-
-ENTRY(fast_syscall_spill_registers_fixup_return)
-
-        /* When we return here, all registers have been restored (a2: DEPC) */
-
-        wsr     a2, depc                # exception address
-
-        /* Restore fixup handler. */
-
-        rsr     a2, excsave1
-        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE
-        movi    a3, fast_syscall_spill_registers_fixup
-        s32i    a3, a2, EXC_TABLE_FIXUP
-        rsr     a3, windowbase
-        s32i    a3, a2, EXC_TABLE_PARAM
-        l32i    a2, a2, EXC_TABLE_KSTK
-
-        /* Load WB at the time the exception occurred. */
-
-        rsr     a3, sar                 # WB is still in SAR
-        neg     a3, a3
-        wsr     a3, windowbase
-        rsync
-
-        rsr     a3, excsave1
-        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
-
-        rfde
-
-ENDPROC(fast_syscall_spill_registers_fixup_return)
-
-/*
- * spill all registers.
- *
- * This is not a real function. The following conditions must be met:
- *
- *  - must be called with call0.
- *  - uses a3, a4 and SAR.
- *  - the last 'valid' register of each frame are clobbered.
- *  - the caller must have registered a fixup handler
- *    (or be inside a critical section)
- *  - PS_EXCM must be set (PS_WOE cleared?)
- */
-
-ENTRY(_spill_registers)
-
         /*
          * Rotate ws so that the current windowbase is at bit 0.
          * Assume ws = xxxwww1yy (www1 current window frame).
          * Rotate ws right so that a4 = yyxxxwww1.
          */
 
-        rsr     a4, windowbase
+        rsr     a0, windowbase
         rsr     a3, windowstart         # a3 = xxxwww1yy
-        ssr     a4                      # holds WB
-        slli    a4, a3, WSBITS
-        or      a3, a3, a4              # a3 = xxxwww1yyxxxwww1yy
+        ssr     a0                      # holds WB
+        slli    a0, a3, WSBITS
+        or      a3, a3, a0              # a3 = xxxwww1yyxxxwww1yy
         srl     a3, a3                  # a3 = 00xxxwww1yyxxxwww1
 
         /* We are done if there are no more than the current register frame. */
 
         extui   a3, a3, 1, WSBITS-1     # a3 = 0yyxxxwww
-        movi    a4, (1 << (WSBITS-1))
+        movi    a0, (1 << (WSBITS-1))
         _beqz   a3, .Lnospill           # only one active frame? jump
 
         /* We want 1 at the top, so that we return to the current windowbase */
 
-        or      a3, a3, a4              # 1yyxxxwww
+        or      a3, a3, a0              # 1yyxxxwww
 
         /* Skip empty frames - get 'oldest' WINDOWSTART-bit. */
 
         wsr     a3, windowstart         # save shifted windowstart
-        neg     a4, a3
-        and     a3, a4, a3              # first bit set from right: 000010000
+        neg     a0, a3
+        and     a3, a0, a3              # first bit set from right: 000010000
 
-        ffs_ws  a4, a3                  # a4: shifts to skip empty frames
+        ffs_ws  a0, a3                  # a0: shifts to skip empty frames
         movi    a3, WSBITS
-        sub     a4, a3, a4              # WSBITS-a4:number of 0-bits from right
-        ssr     a4                      # save in SAR for later.
+        sub     a0, a3, a0              # WSBITS-a0:number of 0-bits from right
+        ssr     a0                      # save in SAR for later.
 
         rsr     a3, windowbase
-        add     a3, a3, a4
+        add     a3, a3, a0
         wsr     a3, windowbase
         rsync
 
@@ -1285,22 +1142,6 @@ ENTRY(_spill_registers)
          * we have to save 4,8. or 12 registers.
          */
 
-        _bbsi.l a3, 1, .Lc4
-        _bbsi.l a3, 2, .Lc8
-
-        /* Special case: we have a call12-frame starting at a4. */
-
-        _bbci.l a3, 3, .Lc12    # bit 3 shouldn't be zero! (Jump to Lc12 first)
-
-        s32e    a4, a1, -16     # a1 is valid with an empty spill area
-        l32e    a4, a5, -12
-        s32e    a8, a4, -48
-        mov     a8, a4
-        l32e    a4, a1, -16
-        j       .Lc12c
-
-.Lnospill:
-        ret
 
 .Lloop: _bbsi.l a3, 1, .Lc4
         _bbci.l a3, 2, .Lc12
@@ -1314,20 +1155,10 @@ ENTRY(_spill_registers)
         s32e    a9, a4, -28
         s32e    a10, a4, -24
         s32e    a11, a4, -20
-
         srli    a11, a3, 2              # shift windowbase by 2
         rotw    2
         _bnei   a3, 1, .Lloop
-
-.Lexit: /* Done. Do the final rotation, set WS, and return. */
-
-        rotw    1
-        rsr     a3, windowbase
-        ssl     a3
-        movi    a3, 1
-        sll     a3, a3
-        wsr     a3, windowstart
-        ret
+        j       .Lexit
 
 .Lc4:   s32e    a4, a9, -16
         s32e    a5, a9, -12
@@ -1343,11 +1174,11 @@ ENTRY(_spill_registers)
 
         /* 12-register frame (call12) */
 
-        l32e    a2, a5, -12
-        s32e    a8, a2, -48
-        mov     a8, a2
+        l32e    a0, a5, -12
+        s32e    a8, a0, -48
+        mov     a8, a0
 
-.Lc12c: s32e    a9, a8, -44
+        s32e    a9, a8, -44
         s32e    a10, a8, -40
         s32e    a11, a8, -36
         s32e    a12, a8, -32
@@ -1367,30 +1198,54 @@ ENTRY(_spill_registers)
          */
 
         rotw    1
-        mov     a5, a13
+        mov     a4, a13
         rotw    -1
 
-        s32e    a4, a9, -16
-        s32e    a5, a9, -12
-        s32e    a6, a9, -8
-        s32e    a7, a9, -4
+        s32e    a4, a8, -16
+        s32e    a5, a8, -12
+        s32e    a6, a8, -8
+        s32e    a7, a8, -4
 
         rotw    3
 
         _beqi   a3, 1, .Lexit
         j       .Lloop
 
-.Linvalid_mask:
+.Lexit:
 
-        /* We get here because of an unrecoverable error in the window
-         * registers. If we are in user space, we kill the application,
-         * however, this condition is unrecoverable in kernel space.
-         */
+        /* Done. Do the final rotation and set WS */
+
+        rotw    1
+        rsr     a3, windowbase
+        ssl     a3
+        movi    a3, 1
+        sll     a3, a3
+        wsr     a3, windowstart
+.Lnospill:
+
+        /* Advance PC, restore registers and SAR, and return from exception. */
+
+        l32i    a3, a2, PT_SAR
+        l32i    a0, a2, PT_AREG0
+        wsr     a3, sar
+        l32i    a3, a2, PT_AREG3
 
-        rsr     a0, ps
-        _bbci.l a0, PS_UM_BIT, 1f
+        /* Restore clobbered registers. */
 
-        /* User space: Setup a dummy frame and kill application.
+        l32i    a4, a2, PT_AREG4
+        l32i    a7, a2, PT_AREG7
+        l32i    a8, a2, PT_AREG8
+        l32i    a11, a2, PT_AREG11
+        l32i    a12, a2, PT_AREG12
+        l32i    a15, a2, PT_AREG15
+
+        movi    a2, 0
+        rfe
+
+.Linvalid_mask:
+
+        /* We get here because of an unrecoverable error in the window
+         * registers, so set up a dummy frame and kill the user application.
          * Note: We assume EXC_TABLE_KSTK contains a valid stack pointer.
          */
 
@@ -1414,14 +1269,136 @@ ENTRY(_spill_registers)
         movi    a4, do_exit
         callx4  a4
 
-1:      /* Kernel space: PANIC! */
+        /* shouldn't return, so panic */
 
         wsr     a0, excsave1
         movi    a0, unrecoverable_exception
         callx0  a0              # should not return
 1:      j       1b
 
-ENDPROC(_spill_registers)
+
+ENDPROC(fast_syscall_spill_registers)
+
+/* Fixup handler.
+ *
+ * We get here if the spill routine causes an exception, e.g. tlb miss.
+ * We basically restore WINDOWBASE and WINDOWSTART to the condition when
+ * we entered the spill routine and jump to the user exception handler.
+ *
+ * Note that we only need to restore the bits in windowstart that have not
+ * been spilled yet by the _spill_register routine. Luckily, a3 contains a
+ * rotated windowstart with only those bits set for frames that haven't been
+ * spilled yet. Because a3 is rotated such that bit 0 represents the register
+ * frame for the current windowbase - 1, we need to rotate a3 left by the
+ * value of the current windowbase + 1 and move it to windowstart.
+ *
+ * a0: value of depc, original value in depc
+ * a2: trashed, original value in EXC_TABLE_DOUBLE_SAVE
+ * a3: exctable, original value in excsave1
+ */
+
+ENTRY(fast_syscall_spill_registers_fixup)
+
+        rsr     a2, windowbase  # get current windowbase (a2 is saved)
+        xsr     a0, depc        # restore depc and a0
+        ssl     a2              # set shift (32 - WB)
+
+        /* We need to make sure the current registers (a0-a3) are preserved.
+         * To do this, we simply set the bit for the current window frame
+         * in WS, so that the exception handlers save them to the task stack.
+         *
+         * Note: we use a3 to set the windowbase, so we take a special care
+         * of it, saving it in the original _spill_registers frame across
+         * the exception handler call.
+         */
+
+        xsr     a3, excsave1    # get spill-mask
+        slli    a3, a3, 1       # shift left by one
+        addi    a3, a3, 1       # set the bit for the current window frame
+
+        slli    a2, a3, 32-WSBITS
+        src     a2, a3, a2      # a2 = xxwww1yyxxxwww1yy......
+        wsr     a2, windowstart # set corrected windowstart
+
+        srli    a3, a3, 1
+        rsr     a2, excsave1
+        l32i    a2, a2, EXC_TABLE_DOUBLE_SAVE   # restore a2
+        xsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE   # save a3
+        l32i    a3, a2, EXC_TABLE_PARAM # original WB (in user task)
+        xsr     a2, excsave1
+
+        /* Return to the original (user task) WINDOWBASE.
+         * We leave the following frame behind:
+         * a0, a1, a2   same
+         * a3:          trashed (saved in EXC_TABLE_DOUBLE_SAVE)
+         * depc:        depc (we have to return to that address)
+         * excsave_1:   exctable
+         */
+
+        wsr     a3, windowbase
+        rsync
+
+        /* We are now in the original frame when we entered _spill_registers:
+         *  a0: return address
+         *  a1: used, stack pointer
+         *  a2: kernel stack pointer
+         *  a3: available
+         *  depc: exception address
+         *  excsave: exctable
+         * Note: This frame might be the same as above.
+         */
+
+        /* Setup stack pointer. */
+
+        addi    a2, a2, -PT_USER_SIZE
+        s32i    a0, a2, PT_AREG0
+
+        /* Make sure we return to this fixup handler. */
+
+        movi    a3, fast_syscall_spill_registers_fixup_return
+        s32i    a3, a2, PT_DEPC         # setup depc
+
+        /* Jump to the exception handler. */
+
+        rsr     a3, excsave1
+        rsr     a0, exccause
+        addx4   a0, a0, a3                      # find entry in table
+        l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
+        jx      a0
+
+ENDPROC(fast_syscall_spill_registers_fixup)
+
+ENTRY(fast_syscall_spill_registers_fixup_return)
+
+        /* When we return here, all registers have been restored (a2: DEPC) */
+
+        wsr     a2, depc                # exception address
+
+        /* Restore fixup handler. */
+
+        rsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE
+        movi    a3, fast_syscall_spill_registers_fixup
+        s32i    a3, a2, EXC_TABLE_FIXUP
+        rsr     a3, windowbase
+        s32i    a3, a2, EXC_TABLE_PARAM
+        l32i    a2, a2, EXC_TABLE_KSTK
+
+        /* Load WB at the time the exception occurred. */
+
+        rsr     a3, sar                 # WB is still in SAR
+        neg     a3, a3
+        wsr     a3, windowbase
+        rsync
+
+        rsr     a3, excsave1
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
+
+        rfde
+
+ENDPROC(fast_syscall_spill_registers_fixup_return)
 
 #ifdef CONFIG_MMU
 /*
@@ -1794,6 +1771,43 @@ ENTRY(system_call)
 
 ENDPROC(system_call)
 
+/*
+ * Spill live registers on the kernel stack macro.
+ *
+ * Entry condition: ps.woe is set, ps.excm is cleared
+ * Exit condition: windowstart has single bit set
+ * May clobber: a12, a13
+ */
+        .macro  spill_registers_kernel
+
+#if XCHAL_NUM_AREGS > 16
+        call12  1f
+        _j      2f
+        retw
+        .align  4
+1:
+        _entry  a1, 48
+        addi    a12, a0, 3
+#if XCHAL_NUM_AREGS > 32
+        .rept   (XCHAL_NUM_AREGS - 32) / 12
+        _entry  a1, 48
+        mov     a12, a0
+        .endr
+#endif
+        _entry  a1, 48
+#if XCHAL_NUM_AREGS % 12 == 0
+        mov     a8, a8
+#elif XCHAL_NUM_AREGS % 12 == 4
+        mov     a12, a12
+#elif XCHAL_NUM_AREGS % 12 == 8
+        mov     a4, a4
+#endif
+        retw
+2:
+#else
+        mov     a12, a12
+#endif
+        .endm
 
 /*
  * Task switch.
@@ -1806,21 +1820,20 @@ ENTRY(_switch_to)
 
         entry   a1, 16
 
-        mov     a12, a2                 # preserve 'prev' (a2)
-        mov     a13, a3                 # and 'next' (a3)
+        mov     a10, a2                 # preserve 'prev' (a2)
+        mov     a11, a3                 # and 'next' (a3)
 
         l32i    a4, a2, TASK_THREAD_INFO
         l32i    a5, a3, TASK_THREAD_INFO
 
-        save_xtregs_user a4 a6 a8 a9 a10 a11 THREAD_XTREGS_USER
+        save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
 
-        s32i    a0, a12, THREAD_RA      # save return address
-        s32i    a1, a12, THREAD_SP      # save stack pointer
+        s32i    a0, a10, THREAD_RA      # save return address
+        s32i    a1, a10, THREAD_SP      # save stack pointer
 
         /* Disable ints while we manipulate the stack pointer. */
 
-        movi    a14, (1 << PS_EXCM_BIT) | LOCKLEVEL
-        xsr     a14, ps
+        rsil    a14, LOCKLEVEL
         rsr     a3, excsave1
         rsync
         s32i    a3, a3, EXC_TABLE_FIXUP /* enter critical section */
@@ -1835,7 +1848,7 @@ ENTRY(_switch_to)
 
         /* Flush register file. */
 
-        call0   _spill_registers        # destroys a3, a4, and SAR
+        spill_registers_kernel
 
         /* Set kernel stack (and leave critical section)
          * Note: It's save to set it here. The stack will not be overwritten
@@ -1851,13 +1864,13 @@ ENTRY(_switch_to)
 
         /* restore context of the task 'next' */
 
-        l32i    a0, a13, THREAD_RA      # restore return address
-        l32i    a1, a13, THREAD_SP      # restore stack pointer
+        l32i    a0, a11, THREAD_RA      # restore return address
+        l32i    a1, a11, THREAD_SP      # restore stack pointer
 
-        load_xtregs_user a5 a6 a8 a9 a10 a11 THREAD_XTREGS_USER
+        load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
 
         wsr     a14, ps
-        mov     a2, a12                 # return 'prev'
+        mov     a2, a10                 # return 'prev'
         rsync
 
         retw
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 7d12af1317f1..84fe931bb60e 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -22,6 +22,7 @@
 #include <linux/bootmem.h>
 #include <linux/kernel.h>
 #include <linux/percpu.h>
+#include <linux/clk-provider.h>
 #include <linux/cpu.h>
 #include <linux/of_fdt.h>
 #include <linux/of_platform.h>
@@ -276,6 +277,7 @@ void __init early_init_devtree(void *params)
 
 static int __init xtensa_device_probe(void)
 {
+        of_clk_init(NULL);
         of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
         return 0;
 }
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index 08b769d3b3a1..2a1823de69cc 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -30,6 +30,7 @@
 #include <asm/platform.h>
 
 unsigned long ccount_freq;              /* ccount Hz */
+EXPORT_SYMBOL(ccount_freq);
 
 static cycle_t ccount_read(struct clocksource *cs)
 {
diff --git a/arch/xtensa/kernel/vectors.S b/arch/xtensa/kernel/vectors.S
index cb8fd44caabc..f9e1ec346e35 100644
--- a/arch/xtensa/kernel/vectors.S
+++ b/arch/xtensa/kernel/vectors.S
@@ -235,7 +235,7 @@ ENTRY(_DoubleExceptionVector)
 
         /* Check for overflow/underflow exception, jump if overflow. */
 
-        _bbci.l a0, 6, _DoubleExceptionVector_WindowOverflow
+        bbci.l  a0, 6, _DoubleExceptionVector_WindowOverflow
 
         /*
          * Restart window underflow exception.
diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index 74a60c7e085e..80b33ed51f31 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -122,9 +122,7 @@ EXPORT_SYMBOL(insw);
 EXPORT_SYMBOL(insl);
 
 extern long common_exception_return;
-extern long _spill_registers;
 EXPORT_SYMBOL(common_exception_return);
-EXPORT_SYMBOL(_spill_registers);
 
 #ifdef CONFIG_FUNCTION_TRACER
 EXPORT_SYMBOL(_mcount);
diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
index 479d7537a32a..aff108df92d3 100644
--- a/arch/xtensa/mm/init.c
+++ b/arch/xtensa/mm/init.c
@@ -90,7 +90,7 @@ int __init mem_reserve(unsigned long start, unsigned long end, int must_exist)
 
 
 /*
- * Initialize the bootmem system and give it all the memory we have available.
+ * Initialize the bootmem system and give it all low memory we have available.
  */
 
 void __init bootmem_init(void)
@@ -142,9 +142,14 @@ void __init bootmem_init(void)
 
         /* Add all remaining memory pieces into the bootmem map */
 
-        for (i=0; i<sysmem.nr_banks; i++)
-                free_bootmem(sysmem.bank[i].start,
-                             sysmem.bank[i].end - sysmem.bank[i].start);
+        for (i = 0; i < sysmem.nr_banks; i++) {
+                if (sysmem.bank[i].start >> PAGE_SHIFT < max_low_pfn) {
+                        unsigned long end = min(max_low_pfn << PAGE_SHIFT,
+                                                sysmem.bank[i].end);
+                        free_bootmem(sysmem.bank[i].start,
+                                     end - sysmem.bank[i].start);
+                }
+        }
 
 }
 
diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
index 36ec171698b8..861203e958da 100644
--- a/arch/xtensa/mm/mmu.c
+++ b/arch/xtensa/mm/mmu.c
@@ -39,7 +39,7 @@ void init_mmu(void)
         set_itlbcfg_register(0);
         set_dtlbcfg_register(0);
 #endif
-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && CONFIG_OF
+#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
         /*
          * Update the IO area mapping in case xtensa_kio_paddr has changed
          */
diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index 800227862fe8..57fd08b36f51 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -135,11 +135,11 @@ static void __init update_local_mac(struct device_node *node)
 
 static int __init machine_setup(void)
 {
-        struct device_node *serial;
+        struct device_node *clock;
         struct device_node *eth = NULL;
 
-        for_each_compatible_node(serial, NULL, "ns16550a")
-                update_clock_frequency(serial);
+        for_each_node_by_name(clock, "main-oscillator")
+                update_clock_frequency(clock);
 
         if ((eth = of_find_compatible_node(eth, NULL, "opencores,ethoc")))
                 update_local_mac(eth);
@@ -290,6 +290,7 @@ static int __init xtavnet_init(void)
          * knows whether they set it correctly on the DIP switches.
          */
         pr_info("XTFPGA: Ethernet MAC %pM\n", ethoc_pdata.hwaddr);
+        ethoc_pdata.eth_clkfreq = *(long *)XTFPGA_CLKFRQ_VADDR;
 
         return 0;
 }
diff --git a/arch/xtensa/variants/fsf/include/variant/tie.h b/arch/xtensa/variants/fsf/include/variant/tie.h
index bf4020116df5..244cdea4dee5 100644
--- a/arch/xtensa/variants/fsf/include/variant/tie.h
+++ b/arch/xtensa/variants/fsf/include/variant/tie.h
@@ -18,13 +18,6 @@
 #define XCHAL_CP_MASK                   0x00    /* bitmask of all CPs by ID */
 #define XCHAL_CP_PORT_MASK              0x00    /* bitmask of only port CPs */
 
-/*  Basic parameters of each coprocessor:  */
-#define XCHAL_CP7_NAME                  "XTIOP"
-#define XCHAL_CP7_IDENT                 XTIOP
-#define XCHAL_CP7_SA_SIZE               0       /* size of state save area */
-#define XCHAL_CP7_SA_ALIGN              1       /* min alignment of save area */
-#define XCHAL_CP_ID_XTIOP               7       /* coprocessor ID (0..7) */
-
 /*  Filler info for unassigned coprocessors, to simplify arrays etc:  */
 #define XCHAL_NCP_SA_SIZE               0
 #define XCHAL_NCP_SA_ALIGN              1
@@ -42,6 +35,8 @@
 #define XCHAL_CP5_SA_ALIGN              1
 #define XCHAL_CP6_SA_SIZE               0
 #define XCHAL_CP6_SA_ALIGN              1
+#define XCHAL_CP7_SA_SIZE               0
+#define XCHAL_CP7_SA_ALIGN              1
 
 /*  Save area for non-coprocessor optional and custom (TIE) state:  */
 #define XCHAL_NCP_SA_SIZE               0
diff --git a/block/blk-exec.c b/block/blk-exec.c
index c68613bb4c79..dbf4502b1d67 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -65,7 +65,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
          * be resued after dying flag is set
          */
         if (q->mq_ops) {
-                blk_mq_insert_request(q, rq, at_head, true);
+                blk_mq_insert_request(rq, at_head, true, false);
                 return;
         }
 
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 66e2b697f5db..f598f794c3c6 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -137,7 +137,7 @@ static void mq_flush_run(struct work_struct *work)
         rq = container_of(work, struct request, mq_flush_work);
 
         memset(&rq->csd, 0, sizeof(rq->csd));
-        blk_mq_run_request(rq, true, false);
+        blk_mq_insert_request(rq, false, true, false);
 }
 
 static bool blk_flush_queue_rq(struct request *rq)
@@ -411,7 +411,7 @@ void blk_insert_flush(struct request *rq)
         if ((policy & REQ_FSEQ_DATA) &&
             !(policy & (REQ_FSEQ_PREFLUSH | REQ_FSEQ_POSTFLUSH))) {
                 if (q->mq_ops) {
-                        blk_mq_run_request(rq, false, true);
+                        blk_mq_insert_request(rq, false, false, true);
                 } else
                         list_add_tail(&rq->queuelist, &q->queue_head);
                 return;
diff --git a/block/blk-mq-cpu.c b/block/blk-mq-cpu.c
index 3146befb56aa..136ef8643bba 100644
--- a/block/blk-mq-cpu.c
+++ b/block/blk-mq-cpu.c
@@ -11,7 +11,7 @@
 #include "blk-mq.h"
 
 static LIST_HEAD(blk_mq_cpu_notify_list);
-static DEFINE_SPINLOCK(blk_mq_cpu_notify_lock);
+static DEFINE_RAW_SPINLOCK(blk_mq_cpu_notify_lock);
 
 static int blk_mq_main_cpu_notify(struct notifier_block *self,
                                   unsigned long action, void *hcpu)
@@ -19,12 +19,12 @@ static int blk_mq_main_cpu_notify(struct notifier_block *self,
         unsigned int cpu = (unsigned long) hcpu;
         struct blk_mq_cpu_notifier *notify;
 
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
 
         list_for_each_entry(notify, &blk_mq_cpu_notify_list, list)
                 notify->notify(notify->data, action, cpu);
 
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
         return NOTIFY_OK;
 }
 
@@ -32,16 +32,16 @@ void blk_mq_register_cpu_notifier(struct blk_mq_cpu_notifier *notifier)
 {
         BUG_ON(!notifier->notify);
 
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
         list_add_tail(&notifier->list, &blk_mq_cpu_notify_list);
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
 }
 
 void blk_mq_unregister_cpu_notifier(struct blk_mq_cpu_notifier *notifier)
 {
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
         list_del(&notifier->list);
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
 }
 
 void blk_mq_init_cpu_notifier(struct blk_mq_cpu_notifier *notifier,
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 1fa9dd153fde..883f72089015 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -73,8 +73,8 @@ static void blk_mq_hctx_mark_pending(struct blk_mq_hw_ctx *hctx,
                 set_bit(ctx->index_hw, hctx->ctx_map);
 }
 
-static struct request *blk_mq_alloc_rq(struct blk_mq_hw_ctx *hctx, gfp_t gfp,
-                                       bool reserved)
+static struct request *__blk_mq_alloc_request(struct blk_mq_hw_ctx *hctx,
+                                              gfp_t gfp, bool reserved)
 {
         struct request *rq;
         unsigned int tag;
@@ -193,12 +193,6 @@ static void blk_mq_rq_ctx_init(struct request_queue *q, struct blk_mq_ctx *ctx,
         ctx->rq_dispatched[rw_is_sync(rw_flags)]++;
 }
 
-static struct request *__blk_mq_alloc_request(struct blk_mq_hw_ctx *hctx,
-                                              gfp_t gfp, bool reserved)
-{
-        return blk_mq_alloc_rq(hctx, gfp, reserved);
-}
-
 static struct request *blk_mq_alloc_request_pinned(struct request_queue *q,
                                                    int rw, gfp_t gfp,
                                                    bool reserved)
@@ -289,38 +283,10 @@ void blk_mq_free_request(struct request *rq)
         __blk_mq_free_request(hctx, ctx, rq);
 }
 
-static void blk_mq_bio_endio(struct request *rq, struct bio *bio, int error)
-{
-        if (error)
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-        else if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
-                error = -EIO;
-
-        if (unlikely(rq->cmd_flags & REQ_QUIET))
-                set_bit(BIO_QUIET, &bio->bi_flags);
-
-        /* don't actually finish bio if it's part of flush sequence */
-        if (!(rq->cmd_flags & REQ_FLUSH_SEQ))
-                bio_endio(bio, error);
-}
-
-void blk_mq_end_io(struct request *rq, int error)
+bool blk_mq_end_io_partial(struct request *rq, int error, unsigned int nr_bytes)
 {
-        struct bio *bio = rq->bio;
-        unsigned int bytes = 0;
-
-        trace_block_rq_complete(rq->q, rq);
-
-        while (bio) {
-                struct bio *next = bio->bi_next;
-
-                bio->bi_next = NULL;
-                bytes += bio->bi_iter.bi_size;
-                blk_mq_bio_endio(rq, bio, error);
-                bio = next;
-        }
-
-        blk_account_io_completion(rq, bytes);
+        if (blk_update_request(rq, error, blk_rq_bytes(rq)))
+                return true;
 
         blk_account_io_done(rq);
 
@@ -328,8 +294,9 @@ void blk_mq_end_io(struct request *rq, int error)
                 rq->end_io(rq, error);
         else
                 blk_mq_free_request(rq);
+        return false;
 }
-EXPORT_SYMBOL(blk_mq_end_io);
+EXPORT_SYMBOL(blk_mq_end_io_partial);
 
 static void __blk_mq_complete_request_remote(void *data)
 {
@@ -730,60 +697,27 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
         blk_mq_add_timer(rq);
 }
 
-void blk_mq_insert_request(struct request_queue *q, struct request *rq,
-                           bool at_head, bool run_queue)
+void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,
+                bool async)
 {
+        struct request_queue *q = rq->q;
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx, *current_ctx;
+        struct blk_mq_ctx *ctx = rq->mq_ctx, *current_ctx;
+
+        current_ctx = blk_mq_get_ctx(q);
+        if (!cpu_online(ctx->cpu))
+                rq->mq_ctx = ctx = current_ctx;
 
-        ctx = rq->mq_ctx;
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
-        if (rq->cmd_flags & (REQ_FLUSH | REQ_FUA)) {
+        if (rq->cmd_flags & (REQ_FLUSH | REQ_FUA) &&
+            !(rq->cmd_flags & (REQ_FLUSH_SEQ))) {
                 blk_insert_flush(rq);
         } else {
-                current_ctx = blk_mq_get_ctx(q);
-
-                if (!cpu_online(ctx->cpu)) {
-                        ctx = current_ctx;
-                        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-                        rq->mq_ctx = ctx;
-                }
                 spin_lock(&ctx->lock);
                 __blk_mq_insert_request(hctx, rq, at_head);
                 spin_unlock(&ctx->lock);
-
-                blk_mq_put_ctx(current_ctx);
-        }
-
-        if (run_queue)
-                __blk_mq_run_hw_queue(hctx);
-}
-EXPORT_SYMBOL(blk_mq_insert_request);
-
-/*
- * This is a special version of blk_mq_insert_request to bypass FLUSH request
- * check. Should only be used internally.
- */
-void blk_mq_run_request(struct request *rq, bool run_queue, bool async)
-{
-        struct request_queue *q = rq->q;
-        struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx, *current_ctx;
-
-        current_ctx = blk_mq_get_ctx(q);
-
-        ctx = rq->mq_ctx;
-        if (!cpu_online(ctx->cpu)) {
-                ctx = current_ctx;
-                rq->mq_ctx = ctx;
         }
-        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-
-        /* ctx->cpu might be offline */
-        spin_lock(&ctx->lock);
-        __blk_mq_insert_request(hctx, rq, false);
-        spin_unlock(&ctx->lock);
 
         blk_mq_put_ctx(current_ctx);
 
@@ -926,6 +860,8 @@ static void blk_mq_make_request(struct request_queue *q, struct bio *bio)
         ctx = blk_mq_get_ctx(q);
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
+        if (is_sync)
+                rw |= REQ_SYNC;
         trace_block_getrq(q, bio, rw);
         rq = __blk_mq_alloc_request(hctx, GFP_ATOMIC, false);
         if (likely(rq))
diff --git a/block/blk-mq.h b/block/blk-mq.h
index ed0035cd458e..72beba1f9d55 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -23,7 +23,6 @@ struct blk_mq_ctx {
 };
 
 void __blk_mq_complete_request(struct request *rq);
-void blk_mq_run_request(struct request *rq, bool run_queue, bool async);
 void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
 void blk_mq_init_flush(struct request_queue *q);
 void blk_mq_drain_queue(struct request_queue *q);
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index e7515aa43d6b..6f190bc2b8b7 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -243,6 +243,8 @@ static int acpi_ac_resume(struct device *dev)
                 kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
         return 0;
 }
+#else
+#define acpi_ac_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_ac_pm_ops, NULL, acpi_ac_resume);
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 018a42883706..797a6938d051 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -841,6 +841,8 @@ static int acpi_battery_resume(struct device *dev)
         acpi_battery_update(battery);
         return 0;
 }
+#else
+#define acpi_battery_resume NULL
 #endif
 
 static SIMPLE_DEV_PM_OPS(acpi_battery_pm, NULL, acpi_battery_resume);
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 10e4964d051a..afec4526c48a 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -260,14 +260,6 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
         },
         {
         .callback = dmi_disable_osi_win8,
-        .ident = "Dell Inspiron 15R SE",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7520"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
         .ident = "ThinkPad Edge E530",
         .matches = {
                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -322,56 +314,6 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                      DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
                 },
         },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ProBook 2013 models",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook "),
-                     DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP EliteBook 2013 models",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook "),
-                     DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ZBook 14",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 14"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ZBook 15",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 15"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP ZBook 17",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 17"),
-                },
-        },
-        {
-        .callback = dmi_disable_osi_win8,
-        .ident = "HP EliteBook 8780w",
-        .matches = {
-                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                     DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8780w"),
-                },
-        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 11c11f6b8fa1..714e957a871a 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -80,6 +80,8 @@ static void acpi_button_notify(struct acpi_device *device, u32 event);
 
 #ifdef CONFIG_PM_SLEEP
 static int acpi_button_resume(struct device *dev);
+#else
+#define acpi_button_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_button_pm, NULL, acpi_button_resume);
 
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index e9b3081c4fe9..5bfd769fc91f 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -713,13 +713,11 @@ static acpi_status __init find_dock_devices(acpi_handle handle, u32 lvl,
 static ssize_t show_docked(struct device *dev,
                            struct device_attribute *attr, char *buf)
 {
-        struct acpi_device *tmp;
-
         struct dock_station *dock_station = dev->platform_data;
+        struct acpi_device *adev = NULL;
 
-        if (!acpi_bus_get_device(dock_station->handle, &tmp))
-                return snprintf(buf, PAGE_SIZE, "1\n");
-        return snprintf(buf, PAGE_SIZE, "0\n");
+        acpi_bus_get_device(dock_station->handle, &adev);
+        return snprintf(buf, PAGE_SIZE, "%u\n", acpi_device_enumerated(adev));
 }
 static DEVICE_ATTR(docked, S_IRUGO, show_docked, NULL);
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 959d41acc108..d7d32c28829b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -67,6 +67,8 @@ enum ec_command {
 #define ACPI_EC_DELAY           500     /* Wait 500ms max. during EC ops */
 #define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
 #define ACPI_EC_MSI_UDELAY      550     /* Wait 550us for MSI EC */
+#define ACPI_EC_CLEAR_MAX       100     /* Maximum number of events to query
+                                         * when trying to clear the EC */
 
 enum {
         EC_FLAGS_QUERY_PENDING,         /* Query is pending */
@@ -116,6 +118,7 @@ EXPORT_SYMBOL(first_ec);
 static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
+static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
 
 /* --------------------------------------------------------------------------
                              Transaction Management
@@ -440,6 +443,29 @@ acpi_handle ec_get_handle(void)
 
 EXPORT_SYMBOL(ec_get_handle);
 
+static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
+
+/*
+ * Clears stale _Q events that might have accumulated in the EC.
+ * Run with locked ec mutex.
+ */
+static void acpi_ec_clear(struct acpi_ec *ec)
+{
+        int i, status;
+        u8 value = 0;
+
+        for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
+                status = acpi_ec_query_unlocked(ec, &value);
+                if (status || !value)
+                        break;
+        }
+
+        if (unlikely(i == ACPI_EC_CLEAR_MAX))
+                pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
+        else
+                pr_info("%d stale EC events cleared\n", i);
+}
+
 void acpi_ec_block_transactions(void)
 {
         struct acpi_ec *ec = first_ec;
@@ -463,6 +489,10 @@ void acpi_ec_unblock_transactions(void)
         mutex_lock(&ec->mutex);
         /* Allow transactions to be carried out again */
         clear_bit(EC_FLAGS_BLOCKED, &ec->flags);
+
+        if (EC_FLAGS_CLEAR_ON_RESUME)
+                acpi_ec_clear(ec);
+
         mutex_unlock(&ec->mutex);
 }
 
@@ -821,6 +851,13 @@ static int acpi_ec_add(struct acpi_device *device)
 
         /* EC is fully operational, allow queries */
         clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+
+        /* Clear stale _Q events if hardware might require that */
+        if (EC_FLAGS_CLEAR_ON_RESUME) {
+                mutex_lock(&ec->mutex);
+                acpi_ec_clear(ec);
+                mutex_unlock(&ec->mutex);
+        }
         return ret;
 }
 
@@ -922,6 +959,30 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
         return 0;
 }
 
+/*
+ * On some hardware it is necessary to clear events accumulated by the EC during
+ * sleep. These ECs stop reporting GPEs until they are manually polled, if too
+ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=44161
+ *
+ * Ideally, the EC should also be instructed NOT to accumulate events during
+ * sleep (which Windows seems to do somehow), but the interface to control this
+ * behaviour is not known at this time.
+ *
+ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx,
+ * however it is very likely that other Samsung models are affected.
+ *
+ * On systems which don't accumulate _Q events during sleep, this extra check
+ * should be harmless.
+ */
+static int ec_clear_on_resume(const struct dmi_system_id *id)
+{
+        pr_debug("Detected system needing EC poll on resume.\n");
+        EC_FLAGS_CLEAR_ON_RESUME = 1;
+        return 0;
+}
+
 static struct dmi_system_id ec_dmi_table[] __initdata = {
         {
         ec_skip_dsdt_scan, "Compal JFL92", {
@@ -965,6 +1026,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
         ec_validate_ecdt, "ASUS hardware", {
         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
         DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
+        {
+        ec_clear_on_resume, "Samsung hardware", {
+        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
         {},
 };
 
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 1fb62900f32a..09e423f3d8ad 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -55,6 +55,9 @@ MODULE_DEVICE_TABLE(acpi, fan_device_ids);
 #ifdef CONFIG_PM_SLEEP
 static int acpi_fan_suspend(struct device *dev);
 static int acpi_fan_resume(struct device *dev);
+#else
+#define acpi_fan_suspend NULL
+#define acpi_fan_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_fan_pm, acpi_fan_suspend, acpi_fan_resume);
 
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index 52d45ea2bc4f..361b40c10c3f 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -430,6 +430,7 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
                                  pin_name(pin));
                 }
 
+                kfree(entry);
                 return 0;
         }
 
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 28baa05b8018..84243c32e29c 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -56,6 +56,12 @@ struct throttling_tstate {
         int target_state;               /* target T-state */
 };
 
+struct acpi_processor_throttling_arg {
+        struct acpi_processor *pr;
+        int target_state;
+        bool force;
+};
+
 #define THROTTLING_PRECHANGE       (1)
 #define THROTTLING_POSTCHANGE      (2)
 
@@ -1060,16 +1066,24 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
         return 0;
 }
 
+static long acpi_processor_throttling_fn(void *data)
+{
+        struct acpi_processor_throttling_arg *arg = data;
+        struct acpi_processor *pr = arg->pr;
+
+        return pr->throttling.acpi_processor_set_throttling(pr,
+                        arg->target_state, arg->force);
+}
+
 int acpi_processor_set_throttling(struct acpi_processor *pr,
                                                 int state, bool force)
 {
-        cpumask_var_t saved_mask;
         int ret = 0;
         unsigned int i;
         struct acpi_processor *match_pr;
         struct acpi_processor_throttling *p_throttling;
+        struct acpi_processor_throttling_arg arg;
         struct throttling_tstate t_state;
-        cpumask_var_t online_throttling_cpus;
 
         if (!pr)
                 return -EINVAL;
@@ -1080,14 +1094,6 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
         if ((state < 0) || (state > (pr->throttling.state_count - 1)))
                 return -EINVAL;
 
-        if (!alloc_cpumask_var(&saved_mask, GFP_KERNEL))
-                return -ENOMEM;
-
-        if (!alloc_cpumask_var(&online_throttling_cpus, GFP_KERNEL)) {
-                free_cpumask_var(saved_mask);
-                return -ENOMEM;
-        }
-
         if (cpu_is_offline(pr->id)) {
                 /*
                  * the cpu pointed by pr->id is offline. Unnecessary to change
@@ -1096,17 +1102,15 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
                 return -ENODEV;
         }
 
-        cpumask_copy(saved_mask, &current->cpus_allowed);
         t_state.target_state = state;
         p_throttling = &(pr->throttling);
-        cpumask_and(online_throttling_cpus, cpu_online_mask,
-                    p_throttling->shared_cpu_map);
+
         /*
          * The throttling notifier will be called for every
          * affected cpu in order to get one proper T-state.
          * The notifier event is THROTTLING_PRECHANGE.
          */
-        for_each_cpu(i, online_throttling_cpus) {
+        for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) {
                 t_state.cpu = i;
                 acpi_processor_throttling_notifier(THROTTLING_PRECHANGE,
                                                         &t_state);
@@ -1118,21 +1122,18 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
          * it can be called only for the cpu pointed by pr.
          */
         if (p_throttling->shared_type == DOMAIN_COORD_TYPE_SW_ANY) {
-                /* FIXME: use work_on_cpu() */
-                if (set_cpus_allowed_ptr(current, cpumask_of(pr->id))) {
-                        /* Can't migrate to the pr->id CPU. Exit */
-                        ret = -ENODEV;
-                        goto exit;
-                }
-                ret = p_throttling->acpi_processor_set_throttling(pr,
-                                                t_state.target_state, force);
+                arg.pr = pr;
+                arg.target_state = state;
+                arg.force = force;
+                ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, &arg);
         } else {
                 /*
                  * When the T-state coordination is SW_ALL or HW_ALL,
                  * it is necessary to set T-state for every affected
                  * cpus.
                  */
-                for_each_cpu(i, online_throttling_cpus) {
+                for_each_cpu_and(i, cpu_online_mask,
+                    p_throttling->shared_cpu_map) {
                         match_pr = per_cpu(processors, i);
                         /*
                          * If the pointer is invalid, we will report the
@@ -1153,13 +1154,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
                                         "on CPU %d\n", i));
                                 continue;
                         }
-                        t_state.cpu = i;
-                        /* FIXME: use work_on_cpu() */
-                        if (set_cpus_allowed_ptr(current, cpumask_of(i)))
-                                continue;
-                        ret = match_pr->throttling.
-                                acpi_processor_set_throttling(
-                                match_pr, t_state.target_state, force);
+
+                        arg.pr = match_pr;
+                        arg.target_state = state;
+                        arg.force = force;
+                        ret = work_on_cpu(pr->id, acpi_processor_throttling_fn,
+                                &arg);
                 }
         }
         /*
@@ -1168,17 +1168,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
          * affected cpu to update the T-states.
          * The notifier event is THROTTLING_POSTCHANGE
          */
-        for_each_cpu(i, online_throttling_cpus) {
+        for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) {
                 t_state.cpu = i;
                 acpi_processor_throttling_notifier(THROTTLING_POSTCHANGE,
                                                         &t_state);
         }
-        /* restore the previous state */
-        /* FIXME: use work_on_cpu() */
-        set_cpus_allowed_ptr(current, saved_mask);
-exit:
-        free_cpumask_var(online_throttling_cpus);
-        free_cpumask_var(saved_mask);
+
         return ret;
 }
 
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index b7201fc6f1e1..0bdacc5e26a3 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -77,18 +77,24 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
         switch (ares->type) {
         case ACPI_RESOURCE_TYPE_MEMORY24:
                 memory24 = &ares->data.memory24;
+                if (!memory24->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, memory24->minimum,
                                          memory24->address_length,
                                          memory24->write_protect);
                 break;
         case ACPI_RESOURCE_TYPE_MEMORY32:
                 memory32 = &ares->data.memory32;
+                if (!memory32->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, memory32->minimum,
                                          memory32->address_length,
                                          memory32->write_protect);
                 break;
         case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
                 fixed_memory32 = &ares->data.fixed_memory32;
+                if (!fixed_memory32->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, fixed_memory32->address,
                                          fixed_memory32->address_length,
                                          fixed_memory32->write_protect);
@@ -144,12 +150,16 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res)
         switch (ares->type) {
         case ACPI_RESOURCE_TYPE_IO:
                 io = &ares->data.io;
+                if (!io->address_length)
+                        return false;
                 acpi_dev_get_ioresource(res, io->minimum,
                                         io->address_length,
                                         io->io_decode);
                 break;
         case ACPI_RESOURCE_TYPE_FIXED_IO:
                 fixed_io = &ares->data.fixed_io;
+                if (!fixed_io->address_length)
+                        return false;
                 acpi_dev_get_ioresource(res, fixed_io->address,
                                         fixed_io->address_length,
                                         ACPI_DECODE_10);
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index d465ae6cdd00..dbd48498b938 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -450,7 +450,7 @@ static ssize_t acpi_battery_alarm_store(struct device *dev,
 {
         unsigned long x;
         struct acpi_battery *battery = to_acpi_battery(dev_get_drvdata(dev));
-        if (sscanf(buf, "%ld\n", &x) == 1)
+        if (sscanf(buf, "%lu\n", &x) == 1)
                 battery->alarm_capacity = x /
                         (1000 * acpi_battery_scale(battery));
         if (battery->present)
@@ -668,6 +668,8 @@ static int acpi_sbs_resume(struct device *dev)
         acpi_sbs_callback(sbs);
         return 0;
 }
+#else
+#define acpi_sbs_resume NULL
 #endif
 
 static SIMPLE_DEV_PM_OPS(acpi_sbs_pm, NULL, acpi_sbs_resume);
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 8349a555b92b..08626c851be7 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -102,6 +102,8 @@ MODULE_DEVICE_TABLE(acpi, thermal_device_ids);
 
 #ifdef CONFIG_PM_SLEEP
 static int acpi_thermal_resume(struct device *dev);
+#else
+#define acpi_thermal_resume NULL
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_thermal_pm, NULL, acpi_thermal_resume);
 
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index b727d105046d..b6ba88ed31ae 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -81,11 +81,12 @@ static bool allow_duplicates;
 module_param(allow_duplicates, bool, 0644);
 
 /*
- * For Windows 8 systems: if set ture and the GPU driver has
- * registered a backlight interface, skip registering ACPI video's.
+ * For Windows 8 systems: used to decide if video module
+ * should skip registering backlight interface of its own.
  */
-static bool use_native_backlight = false;
-module_param(use_native_backlight, bool, 0644);
+static int use_native_backlight_param = -1;
+module_param_named(use_native_backlight, use_native_backlight_param, int, 0444);
+static bool use_native_backlight_dmi = false;
 
 static int register_count;
 static struct mutex video_list_lock;
@@ -231,9 +232,17 @@ static int acpi_video_get_next_level(struct acpi_video_device *device,
 static int acpi_video_switch_brightness(struct acpi_video_device *device,
                                          int event);
 
+static bool acpi_video_use_native_backlight(void)
+{
+        if (use_native_backlight_param != -1)
+                return use_native_backlight_param;
+        else
+                return use_native_backlight_dmi;
+}
+
 static bool acpi_video_verify_backlight_support(void)
 {
-        if (acpi_osi_is_win8() && use_native_backlight &&
+        if (acpi_osi_is_win8() && acpi_video_use_native_backlight() &&
             backlight_device_registered(BACKLIGHT_RAW))
                 return false;
         return acpi_video_backlight_support();
@@ -398,6 +407,12 @@ static int __init video_set_bqc_offset(const struct dmi_system_id *d)
         return 0;
 }
 
+static int __init video_set_use_native_backlight(const struct dmi_system_id *d)
+{
+        use_native_backlight_dmi = true;
+        return 0;
+}
+
 static struct dmi_system_id video_dmi_table[] __initdata = {
         /*
          * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
@@ -442,6 +457,120 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720"),
                 },
         },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "ThinkPad T430s",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "ThinkPad X230",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X230"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "ThinkPad X1 Carbon",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X1 Carbon"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Lenovo Yoga 13",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo IdeaPad Yoga 13"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Dell Inspiron 7520",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "Inspiron 7520"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Acer Aspire 5733Z",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5733Z"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Acer Aspire V5-431",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire V5-431"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ProBook 4340s",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "HP ProBook 4340s"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ProBook 2013 models",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook "),
+                DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP EliteBook 2013 models",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook "),
+                DMI_MATCH(DMI_PRODUCT_NAME, " G1"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ZBook 14",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 14"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ZBook 15",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 15"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP ZBook 17",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP ZBook 17"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
+        .ident = "HP EliteBook 8780w",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8780w"),
+                },
+        },
         {}
 };
 
@@ -685,6 +814,7 @@ acpi_video_init_brightness(struct acpi_video_device *device)
         union acpi_object *o;
         struct acpi_video_device_brightness *br = NULL;
         int result = -EINVAL;
+        u32 value;
 
         if (!ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) {
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available "
@@ -715,7 +845,12 @@ acpi_video_init_brightness(struct acpi_video_device *device)
                         printk(KERN_ERR PREFIX "Invalid data\n");
                         continue;
                 }
-                br->levels[count] = (u32) o->integer.value;
+                value = (u32) o->integer.value;
+                /* Skip duplicate entries */
+                if (count > 2 && br->levels[count - 1] == value)
+                        continue;
+
+                br->levels[count] = value;
 
                 if (br->levels[count] > max_level)
                         max_level = br->levels[count];
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index a697b77b8865..19080c8e2f2a 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -168,22 +168,6 @@ static struct dmi_system_id video_detect_dmi_table[] = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"),
                 },
         },
-        {
-        .callback = video_detect_force_vendor,
-        .ident = "HP EliteBook Revolve 810",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook Revolve 810 G1"),
-                },
-        },
-        {
-        .callback = video_detect_force_vendor,
-        .ident = "Lenovo Yoga 13",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo IdeaPad Yoga 13"),
-                },
-        },
         { },
 };
 
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 4e737728aee2..868429a47be4 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -247,6 +247,7 @@ config SATA_HIGHBANK
 
 config SATA_MV
         tristate "Marvell SATA support"
+        select GENERIC_PHY
         help
           This option enables support for the Marvell Serial ATA family.
           Currently supports 88SX[56]0[48][01] PCI(-X) chips,
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index dc2756fb6f33..c81d809c111b 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -61,6 +61,7 @@ enum board_ids {
         /* board IDs by feature in alphabetical order */
         board_ahci,
         board_ahci_ign_iferr,
+        board_ahci_noncq,
         board_ahci_nosntf,
         board_ahci_yes_fbs,
 
@@ -121,6 +122,13 @@ static const struct ata_port_info ahci_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &ahci_ops,
         },
+        [board_ahci_noncq] = {
+                AHCI_HFLAGS     (AHCI_HFLAG_NO_NCQ),
+                .flags          = AHCI_FLAG_COMMON,
+                .pio_mask       = ATA_PIO4,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &ahci_ops,
+        },
         [board_ahci_nosntf] = {
                 AHCI_HFLAGS     (AHCI_HFLAG_NO_SNTF),
                 .flags          = AHCI_FLAG_COMMON,
@@ -452,6 +460,12 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },   /* ASM1061 */
         { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
+        /*
+         * Samsung SSDs found on some macbooks.  NCQ times out.
+         * https://bugzilla.kernel.org/show_bug.cgi?id=60731
+         */
+        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq },
+
         /* Enmotus */
         { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
 
@@ -1170,8 +1184,10 @@ static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
 
         nvec = rc;
         rc = pci_enable_msi_block(pdev, nvec);
-        if (rc)
+        if (rc < 0)
                 goto intx;
+        else if (rc > 0)
+                goto single_msi;
 
         return nvec;
 
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1a3dbd1b196e..65d3f1b5966c 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4175,6 +4175,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
 
         /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
         { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+        { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
 
         /* Blacklist entries taken from Silicon Image 3124/3132
            Windows driver .inf file - also several Linux problem reports */
@@ -4225,6 +4226,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
         { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD3",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
 
         /*
          * Some WD SATA-I drives spin up and down erratically when the link
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 20fd337a5731..7ccc084bf1df 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -447,8 +447,11 @@ static void sata_pmp_quirks(struct ata_port *ap)
                  * otherwise.  Don't try hard to recover it.
                  */
                 ap->pmp_link[ap->nr_pmp_links - 1].flags |= ATA_LFLAG_NO_RETRY;
-        } else if (vendor == 0x197b && devid == 0x2352) {
-                /* chip found in Thermaltake BlackX Duet, jmicron JMB350? */
+        } else if (vendor == 0x197b && (devid == 0x2352 || devid == 0x0325)) {
+                /*
+                 * 0x2352: found in Thermaltake BlackX Duet, jmicron JMB350?
+                 * 0x0325: jmicron JMB394.
+                 */
                 ata_for_each_link(link, ap, EDGE) {
                         /* SRST breaks detection and disks get misclassified
                          * LPM disabled to avoid potential problems
diff --git a/drivers/ata/pata_imx.c b/drivers/ata/pata_imx.c
index 26386f0b89a8..b0b18ec5465f 100644
--- a/drivers/ata/pata_imx.c
+++ b/drivers/ata/pata_imx.c
@@ -119,7 +119,9 @@ static int pata_imx_probe(struct platform_device *pdev)
                 return PTR_ERR(priv->clk);
         }
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         host = ata_host_alloc(&pdev->dev, 1);
         if (!host) {
@@ -212,7 +214,9 @@ static int pata_imx_resume(struct device *dev)
         struct ata_host *host = dev_get_drvdata(dev);
         struct pata_imx_priv *priv = host->private_data;
 
-        clk_prepare_enable(priv->clk);
+        int ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         __raw_writel(priv->ata_ctl, priv->host_regs + PATA_IMX_ATA_CONTROL);
 
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 52b8181ddafd..05c8a44adf8e 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4104,7 +4104,6 @@ static int mv_platform_probe(struct platform_device *pdev)
         if (!hpriv->port_phys)
                 return -ENOMEM;
         host->private_data = hpriv;
-        hpriv->n_ports = n_ports;
         hpriv->board_idx = chip_soc;
 
         host->iomap = NULL;
@@ -4132,13 +4131,18 @@ static int mv_platform_probe(struct platform_device *pdev)
                         rc = PTR_ERR(hpriv->port_phys[port]);
                         hpriv->port_phys[port] = NULL;
                         if (rc != -EPROBE_DEFER)
-                                dev_warn(&pdev->dev, "error getting phy %d",
-                                        rc);
+                                dev_warn(&pdev->dev, "error getting phy %d", rc);
+
+                        /* Cleanup only the initialized ports */
+                        hpriv->n_ports = port;
                         goto err;
                 } else
                         phy_power_on(hpriv->port_phys[port]);
         }
 
+        /* All the ports have been initialized */
+        hpriv->n_ports = n_ports;
+
         /*
          * (Re-)program MBUS remapping windows if we are asked to.
          */
@@ -4176,7 +4180,7 @@ err:
                 clk_disable_unprepare(hpriv->clk);
                 clk_put(hpriv->clk);
         }
-        for (port = 0; port < n_ports; port++) {
+        for (port = 0; port < hpriv->n_ports; port++) {
                 if (!IS_ERR(hpriv->port_clks[port])) {
                         clk_disable_unprepare(hpriv->port_clks[port]);
                         clk_put(hpriv->port_clks[port]);
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index d67fc351343c..b7695e804635 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -157,6 +157,7 @@ static const struct sil_drivelist {
         { "ST380011ASL",        SIL_QUIRK_MOD15WRITE },
         { "ST3120022ASL",       SIL_QUIRK_MOD15WRITE },
         { "ST3160021ASL",       SIL_QUIRK_MOD15WRITE },
+        { "TOSHIBA MK2561GSYN", SIL_QUIRK_MOD15WRITE },
         { "Maxtor 4D060H3",     SIL_QUIRK_UDMA5MAX },
         { }
 };
diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c
index 1e16cbd61da2..61d6d62cc0d3 100644
--- a/drivers/base/dma-buf.c
+++ b/drivers/base/dma-buf.c
@@ -616,36 +616,35 @@ static int dma_buf_describe(struct seq_file *s)
         if (ret)
                 return ret;
 
-        seq_printf(s, "\nDma-buf Objects:\n");
-        seq_printf(s, "\texp_name\tsize\tflags\tmode\tcount\n");
+        seq_puts(s, "\nDma-buf Objects:\n");
+        seq_puts(s, "size\tflags\tmode\tcount\texp_name\n");
 
         list_for_each_entry(buf_obj, &db_list.head, list_node) {
                 ret = mutex_lock_interruptible(&buf_obj->lock);
 
                 if (ret) {
-                        seq_printf(s,
-                                  "\tERROR locking buffer object: skipping\n");
+                        seq_puts(s,
+                                 "\tERROR locking buffer object: skipping\n");
                         continue;
                 }
 
-                seq_printf(s, "\t");
-
-                seq_printf(s, "\t%s\t%08zu\t%08x\t%08x\t%08ld\n",
-                                buf_obj->exp_name, buf_obj->size,
+                seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\n",
+                                buf_obj->size,
                                 buf_obj->file->f_flags, buf_obj->file->f_mode,
-                                (long)(buf_obj->file->f_count.counter));
+                                (long)(buf_obj->file->f_count.counter),
+                                buf_obj->exp_name);
 
-                seq_printf(s, "\t\tAttached Devices:\n");
+                seq_puts(s, "\tAttached Devices:\n");
                 attach_count = 0;
 
                 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
-                        seq_printf(s, "\t\t");
+                        seq_puts(s, "\t");
 
-                        seq_printf(s, "%s\n", attach_obj->dev->init_name);
+                        seq_printf(s, "%s\n", dev_name(attach_obj->dev));
                         attach_count++;
                 }
 
-                seq_printf(s, "\n\t\tTotal %d devices attached\n",
+                seq_printf(s, "Total %d devices attached\n\n",
                                 attach_count);
 
                 count++;
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 8a97ddfa6122..c30df50e4440 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -1580,6 +1580,7 @@ static int fw_pm_notify(struct notifier_block *notify_block,
         switch (mode) {
         case PM_HIBERNATION_PREPARE:
         case PM_SUSPEND_PREPARE:
+        case PM_RESTORE_PREPARE:
                 kill_requests_without_uevent();
                 device_cache_fw_images();
                 break;
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 8184451b57c0..422b7d84f686 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -874,7 +874,7 @@ bio_pageinc(struct bio *bio)
                 /* Non-zero page count for non-head members of
                  * compound pages is no longer allowed by the kernel.
                  */
-                page = compound_trans_head(bv.bv_page);
+                page = compound_head(bv.bv_page);
                 atomic_inc(&page->_count);
         }
 }
@@ -887,7 +887,7 @@ bio_pagedec(struct bio *bio)
         struct bvec_iter iter;
 
         bio_for_each_segment(bv, bio, iter) {
-                page = compound_trans_head(bv.bv_page);
+                page = compound_head(bv.bv_page);
                 atomic_dec(&page->_count);
         }
 }
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index b52e9a6d6aad..54174cb32feb 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -53,7 +53,7 @@
 #define MTIP_FTL_REBUILD_TIMEOUT_MS     2400000
 
 /* unaligned IO handling */
-#define MTIP_MAX_UNALIGNED_SLOTS        8
+#define MTIP_MAX_UNALIGNED_SLOTS        2
 
 /* Macro to extract the tag bit number from a tag value. */
 #define MTIP_TAG_BIT(tag)       (tag & 0x1F)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 011e55d820b1..51c557cfd92b 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -612,6 +612,8 @@ static ssize_t disksize_store(struct device *dev,
 
         disksize = PAGE_ALIGN(disksize);
         meta = zram_meta_alloc(disksize);
+        if (!meta)
+                return -ENOMEM;
         down_write(&zram->init_lock);
         if (zram->init_done) {
                 up_write(&zram->init_lock);
diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
index bd313f7816a8..c1af80bcdf20 100644
--- a/drivers/clk/at91/clk-master.c
+++ b/drivers/clk/at91/clk-master.c
@@ -242,7 +242,7 @@ of_at91_clk_master_setup(struct device_node *np, struct at91_pmc *pmc,
 
         irq = irq_of_parse_and_map(np, 0);
         if (!irq)
-                return;
+                goto out_free_characteristics;
 
         clk = at91_clk_register_master(pmc, irq, name, num_parents,
                                        parent_names, layout,
diff --git a/drivers/clk/clk-nomadik.c b/drivers/clk/clk-nomadik.c
index 6a934a5296bd..05e04ce0f148 100644
--- a/drivers/clk/clk-nomadik.c
+++ b/drivers/clk/clk-nomadik.c
@@ -494,6 +494,9 @@ static const struct file_operations nomadik_src_clk_debugfs_ops = {
 
 static int __init nomadik_src_clk_init_debugfs(void)
 {
+        /* Vital for multiplatform */
+        if (!src_base)
+                return -ENODEV;
         src_pcksr0_boot = readl(src_base + SRC_PCKSR0);
         src_pcksr1_boot = readl(src_base + SRC_PCKSR1);
         debugfs_create_file("nomadik-src-clk", S_IFREG | S_IRUGO,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 5517944495d8..c42e608af6bb 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2226,24 +2226,25 @@ EXPORT_SYMBOL_GPL(devm_clk_unregister);
  */
 int __clk_get(struct clk *clk)
 {
-        if (clk && !try_module_get(clk->owner))
-                return 0;
+        if (clk) {
+                if (!try_module_get(clk->owner))
+                        return 0;
 
-        kref_get(&clk->ref);
+                kref_get(&clk->ref);
+        }
         return 1;
 }
 
 void __clk_put(struct clk *clk)
 {
-        if (WARN_ON_ONCE(IS_ERR(clk)))
+        if (!clk || WARN_ON_ONCE(IS_ERR(clk)))
                 return;
 
         clk_prepare_lock();
         kref_put(&clk->ref, __clk_release);
         clk_prepare_unlock();
 
-        if (clk)
-                module_put(clk->owner);
+        module_put(clk->owner);
 }
 
 /***        clk rate change notifiers        ***/
diff --git a/drivers/clk/keystone/gate.c b/drivers/clk/keystone/gate.c
index 17a598398a53..86f1e362eafb 100644
--- a/drivers/clk/keystone/gate.c
+++ b/drivers/clk/keystone/gate.c
@@ -179,6 +179,7 @@ static struct clk *clk_register_psc(struct device *dev,
 
         init.name = name;
         init.ops = &clk_psc_ops;
+        init.flags = 0;
         init.parent_names = (parent_name ? &parent_name : NULL);
         init.num_parents = (parent_name ? 1 : 0);
 
diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index 81a202d12a7a..bef198a83863 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -141,13 +141,6 @@ static const struct coreclk_soc_desc a370_coreclks = {
         .num_ratios = ARRAY_SIZE(a370_coreclk_ratios),
 };
 
-static void __init a370_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &a370_coreclks);
-}
-CLK_OF_DECLARE(a370_core_clk, "marvell,armada-370-core-clock",
-               a370_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -168,9 +161,15 @@ static const struct clk_gating_soc_desc a370_gating_desc[] __initconst = {
         { }
 };
 
-static void __init a370_clk_gating_init(struct device_node *np)
+static void __init a370_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, a370_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,armada-370-gating-clock");
+
+        mvebu_coreclk_setup(np, &a370_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, a370_gating_desc);
 }
-CLK_OF_DECLARE(a370_clk_gating, "marvell,armada-370-gating-clock",
-               a370_clk_gating_init);
+CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+
diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
index 9922c4475aa8..b3094315a3c0 100644
--- a/drivers/clk/mvebu/armada-xp.c
+++ b/drivers/clk/mvebu/armada-xp.c
@@ -158,13 +158,6 @@ static const struct coreclk_soc_desc axp_coreclks = {
         .num_ratios = ARRAY_SIZE(axp_coreclk_ratios),
 };
 
-static void __init axp_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &axp_coreclks);
-}
-CLK_OF_DECLARE(axp_core_clk, "marvell,armada-xp-core-clock",
-               axp_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -202,9 +195,14 @@ static const struct clk_gating_soc_desc axp_gating_desc[] __initconst = {
         { }
 };
 
-static void __init axp_clk_gating_init(struct device_node *np)
+static void __init axp_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, axp_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,armada-xp-gating-clock");
+
+        mvebu_coreclk_setup(np, &axp_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, axp_gating_desc);
 }
-CLK_OF_DECLARE(axp_clk_gating, "marvell,armada-xp-gating-clock",
-               axp_clk_gating_init);
+CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
index 38aee1e3f242..b8c2424ac926 100644
--- a/drivers/clk/mvebu/dove.c
+++ b/drivers/clk/mvebu/dove.c
@@ -154,12 +154,6 @@ static const struct coreclk_soc_desc dove_coreclks = {
         .num_ratios = ARRAY_SIZE(dove_coreclk_ratios),
 };
 
-static void __init dove_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &dove_coreclks);
-}
-CLK_OF_DECLARE(dove_core_clk, "marvell,dove-core-clock", dove_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -186,9 +180,14 @@ static const struct clk_gating_soc_desc dove_gating_desc[] __initconst = {
         { }
 };
 
-static void __init dove_clk_gating_init(struct device_node *np)
+static void __init dove_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, dove_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,dove-gating-clock");
+
+        mvebu_coreclk_setup(np, &dove_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, dove_gating_desc);
 }
-CLK_OF_DECLARE(dove_clk_gating, "marvell,dove-gating-clock",
-               dove_clk_gating_init);
+CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
index 2636a55f29f9..ddb666a86500 100644
--- a/drivers/clk/mvebu/kirkwood.c
+++ b/drivers/clk/mvebu/kirkwood.c
@@ -193,13 +193,6 @@ static const struct coreclk_soc_desc kirkwood_coreclks = {
         .num_ratios = ARRAY_SIZE(kirkwood_coreclk_ratios),
 };
 
-static void __init kirkwood_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &kirkwood_coreclks);
-}
-CLK_OF_DECLARE(kirkwood_core_clk, "marvell,kirkwood-core-clock",
-               kirkwood_coreclk_init);
-
 static const struct coreclk_soc_desc mv88f6180_coreclks = {
         .get_tclk_freq = kirkwood_get_tclk_freq,
         .get_cpu_freq = mv88f6180_get_cpu_freq,
@@ -208,13 +201,6 @@ static const struct coreclk_soc_desc mv88f6180_coreclks = {
         .num_ratios = ARRAY_SIZE(kirkwood_coreclk_ratios),
 };
 
-static void __init mv88f6180_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &mv88f6180_coreclks);
-}
-CLK_OF_DECLARE(mv88f6180_core_clk, "marvell,mv88f6180-core-clock",
-               mv88f6180_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -239,9 +225,21 @@ static const struct clk_gating_soc_desc kirkwood_gating_desc[] __initconst = {
         { }
 };
 
-static void __init kirkwood_clk_gating_init(struct device_node *np)
+static void __init kirkwood_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, kirkwood_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,kirkwood-gating-clock");
+
+
+        if (of_device_is_compatible(np, "marvell,mv88f6180-core-clock"))
+                mvebu_coreclk_setup(np, &mv88f6180_coreclks);
+        else
+                mvebu_coreclk_setup(np, &kirkwood_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
 }
-CLK_OF_DECLARE(kirkwood_clk_gating, "marvell,kirkwood-gating-clock",
-               kirkwood_clk_gating_init);
+CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+               kirkwood_clk_init);
+CLK_OF_DECLARE(mv88f6180_clk, "marvell,mv88f6180-core-clock",
+               kirkwood_clk_init);
diff --git a/drivers/clk/shmobile/clk-rcar-gen2.c b/drivers/clk/shmobile/clk-rcar-gen2.c
index a59ec217a124..99c27b1c625b 100644
--- a/drivers/clk/shmobile/clk-rcar-gen2.c
+++ b/drivers/clk/shmobile/clk-rcar-gen2.c
@@ -26,6 +26,8 @@ struct rcar_gen2_cpg {
         void __iomem *reg;
 };
 
+#define CPG_FRQCRB                      0x00000004
+#define CPG_FRQCRB_KICK                 BIT(31)
 #define CPG_SDCKCR                      0x00000074
 #define CPG_PLL0CR                      0x000000d8
 #define CPG_FRQCRC                      0x000000e0
@@ -45,6 +47,7 @@ struct rcar_gen2_cpg {
 struct cpg_z_clk {
         struct clk_hw hw;
         void __iomem *reg;
+        void __iomem *kick_reg;
 };
 
 #define to_z_clk(_hw)   container_of(_hw, struct cpg_z_clk, hw)
@@ -83,17 +86,45 @@ static int cpg_z_clk_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct cpg_z_clk *zclk = to_z_clk(hw);
         unsigned int mult;
-        u32 val;
+        u32 val, kick;
+        unsigned int i;
 
         mult = div_u64((u64)rate * 32, parent_rate);
         mult = clamp(mult, 1U, 32U);
 
+        if (clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK)
+                return -EBUSY;
+
         val = clk_readl(zclk->reg);
         val &= ~CPG_FRQCRC_ZFC_MASK;
         val |= (32 - mult) << CPG_FRQCRC_ZFC_SHIFT;
         clk_writel(val, zclk->reg);
 
-        return 0;
+        /*
+         * Set KICK bit in FRQCRB to update hardware setting and wait for
+         * clock change completion.
+         */
+        kick = clk_readl(zclk->kick_reg);
+        kick |= CPG_FRQCRB_KICK;
+        clk_writel(kick, zclk->kick_reg);
+
+        /*
+         * Note: There is no HW information about the worst case latency.
+         *
+         * Using experimental measurements, it seems that no more than
+         * ~10 iterations are needed, independently of the CPU rate.
+         * Since this value might be dependant of external xtal rate, pll1
+         * rate or even the other emulation clocks rate, use 1000 as a
+         * "super" safe value.
+         */
+        for (i = 1000; i; i--) {
+                if (!(clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK))
+                        return 0;
+
+                cpu_relax();
+        }
+
+        return -ETIMEDOUT;
 }
 
 static const struct clk_ops cpg_z_clk_ops = {
@@ -120,6 +151,7 @@ static struct clk * __init cpg_z_clk_register(struct rcar_gen2_cpg *cpg)
         init.num_parents = 1;
 
         zclk->reg = cpg->reg + CPG_FRQCRC;
+        zclk->kick_reg = cpg->reg + CPG_FRQCRB;
         zclk->hw.init = &init;
 
         clk = clk_register(NULL, &zclk->hw);
@@ -186,7 +218,7 @@ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
                              const char *name)
 {
         const struct clk_div_table *table = NULL;
-        const char *parent_name = "main";
+        const char *parent_name;
         unsigned int shift;
         unsigned int mult = 1;
         unsigned int div = 1;
@@ -201,23 +233,31 @@ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
                  * the multiplier value.
                  */
                 u32 value = clk_readl(cpg->reg + CPG_PLL0CR);
+                parent_name = "main";
                 mult = ((value >> 24) & ((1 << 7) - 1)) + 1;
         } else if (!strcmp(name, "pll1")) {
+                parent_name = "main";
                 mult = config->pll1_mult / 2;
         } else if (!strcmp(name, "pll3")) {
+                parent_name = "main";
                 mult = config->pll3_mult;
         } else if (!strcmp(name, "lb")) {
+                parent_name = "pll1_div2";
                 div = cpg_mode & BIT(18) ? 36 : 24;
         } else if (!strcmp(name, "qspi")) {
+                parent_name = "pll1_div2";
                 div = (cpg_mode & (BIT(3) | BIT(2) | BIT(1))) == BIT(2)
-                    ? 16 : 20;
+                    ? 8 : 10;
         } else if (!strcmp(name, "sdh")) {
+                parent_name = "pll1_div2";
                 table = cpg_sdh_div_table;
                 shift = 8;
         } else if (!strcmp(name, "sd0")) {
+                parent_name = "pll1_div2";
                 table = cpg_sd01_div_table;
                 shift = 4;
         } else if (!strcmp(name, "sd1")) {
+                parent_name = "pll1_div2";
                 table = cpg_sd01_div_table;
                 shift = 0;
         } else if (!strcmp(name, "z")) {
diff --git a/drivers/clk/tegra/clk-divider.c b/drivers/clk/tegra/clk-divider.c
index 4d75b1f37e3a..290f9c1a3749 100644
--- a/drivers/clk/tegra/clk-divider.c
+++ b/drivers/clk/tegra/clk-divider.c
@@ -59,7 +59,7 @@ static int get_div(struct tegra_clk_frac_div *divider, unsigned long rate,
                 return 0;
 
         if (divider_ux1 > get_max_div(divider))
-                return -EINVAL;
+                return get_max_div(divider);
 
         return divider_ux1;
 }
diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index cf0c323f2c36..c39613c519af 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -180,9 +180,13 @@ enum clk_id {
         tegra_clk_sbc6_8,
         tegra_clk_sclk,
         tegra_clk_sdmmc1,
+        tegra_clk_sdmmc1_8,
         tegra_clk_sdmmc2,
+        tegra_clk_sdmmc2_8,
         tegra_clk_sdmmc3,
+        tegra_clk_sdmmc3_8,
         tegra_clk_sdmmc4,
+        tegra_clk_sdmmc4_8,
         tegra_clk_se,
         tegra_clk_soc_therm,
         tegra_clk_sor0,
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index 5c35885f4a7c..1fa5c3f33b20 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -371,9 +371,7 @@ static const char *mux_pllp3_pllc_clkm[] = {
 static const char *mux_pllm_pllc_pllp_plla_pllc2_c3_clkm[] = {
         "pll_m", "pll_c", "pll_p", "pll_a", "pll_c2", "pll_c3", "clk_m"
 };
-static u32 mux_pllm_pllc_pllp_plla_pllc2_c3_clkm_idx[] = {
-        [0] = 0, [1] = 1, [2] = 2, [3] = 3, [4] = 4, [5] = 6,
-};
+#define mux_pllm_pllc_pllp_plla_pllc2_c3_clkm_idx NULL
 
 static const char *mux_pllm_pllc2_c_c3_pllp_plla_pllc4[] = {
         "pll_m", "pll_c2", "pll_c", "pll_c3", "pll_p", "pll_a_out0", "pll_c4",
@@ -465,6 +463,10 @@ static struct tegra_periph_init_data periph_clks[] = {
         MUX("adx1", mux_plla_pllc_pllp_clkm, CLK_SOURCE_ADX1, 180, TEGRA_PERIPH_ON_APB, tegra_clk_adx1),
         MUX("amx1", mux_plla_pllc_pllp_clkm, CLK_SOURCE_AMX1, 185, TEGRA_PERIPH_ON_APB, tegra_clk_amx1),
         MUX("vi_sensor2", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_VI_SENSOR2, 20, TEGRA_PERIPH_NO_RESET, tegra_clk_vi_sensor2),
+        MUX8("sdmmc1", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC1, 14, 0, tegra_clk_sdmmc1_8),
+        MUX8("sdmmc2", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC2, 9, 0, tegra_clk_sdmmc2_8),
+        MUX8("sdmmc3", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC3, 69, 0, tegra_clk_sdmmc3_8),
+        MUX8("sdmmc4", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC4, 15, 0, tegra_clk_sdmmc4_8),
         MUX8("sbc1", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC1, 41, TEGRA_PERIPH_ON_APB, tegra_clk_sbc1_8),
         MUX8("sbc2", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC2, 44, TEGRA_PERIPH_ON_APB, tegra_clk_sbc2_8),
         MUX8("sbc3", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC3, 46, TEGRA_PERIPH_ON_APB, tegra_clk_sbc3_8),
@@ -492,7 +494,7 @@ static struct tegra_periph_init_data periph_clks[] = {
         UART("uartb", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTB, 7, tegra_clk_uartb),
         UART("uartc", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTC, 55, tegra_clk_uartc),
         UART("uartd", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTD, 65, tegra_clk_uartd),
-        UART("uarte", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTE, 65, tegra_clk_uarte),
+        UART("uarte", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTE, 66, tegra_clk_uarte),
         XUSB("xusb_host_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_HOST_SRC, 143, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_host_src),
         XUSB("xusb_falcon_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_FALCON_SRC, 143, TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_falcon_src),
         XUSB("xusb_fs_src", mux_clkm_48M_pllp_480M, CLK_SOURCE_XUSB_FS_SRC, 143, TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_fs_src),
diff --git a/drivers/clk/tegra/clk-tegra-super-gen4.c b/drivers/clk/tegra/clk-tegra-super-gen4.c
index 05dce4aa2c11..feb3201c85ce 100644
--- a/drivers/clk/tegra/clk-tegra-super-gen4.c
+++ b/drivers/clk/tegra/clk-tegra-super-gen4.c
@@ -120,7 +120,7 @@ void __init tegra_super_clk_gen4_init(void __iomem *clk_base,
                                         ARRAY_SIZE(cclk_lp_parents),
                                         CLK_SET_RATE_PARENT,
                                         clk_base + CCLKLP_BURST_POLICY,
-                                        0, 4, 8, 9, NULL);
+                                        TEGRA_DIVIDER_2, 4, 8, 9, NULL);
                 *dt_clk = clk;
         }
 
diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
index 90d9d25f2228..80431f0fb268 100644
--- a/drivers/clk/tegra/clk-tegra114.c
+++ b/drivers/clk/tegra/clk-tegra114.c
@@ -682,12 +682,12 @@ static struct tegra_clk tegra114_clks[tegra_clk_max] __initdata = {
         [tegra_clk_timer] = { .dt_id = TEGRA114_CLK_TIMER, .present = true },
         [tegra_clk_uarta] = { .dt_id = TEGRA114_CLK_UARTA, .present = true },
         [tegra_clk_uartd] = { .dt_id = TEGRA114_CLK_UARTD, .present = true },
-        [tegra_clk_sdmmc2] = { .dt_id = TEGRA114_CLK_SDMMC2, .present = true },
+        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA114_CLK_SDMMC2, .present = true },
         [tegra_clk_i2s1] = { .dt_id = TEGRA114_CLK_I2S1, .present = true },
         [tegra_clk_i2c1] = { .dt_id = TEGRA114_CLK_I2C1, .present = true },
         [tegra_clk_ndflash] = { .dt_id = TEGRA114_CLK_NDFLASH, .present = true },
-        [tegra_clk_sdmmc1] = { .dt_id = TEGRA114_CLK_SDMMC1, .present = true },
-        [tegra_clk_sdmmc4] = { .dt_id = TEGRA114_CLK_SDMMC4, .present = true },
+        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA114_CLK_SDMMC1, .present = true },
+        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA114_CLK_SDMMC4, .present = true },
         [tegra_clk_pwm] = { .dt_id = TEGRA114_CLK_PWM, .present = true },
         [tegra_clk_i2s0] = { .dt_id = TEGRA114_CLK_I2S0, .present = true },
         [tegra_clk_i2s2] = { .dt_id = TEGRA114_CLK_I2S2, .present = true },
@@ -723,7 +723,7 @@ static struct tegra_clk tegra114_clks[tegra_clk_max] __initdata = {
         [tegra_clk_bsev] = { .dt_id = TEGRA114_CLK_BSEV, .present = true },
         [tegra_clk_i2c3] = { .dt_id = TEGRA114_CLK_I2C3, .present = true },
         [tegra_clk_sbc4_8] = { .dt_id = TEGRA114_CLK_SBC4, .present = true },
-        [tegra_clk_sdmmc3] = { .dt_id = TEGRA114_CLK_SDMMC3, .present = true },
+        [tegra_clk_sdmmc3_8] = { .dt_id = TEGRA114_CLK_SDMMC3, .present = true },
         [tegra_clk_owr] = { .dt_id = TEGRA114_CLK_OWR, .present = true },
         [tegra_clk_csite] = { .dt_id = TEGRA114_CLK_CSITE, .present = true },
         [tegra_clk_la] = { .dt_id = TEGRA114_CLK_LA, .present = true },
diff --git a/drivers/clk/tegra/clk-tegra124.c b/drivers/clk/tegra/clk-tegra124.c
index aff86b5bc745..166e02f16c8a 100644
--- a/drivers/clk/tegra/clk-tegra124.c
+++ b/drivers/clk/tegra/clk-tegra124.c
@@ -516,11 +516,11 @@ static struct div_nmp pllp_nmp = {
 };
 
 static struct tegra_clk_pll_freq_table pll_p_freq_table[] = {
-        {12000000, 216000000, 432, 12, 1, 8},
-        {13000000, 216000000, 432, 13, 1, 8},
-        {16800000, 216000000, 360, 14, 1, 8},
-        {19200000, 216000000, 360, 16, 1, 8},
-        {26000000, 216000000, 432, 26, 1, 8},
+        {12000000, 408000000, 408, 12, 0, 8},
+        {13000000, 408000000, 408, 13, 0, 8},
+        {16800000, 408000000, 340, 14, 0, 8},
+        {19200000, 408000000, 340, 16, 0, 8},
+        {26000000, 408000000, 408, 26, 0, 8},
         {0, 0, 0, 0, 0, 0},
 };
 
@@ -570,6 +570,15 @@ static struct tegra_clk_pll_params pll_a_params = {
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_USE_LOCK,
 };
 
+static struct div_nmp plld_nmp = {
+        .divm_shift = 0,
+        .divm_width = 5,
+        .divn_shift = 8,
+        .divn_width = 11,
+        .divp_shift = 20,
+        .divp_width = 3,
+};
+
 static struct tegra_clk_pll_freq_table pll_d_freq_table[] = {
         {12000000, 216000000, 864, 12, 4, 12},
         {13000000, 216000000, 864, 13, 4, 12},
@@ -603,19 +612,18 @@ static struct tegra_clk_pll_params pll_d_params = {
         .lock_mask = PLL_BASE_LOCK,
         .lock_enable_bit_idx = PLLDU_MISC_LOCK_ENABLE,
         .lock_delay = 1000,
-        .div_nmp = &pllp_nmp,
+        .div_nmp = &plld_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
                  TEGRA_PLL_USE_LOCK,
 };
 
 static struct tegra_clk_pll_freq_table tegra124_pll_d2_freq_table[] = {
-        { 12000000, 148500000,  99, 1, 8},
-        { 12000000, 594000000,  99, 1, 1},
-        { 13000000, 594000000,  91, 1, 1},      /* actual: 591.5 MHz */
-        { 16800000, 594000000,  71, 1, 1},      /* actual: 596.4 MHz */
-        { 19200000, 594000000,  62, 1, 1},      /* actual: 595.2 MHz */
-        { 26000000, 594000000,  91, 2, 1},      /* actual: 591.5 MHz */
+        { 12000000, 594000000,  99, 1, 2},
+        { 13000000, 594000000,  91, 1, 2},      /* actual: 591.5 MHz */
+        { 16800000, 594000000,  71, 1, 2},      /* actual: 596.4 MHz */
+        { 19200000, 594000000,  62, 1, 2},      /* actual: 595.2 MHz */
+        { 26000000, 594000000,  91, 2, 2},      /* actual: 591.5 MHz */
         { 0, 0, 0, 0, 0, 0 },
 };
 
@@ -753,21 +761,19 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
         [tegra_clk_rtc] = { .dt_id = TEGRA124_CLK_RTC, .present = true },
         [tegra_clk_timer] = { .dt_id = TEGRA124_CLK_TIMER, .present = true },
         [tegra_clk_uarta] = { .dt_id = TEGRA124_CLK_UARTA, .present = true },
-        [tegra_clk_sdmmc2] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
+        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
         [tegra_clk_i2s1] = { .dt_id = TEGRA124_CLK_I2S1, .present = true },
         [tegra_clk_i2c1] = { .dt_id = TEGRA124_CLK_I2C1, .present = true },
         [tegra_clk_ndflash] = { .dt_id = TEGRA124_CLK_NDFLASH, .present = true },
-        [tegra_clk_sdmmc1] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
-        [tegra_clk_sdmmc4] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
+        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
+        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
         [tegra_clk_pwm] = { .dt_id = TEGRA124_CLK_PWM, .present = true },
         [tegra_clk_i2s2] = { .dt_id = TEGRA124_CLK_I2S2, .present = true },
-        [tegra_clk_gr2d] = { .dt_id = TEGRA124_CLK_GR_2D, .present = true },
         [tegra_clk_usbd] = { .dt_id = TEGRA124_CLK_USBD, .present = true },
         [tegra_clk_isp_8] = { .dt_id = TEGRA124_CLK_ISP, .present = true },
-        [tegra_clk_gr3d] = { .dt_id = TEGRA124_CLK_GR_3D, .present = true },
         [tegra_clk_disp2] = { .dt_id = TEGRA124_CLK_DISP2, .present = true },
         [tegra_clk_disp1] = { .dt_id = TEGRA124_CLK_DISP1, .present = true },
-        [tegra_clk_host1x] = { .dt_id = TEGRA124_CLK_HOST1X, .present = true },
+        [tegra_clk_host1x_8] = { .dt_id = TEGRA124_CLK_HOST1X, .present = true },
         [tegra_clk_vcp] = { .dt_id = TEGRA124_CLK_VCP, .present = true },
         [tegra_clk_i2s0] = { .dt_id = TEGRA124_CLK_I2S0, .present = true },
         [tegra_clk_apbdma] = { .dt_id = TEGRA124_CLK_APBDMA, .present = true },
@@ -794,7 +800,7 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
         [tegra_clk_uartd] = { .dt_id = TEGRA124_CLK_UARTD, .present = true },
         [tegra_clk_i2c3] = { .dt_id = TEGRA124_CLK_I2C3, .present = true },
         [tegra_clk_sbc4] = { .dt_id = TEGRA124_CLK_SBC4, .present = true },
-        [tegra_clk_sdmmc3] = { .dt_id = TEGRA124_CLK_SDMMC3, .present = true },
+        [tegra_clk_sdmmc3_8] = { .dt_id = TEGRA124_CLK_SDMMC3, .present = true },
         [tegra_clk_pcie] = { .dt_id = TEGRA124_CLK_PCIE, .present = true },
         [tegra_clk_owr] = { .dt_id = TEGRA124_CLK_OWR, .present = true },
         [tegra_clk_afi] = { .dt_id = TEGRA124_CLK_AFI, .present = true },
@@ -1286,9 +1292,9 @@ static void __init tegra124_pll_init(void __iomem *clk_base,
         clk_register_clkdev(clk, "pll_d2", NULL);
         clks[TEGRA124_CLK_PLL_D2] = clk;
 
-        /* PLLD2_OUT0 ?? */
+        /* PLLD2_OUT0 */
         clk = clk_register_fixed_factor(NULL, "pll_d2_out0", "pll_d2",
-                                        CLK_SET_RATE_PARENT, 1, 2);
+                                        CLK_SET_RATE_PARENT, 1, 1);
         clk_register_clkdev(clk, "pll_d2_out0", NULL);
         clks[TEGRA124_CLK_PLL_D2_OUT0] = clk;
 
diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
index dbace152b2fa..dace2b1b5ae6 100644
--- a/drivers/clk/tegra/clk-tegra20.c
+++ b/drivers/clk/tegra/clk-tegra20.c
@@ -574,6 +574,8 @@ static struct tegra_clk tegra20_clks[tegra_clk_max] __initdata = {
         [tegra_clk_tvdac] = { .dt_id = TEGRA20_CLK_TVDAC, .present = true },
         [tegra_clk_vi_sensor] = { .dt_id = TEGRA20_CLK_VI_SENSOR, .present = true },
         [tegra_clk_afi] = { .dt_id = TEGRA20_CLK_AFI, .present = true },
+        [tegra_clk_fuse] = { .dt_id = TEGRA20_CLK_FUSE, .present = true },
+        [tegra_clk_kfuse] = { .dt_id = TEGRA20_CLK_KFUSE, .present = true },
 };
 
 static unsigned long tegra20_clk_measure_input_freq(void)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 08ca8c9f41cd..cf485d928903 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1109,6 +1109,21 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 goto err_set_policy_cpu;
         }
 
+        /* related cpus should atleast have policy->cpus */
+        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
+
+        /*
+         * affected cpus must always be the one, which are online. We aren't
+         * managing offline cpus here.
+         */
+        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
+
+        if (!frozen) {
+                policy->user_policy.min = policy->min;
+                policy->user_policy.max = policy->max;
+        }
+
+        down_write(&policy->rwsem);
         write_lock_irqsave(&cpufreq_driver_lock, flags);
         for_each_cpu(j, policy->cpus)
                 per_cpu(cpufreq_cpu_data, j) = policy;
@@ -1162,20 +1177,6 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 }
         }
 
-        /* related cpus should atleast have policy->cpus */
-        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
-
-        /*
-         * affected cpus must always be the one, which are online. We aren't
-         * managing offline cpus here.
-         */
-        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
-
-        if (!frozen) {
-                policy->user_policy.min = policy->min;
-                policy->user_policy.max = policy->max;
-        }
-
         blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                                      CPUFREQ_START, policy);
 
@@ -1206,6 +1207,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 policy->user_policy.policy = policy->policy;
                 policy->user_policy.governor = policy->governor;
         }
+        up_write(&policy->rwsem);
 
         kobject_uevent(&policy->kobj, KOBJ_ADD);
         up_read(&cpufreq_rwsem);
@@ -1323,8 +1325,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
         up_read(&policy->rwsem);
 
         if (cpu != policy->cpu) {
-                if (!frozen)
-                        sysfs_remove_link(&dev->kobj, "cpufreq");
+                sysfs_remove_link(&dev->kobj, "cpufreq");
         } else if (cpus > 1) {
                 new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu);
                 if (new_cpu >= 0) {
@@ -1547,23 +1548,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
  */
 unsigned int cpufreq_get(unsigned int cpu)
 {
-        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
+        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
         unsigned int ret_freq = 0;
 
-        if (cpufreq_disabled() || !cpufreq_driver)
-                return -ENOENT;
-
-        BUG_ON(!policy);
-
-        if (!down_read_trylock(&cpufreq_rwsem))
-                return 0;
-
-        down_read(&policy->rwsem);
-
-        ret_freq = __cpufreq_get(cpu);
+        if (policy) {
+                down_read(&policy->rwsem);
+                ret_freq = __cpufreq_get(cpu);
+                up_read(&policy->rwsem);
 
-        up_read(&policy->rwsem);
-        up_read(&cpufreq_rwsem);
+                cpufreq_cpu_put(policy);
+        }
 
         return ret_freq;
 }
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index c788abf1c457..2cd36b9297f3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -34,12 +34,15 @@
 
 #define SAMPLE_COUNT            3
 
-#define BYT_RATIOS      0x66a
-#define BYT_VIDS        0x66b
+#define BYT_RATIOS              0x66a
+#define BYT_VIDS                0x66b
+#define BYT_TURBO_RATIOS        0x66c
 
-#define FRAC_BITS 8
+
+#define FRAC_BITS 6
 #define int_tofp(X) ((int64_t)(X) << FRAC_BITS)
 #define fp_toint(X) ((X) >> FRAC_BITS)
+#define FP_ROUNDUP(X) ((X) += 1 << FRAC_BITS)
 
 static inline int32_t mul_fp(int32_t x, int32_t y)
 {
@@ -357,7 +360,7 @@ static int byt_get_min_pstate(void)
 {
         u64 value;
         rdmsrl(BYT_RATIOS, value);
-        return value & 0xFF;
+        return (value >> 8) & 0xFF;
 }
 
 static int byt_get_max_pstate(void)
@@ -367,6 +370,13 @@ static int byt_get_max_pstate(void)
         return (value >> 16) & 0xFF;
 }
 
+static int byt_get_turbo_pstate(void)
+{
+        u64 value;
+        rdmsrl(BYT_TURBO_RATIOS, value);
+        return value & 0x3F;
+}
+
 static void byt_set_pstate(struct cpudata *cpudata, int pstate)
 {
         u64 val;
@@ -469,7 +479,7 @@ static struct cpu_defaults byt_params = {
         .funcs = {
                 .get_max = byt_get_max_pstate,
                 .get_min = byt_get_min_pstate,
-                .get_turbo = byt_get_max_pstate,
+                .get_turbo = byt_get_turbo_pstate,
                 .set = byt_set_pstate,
                 .get_vid = byt_get_vid,
         },
@@ -547,18 +557,20 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
 static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                         struct sample *sample)
 {
-        u64 core_pct;
-        u64 c0_pct;
+        int32_t core_pct;
+        int32_t c0_pct;
 
-        core_pct = div64_u64(sample->aperf * 100, sample->mperf);
+        core_pct = div_fp(int_tofp((sample->aperf)),
+                        int_tofp((sample->mperf)));
+        core_pct = mul_fp(core_pct, int_tofp(100));
+        FP_ROUNDUP(core_pct);
+
+        c0_pct = div_fp(int_tofp(sample->mperf), int_tofp(sample->tsc));
 
-        c0_pct = div64_u64(sample->mperf * 100, sample->tsc);
         sample->freq = fp_toint(
-                mul_fp(int_tofp(cpu->pstate.max_pstate),
-                        int_tofp(core_pct * 1000)));
+                mul_fp(int_tofp(cpu->pstate.max_pstate * 1000), core_pct));
 
-        sample->core_pct_busy = mul_fp(int_tofp(core_pct),
-                                div_fp(int_tofp(c0_pct + 1), int_tofp(100)));
+        sample->core_pct_busy = mul_fp(core_pct, c0_pct);
 }
 
 static inline void intel_pstate_sample(struct cpudata *cpu)
@@ -570,6 +582,10 @@ static inline void intel_pstate_sample(struct cpudata *cpu)
         rdmsrl(MSR_IA32_MPERF, mperf);
         tsc = native_read_tsc();
 
+        aperf = aperf >> FRAC_BITS;
+        mperf = mperf >> FRAC_BITS;
+        tsc = tsc >> FRAC_BITS;
+
         cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
         cpu->samples[cpu->sample_ptr].aperf = aperf;
         cpu->samples[cpu->sample_ptr].mperf = mperf;
@@ -601,7 +617,8 @@ static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
         core_busy = cpu->samples[cpu->sample_ptr].core_pct_busy;
         max_pstate = int_tofp(cpu->pstate.max_pstate);
         current_pstate = int_tofp(cpu->pstate.current_pstate);
-        return mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+        core_busy = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+        return FP_ROUNDUP(core_busy);
 }
 
 static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index e10b646634d7..6684e0342792 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -1076,7 +1076,7 @@ static int powernowk8_cpu_init(struct cpufreq_policy *pol)
 {
         struct powernow_k8_data *data;
         struct init_on_cpu init_on_cpu;
-        int rc;
+        int rc, cpu;
 
         smp_call_function_single(pol->cpu, check_supported_cpu, &rc, 1);
         if (rc)
@@ -1140,7 +1140,9 @@ static int powernowk8_cpu_init(struct cpufreq_policy *pol)
         pr_debug("cpu_init done, current fid 0x%x, vid 0x%x\n",
                  data->currfid, data->currvid);
 
-        per_cpu(powernow_data, pol->cpu) = data;
+        /* Point all the CPUs in this policy to the same data */
+        for_each_cpu(cpu, pol->cpus)
+                per_cpu(powernow_data, cpu) = data;
 
         return 0;
 
@@ -1155,6 +1157,7 @@ err_out:
 static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
 {
         struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
+        int cpu;
 
         if (!data)
                 return -EINVAL;
@@ -1165,7 +1168,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
 
         kfree(data->powernow_table);
         kfree(data);
-        per_cpu(powernow_data, pol->cpu) = NULL;
+        for_each_cpu(cpu, pol->cpus)
+                per_cpu(powernow_data, cpu) = NULL;
 
         return 0;
 }
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 4e7918339b12..19041cefabb1 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -449,6 +449,7 @@ static const struct of_device_id sdma_dt_ids[] = {
         { .compatible = "fsl,imx51-sdma", .data = &sdma_imx51, },
         { .compatible = "fsl,imx35-sdma", .data = &sdma_imx35, },
         { .compatible = "fsl,imx31-sdma", .data = &sdma_imx31, },
+        { .compatible = "fsl,imx25-sdma", .data = &sdma_imx25, },
         { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, sdma_dt_ids);
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 87529181efcc..4e3549a16132 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -77,7 +77,8 @@ static irqreturn_t ioat_dma_do_interrupt(int irq, void *data)
         attnstatus = readl(instance->reg_base + IOAT_ATTNSTATUS_OFFSET);
         for_each_set_bit(bit, &attnstatus, BITS_PER_LONG) {
                 chan = ioat_chan_by_index(instance, bit);
-                tasklet_schedule(&chan->cleanup_task);
+                if (test_bit(IOAT_RUN, &chan->state))
+                        tasklet_schedule(&chan->cleanup_task);
         }
 
         writeb(intrctrl, instance->reg_base + IOAT_INTRCTRL_OFFSET);
@@ -93,7 +94,8 @@ static irqreturn_t ioat_dma_do_interrupt_msix(int irq, void *data)
 {
         struct ioat_chan_common *chan = data;
 
-        tasklet_schedule(&chan->cleanup_task);
+        if (test_bit(IOAT_RUN, &chan->state))
+                tasklet_schedule(&chan->cleanup_task);
 
         return IRQ_HANDLED;
 }
@@ -116,7 +118,6 @@ void ioat_init_channel(struct ioatdma_device *device, struct ioat_chan_common *c
         chan->timer.function = device->timer_fn;
         chan->timer.data = data;
         tasklet_init(&chan->cleanup_task, device->cleanup_fn, data);
-        tasklet_disable(&chan->cleanup_task);
 }
 
 /**
@@ -354,13 +355,49 @@ static int ioat1_dma_alloc_chan_resources(struct dma_chan *c)
         writel(((u64) chan->completion_dma) >> 32,
                chan->reg_base + IOAT_CHANCMP_OFFSET_HIGH);
 
-        tasklet_enable(&chan->cleanup_task);
+        set_bit(IOAT_RUN, &chan->state);
         ioat1_dma_start_null_desc(ioat);  /* give chain to dma device */
         dev_dbg(to_dev(chan), "%s: allocated %d descriptors\n",
                 __func__, ioat->desccount);
         return ioat->desccount;
 }
 
+void ioat_stop(struct ioat_chan_common *chan)
+{
+        struct ioatdma_device *device = chan->device;
+        struct pci_dev *pdev = device->pdev;
+        int chan_id = chan_num(chan);
+        struct msix_entry *msix;
+
+        /* 1/ stop irq from firing tasklets
+         * 2/ stop the tasklet from re-arming irqs
+         */
+        clear_bit(IOAT_RUN, &chan->state);
+
+        /* flush inflight interrupts */
+        switch (device->irq_mode) {
+        case IOAT_MSIX:
+                msix = &device->msix_entries[chan_id];
+                synchronize_irq(msix->vector);
+                break;
+        case IOAT_MSI:
+        case IOAT_INTX:
+                synchronize_irq(pdev->irq);
+                break;
+        default:
+                break;
+        }
+
+        /* flush inflight timers */
+        del_timer_sync(&chan->timer);
+
+        /* flush inflight tasklet runs */
+        tasklet_kill(&chan->cleanup_task);
+
+        /* final cleanup now that everything is quiesced and can't re-arm */
+        device->cleanup_fn((unsigned long) &chan->common);
+}
+
 /**
  * ioat1_dma_free_chan_resources - release all the descriptors
  * @chan: the channel to be cleaned
@@ -379,9 +416,7 @@ static void ioat1_dma_free_chan_resources(struct dma_chan *c)
         if (ioat->desccount == 0)
                 return;
 
-        tasklet_disable(&chan->cleanup_task);
-        del_timer_sync(&chan->timer);
-        ioat1_cleanup(ioat);
+        ioat_stop(chan);
 
         /* Delay 100ms after reset to allow internal DMA logic to quiesce
          * before removing DMA descriptor resources.
@@ -526,8 +561,11 @@ ioat1_dma_prep_memcpy(struct dma_chan *c, dma_addr_t dma_dest,
 static void ioat1_cleanup_event(unsigned long data)
 {
         struct ioat_dma_chan *ioat = to_ioat_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat1_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index 11fb877ddca9..e982f00a9843 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -356,6 +356,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
 void ioat_kobject_del(struct ioatdma_device *device);
 int ioat_dma_setup_interrupts(struct ioatdma_device *device);
+void ioat_stop(struct ioat_chan_common *chan);
 extern const struct sysfs_ops ioat_sysfs_ops;
 extern struct ioat_sysfs_entry ioat_version_attr;
 extern struct ioat_sysfs_entry ioat_cap_attr;
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 5d3affe7e976..8d1058085eeb 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -190,8 +190,11 @@ static void ioat2_cleanup(struct ioat2_dma_chan *ioat)
 void ioat2_cleanup_event(unsigned long data)
 {
         struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat2_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
@@ -553,10 +556,10 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         ioat->issued = 0;
         ioat->tail = 0;
         ioat->alloc_order = order;
+        set_bit(IOAT_RUN, &chan->state);
         spin_unlock_bh(&ioat->prep_lock);
         spin_unlock_bh(&chan->cleanup_lock);
 
-        tasklet_enable(&chan->cleanup_task);
         ioat2_start_null_desc(ioat);
 
         /* check that we got off the ground */
@@ -566,7 +569,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         } while (i++ < 20 && !is_ioat_active(status) && !is_ioat_idle(status));
 
         if (is_ioat_active(status) || is_ioat_idle(status)) {
-                set_bit(IOAT_RUN, &chan->state);
                 return 1 << ioat->alloc_order;
         } else {
                 u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
@@ -809,11 +811,8 @@ void ioat2_free_chan_resources(struct dma_chan *c)
         if (!ioat->ring)
                 return;
 
-        tasklet_disable(&chan->cleanup_task);
-        del_timer_sync(&chan->timer);
-        device->cleanup_fn((unsigned long) c);
+        ioat_stop(chan);
         device->reset_hw(chan);
-        clear_bit(IOAT_RUN, &chan->state);
 
         spin_lock_bh(&chan->cleanup_lock);
         spin_lock_bh(&ioat->prep_lock);
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 820817e97e62..b9b38a1cf92f 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -464,8 +464,11 @@ static void ioat3_cleanup(struct ioat2_dma_chan *ioat)
 static void ioat3_cleanup_event(unsigned long data)
 {
         struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat3_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 00a2de957b23..bf18c786ed40 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -1641,6 +1641,7 @@ static void dma_tasklet(unsigned long data)
         struct d40_chan *d40c = (struct d40_chan *) data;
         struct d40_desc *d40d;
         unsigned long flags;
+        bool callback_active;
         dma_async_tx_callback callback;
         void *callback_param;
 
@@ -1668,6 +1669,7 @@ static void dma_tasklet(unsigned long data)
         }
 
         /* Callback to client */
+        callback_active = !!(d40d->txd.flags & DMA_PREP_INTERRUPT);
         callback = d40d->txd.callback;
         callback_param = d40d->txd.callback_param;
 
@@ -1690,7 +1692,7 @@ static void dma_tasklet(unsigned long data)
 
         spin_unlock_irqrestore(&d40c->lock, flags);
 
-        if (callback && (d40d->txd.flags & DMA_PREP_INTERRUPT))
+        if (callback_active && callback)
                 callback(callback_param);
 
         return;
diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
index d63f4798f7d0..57e96a3350f0 100644
--- a/drivers/edac/i7300_edac.c
+++ b/drivers/edac/i7300_edac.c
@@ -943,33 +943,35 @@ static int i7300_get_devices(struct mem_ctl_info *mci)
 
         /* Attempt to 'get' the MCH register we want */
         pdev = NULL;
-        while (!pvt->pci_dev_16_1_fsb_addr_map ||
-               !pvt->pci_dev_16_2_fsb_err_regs) {
-                pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
-                                      PCI_DEVICE_ID_INTEL_I7300_MCH_ERR, pdev);
-                if (!pdev) {
-                        /* End of list, leave */
-                        i7300_printk(KERN_ERR,
-                                "'system address,Process Bus' "
-                                "device not found:"
-                                "vendor 0x%x device 0x%x ERR funcs "
-                                "(broken BIOS?)\n",
-                                PCI_VENDOR_ID_INTEL,
-                                PCI_DEVICE_ID_INTEL_I7300_MCH_ERR);
-                        goto error;
-                }
-
+        while ((pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                      PCI_DEVICE_ID_INTEL_I7300_MCH_ERR,
+                                      pdev))) {
                 /* Store device 16 funcs 1 and 2 */
                 switch (PCI_FUNC(pdev->devfn)) {
                 case 1:
-                        pvt->pci_dev_16_1_fsb_addr_map = pdev;
+                        if (!pvt->pci_dev_16_1_fsb_addr_map)
+                                pvt->pci_dev_16_1_fsb_addr_map =
+                                                        pci_dev_get(pdev);
                         break;
                 case 2:
-                        pvt->pci_dev_16_2_fsb_err_regs = pdev;
+                        if (!pvt->pci_dev_16_2_fsb_err_regs)
+                                pvt->pci_dev_16_2_fsb_err_regs =
+                                                        pci_dev_get(pdev);
                         break;
                 }
         }
 
+        if (!pvt->pci_dev_16_1_fsb_addr_map ||
+            !pvt->pci_dev_16_2_fsb_err_regs) {
+                /* At least one device was not found */
+                i7300_printk(KERN_ERR,
+                        "'system address,Process Bus' device not found:"
+                        "vendor 0x%x device 0x%x ERR funcs (broken BIOS?)\n",
+                        PCI_VENDOR_ID_INTEL,
+                        PCI_DEVICE_ID_INTEL_I7300_MCH_ERR);
+                goto error;
+        }
+
         edac_dbg(1, "System Address, processor bus- PCI Bus ID: %s  %x:%x\n",
                  pci_name(pvt->pci_dev_16_0_fsb_ctlr),
                  pvt->pci_dev_16_0_fsb_ctlr->vendor,
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 87533ca7752e..d871275196f6 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1334,14 +1334,19 @@ static int i7core_get_onedevice(struct pci_dev **prev,
          * is at addr 8086:2c40, instead of 8086:2c41. So, we need
          * to probe for the alternate address in case of failure
          */
-        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev)
+        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev) {
+                pci_dev_get(*prev);     /* pci_get_device will put it */
                 pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                       PCI_DEVICE_ID_INTEL_I7_NONCORE_ALT, *prev);
+        }
 
-        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE && !pdev)
+        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE &&
+            !pdev) {
+                pci_dev_get(*prev);     /* pci_get_device will put it */
                 pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                       PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE_ALT,
                                       *prev);
+        }
 
         if (!pdev) {
                 if (*prev) {
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index c20602f601ee..98a14f6143a7 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -222,27 +222,19 @@ static void arizona_extcon_pulse_micbias(struct arizona_extcon_info *info)
         struct snd_soc_dapm_context *dapm = arizona->dapm;
         int ret;
 
-        mutex_lock(&dapm->card->dapm_mutex);
-
         ret = snd_soc_dapm_force_enable_pin(dapm, widget);
         if (ret != 0)
                 dev_warn(arizona->dev, "Failed to enable %s: %d\n",
                          widget, ret);
 
-        mutex_unlock(&dapm->card->dapm_mutex);
-
         snd_soc_dapm_sync(dapm);
 
         if (!arizona->pdata.micd_force_micbias) {
-                mutex_lock(&dapm->card->dapm_mutex);
-
                 ret = snd_soc_dapm_disable_pin(arizona->dapm, widget);
                 if (ret != 0)
                         dev_warn(arizona->dev, "Failed to disable %s: %d\n",
                                  widget, ret);
 
-                mutex_unlock(&dapm->card->dapm_mutex);
-
                 snd_soc_dapm_sync(dapm);
         }
 }
@@ -304,16 +296,12 @@ static void arizona_stop_mic(struct arizona_extcon_info *info)
                                  ARIZONA_MICD_ENA, 0,
                                  &change);
 
-        mutex_lock(&dapm->card->dapm_mutex);
-
         ret = snd_soc_dapm_disable_pin(dapm, widget);
         if (ret != 0)
                 dev_warn(arizona->dev,
                          "Failed to disable %s: %d\n",
                          widget, ret);
 
-        mutex_unlock(&dapm->card->dapm_mutex);
-
         snd_soc_dapm_sync(dapm);
 
         if (info->micd_reva) {
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index de4aa409abe2..2c6d5e118ac1 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -916,7 +916,7 @@ static int lookup_existing_device(struct device *dev, void *data)
                 old->config_rom_retries = 0;
                 fw_notice(card, "rediscovered device %s\n", dev_name(dev));
 
-                PREPARE_DELAYED_WORK(&old->work, fw_device_update);
+                old->workfn = fw_device_update;
                 fw_schedule_device_work(old, 0);
 
                 if (current_node == card->root_node)
@@ -1075,7 +1075,7 @@ static void fw_device_init(struct work_struct *work)
         if (atomic_cmpxchg(&device->state,
                            FW_DEVICE_INITIALIZING,
                            FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
-                PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                device->workfn = fw_device_shutdown;
                 fw_schedule_device_work(device, SHUTDOWN_DELAY);
         } else {
                 fw_notice(card, "created device %s: GUID %08x%08x, S%d00\n",
@@ -1196,13 +1196,20 @@ static void fw_device_refresh(struct work_struct *work)
                   dev_name(&device->device), fw_rcode_string(ret));
  gone:
         atomic_set(&device->state, FW_DEVICE_GONE);
-        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+        device->workfn = fw_device_shutdown;
         fw_schedule_device_work(device, SHUTDOWN_DELAY);
  out:
         if (node_id == card->root_node->node_id)
                 fw_schedule_bm_work(card, 0);
 }
 
+static void fw_device_workfn(struct work_struct *work)
+{
+        struct fw_device *device = container_of(to_delayed_work(work),
+                                                struct fw_device, work);
+        device->workfn(work);
+}
+
 void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
 {
         struct fw_device *device;
@@ -1252,7 +1259,8 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                  * power-up after getting plugged in.  We schedule the
                  * first config rom scan half a second after bus reset.
                  */
-                INIT_DELAYED_WORK(&device->work, fw_device_init);
+                device->workfn = fw_device_init;
+                INIT_DELAYED_WORK(&device->work, fw_device_workfn);
                 fw_schedule_device_work(device, INITIAL_DELAY);
                 break;
 
@@ -1268,7 +1276,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 if (atomic_cmpxchg(&device->state,
                             FW_DEVICE_RUNNING,
                             FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_refresh);
+                        device->workfn = fw_device_refresh;
                         fw_schedule_device_work(device,
                                 device->is_local ? 0 : INITIAL_DELAY);
                 }
@@ -1283,7 +1291,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 smp_wmb();  /* update node_id before generation */
                 device->generation = card->generation;
                 if (atomic_read(&device->state) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_update);
+                        device->workfn = fw_device_update;
                         fw_schedule_device_work(device, 0);
                 }
                 break;
@@ -1308,7 +1316,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 device = node->data;
                 if (atomic_xchg(&device->state,
                                 FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                        device->workfn = fw_device_shutdown;
                         fw_schedule_device_work(device,
                                 list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
                 }
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 6b895986dc22..4af0a7bad7f2 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -929,8 +929,6 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
         if (rcode == RCODE_COMPLETE) {
                 fwnet_transmit_packet_done(ptask);
         } else {
-                fwnet_transmit_packet_failed(ptask);
-
                 if (printk_timed_ratelimit(&j,  1000) || rcode != last_rcode) {
                         dev_err(&ptask->dev->netdev->dev,
                                 "fwnet_write_complete failed: %x (skipped %d)\n",
@@ -938,8 +936,10 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
 
                         errors_skipped = 0;
                         last_rcode = rcode;
-                } else
+                } else {
                         errors_skipped++;
+                }
+                fwnet_transmit_packet_failed(ptask);
         }
 }
 
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 6f74d8d3f700..8db663219560 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -290,7 +290,6 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
 #define QUIRK_NO_MSI                    0x10
 #define QUIRK_TI_SLLZ059                0x20
 #define QUIRK_IR_WAKE                   0x40
-#define QUIRK_PHY_LCTRL_TIMEOUT         0x80
 
 /* In case of multiple matches in ohci_quirks[], only the first one is used. */
 static const struct {
@@ -303,10 +302,7 @@ static const struct {
                 QUIRK_BE_HEADERS},
 
         {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
-                QUIRK_PHY_LCTRL_TIMEOUT | QUIRK_NO_MSI},
-
-        {PCI_VENDOR_ID_ATT, PCI_ANY_ID, PCI_ANY_ID,
-                QUIRK_PHY_LCTRL_TIMEOUT},
+                QUIRK_NO_MSI},
 
         {PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID,
                 QUIRK_RESET_PACKET},
@@ -353,7 +349,6 @@ MODULE_PARM_DESC(quirks, "Chip quirks (default = 0"
         ", disable MSI = "              __stringify(QUIRK_NO_MSI)
         ", TI SLLZ059 erratum = "       __stringify(QUIRK_TI_SLLZ059)
         ", IR wake unreliable = "       __stringify(QUIRK_IR_WAKE)
-        ", phy LCtrl timeout = "        __stringify(QUIRK_PHY_LCTRL_TIMEOUT)
         ")");
 
 #define OHCI_PARAM_DEBUG_AT_AR          1
@@ -2299,9 +2294,6 @@ static int ohci_enable(struct fw_card *card,
          * TI TSB82AA2 + TSB81BA3(A) cards signal LPS enabled early but
          * cannot actually use the phy at that time.  These need tens of
          * millisecods pause between LPS write and first phy access too.
-         *
-         * But do not wait for 50msec on Agere/LSI cards.  Their phy
-         * arbitration state machine may time out during such a long wait.
          */
 
         reg_write(ohci, OHCI1394_HCControlSet,
@@ -2309,11 +2301,8 @@ static int ohci_enable(struct fw_card *card,
                   OHCI1394_HCControl_postedWriteEnable);
         flush_writes(ohci);
 
-        if (!(ohci->quirks & QUIRK_PHY_LCTRL_TIMEOUT))
+        for (lps = 0, i = 0; !lps && i < 3; i++) {
                 msleep(50);
-
-        for (lps = 0, i = 0; !lps && i < 150; i++) {
-                msleep(1);
                 lps = reg_read(ohci, OHCI1394_HCControlSet) &
                       OHCI1394_HCControl_LPS;
         }
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 281029daf98c..7aef911fdc71 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -146,6 +146,7 @@ struct sbp2_logical_unit {
          */
         int generation;
         int retries;
+        work_func_t workfn;
         struct delayed_work work;
         bool has_sdev;
         bool blocked;
@@ -864,7 +865,7 @@ static void sbp2_login(struct work_struct *work)
         /* set appropriate retry limit(s) in BUSY_TIMEOUT register */
         sbp2_set_busy_timeout(lu);
 
-        PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect);
+        lu->workfn = sbp2_reconnect;
         sbp2_agent_reset(lu);
 
         /* This was a re-login. */
@@ -918,7 +919,7 @@ static void sbp2_login(struct work_struct *work)
          * If a bus reset happened, sbp2_update will have requeued
          * lu->work already.  Reset the work from reconnect to login.
          */
-        PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
+        lu->workfn = sbp2_login;
 }
 
 static void sbp2_reconnect(struct work_struct *work)
@@ -952,7 +953,7 @@ static void sbp2_reconnect(struct work_struct *work)
                     lu->retries++ >= 5) {
                         dev_err(tgt_dev(tgt), "failed to reconnect\n");
                         lu->retries = 0;
-                        PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
+                        lu->workfn = sbp2_login;
                 }
                 sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
 
@@ -972,6 +973,13 @@ static void sbp2_reconnect(struct work_struct *work)
         sbp2_conditionally_unblock(lu);
 }
 
+static void sbp2_lu_workfn(struct work_struct *work)
+{
+        struct sbp2_logical_unit *lu = container_of(to_delayed_work(work),
+                                                struct sbp2_logical_unit, work);
+        lu->workfn(work);
+}
+
 static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
 {
         struct sbp2_logical_unit *lu;
@@ -998,7 +1006,8 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
         lu->blocked  = false;
         ++tgt->dont_block;
         INIT_LIST_HEAD(&lu->orb_list);
-        INIT_DELAYED_WORK(&lu->work, sbp2_login);
+        lu->workfn = sbp2_login;
+        INIT_DELAYED_WORK(&lu->work, sbp2_lu_workfn);
 
         list_add_tail(&lu->link, &tgt->lu_list);
         return 0;
diff --git a/drivers/fmc/fmc-write-eeprom.c b/drivers/fmc/fmc-write-eeprom.c
index ee5b47904130..9bb2cbd5c9f2 100644
--- a/drivers/fmc/fmc-write-eeprom.c
+++ b/drivers/fmc/fmc-write-eeprom.c
@@ -27,7 +27,7 @@ FMC_PARAM_BUSID(fwe_drv);
 /* The "file=" is like the generic "gateware=" used elsewhere */
 static char *fwe_file[FMC_MAX_CARDS];
 static int fwe_file_n;
-module_param_array_named(file, fwe_file, charp, &fwe_file_n, 444);
+module_param_array_named(file, fwe_file, charp, &fwe_file_n, 0444);
 
 static int fwe_run_tlv(struct fmc_device *fmc, const struct firmware *fw,
         int write)
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index acf3a36c9ebc..32982da82694 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -68,15 +68,7 @@ void __armada_drm_queue_unref_work(struct drm_device *dev,
 {
         struct armada_private *priv = dev->dev_private;
 
-        /*
-         * Yes, we really must jump through these hoops just to store a
-         * _pointer_ to something into the kfifo.  This is utterly insane
-         * and idiotic, because it kfifo requires the _data_ pointed to by
-         * the pointer const, not the pointer itself.  Not only that, but
-         * you have to pass a pointer _to_ the pointer you want stored.
-         */
-        const struct drm_framebuffer *silly_api_alert = fb;
-        WARN_ON(!kfifo_put(&priv->fb_unref, &silly_api_alert));
+        WARN_ON(!kfifo_put(&priv->fb_unref, fb));
         schedule_work(&priv->fb_unref_work);
 }
 
diff --git a/drivers/gpu/drm/bochs/Kconfig b/drivers/gpu/drm/bochs/Kconfig
index c8fcf12019f0..5f8b0c2b9a44 100644
--- a/drivers/gpu/drm/bochs/Kconfig
+++ b/drivers/gpu/drm/bochs/Kconfig
@@ -2,6 +2,7 @@ config DRM_BOCHS
         tristate "DRM Support for bochs dispi vga interface (qemu stdvga)"
         depends on DRM && PCI
         select DRM_KMS_HELPER
+        select DRM_KMS_FB_HELPER
         select FB_SYS_FILLRECT
         select FB_SYS_COPYAREA
         select FB_SYS_IMAGEBLIT
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index dffc836144cc..f4dc9b7a3831 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -296,6 +296,18 @@ int drm_getcap(struct drm_device *dev, void *data, struct drm_file *file_priv)
         case DRM_CAP_ASYNC_PAGE_FLIP:
                 req->value = dev->mode_config.async_page_flip;
                 break;
+        case DRM_CAP_CURSOR_WIDTH:
+                if (dev->mode_config.cursor_width)
+                        req->value = dev->mode_config.cursor_width;
+                else
+                        req->value = 64;
+                break;
+        case DRM_CAP_CURSOR_HEIGHT:
+                if (dev->mode_config.cursor_height)
+                        req->value = dev->mode_config.cursor_height;
+                else
+                        req->value = 64;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index fa18cf374470..faa77f543a07 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -1151,8 +1151,10 @@ tda998x_encoder_init(struct i2c_client *client,
 
         priv->current_page = 0xff;
         priv->cec = i2c_new_dummy(client->adapter, 0x34);
-        if (!priv->cec)
+        if (!priv->cec) {
+                kfree(priv);
                 return -ENODEV;
+        }
         priv->dpms = DRM_MODE_DPMS_OFF;
 
         encoder_slave->slave_priv = priv;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 04f1f02c4019..ec7bb0fc71bc 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -403,7 +403,7 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
 void intel_detect_pch(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct pci_dev *pch;
+        struct pci_dev *pch = NULL;
 
         /* In all current cases, num_pipes is equivalent to the PCH_NOP setting
          * (which really amounts to a PCH but no South Display).
@@ -424,12 +424,9 @@ void intel_detect_pch(struct drm_device *dev)
          * all the ISA bridge devices and check for the first match, instead
          * of only checking the first one.
          */
-        pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, NULL);
-        while (pch) {
-                struct pci_dev *curr = pch;
+        while ((pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, pch))) {
                 if (pch->vendor == PCI_VENDOR_ID_INTEL) {
-                        unsigned short id;
-                        id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
+                        unsigned short id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
                         dev_priv->pch_id = id;
 
                         if (id == INTEL_PCH_IBX_DEVICE_ID_TYPE) {
@@ -461,18 +458,16 @@ void intel_detect_pch(struct drm_device *dev)
                                 DRM_DEBUG_KMS("Found LynxPoint LP PCH\n");
                                 WARN_ON(!IS_HASWELL(dev));
                                 WARN_ON(!IS_ULT(dev));
-                        } else {
-                                goto check_next;
-                        }
-                        pci_dev_put(pch);
+                        } else
+                                continue;
+
                         break;
                 }
-check_next:
-                pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, curr);
-                pci_dev_put(curr);
         }
         if (!pch)
-                DRM_DEBUG_KMS("No PCH found?\n");
+                DRM_DEBUG_KMS("No PCH found.\n");
+
+        pci_dev_put(pch);
 }
 
 bool i915_semaphore_is_enabled(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 1a24e84f2315..d58b4e287e32 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -82,9 +82,22 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
         r = devm_request_mem_region(dev->dev, base, dev_priv->gtt.stolen_size,
                                     "Graphics Stolen Memory");
         if (r == NULL) {
-                DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
-                          base, base + (uint32_t)dev_priv->gtt.stolen_size);
-                base = 0;
+                /*
+                 * One more attempt but this time requesting region from
+                 * base + 1, as we have seen that this resolves the region
+                 * conflict with the PCI Bus.
+                 * This is a BIOS w/a: Some BIOS wrap stolen in the root
+                 * PCI bus, but have an off-by-one error. Hence retry the
+                 * reservation starting from 1 instead of 0.
+                 */
+                r = devm_request_mem_region(dev->dev, base + 1,
+                                            dev_priv->gtt.stolen_size - 1,
+                                            "Graphics Stolen Memory");
+                if (r == NULL) {
+                        DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
+                                  base, base + (uint32_t)dev_priv->gtt.stolen_size);
+                        base = 0;
+                }
         }
 
         return base;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9fa24347963a..9b8a7c7ea7fc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1092,12 +1092,12 @@ static void assert_cursor(struct drm_i915_private *dev_priv,
         struct drm_device *dev = dev_priv->dev;
         bool cur_state;
 
-        if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
-                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
-        else if (IS_845G(dev) || IS_I865G(dev))
+        if (IS_845G(dev) || IS_I865G(dev))
                 cur_state = I915_READ(_CURACNTR) & CURSOR_ENABLE;
-        else
+        else if (INTEL_INFO(dev)->gen <= 6 || IS_VALLEYVIEW(dev))
                 cur_state = I915_READ(CURCNTR(pipe)) & CURSOR_MODE;
+        else
+                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
 
         WARN(cur_state != state,
              "cursor on pipe %c assertion failure (expected %s, current %s)\n",
@@ -8586,6 +8586,20 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
         if (ring->id == RCS)
                 len += 6;
 
+        /*
+         * BSpec MI_DISPLAY_FLIP for IVB:
+         * "The full packet must be contained within the same cache line."
+         *
+         * Currently the LRI+SRM+MI_DISPLAY_FLIP all fit within the same
+         * cacheline, if we ever start emitting more commands before
+         * the MI_DISPLAY_FLIP we may need to first emit everything else,
+         * then do the cacheline alignment, and finally emit the
+         * MI_DISPLAY_FLIP.
+         */
+        ret = intel_ring_cacheline_align(ring);
+        if (ret)
+                goto err_unpin;
+
         ret = intel_ring_begin(ring, len);
         if (ret)
                 goto err_unpin;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 2f517b85b3f4..57552eb386b0 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -537,6 +537,7 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp,
         uint8_t msg[20];
         int msg_bytes;
         uint8_t ack;
+        int retry;
 
         if (WARN_ON(send_bytes > 16))
                 return -E2BIG;
@@ -548,19 +549,21 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp,
         msg[3] = send_bytes - 1;
         memcpy(&msg[4], send, send_bytes);
         msg_bytes = send_bytes + 4;
-        for (;;) {
+        for (retry = 0; retry < 7; retry++) {
                 ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes, &ack, 1);
                 if (ret < 0)
                         return ret;
                 ack >>= 4;
                 if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_ACK)
-                        break;
+                        return send_bytes;
                 else if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_DEFER)
-                        udelay(100);
+                        usleep_range(400, 500);
                 else
                         return -EIO;
         }
-        return send_bytes;
+
+        DRM_ERROR("too many retries, giving up\n");
+        return -EIO;
 }
 
 /* Write a single byte to the aux channel in native mode */
@@ -582,6 +585,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
         int reply_bytes;
         uint8_t ack;
         int ret;
+        int retry;
 
         if (WARN_ON(recv_bytes > 19))
                 return -E2BIG;
@@ -595,7 +599,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
         msg_bytes = 4;
         reply_bytes = recv_bytes + 1;
 
-        for (;;) {
+        for (retry = 0; retry < 7; retry++) {
                 ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes,
                                       reply, reply_bytes);
                 if (ret == 0)
@@ -608,10 +612,13 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
                         return ret - 1;
                 }
                 else if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_DEFER)
-                        udelay(100);
+                        usleep_range(400, 500);
                 else
                         return -EIO;
         }
+
+        DRM_ERROR("too many retries, giving up\n");
+        return -EIO;
 }
 
 static int
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 6db0d9d17f47..ee3181ebcc92 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -845,7 +845,7 @@ static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
 {
         struct drm_device *dev = intel_hdmi_to_dev(hdmi);
 
-        if (IS_G4X(dev))
+        if (!hdmi->has_hdmi_sink || IS_G4X(dev))
                 return 165000;
         else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
                 return 300000;
@@ -899,8 +899,8 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
          * outputs. We also need to check that the higher clock still fits
          * within limits.
          */
-        if (pipe_config->pipe_bpp > 8*3 && clock_12bpc <= portclock_limit
-            && HAS_PCH_SPLIT(dev)) {
+        if (pipe_config->pipe_bpp > 8*3 && intel_hdmi->has_hdmi_sink &&
+            clock_12bpc <= portclock_limit && HAS_PCH_SPLIT(dev)) {
                 DRM_DEBUG_KMS("picking bpc to 12 for HDMI output\n");
                 desired_bpp = 12*3;
 
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 350de359123a..079ea38f14d9 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -698,7 +698,7 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
                 freq /= 0xff;
 
         ctl = freq << 17;
-        if (IS_GEN2(dev) && panel->backlight.combination_mode)
+        if (panel->backlight.combination_mode)
                 ctl |= BLM_LEGACY_MODE;
         if (IS_PINEVIEW(dev) && panel->backlight.active_low_pwm)
                 ctl |= BLM_POLARITY_PNV;
@@ -979,7 +979,7 @@ static int i9xx_setup_backlight(struct intel_connector *connector)
 
         ctl = I915_READ(BLC_PWM_CTL);
 
-        if (IS_GEN2(dev))
+        if (IS_GEN2(dev) || IS_I915GM(dev) || IS_I945GM(dev))
                 panel->backlight.combination_mode = ctl & BLM_LEGACY_MODE;
 
         if (IS_PINEVIEW(dev))
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d77cc81900f9..e1fc35a72656 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3493,6 +3493,8 @@ static void valleyview_setup_pctx(struct drm_device *dev)
         u32 pcbr;
         int pctx_size = 24*1024;
 
+        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
+
         pcbr = I915_READ(VLV_PCBR);
         if (pcbr) {
                 /* BIOS set it up already, grab the pre-alloc'd space */
@@ -3542,8 +3544,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
                 I915_WRITE(GTFIFODBG, gtfifodbg);
         }
 
-        valleyview_setup_pctx(dev);
-
         /* If VLV, Forcewake all wells, else re-direct to regular path */
         gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
 
@@ -4395,6 +4395,8 @@ void intel_enable_gt_powersave(struct drm_device *dev)
                 ironlake_enable_rc6(dev);
                 intel_init_emon(dev);
         } else if (IS_GEN6(dev) || IS_GEN7(dev)) {
+                if (IS_VALLEYVIEW(dev))
+                        valleyview_setup_pctx(dev);
                 /*
                  * PCU communication is slow and this doesn't need to be
                  * done at any specific time, so do this out of our fast path
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b7f1742caf87..31b36c5ac894 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1653,6 +1653,27 @@ int intel_ring_begin(struct intel_ring_buffer *ring,
         return 0;
 }
 
+/* Align the ring tail to a cacheline boundary */
+int intel_ring_cacheline_align(struct intel_ring_buffer *ring)
+{
+        int num_dwords = (64 - (ring->tail & 63)) / sizeof(uint32_t);
+        int ret;
+
+        if (num_dwords == 0)
+                return 0;
+
+        ret = intel_ring_begin(ring, num_dwords);
+        if (ret)
+                return ret;
+
+        while (num_dwords--)
+                intel_ring_emit(ring, MI_NOOP);
+
+        intel_ring_advance(ring);
+
+        return 0;
+}
+
 void intel_ring_init_seqno(struct intel_ring_buffer *ring, u32 seqno)
 {
         struct drm_i915_private *dev_priv = ring->dev->dev_private;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 71a73f4fe252..0b243ce33714 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -233,6 +233,7 @@ intel_write_status_page(struct intel_ring_buffer *ring,
 void intel_cleanup_ring_buffer(struct intel_ring_buffer *ring);
 
 int __must_check intel_ring_begin(struct intel_ring_buffer *ring, int n);
+int __must_check intel_ring_cacheline_align(struct intel_ring_buffer *ring);
 static inline void intel_ring_emit(struct intel_ring_buffer *ring,
                                    u32 data)
 {
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index e88145ba1bf5..d310c195bdfe 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -141,6 +141,7 @@ nouveau-y += core/subdev/mc/base.o
 nouveau-y += core/subdev/mc/nv04.o
 nouveau-y += core/subdev/mc/nv40.o
 nouveau-y += core/subdev/mc/nv44.o
+nouveau-y += core/subdev/mc/nv4c.o
 nouveau-y += core/subdev/mc/nv50.o
 nouveau-y += core/subdev/mc/nv94.o
 nouveau-y += core/subdev/mc/nv98.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv40.c b/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
index 1b653dd74a70..08b88591ed60 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
@@ -311,7 +311,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
@@ -334,7 +334,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv4e_fb_oclass;
@@ -357,7 +357,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
@@ -380,7 +380,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
@@ -403,7 +403,7 @@ nv40_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nv40_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv40_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] =  nv1a_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nv44_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nv4c_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nv31_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nv46_fb_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 940eaa5d8b9a..9ad722e4e087 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -1142,7 +1142,7 @@ nv50_disp_intr_unk20_2(struct nv50_disp_priv *priv, int head)
         if (conf != ~0) {
                 if (outp.location == 0 && outp.type == DCB_OUTPUT_DP) {
                         u32 soff = (ffs(outp.or) - 1) * 0x08;
-                        u32 ctrl = nv_rd32(priv, 0x610798 + soff);
+                        u32 ctrl = nv_rd32(priv, 0x610794 + soff);
                         u32 datarate;
 
                         switch ((ctrl & 0x000f0000) >> 16) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
index 9a850fe19515..54c1b5b471cd 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
@@ -112,7 +112,7 @@ nve0_fifo_runlist_update(struct nve0_fifo_priv *priv, u32 engine)
 
         nv_wr32(priv, 0x002270, cur->addr >> 12);
         nv_wr32(priv, 0x002274, (engine << 20) | (p >> 3));
-        if (!nv_wait(priv, 0x002284 + (engine * 4), 0x00100000, 0x00000000))
+        if (!nv_wait(priv, 0x002284 + (engine * 8), 0x00100000, 0x00000000))
                 nv_error(priv, "runlist %d update timeout\n", engine);
         mutex_unlock(&nv_subdev(priv)->mutex);
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c b/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
index 30ed19c52e05..7a367c402978 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
@@ -539,7 +539,7 @@ nv50_priv_tp_trap(struct nv50_graph_priv *priv, int type, u32 ustatus_old,
                                 ustatus &= ~0x04030000;
                         }
                         if (ustatus && display) {
-                                nv_error("%s - TP%d:", name, i);
+                                nv_error(priv, "%s - TP%d:", name, i);
                                 nouveau_bitfield_print(nv50_mpc_traps, ustatus);
                                 pr_cont("\n");
                                 ustatus = 0;
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
index adc88b73d911..3c6738edd127 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
@@ -47,6 +47,7 @@ struct nouveau_mc_oclass {
 extern struct nouveau_oclass *nv04_mc_oclass;
 extern struct nouveau_oclass *nv40_mc_oclass;
 extern struct nouveau_oclass *nv44_mc_oclass;
+extern struct nouveau_oclass *nv4c_mc_oclass;
 extern struct nouveau_oclass *nv50_mc_oclass;
 extern struct nouveau_oclass *nv94_mc_oclass;
 extern struct nouveau_oclass *nv98_mc_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
index aa0fbbec7f08..ef0c9c4a8cc3 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
@@ -130,6 +130,10 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
         u16 pcir;
         int i;
 
+        /* there is no prom on nv4x IGP's */
+        if (device->card_type == NV_40 && device->chipset >= 0x4c)
+                return;
+
         /* enable access to rom */
         if (device->card_type >= NV_50)
                 pcireg = 0x088050;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c
index 9159a5ccee93..265d1253624a 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv1a.c
@@ -36,7 +36,7 @@ nv1a_fb_oclass = &(struct nv04_fb_impl) {
                 .fini = _nouveau_fb_fini,
         },
         .base.memtype = nv04_fb_memtype_valid,
-        .base.ram = &nv10_ram_oclass,
+        .base.ram = &nv1a_ram_oclass,
         .tile.regions = 8,
         .tile.init = nv10_fb_tile_init,
         .tile.fini = nv10_fb_tile_fini,
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
index b0d5c31606c1..81a408e7d034 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
@@ -14,6 +14,7 @@ int  nv04_mc_ctor(struct nouveau_object *, struct nouveau_object *,
 extern const struct nouveau_mc_intr nv04_mc_intr[];
 int  nv04_mc_init(struct nouveau_object *);
 void nv40_mc_msi_rearm(struct nouveau_mc *);
+int  nv44_mc_init(struct nouveau_object *object);
 int  nv50_mc_init(struct nouveau_object *);
 extern const struct nouveau_mc_intr nv50_mc_intr[];
 extern const struct nouveau_mc_intr nvc0_mc_intr[];
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
index 3bfee5c6c4f2..cc4d0d2d886e 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
@@ -24,7 +24,7 @@
 
 #include "nv04.h"
 
-static int
+int
 nv44_mc_init(struct nouveau_object *object)
 {
         struct nv04_mc_priv *priv = (void *)object;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
new file mode 100644
index 000000000000..a75c35ccf25c
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2014 Ilia Mirkin
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ilia Mirkin
+ */
+
+#include "nv04.h"
+
+static void
+nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
+{
+        struct nv04_mc_priv *priv = (void *)pmc;
+        nv_wr08(priv, 0x088050, 0xff);
+}
+
+struct nouveau_oclass *
+nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
+        .base.handle = NV_SUBDEV(MC, 0x4c),
+        .base.ofuncs = &(struct nouveau_ofuncs) {
+                .ctor = nv04_mc_ctor,
+                .dtor = _nouveau_mc_dtor,
+                .init = nv44_mc_init,
+                .fini = _nouveau_mc_fini,
+        },
+        .intr = nv04_mc_intr,
+        .msi_rearm = nv4c_mc_msi_rearm,
+}.base;
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 4ef83df2b246..83face3f608f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -106,6 +106,29 @@ static int nouveau_optimus_dsm(acpi_handle handle, int func, int arg, uint32_t *
         return 0;
 }
 
+/*
+ * On some platforms, _DSM(nouveau_op_dsm_muid, func0) has special
+ * requirements on the fourth parameter, so a private implementation
+ * instead of using acpi_check_dsm().
+ */
+static int nouveau_check_optimus_dsm(acpi_handle handle)
+{
+        int result;
+
+        /*
+         * Function 0 returns a Buffer containing available functions.
+         * The args parameter is ignored for function 0, so just put 0 in it
+         */
+        if (nouveau_optimus_dsm(handle, 0, 0, &result))
+                return 0;
+
+        /*
+         * ACPI Spec v4 9.14.1: if bit 0 is zero, no function is supported.
+         * If the n-th bit is enabled, function n is supported
+         */
+        return result & 1 && result & (1 << NOUVEAU_DSM_OPTIMUS_CAPS);
+}
+
 static int nouveau_dsm(acpi_handle handle, int func, int arg)
 {
         int ret = 0;
@@ -207,8 +230,7 @@ static int nouveau_dsm_pci_probe(struct pci_dev *pdev)
                            1 << NOUVEAU_DSM_POWER))
                 retval |= NOUVEAU_DSM_HAS_MUX;
 
-        if (acpi_check_dsm(dhandle, nouveau_op_dsm_muid, 0x00000100,
-                           1 << NOUVEAU_DSM_OPTIMUS_CAPS))
+        if (nouveau_check_optimus_dsm(dhandle))
                 retval |= NOUVEAU_DSM_HAS_OPT;
 
         if (retval & NOUVEAU_DSM_HAS_OPT) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 488686d490c0..4aed1714b9ab 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1249,7 +1249,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem)
                         mem->bus.is_iomem = !dev->agp->cant_use_aperture;
                 }
 #endif
-                if (!node->memtype)
+                if (nv_device(drm->device)->card_type < NV_50 || !node->memtype)
                         /* untiled */
                         break;
                 /* fallthrough, tiled memory */
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 78c8e7146d56..89c484d8ac26 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -376,6 +376,8 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto fail_device;
 
+        dev->irq_enabled = true;
+
         /* workaround an odd issue on nvc1 by disabling the device's
          * nosnoop capability.  hopefully won't cause issues until a
          * better fix is found - assuming there is one...
@@ -475,6 +477,7 @@ nouveau_drm_remove(struct pci_dev *pdev)
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nouveau_object *device;
 
+        dev->irq_enabled = false;
         device = drm->client.base.device;
         drm_put_dev(dev);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index 81638d7f2eff..471347edc27e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -14,7 +14,9 @@ nouveau_vga_set_decode(void *priv, bool state)
 {
         struct nouveau_device *device = nouveau_dev(priv);
 
-        if (device->chipset >= 0x40)
+        if (device->card_type == NV_40 && device->chipset >= 0x4c)
+                nv_wr32(device, 0x088060, state);
+        else if (device->chipset >= 0x40)
                 nv_wr32(device, 0x088054, state);
         else
                 nv_wr32(device, 0x001854, state);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index a9338c85630f..daa4dd375ab1 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -559,7 +559,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
         u32 adjusted_clock = mode->clock;
         int encoder_mode = atombios_get_encoder_mode(encoder);
         u32 dp_clock = mode->clock;
-        int bpc = radeon_get_monitor_bpc(connector);
+        int bpc = radeon_crtc->bpc;
         bool is_duallink = radeon_dig_monitor_is_duallink(encoder, mode->clock);
 
         /* reset the pll flags */
@@ -1176,7 +1176,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                 evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
 
                 /* Set NUM_BANKS. */
-                if (rdev->family >= CHIP_BONAIRE) {
+                if (rdev->family >= CHIP_TAHITI) {
                         unsigned tileb, index, num_banks, tile_split_bytes;
 
                         /* Calculate the macrotile mode index. */
@@ -1194,13 +1194,14 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                                 return -EINVAL;
                         }
 
-                        num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
+                        if (rdev->family >= CHIP_BONAIRE)
+                                num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
+                        else
+                                num_banks = (rdev->config.si.tile_mode_array[index] >> 20) & 0x3;
                         fb_format |= EVERGREEN_GRPH_NUM_BANKS(num_banks);
                 } else {
-                        /* SI and older. */
-                        if (rdev->family >= CHIP_TAHITI)
-                                tmp = rdev->config.si.tile_config;
-                        else if (rdev->family >= CHIP_CAYMAN)
+                        /* NI and older. */
+                        if (rdev->family >= CHIP_CAYMAN)
                                 tmp = rdev->config.cayman.tile_config;
                         else
                                 tmp = rdev->config.evergreen.tile_config;
@@ -1773,6 +1774,20 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                         return ATOM_PPLL1;
                 DRM_ERROR("unable to allocate a PPLL\n");
                 return ATOM_PPLL_INVALID;
+        } else if (ASIC_IS_DCE41(rdev)) {
+                /* Don't share PLLs on DCE4.1 chips */
+                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) {
+                        if (rdev->clock.dp_extclk)
+                                /* skip PPLL programming if using ext clock */
+                                return ATOM_PPLL_INVALID;
+                }
+                pll_in_use = radeon_get_pll_use_mask(crtc);
+                if (!(pll_in_use & (1 << ATOM_PPLL1)))
+                        return ATOM_PPLL1;
+                if (!(pll_in_use & (1 << ATOM_PPLL2)))
+                        return ATOM_PPLL2;
+                DRM_ERROR("unable to allocate a PPLL\n");
+                return ATOM_PPLL_INVALID;
         } else if (ASIC_IS_DCE4(rdev)) {
                 /* in DP mode, the DP ref clock can come from PPLL, DCPLL, or ext clock,
                  * depending on the asic:
@@ -1800,7 +1815,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                 if (pll != ATOM_PPLL_INVALID)
                                         return pll;
                         }
-                } else if (!ASIC_IS_DCE41(rdev)) { /* Don't share PLLs on DCE4.1 chips */
+                } else {
                         /* use the same PPLL for all monitors with the same clock */
                         pll = radeon_get_shared_nondp_ppll(crtc);
                         if (pll != ATOM_PPLL_INVALID)
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index a42d61571f49..607dc14d195e 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -464,11 +464,12 @@ atombios_tv_setup(struct drm_encoder *encoder, int action)
 
 static u8 radeon_atom_get_bpc(struct drm_encoder *encoder)
 {
-        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
         int bpc = 8;
 
-        if (connector)
-                bpc = radeon_get_monitor_bpc(connector);
+        if (encoder->crtc) {
+                struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
+                bpc = radeon_crtc->bpc;
+        }
 
         switch (bpc) {
         case 0:
@@ -1313,7 +1314,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                         }
                         if (is_dp)
                                 args.v5.ucLaneNum = dp_lane_count;
-                        else if (radeon_encoder->pixel_clock > 165000)
+                        else if (radeon_dig_monitor_is_duallink(encoder, radeon_encoder->pixel_clock))
                                 args.v5.ucLaneNum = 8;
                         else
                                 args.v5.ucLaneNum = 4;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e6419ca7cd37..e22be8458d92 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3046,7 +3046,7 @@ static u32 cik_create_bitmask(u32 bit_width)
 }
 
 /**
- * cik_select_se_sh - select which SE, SH to address
+ * cik_get_rb_disabled - computes the mask of disabled RBs
  *
  * @rdev: radeon_device pointer
  * @max_rb_num: max RBs (render backends) for the asic
@@ -7902,7 +7902,8 @@ int cik_resume(struct radeon_device *rdev)
         /* init golden registers */
         cik_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = cik_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 713a5d359901..94e858751994 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -278,13 +278,15 @@ static int dce6_audio_chipset_supported(struct radeon_device *rdev)
         return !ASIC_IS_NODCE(rdev);
 }
 
-static void dce6_audio_enable(struct radeon_device *rdev,
-                              struct r600_audio_pin *pin,
-                              bool enable)
+void dce6_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable)
 {
+        if (!pin)
+                return;
+
         WREG32_ENDPOINT(pin->offset, AZ_F0_CODEC_PIN_CONTROL_HOTPLUG_CONTROL,
-                        AUDIO_ENABLED);
-        DRM_INFO("%s audio %d support\n", enable ? "Enabling" : "Disabling", pin->id);
+                        enable ? AUDIO_ENABLED : 0);
 }
 
 static const u32 pin_offsets[7] =
@@ -323,7 +325,8 @@ int dce6_audio_init(struct radeon_device *rdev)
                 rdev->audio.pin[i].connected = false;
                 rdev->audio.pin[i].offset = pin_offsets[i];
                 rdev->audio.pin[i].id = i;
-                dce6_audio_enable(rdev, &rdev->audio.pin[i], true);
+                /* disable audio.  it will be set up later */
+                dce6_audio_enable(rdev, &rdev->audio.pin[i], false);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f2b9e21ce4da..27b0ff16082e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1680,7 +1680,7 @@ bool evergreen_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd)
         case RADEON_HPD_6:
                 if (RREG32(DC_HPD6_INT_STATUS) & DC_HPDx_SENSE)
                         connected = true;
-                        break;
+                break;
         default:
                 break;
         }
@@ -5299,7 +5299,8 @@ int evergreen_resume(struct radeon_device *rdev)
         /* init golden registers */
         evergreen_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = evergreen_startup(rdev);
@@ -5475,9 +5476,9 @@ void evergreen_fini(struct radeon_device *rdev)
         radeon_wb_fini(rdev);
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
-        evergreen_pcie_gart_fini(rdev);
         uvd_v1_0_fini(rdev);
         radeon_uvd_fini(rdev);
+        evergreen_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
         radeon_fence_driver_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index 0c6d5cef4cf1..05b0c95813fd 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -306,6 +306,15 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
                 return;
         offset = dig->afmt->offset;
 
+        /* disable audio prior to setting up hw */
+        if (ASIC_IS_DCE6(rdev)) {
+                dig->afmt->pin = dce6_audio_get_pin(rdev);
+                dce6_audio_enable(rdev, dig->afmt->pin, false);
+        } else {
+                dig->afmt->pin = r600_audio_get_pin(rdev);
+                r600_audio_enable(rdev, dig->afmt->pin, false);
+        }
+
         evergreen_audio_set_dto(encoder, mode->clock);
 
         WREG32(HDMI_VBI_PACKET_CONTROL + offset,
@@ -409,12 +418,16 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
         WREG32(AFMT_RAMP_CONTROL1 + offset, 0x007FFFFF);
         WREG32(AFMT_RAMP_CONTROL2 + offset, 0x00000001);
         WREG32(AFMT_RAMP_CONTROL3 + offset, 0x00000001);
+
+        /* enable audio after to setting up hw */
+        if (ASIC_IS_DCE6(rdev))
+                dce6_audio_enable(rdev, dig->afmt->pin, true);
+        else
+                r600_audio_enable(rdev, dig->afmt->pin, true);
 }
 
 void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
 {
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 
@@ -427,15 +440,6 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!enable && !dig->afmt->enabled)
                 return;
 
-        if (enable) {
-                if (ASIC_IS_DCE6(rdev))
-                        dig->afmt->pin = dce6_audio_get_pin(rdev);
-                else
-                        dig->afmt->pin = r600_audio_get_pin(rdev);
-        } else {
-                dig->afmt->pin = NULL;
-        }
-
         dig->afmt->enabled = enable;
 
         DRM_DEBUG("%sabling HDMI interface @ 0x%04X for encoder 0x%x\n",
diff --git a/drivers/gpu/drm/radeon/evergreen_smc.h b/drivers/gpu/drm/radeon/evergreen_smc.h
index 76ada8cfe902..3a03ba37d043 100644
--- a/drivers/gpu/drm/radeon/evergreen_smc.h
+++ b/drivers/gpu/drm/radeon/evergreen_smc.h
@@ -57,7 +57,7 @@ typedef struct SMC_Evergreen_MCRegisters SMC_Evergreen_MCRegisters;
 
 #define EVERGREEN_SMC_FIRMWARE_HEADER_LOCATION 0x100
 
-#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x0
+#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x8
 #define EVERGREEN_SMC_FIRMWARE_HEADER_stateTable      0xC
 #define EVERGREEN_SMC_FIRMWARE_HEADER_mcRegisterTable 0x20
 
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index ea932ac66fc6..bf6300cfd62d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -2105,7 +2105,8 @@ int cayman_resume(struct radeon_device *rdev)
         /* init golden registers */
         ni_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = cayman_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 1217fbcbdcca..ca814276b075 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -2588,7 +2588,7 @@ static int ni_populate_sq_ramping_values(struct radeon_device *rdev,
         if (NISLANDS_DPM2_SQ_RAMP_STI_SIZE > (STI_SIZE_MASK >> STI_SIZE_SHIFT))
                 enable_sq_ramping = false;
 
-        if (NISLANDS_DPM2_SQ_RAMP_LTI_RATIO <= (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
+        if (NISLANDS_DPM2_SQ_RAMP_LTI_RATIO > (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
                 enable_sq_ramping = false;
 
         for (i = 0; i < state->performance_level_count; i++) {
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index ef024ce3f7cc..3cc78bb66042 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3942,8 +3942,6 @@ int r100_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r100_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 7c63ef840e86..0b658b34b33a 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -1430,8 +1430,6 @@ int r300_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r300_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 3768aab2710b..802b19220a21 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -325,8 +325,6 @@ int r420_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r420_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index e209eb75024f..98d6053c36c6 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -240,8 +240,6 @@ int r520_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r520_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index cdbc4171fe73..647ef4079217 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2968,7 +2968,8 @@ int r600_resume(struct radeon_device *rdev)
         /* post card */
         atom_asic_init(rdev->mode_info.atom_context);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = r600_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index 47fc2b886979..bffac10c4296 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -142,12 +142,15 @@ void r600_audio_update_hdmi(struct work_struct *work)
 }
 
 /* enable the audio stream */
-static void r600_audio_enable(struct radeon_device *rdev,
-                              struct r600_audio_pin *pin,
-                              bool enable)
+void r600_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable)
 {
         u32 value = 0;
 
+        if (!pin)
+                return;
+
         if (ASIC_IS_DCE4(rdev)) {
                 if (enable) {
                         value |= 0x81000000; /* Required to enable audio */
@@ -158,7 +161,6 @@ static void r600_audio_enable(struct radeon_device *rdev,
                 WREG32_P(R600_AUDIO_ENABLE,
                          enable ? 0x81000000 : 0x0, ~0x81000000);
         }
-        DRM_INFO("%s audio %d support\n", enable ? "Enabling" : "Disabling", pin->id);
 }
 
 /*
@@ -178,8 +180,8 @@ int r600_audio_init(struct radeon_device *rdev)
         rdev->audio.pin[0].status_bits = 0;
         rdev->audio.pin[0].category_code = 0;
         rdev->audio.pin[0].id = 0;
-
-        r600_audio_enable(rdev, &rdev->audio.pin[0], true);
+        /* disable audio.  it will be set up later */
+        r600_audio_enable(rdev, &rdev->audio.pin[0], false);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 3016fc14f502..85a2bb28aed2 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -329,9 +329,6 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         u8 *sadb;
         int sad_count;
 
-        /* XXX: setting this register causes hangs on some asics */
-        return;
-
         list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                 if (connector->encoder == encoder) {
                         radeon_connector = to_radeon_connector(connector);
@@ -460,6 +457,10 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
                 return;
         offset = dig->afmt->offset;
 
+        /* disable audio prior to setting up hw */
+        dig->afmt->pin = r600_audio_get_pin(rdev);
+        r600_audio_enable(rdev, dig->afmt->pin, false);
+
         r600_audio_set_dto(encoder, mode->clock);
 
         WREG32(HDMI0_VBI_PACKET_CONTROL + offset,
@@ -531,6 +532,9 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
         WREG32(HDMI0_RAMP_CONTROL3 + offset, 0x00000001);
 
         r600_hdmi_audio_workaround(encoder);
+
+        /* enable audio after to setting up hw */
+        r600_audio_enable(rdev, dig->afmt->pin, true);
 }
 
 /*
@@ -651,11 +655,6 @@ void r600_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!enable && !dig->afmt->enabled)
                 return;
 
-        if (enable)
-                dig->afmt->pin = r600_audio_get_pin(rdev);
-        else
-                dig->afmt->pin = NULL;
-
         /* Older chipsets require setting HDMI and routing manually */
         if (!ASIC_IS_DCE3(rdev)) {
                 if (enable)
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 4a8ac1cd6b4c..e887d027b6d0 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -135,6 +135,9 @@ extern int radeon_hard_reset;
 /* R600+ */
 #define R600_RING_TYPE_UVD_INDEX        5
 
+/* number of hw syncs before falling back on blocking */
+#define RADEON_NUM_SYNCS                        4
+
 /* hardcode those limit for now */
 #define RADEON_VA_IB_OFFSET                     (1 << 20)
 #define RADEON_VA_RESERVED_SIZE                 (8 << 20)
@@ -554,7 +557,6 @@ int radeon_mode_dumb_mmap(struct drm_file *filp,
 /*
  * Semaphores.
  */
-/* everything here is constant */
 struct radeon_semaphore {
         struct radeon_sa_bo             *sa_bo;
         signed                          waiters;
@@ -2745,6 +2747,12 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
 void r600_audio_update_hdmi(struct work_struct *work);
 struct r600_audio_pin *r600_audio_get_pin(struct radeon_device *rdev);
 struct r600_audio_pin *dce6_audio_get_pin(struct radeon_device *rdev);
+void r600_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable);
+void dce6_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable);
 
 /*
  * R600 vram scratch functions
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 485848f889f5..fa9a9c02751e 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -219,7 +219,8 @@ static int radeon_atpx_verify_interface(struct radeon_atpx *atpx)
         memcpy(&output, info->buffer.pointer, size);
 
         /* TODO: check version? */
-        printk("ATPX version %u\n", output.version);
+        printk("ATPX version %u, functions 0x%08x\n",
+               output.version, output.function_bits);
 
         radeon_atpx_parse_functions(&atpx->functions, output.function_bits);
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index b012cbbc3ed5..044bc98fb459 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1521,13 +1521,16 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         if (r)
                 DRM_ERROR("ib ring test failed (%d).\n", r);
 
-        if (rdev->pm.dpm_enabled) {
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
                 /* do dpm late init */
                 r = radeon_pm_late_init(rdev);
                 if (r) {
                         rdev->pm.dpm_enabled = false;
                         DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n");
                 }
+        } else {
+                /* resume old pm late */
+                radeon_pm_resume(rdev);
         }
 
         radeon_restore_bios_scratch_regs(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index d680608f6f5b..fbd8b930f2be 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -571,6 +571,8 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
                 radeon_crtc->max_cursor_width = CURSOR_WIDTH;
                 radeon_crtc->max_cursor_height = CURSOR_HEIGHT;
         }
+        dev->mode_config.cursor_width = radeon_crtc->max_cursor_width;
+        dev->mode_config.cursor_height = radeon_crtc->max_cursor_height;
 
 #if 0
         radeon_crtc->mode_set.crtc = &radeon_crtc->base;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 114d1672d616..2aecd6dc2610 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -537,6 +537,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
 
                 radeon_vm_init(rdev, &fpriv->vm);
 
+                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                if (r)
+                        return r;
+
                 /* map the ib pool buffer read only into
                  * virtual address space */
                 bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
@@ -544,6 +548,8 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                 r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
                                           RADEON_VM_PAGE_READABLE |
                                           RADEON_VM_PAGE_SNOOPED);
+
+                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
                 if (r) {
                         radeon_vm_fini(rdev, &fpriv->vm);
                         kfree(fpriv);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 1b783f0e6d3a..15e44a7281ab 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -139,7 +139,7 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
         }
 
         /* 64 dwords should be enough for fence too */
-        r = radeon_ring_lock(rdev, ring, 64 + RADEON_NUM_RINGS * 8);
+        r = radeon_ring_lock(rdev, ring, 64 + RADEON_NUM_SYNCS * 8);
         if (r) {
                 dev_err(rdev->dev, "scheduling IB failed (%d).\n", r);
                 return r;
diff --git a/drivers/gpu/drm/radeon/radeon_semaphore.c b/drivers/gpu/drm/radeon/radeon_semaphore.c
index 2b42aa1914f2..9006b32d5eed 100644
--- a/drivers/gpu/drm/radeon/radeon_semaphore.c
+++ b/drivers/gpu/drm/radeon/radeon_semaphore.c
@@ -34,14 +34,15 @@
 int radeon_semaphore_create(struct radeon_device *rdev,
                             struct radeon_semaphore **semaphore)
 {
+        uint32_t *cpu_addr;
         int i, r;
 
         *semaphore = kmalloc(sizeof(struct radeon_semaphore), GFP_KERNEL);
         if (*semaphore == NULL) {
                 return -ENOMEM;
         }
-        r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo,
-                             &(*semaphore)->sa_bo, 8, 8, true);
+        r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo, &(*semaphore)->sa_bo,
+                             8 * RADEON_NUM_SYNCS, 8, true);
         if (r) {
                 kfree(*semaphore);
                 *semaphore = NULL;
@@ -49,7 +50,10 @@ int radeon_semaphore_create(struct radeon_device *rdev,
         }
         (*semaphore)->waiters = 0;
         (*semaphore)->gpu_addr = radeon_sa_bo_gpu_addr((*semaphore)->sa_bo);
-        *((uint64_t*)radeon_sa_bo_cpu_addr((*semaphore)->sa_bo)) = 0;
+
+        cpu_addr = radeon_sa_bo_cpu_addr((*semaphore)->sa_bo);
+        for (i = 0; i < RADEON_NUM_SYNCS; ++i)
+                cpu_addr[i] = 0;
 
         for (i = 0; i < RADEON_NUM_RINGS; ++i)
                 (*semaphore)->sync_to[i] = NULL;
@@ -125,6 +129,7 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                                 struct radeon_semaphore *semaphore,
                                 int ring)
 {
+        unsigned count = 0;
         int i, r;
 
         for (i = 0; i < RADEON_NUM_RINGS; ++i) {
@@ -140,6 +145,12 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                         return -EINVAL;
                 }
 
+                if (++count > RADEON_NUM_SYNCS) {
+                        /* not enough room, wait manually */
+                        radeon_fence_wait_locked(fence);
+                        continue;
+                }
+
                 /* allocate enough space for sync command */
                 r = radeon_ring_alloc(rdev, &rdev->ring[i], 16);
                 if (r) {
@@ -164,6 +175,8 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
 
                 radeon_ring_commit(rdev, &rdev->ring[i]);
                 radeon_fence_note_sync(fence, ring);
+
+                semaphore->gpu_addr += 8;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 77f5b0c3edb8..040a2a10ea17 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -714,6 +714,9 @@ int radeon_ttm_init(struct radeon_device *rdev)
                 DRM_ERROR("Failed initializing VRAM heap.\n");
                 return r;
         }
+        /* Change the size here instead of the init above so only lpfn is affected */
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
+
         r = radeon_bo_create(rdev, 256 * 1024, PAGE_SIZE, true,
                              RADEON_GEM_DOMAIN_VRAM,
                              NULL, &rdev->stollen_vga_memory);
@@ -935,7 +938,7 @@ static ssize_t radeon_ttm_gtt_read(struct file *f, char __user *buf,
         while (size) {
                 loff_t p = *pos / PAGE_SIZE;
                 unsigned off = *pos & ~PAGE_MASK;
-                ssize_t cur_size = min(size, PAGE_SIZE - off);
+                size_t cur_size = min_t(size_t, size, PAGE_SIZE - off);
                 struct page *page;
                 void *ptr;
 
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 6781fee1eaad..3e6804b2b2ef 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -171,6 +171,8 @@ void radeon_uvd_fini(struct radeon_device *rdev)
 
         radeon_bo_unref(&rdev->uvd.vcpu_bo);
 
+        radeon_ring_fini(rdev, &rdev->ring[R600_RING_TYPE_UVD_INDEX]);
+
         release_firmware(rdev->uvd_fw);
 }
 
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b5c2369cda2f..130d5cc50d43 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -474,8 +474,6 @@ int rs400_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs400_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index fdcde7693032..72d3616de08e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -1048,8 +1048,6 @@ int rs600_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs600_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 35950738bd5e..3462b64369bf 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -756,8 +756,6 @@ int rs690_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs690_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 98e8138ff779..237dd29d9f1c 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -586,8 +586,6 @@ int rv515_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r =  rv515_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 6c772e58c784..fef310773aad 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1811,7 +1811,8 @@ int rv770_resume(struct radeon_device *rdev)
         /* init golden registers */
         rv770_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = rv770_startup(rdev);
@@ -1955,9 +1956,9 @@ void rv770_fini(struct radeon_device *rdev)
         radeon_wb_fini(rdev);
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
-        rv770_pcie_gart_fini(rdev);
         uvd_v1_0_fini(rdev);
         radeon_uvd_fini(rdev);
+        rv770_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
         radeon_fence_driver_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 5b2ea8ac0731..b5f63f5e22a3 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2526,14 +2526,7 @@ u32 rv770_dpm_get_mclk(struct radeon_device *rdev, bool low)
 bool rv770_dpm_vblank_too_short(struct radeon_device *rdev)
 {
         u32 vblank_time = r600_dpm_get_vblank_time(rdev);
-        u32 switch_limit = 300;
-
-        /* quirks */
-        /* ASUS K70AF */
-        if ((rdev->pdev->device == 0x9553) &&
-            (rdev->pdev->subsystem_vendor == 0x1043) &&
-            (rdev->pdev->subsystem_device == 0x1c42))
-                switch_limit = 200;
+        u32 switch_limit = 200; /* 300 */
 
         /* RV770 */
         /* mclk switching doesn't seem to work reliably on desktop RV770s */
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 83578324e5d1..9a124d0608b3 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6618,7 +6618,8 @@ int si_resume(struct radeon_device *rdev)
         /* init golden registers */
         si_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = si_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index eafb0e6bc67e..0a2f5b4bca43 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2395,7 +2395,7 @@ static int si_populate_sq_ramping_values(struct radeon_device *rdev,
         if (SISLANDS_DPM2_SQ_RAMP_STI_SIZE > (STI_SIZE_MASK >> STI_SIZE_SHIFT))
                 enable_sq_ramping = false;
 
-        if (SISLANDS_DPM2_SQ_RAMP_LTI_RATIO <= (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
+        if (SISLANDS_DPM2_SQ_RAMP_LTI_RATIO > (LTI_RATIO_MASK >> LTI_RATIO_SHIFT))
                 enable_sq_ramping = false;
 
         for (i = 0; i < state->performance_level_count; i++) {
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 88a529008ce0..c71594754f46 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -104,7 +104,7 @@ static void tegra_drm_context_free(struct tegra_drm_context *context)
 
 static void tegra_drm_lastclose(struct drm_device *drm)
 {
-#ifdef CONFIG_TEGRA_DRM_FBDEV
+#ifdef CONFIG_DRM_TEGRA_FBDEV
         struct tegra_drm *tegra = drm->dev_private;
 
         tegra_fbdev_restore_mode(tegra->fbdev);
diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
index 338f7f6561d7..0266fb40479e 100644
--- a/drivers/gpu/drm/tegra/rgb.c
+++ b/drivers/gpu/drm/tegra/rgb.c
@@ -15,6 +15,7 @@
 struct tegra_rgb {
         struct tegra_output output;
         struct tegra_dc *dc;
+        bool enabled;
 
         struct clk *clk_parent;
         struct clk *clk;
@@ -89,6 +90,9 @@ static int tegra_output_rgb_enable(struct tegra_output *output)
         struct tegra_rgb *rgb = to_rgb(output);
         unsigned long value;
 
+        if (rgb->enabled)
+                return 0;
+
         tegra_dc_write_regs(rgb->dc, rgb_enable, ARRAY_SIZE(rgb_enable));
 
         value = DE_SELECT_ACTIVE | DE_CONTROL_NORMAL;
@@ -122,6 +126,8 @@ static int tegra_output_rgb_enable(struct tegra_output *output)
         tegra_dc_writel(rgb->dc, GENERAL_ACT_REQ << 8, DC_CMD_STATE_CONTROL);
         tegra_dc_writel(rgb->dc, GENERAL_ACT_REQ, DC_CMD_STATE_CONTROL);
 
+        rgb->enabled = true;
+
         return 0;
 }
 
@@ -130,6 +136,9 @@ static int tegra_output_rgb_disable(struct tegra_output *output)
         struct tegra_rgb *rgb = to_rgb(output);
         unsigned long value;
 
+        if (!rgb->enabled)
+                return 0;
+
         value = tegra_dc_readl(rgb->dc, DC_CMD_DISPLAY_POWER_CONTROL);
         value &= ~(PW0_ENABLE | PW1_ENABLE | PW2_ENABLE | PW3_ENABLE |
                    PW4_ENABLE | PM0_ENABLE | PM1_ENABLE);
@@ -144,6 +153,8 @@ static int tegra_output_rgb_disable(struct tegra_output *output)
 
         tegra_dc_write_regs(rgb->dc, rgb_disable, ARRAY_SIZE(rgb_disable));
 
+        rgb->enabled = false;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/ttm/ttm_agp_backend.c b/drivers/gpu/drm/ttm/ttm_agp_backend.c
index 3302f99e7497..764be36397fd 100644
--- a/drivers/gpu/drm/ttm/ttm_agp_backend.c
+++ b/drivers/gpu/drm/ttm/ttm_agp_backend.c
@@ -126,6 +126,7 @@ struct ttm_tt *ttm_agp_tt_create(struct ttm_bo_device *bdev,
         agp_be->ttm.func = &ttm_agp_func;
 
         if (ttm_tt_init(&agp_be->ttm, bdev, size, page_flags, dummy_read_page)) {
+                kfree(agp_be);
                 return NULL;
         }
 
diff --git a/drivers/gpu/drm/vmwgfx/svga3d_reg.h b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
index b645647b7776..f58dc7dd15c5 100644
--- a/drivers/gpu/drm/vmwgfx/svga3d_reg.h
+++ b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
@@ -261,12 +261,7 @@ typedef enum SVGA3dSurfaceFormat {
    /* Planar video formats. */
    SVGA3D_YV12                         = 121,
 
-   /* Shader constant formats. */
-   SVGA3D_SURFACE_SHADERCONST_FLOAT    = 122,
-   SVGA3D_SURFACE_SHADERCONST_INT      = 123,
-   SVGA3D_SURFACE_SHADERCONST_BOOL     = 124,
-
-   SVGA3D_FORMAT_MAX                   = 125,
+   SVGA3D_FORMAT_MAX                   = 122,
 } SVGA3dSurfaceFormat;
 
 typedef uint32 SVGA3dColor; /* a, r, g, b */
@@ -1223,9 +1218,19 @@ typedef enum {
 #define SVGA_3D_CMD_INVALIDATE_GB_IMAGE_PARTIAL 1129
 
 #define SVGA_3D_CMD_SET_GB_SHADERCONSTS_INLINE  1130
-
+#define SVGA_3D_CMD_GB_SCREEN_DMA               1131
+#define SVGA_3D_CMD_BIND_GB_SURFACE_WITH_PITCH  1132
+#define SVGA_3D_CMD_GB_MOB_FENCE                1133
+#define SVGA_3D_CMD_DEFINE_GB_SURFACE_V2        1134
 #define SVGA_3D_CMD_DEFINE_GB_MOB64          1135
 #define SVGA_3D_CMD_REDEFINE_GB_MOB64        1136
+#define SVGA_3D_CMD_NOP_ERROR                1137
+
+#define SVGA_3D_CMD_RESERVED1                1138
+#define SVGA_3D_CMD_RESERVED2                1139
+#define SVGA_3D_CMD_RESERVED3                1140
+#define SVGA_3D_CMD_RESERVED4                1141
+#define SVGA_3D_CMD_RESERVED5                1142
 
 #define SVGA_3D_CMD_MAX                      1142
 #define SVGA_3D_CMD_FUTURE_MAX               3000
@@ -1973,8 +1978,7 @@ struct {
    uint32 sizeInBytes;
    uint32 validSizeInBytes;
    SVGAMobFormat ptDepth;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdSetOTableBase;  /* SVGA_3D_CMD_SET_OTABLE_BASE */
 
 typedef
@@ -1984,15 +1988,13 @@ struct {
    uint32 sizeInBytes;
    uint32 validSizeInBytes;
    SVGAMobFormat ptDepth;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdSetOTableBase64;  /* SVGA_3D_CMD_SET_OTABLE_BASE64 */
 
 typedef
 struct {
    SVGAOTableType type;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdReadbackOTable;  /* SVGA_3D_CMD_READBACK_OTABLE */
 
 /*
@@ -2005,8 +2007,7 @@ struct SVGA3dCmdDefineGBMob {
    SVGAMobFormat ptDepth;
    PPN base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdDefineGBMob;   /* SVGA_3D_CMD_DEFINE_GB_MOB */
 
 
@@ -2017,8 +2018,7 @@ SVGA3dCmdDefineGBMob;   /* SVGA_3D_CMD_DEFINE_GB_MOB */
 typedef
 struct SVGA3dCmdDestroyGBMob {
    SVGAMobId mobid;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdDestroyGBMob;   /* SVGA_3D_CMD_DESTROY_GB_MOB */
 
 /*
@@ -2031,8 +2031,7 @@ struct SVGA3dCmdRedefineGBMob {
    SVGAMobFormat ptDepth;
    PPN base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdRedefineGBMob;   /* SVGA_3D_CMD_REDEFINE_GB_MOB */
 
 /*
@@ -2045,8 +2044,7 @@ struct SVGA3dCmdDefineGBMob64 {
    SVGAMobFormat ptDepth;
    PPN64 base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdDefineGBMob64;   /* SVGA_3D_CMD_DEFINE_GB_MOB64 */
 
 /*
@@ -2059,8 +2057,7 @@ struct SVGA3dCmdRedefineGBMob64 {
    SVGAMobFormat ptDepth;
    PPN64 base;
    uint32 sizeInBytes;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdRedefineGBMob64;   /* SVGA_3D_CMD_REDEFINE_GB_MOB64 */
 
 /*
@@ -2070,8 +2067,7 @@ SVGA3dCmdRedefineGBMob64;   /* SVGA_3D_CMD_REDEFINE_GB_MOB64 */
 typedef
 struct SVGA3dCmdUpdateGBMobMapping {
    SVGAMobId mobid;
-}
-__attribute__((__packed__))
+} __packed
 SVGA3dCmdUpdateGBMobMapping;   /* SVGA_3D_CMD_UPDATE_GB_MOB_MAPPING */
 
 /*
@@ -2087,7 +2083,8 @@ struct SVGA3dCmdDefineGBSurface {
    uint32 multisampleCount;
    SVGA3dTextureFilter autogenFilter;
    SVGA3dSize size;
-} SVGA3dCmdDefineGBSurface;   /* SVGA_3D_CMD_DEFINE_GB_SURFACE */
+} __packed
+SVGA3dCmdDefineGBSurface;   /* SVGA_3D_CMD_DEFINE_GB_SURFACE */
 
 /*
  * Destroy a guest-backed surface.
@@ -2096,7 +2093,8 @@ struct SVGA3dCmdDefineGBSurface {
 typedef
 struct SVGA3dCmdDestroyGBSurface {
    uint32 sid;
-} SVGA3dCmdDestroyGBSurface;   /* SVGA_3D_CMD_DESTROY_GB_SURFACE */
+} __packed
+SVGA3dCmdDestroyGBSurface;   /* SVGA_3D_CMD_DESTROY_GB_SURFACE */
 
 /*
  * Bind a guest-backed surface to an object.
@@ -2106,7 +2104,8 @@ typedef
 struct SVGA3dCmdBindGBSurface {
    uint32 sid;
    SVGAMobId mobid;
-} SVGA3dCmdBindGBSurface;   /* SVGA_3D_CMD_BIND_GB_SURFACE */
+} __packed
+SVGA3dCmdBindGBSurface;   /* SVGA_3D_CMD_BIND_GB_SURFACE */
 
 /*
  * Conditionally bind a mob to a guest backed surface if testMobid
@@ -2123,7 +2122,7 @@ struct{
    SVGAMobId testMobid;
    SVGAMobId mobid;
    uint32 flags;
-}
+} __packed
 SVGA3dCmdCondBindGBSurface;          /* SVGA_3D_CMD_COND_BIND_GB_SURFACE */
 
 /*
@@ -2135,7 +2134,8 @@ typedef
 struct SVGA3dCmdUpdateGBImage {
    SVGA3dSurfaceImageId image;
    SVGA3dBox box;
-} SVGA3dCmdUpdateGBImage;   /* SVGA_3D_CMD_UPDATE_GB_IMAGE */
+} __packed
+SVGA3dCmdUpdateGBImage;   /* SVGA_3D_CMD_UPDATE_GB_IMAGE */
 
 /*
  * Update an entire guest-backed surface.
@@ -2145,7 +2145,8 @@ struct SVGA3dCmdUpdateGBImage {
 typedef
 struct SVGA3dCmdUpdateGBSurface {
    uint32 sid;
-} SVGA3dCmdUpdateGBSurface;   /* SVGA_3D_CMD_UPDATE_GB_SURFACE */
+} __packed
+SVGA3dCmdUpdateGBSurface;   /* SVGA_3D_CMD_UPDATE_GB_SURFACE */
 
 /*
  * Readback an image in a guest-backed surface.
@@ -2155,7 +2156,8 @@ struct SVGA3dCmdUpdateGBSurface {
 typedef
 struct SVGA3dCmdReadbackGBImage {
    SVGA3dSurfaceImageId image;
-} SVGA3dCmdReadbackGBImage;   /* SVGA_3D_CMD_READBACK_GB_IMAGE*/
+} __packed
+SVGA3dCmdReadbackGBImage;   /* SVGA_3D_CMD_READBACK_GB_IMAGE*/
 
 /*
  * Readback an entire guest-backed surface.
@@ -2165,7 +2167,8 @@ struct SVGA3dCmdReadbackGBImage {
 typedef
 struct SVGA3dCmdReadbackGBSurface {
    uint32 sid;
-} SVGA3dCmdReadbackGBSurface;   /* SVGA_3D_CMD_READBACK_GB_SURFACE */
+} __packed
+SVGA3dCmdReadbackGBSurface;   /* SVGA_3D_CMD_READBACK_GB_SURFACE */
 
 /*
  * Readback a sub rect of an image in a guest-backed surface.  After
@@ -2179,7 +2182,7 @@ struct SVGA3dCmdReadbackGBImagePartial {
    SVGA3dSurfaceImageId image;
    SVGA3dBox box;
    uint32 invertBox;
-}
+} __packed
 SVGA3dCmdReadbackGBImagePartial; /* SVGA_3D_CMD_READBACK_GB_IMAGE_PARTIAL */
 
 /*
@@ -2190,7 +2193,8 @@ SVGA3dCmdReadbackGBImagePartial; /* SVGA_3D_CMD_READBACK_GB_IMAGE_PARTIAL */
 typedef
 struct SVGA3dCmdInvalidateGBImage {
    SVGA3dSurfaceImageId image;
-} SVGA3dCmdInvalidateGBImage;   /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE */
+} __packed
+SVGA3dCmdInvalidateGBImage;   /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE */
 
 /*
  * Invalidate an entire guest-backed surface.
@@ -2200,7 +2204,8 @@ struct SVGA3dCmdInvalidateGBImage {
 typedef
 struct SVGA3dCmdInvalidateGBSurface {
    uint32 sid;
-} SVGA3dCmdInvalidateGBSurface; /* SVGA_3D_CMD_INVALIDATE_GB_SURFACE */
+} __packed
+SVGA3dCmdInvalidateGBSurface; /* SVGA_3D_CMD_INVALIDATE_GB_SURFACE */
 
 /*
  * Invalidate a sub rect of an image in a guest-backed surface.  After
@@ -2214,7 +2219,7 @@ struct SVGA3dCmdInvalidateGBImagePartial {
    SVGA3dSurfaceImageId image;
    SVGA3dBox box;
    uint32 invertBox;
-}
+} __packed
 SVGA3dCmdInvalidateGBImagePartial; /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE_PARTIAL */
 
 /*
@@ -2224,7 +2229,8 @@ SVGA3dCmdInvalidateGBImagePartial; /* SVGA_3D_CMD_INVALIDATE_GB_IMAGE_PARTIAL */
 typedef
 struct SVGA3dCmdDefineGBContext {
    uint32 cid;
-} SVGA3dCmdDefineGBContext;   /* SVGA_3D_CMD_DEFINE_GB_CONTEXT */
+} __packed
+SVGA3dCmdDefineGBContext;   /* SVGA_3D_CMD_DEFINE_GB_CONTEXT */
 
 /*
  * Destroy a guest-backed context.
@@ -2233,7 +2239,8 @@ struct SVGA3dCmdDefineGBContext {
 typedef
 struct SVGA3dCmdDestroyGBContext {
    uint32 cid;
-} SVGA3dCmdDestroyGBContext;   /* SVGA_3D_CMD_DESTROY_GB_CONTEXT */
+} __packed
+SVGA3dCmdDestroyGBContext;   /* SVGA_3D_CMD_DESTROY_GB_CONTEXT */
 
 /*
  * Bind a guest-backed context.
@@ -2252,7 +2259,8 @@ struct SVGA3dCmdBindGBContext {
    uint32 cid;
    SVGAMobId mobid;
    uint32 validContents;
-} SVGA3dCmdBindGBContext;   /* SVGA_3D_CMD_BIND_GB_CONTEXT */
+} __packed
+SVGA3dCmdBindGBContext;   /* SVGA_3D_CMD_BIND_GB_CONTEXT */
 
 /*
  * Readback a guest-backed context.
@@ -2262,7 +2270,8 @@ struct SVGA3dCmdBindGBContext {
 typedef
 struct SVGA3dCmdReadbackGBContext {
    uint32 cid;
-} SVGA3dCmdReadbackGBContext;   /* SVGA_3D_CMD_READBACK_GB_CONTEXT */
+} __packed
+SVGA3dCmdReadbackGBContext;   /* SVGA_3D_CMD_READBACK_GB_CONTEXT */
 
 /*
  * Invalidate a guest-backed context.
@@ -2270,7 +2279,8 @@ struct SVGA3dCmdReadbackGBContext {
 typedef
 struct SVGA3dCmdInvalidateGBContext {
    uint32 cid;
-} SVGA3dCmdInvalidateGBContext;   /* SVGA_3D_CMD_INVALIDATE_GB_CONTEXT */
+} __packed
+SVGA3dCmdInvalidateGBContext;   /* SVGA_3D_CMD_INVALIDATE_GB_CONTEXT */
 
 /*
  * Define a guest-backed shader.
@@ -2281,7 +2291,8 @@ struct SVGA3dCmdDefineGBShader {
    uint32 shid;
    SVGA3dShaderType type;
    uint32 sizeInBytes;
-} SVGA3dCmdDefineGBShader;   /* SVGA_3D_CMD_DEFINE_GB_SHADER */
+} __packed
+SVGA3dCmdDefineGBShader;   /* SVGA_3D_CMD_DEFINE_GB_SHADER */
 
 /*
  * Bind a guest-backed shader.
@@ -2291,7 +2302,8 @@ typedef struct SVGA3dCmdBindGBShader {
    uint32 shid;
    SVGAMobId mobid;
    uint32 offsetInBytes;
-} SVGA3dCmdBindGBShader;   /* SVGA_3D_CMD_BIND_GB_SHADER */
+} __packed
+SVGA3dCmdBindGBShader;   /* SVGA_3D_CMD_BIND_GB_SHADER */
 
 /*
  * Destroy a guest-backed shader.
@@ -2299,7 +2311,8 @@ typedef struct SVGA3dCmdBindGBShader {
 
 typedef struct SVGA3dCmdDestroyGBShader {
    uint32 shid;
-} SVGA3dCmdDestroyGBShader;   /* SVGA_3D_CMD_DESTROY_GB_SHADER */
+} __packed
+SVGA3dCmdDestroyGBShader;   /* SVGA_3D_CMD_DESTROY_GB_SHADER */
 
 typedef
 struct {
@@ -2314,14 +2327,16 @@ struct {
     * Note that FLOAT and INT constants are 4-dwords in length, while
     * BOOL constants are 1-dword in length.
     */
-} SVGA3dCmdSetGBShaderConstInline;
+} __packed
+SVGA3dCmdSetGBShaderConstInline;
 /* SVGA_3D_CMD_SET_GB_SHADERCONSTS_INLINE */
 
 typedef
 struct {
    uint32               cid;
    SVGA3dQueryType      type;
-} SVGA3dCmdBeginGBQuery;           /* SVGA_3D_CMD_BEGIN_GB_QUERY */
+} __packed
+SVGA3dCmdBeginGBQuery;           /* SVGA_3D_CMD_BEGIN_GB_QUERY */
 
 typedef
 struct {
@@ -2329,7 +2344,8 @@ struct {
    SVGA3dQueryType      type;
    SVGAMobId mobid;
    uint32 offset;
-} SVGA3dCmdEndGBQuery;                  /* SVGA_3D_CMD_END_GB_QUERY */
+} __packed
+SVGA3dCmdEndGBQuery;                  /* SVGA_3D_CMD_END_GB_QUERY */
 
 
 /*
@@ -2346,21 +2362,22 @@ struct {
    SVGA3dQueryType      type;
    SVGAMobId mobid;
    uint32 offset;
-} SVGA3dCmdWaitForGBQuery;          /* SVGA_3D_CMD_WAIT_FOR_GB_QUERY */
+} __packed
+SVGA3dCmdWaitForGBQuery;          /* SVGA_3D_CMD_WAIT_FOR_GB_QUERY */
 
 typedef
 struct {
    SVGAMobId mobid;
    uint32 fbOffset;
    uint32 initalized;
-}
+} __packed
 SVGA3dCmdEnableGart;              /* SVGA_3D_CMD_ENABLE_GART */
 
 typedef
 struct {
    SVGAMobId mobid;
    uint32 gartOffset;
-}
+} __packed
 SVGA3dCmdMapMobIntoGart;          /* SVGA_3D_CMD_MAP_MOB_INTO_GART */
 
 
@@ -2368,7 +2385,7 @@ typedef
 struct {
    uint32 gartOffset;
    uint32 numPages;
-}
+} __packed
 SVGA3dCmdUnmapGartRange;          /* SVGA_3D_CMD_UNMAP_GART_RANGE */
 
 
@@ -2385,27 +2402,27 @@ struct {
    int32 xRoot;
    int32 yRoot;
    uint32 flags;
-}
+} __packed
 SVGA3dCmdDefineGBScreenTarget;    /* SVGA_3D_CMD_DEFINE_GB_SCREENTARGET */
 
 typedef
 struct {
    uint32 stid;
-}
+} __packed
 SVGA3dCmdDestroyGBScreenTarget;  /* SVGA_3D_CMD_DESTROY_GB_SCREENTARGET */
 
 typedef
 struct {
    uint32 stid;
    SVGA3dSurfaceImageId image;
-}
+} __packed
 SVGA3dCmdBindGBScreenTarget;  /* SVGA_3D_CMD_BIND_GB_SCREENTARGET */
 
 typedef
 struct {
    uint32 stid;
    SVGA3dBox box;
-}
+} __packed
 SVGA3dCmdUpdateGBScreenTarget;  /* SVGA_3D_CMD_UPDATE_GB_SCREENTARGET */
 
 /*
diff --git a/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h b/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h
index 8369c3ba10fe..ef3385096145 100644
--- a/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h
+++ b/drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h
@@ -38,8 +38,11 @@
 
 #define DIV_ROUND_UP(x, y)  (((x) + (y) - 1) / (y))
 #define max_t(type, x, y)  ((x) > (y) ? (x) : (y))
+#define min_t(type, x, y)  ((x) < (y) ? (x) : (y))
 #define surf_size_struct SVGA3dSize
 #define u32 uint32
+#define u64 uint64_t
+#define U32_MAX ((u32)~0U)
 
 #endif /* __KERNEL__ */
 
@@ -704,8 +707,8 @@ static const struct svga3d_surface_desc svga3d_surface_descs[] = {
 
 static inline u32 clamped_umul32(u32 a, u32 b)
 {
-        uint64_t tmp = (uint64_t) a*b;
-        return (tmp > (uint64_t) ((u32) -1)) ? (u32) -1 : tmp;
+        u64 tmp = (u64) a*b;
+        return (tmp > (u64) U32_MAX) ? U32_MAX : tmp;
 }
 
 static inline const struct svga3d_surface_desc *
@@ -834,7 +837,7 @@ svga3dsurface_get_serialized_size(SVGA3dSurfaceFormat format,
                                   bool cubemap)
 {
         const struct svga3d_surface_desc *desc = svga3dsurface_get_desc(format);
-        u32 total_size = 0;
+        u64 total_size = 0;
         u32 mip;
 
         for (mip = 0; mip < num_mip_levels; mip++) {
@@ -847,7 +850,7 @@ svga3dsurface_get_serialized_size(SVGA3dSurfaceFormat format,
         if (cubemap)
                 total_size *= SVGA3D_MAX_SURFACE_FACES;
 
-        return total_size;
+        return (u32) min_t(u64, total_size, (u64) U32_MAX);
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/svga_reg.h b/drivers/gpu/drm/vmwgfx/svga_reg.h
index 71defa4d2d75..11323dd5196f 100644
--- a/drivers/gpu/drm/vmwgfx/svga_reg.h
+++ b/drivers/gpu/drm/vmwgfx/svga_reg.h
@@ -169,10 +169,17 @@ enum {
    SVGA_REG_TRACES = 45,            /* Enable trace-based updates even when FIFO is on */
    SVGA_REG_GMRS_MAX_PAGES = 46,    /* Maximum number of 4KB pages for all GMRs */
    SVGA_REG_MEMORY_SIZE = 47,       /* Total dedicated device memory excluding FIFO */
+   SVGA_REG_COMMAND_LOW = 48,       /* Lower 32 bits and submits commands */
+   SVGA_REG_COMMAND_HIGH = 49,      /* Upper 32 bits of command buffer PA */
    SVGA_REG_MAX_PRIMARY_BOUNDING_BOX_MEM = 50,   /* Max primary memory */
    SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB = 51, /* Suggested limit on mob mem */
    SVGA_REG_DEV_CAP = 52,           /* Write dev cap index, read value */
-   SVGA_REG_TOP = 53,               /* Must be 1 more than the last register */
+   SVGA_REG_CMD_PREPEND_LOW = 53,
+   SVGA_REG_CMD_PREPEND_HIGH = 54,
+   SVGA_REG_SCREENTARGET_MAX_WIDTH = 55,
+   SVGA_REG_SCREENTARGET_MAX_HEIGHT = 56,
+   SVGA_REG_MOB_MAX_SIZE = 57,
+   SVGA_REG_TOP = 58,               /* Must be 1 more than the last register */
 
    SVGA_PALETTE_BASE = 1024,        /* Base of SVGA color map */
    /* Next 768 (== 256*3) registers exist for colormap */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
index 9426c53fb483..1e80152674b5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
@@ -551,8 +551,7 @@ static int vmw_context_scrub_shader(struct vmw_ctx_bindinfo *bi, bool rebind)
         cmd->header.size = sizeof(cmd->body);
         cmd->body.cid = bi->ctx->id;
         cmd->body.type = bi->i1.shader_type;
-        cmd->body.shid =
-                cpu_to_le32((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
+        cmd->body.shid = ((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
 
         return 0;
@@ -585,8 +584,7 @@ static int vmw_context_scrub_render_target(struct vmw_ctx_bindinfo *bi,
         cmd->header.size = sizeof(cmd->body);
         cmd->body.cid = bi->ctx->id;
         cmd->body.type = bi->i1.rt_type;
-        cmd->body.target.sid =
-                cpu_to_le32((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
+        cmd->body.target.sid = ((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
         cmd->body.target.face = 0;
         cmd->body.target.mipmap = 0;
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
@@ -628,8 +626,7 @@ static int vmw_context_scrub_texture(struct vmw_ctx_bindinfo *bi,
         cmd->body.c.cid = bi->ctx->id;
         cmd->body.s1.stage = bi->i1.texture_stage;
         cmd->body.s1.name = SVGA3D_TS_BIND_TEXTURE;
-        cmd->body.s1.value =
-                cpu_to_le32((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
+        cmd->body.s1.value = ((rebind) ? bi->res->id : SVGA3D_INVALID_ID);
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
 
         return 0;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 3bdc0adc656d..0083cbf99edf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -667,6 +667,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 dev_priv->memory_size = 512*1024*1024;
         }
         dev_priv->max_mob_pages = 0;
+        dev_priv->max_mob_size = 0;
         if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
                 uint64_t mem_size =
                         vmw_read(dev_priv,
@@ -676,6 +677,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 dev_priv->prim_bb_mem =
                         vmw_read(dev_priv,
                                  SVGA_REG_MAX_PRIMARY_BOUNDING_BOX_MEM);
+                dev_priv->max_mob_size =
+                        vmw_read(dev_priv, SVGA_REG_MOB_MAX_SIZE);
         } else
                 dev_priv->prim_bb_mem = dev_priv->vram_size;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index ecaa302a6154..07831554dad7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -40,7 +40,7 @@
 #include <drm/ttm/ttm_module.h>
 #include "vmwgfx_fence.h"
 
-#define VMWGFX_DRIVER_DATE "20121114"
+#define VMWGFX_DRIVER_DATE "20140228"
 #define VMWGFX_DRIVER_MAJOR 2
 #define VMWGFX_DRIVER_MINOR 5
 #define VMWGFX_DRIVER_PATCHLEVEL 0
@@ -386,6 +386,7 @@ struct vmw_private {
         uint32_t max_gmr_ids;
         uint32_t max_gmr_pages;
         uint32_t max_mob_pages;
+        uint32_t max_mob_size;
         uint32_t memory_size;
         bool has_gmr;
         bool has_mob;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 269b85cc875a..efb575a7996c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -602,7 +602,7 @@ static int vmw_cmd_cid_check(struct vmw_private *dev_priv,
 {
         struct vmw_cid_cmd {
                 SVGA3dCmdHeader header;
-                __le32 cid;
+                uint32_t cid;
         } *cmd;
 
         cmd = container_of(header, struct vmw_cid_cmd, header);
@@ -1835,7 +1835,7 @@ static int vmw_cmd_check_not_3d(struct vmw_private *dev_priv,
         return 0;
 }
 
-static const struct vmw_cmd_entry const vmw_cmd_entries[SVGA_3D_CMD_MAX] = {
+static const struct vmw_cmd_entry vmw_cmd_entries[SVGA_3D_CMD_MAX] = {
         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DEFINE, &vmw_cmd_invalid,
                     false, false, false),
         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DESTROY, &vmw_cmd_invalid,
@@ -2032,6 +2032,9 @@ static int vmw_cmd_check(struct vmw_private *dev_priv,
                 goto out_invalid;
 
         entry = &vmw_cmd_entries[cmd_id];
+        if (unlikely(!entry->func))
+                goto out_invalid;
+
         if (unlikely(!entry->user_allow && !sw_context->kernel))
                 goto out_privileged;
 
@@ -2469,7 +2472,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,
         if (dev_priv->has_mob) {
                 ret = vmw_rebind_contexts(sw_context);
                 if (unlikely(ret != 0))
-                        goto out_err;
+                        goto out_unlock_binding;
         }
 
         cmd = vmw_fifo_reserve(dev_priv, command_size);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index f9881f9e62bd..47b70949bf3a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -102,6 +102,9 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                 vmw_fp->gb_aware = true;
                 param->value = dev_priv->max_mob_pages * PAGE_SIZE;
                 break;
+        case DRM_VMW_PARAM_MAX_MOB_SIZE:
+                param->value = dev_priv->max_mob_size;
+                break;
         default:
                 DRM_ERROR("Illegal vmwgfx get param request: %d\n",
                           param->param);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
index d4a5a19cb8c3..04a64b8cd3cd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
@@ -188,18 +188,20 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv,
 
         bo = otable->page_table->pt_bo;
         cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
-        if (unlikely(cmd == NULL))
-                DRM_ERROR("Failed reserving FIFO space for OTable setup.\n");
-
-        memset(cmd, 0, sizeof(*cmd));
-        cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
-        cmd->header.size = sizeof(cmd->body);
-        cmd->body.type = type;
-        cmd->body.baseAddress = 0;
-        cmd->body.sizeInBytes = 0;
-        cmd->body.validSizeInBytes = 0;
-        cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
-        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        if (unlikely(cmd == NULL)) {
+                DRM_ERROR("Failed reserving FIFO space for OTable "
+                          "takedown.\n");
+        } else {
+                memset(cmd, 0, sizeof(*cmd));
+                cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
+                cmd->header.size = sizeof(cmd->body);
+                cmd->body.type = type;
+                cmd->body.baseAddress = 0;
+                cmd->body.sizeInBytes = 0;
+                cmd->body.validSizeInBytes = 0;
+                cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
+                vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        }
 
         if (bo) {
                 int ret;
@@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
         if (unlikely(cmd == NULL)) {
                 DRM_ERROR("Failed reserving FIFO space for Memory "
                           "Object unbinding.\n");
+        } else {
+                cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
+                cmd->header.size = sizeof(cmd->body);
+                cmd->body.mobid = mob->id;
+                vmw_fifo_commit(dev_priv, sizeof(*cmd));
         }
-        cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
-        cmd->header.size = sizeof(cmd->body);
-        cmd->body.mobid = mob->id;
-        vmw_fifo_commit(dev_priv, sizeof(*cmd));
         if (bo) {
                 vmw_fence_single_bo(bo, NULL);
                 ttm_bo_unreserve(bo);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 2aa4bc6a4d60..9757b57f8388 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -427,8 +427,7 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
         INIT_LIST_HEAD(&vmw_bo->res_list);
 
         ret = ttm_bo_init(bdev, &vmw_bo->base, size,
-                          (user) ? ttm_bo_type_device :
-                          ttm_bo_type_kernel, placement,
+                          ttm_bo_type_device, placement,
                           0, interruptible,
                           NULL, acc_size, NULL, bo_free);
         return ret;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
index 217d941b8176..ee3856578a12 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -371,13 +371,13 @@ int vmw_shader_destroy_ioctl(struct drm_device *dev, void *data,
                                          TTM_REF_USAGE);
 }
 
-int vmw_shader_alloc(struct vmw_private *dev_priv,
-                     struct vmw_dma_buffer *buffer,
-                     size_t shader_size,
-                     size_t offset,
-                     SVGA3dShaderType shader_type,
-                     struct ttm_object_file *tfile,
-                     u32 *handle)
+static int vmw_shader_alloc(struct vmw_private *dev_priv,
+                            struct vmw_dma_buffer *buffer,
+                            size_t shader_size,
+                            size_t offset,
+                            SVGA3dShaderType shader_type,
+                            struct ttm_object_file *tfile,
+                            u32 *handle)
 {
         struct vmw_user_shader *ushader;
         struct vmw_resource *res, *tmp;
@@ -779,6 +779,8 @@ vmw_compat_shader_man_create(struct vmw_private *dev_priv)
         int ret;
 
         man = kzalloc(sizeof(*man), GFP_KERNEL);
+        if (man == NULL)
+                return ERR_PTR(-ENOMEM);
 
         man->dev_priv = dev_priv;
         INIT_LIST_HEAD(&man->list);
diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index 1146e3bba6e1..112f27e51bc7 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -538,7 +538,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev)
 
                 g->base = job->gather_addr_phys[i];
 
-                for (j = 0; j < job->num_gathers; j++)
+                for (j = i + 1; j < job->num_gathers; j++)
                         if (job->gathers[j].bo == g->bo)
                                 job->gathers[j].handled = true;
 
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 497558127bb3..f822fd2a1ada 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -469,6 +469,9 @@ static const struct hid_device_id apple_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
                                 USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
+                                USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS),
+                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_JIS),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3bfac3accd22..cc32a6f96c64 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1679,6 +1679,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_AUREAL, USB_DEVICE_ID_AUREAL_W01RN) },
@@ -1779,6 +1780,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
index 8fae6d1414cc..c24908f14934 100644
--- a/drivers/hid/hid-hyperv.c
+++ b/drivers/hid/hid-hyperv.c
@@ -157,6 +157,7 @@ struct mousevsc_dev {
         u32                     report_desc_size;
         struct hv_input_dev_info hid_dev_info;
         struct hid_device       *hid_device;
+        u8                      input_buf[HID_MAX_BUFFER_SIZE];
 };
 
 
@@ -256,6 +257,7 @@ static void mousevsc_on_receive(struct hv_device *device,
         struct synthhid_msg *hid_msg;
         struct mousevsc_dev *input_dev = hv_get_drvdata(device);
         struct synthhid_input_report *input_report;
+        size_t len;
 
         pipe_msg = (struct pipe_prt_msg *)((unsigned long)packet +
                                                 (packet->offset8 << 3));
@@ -300,9 +302,12 @@ static void mousevsc_on_receive(struct hv_device *device,
                         (struct synthhid_input_report *)pipe_msg->data;
                 if (!input_dev->init_complete)
                         break;
-                hid_input_report(input_dev->hid_device,
-                                HID_INPUT_REPORT, input_report->buffer,
-                                input_report->header.size, 1);
+
+                len = min(input_report->header.size,
+                          (u32)sizeof(input_dev->input_buf));
+                memcpy(input_dev->input_buf, input_report->buffer, len);
+                hid_input_report(input_dev->hid_device, HID_INPUT_REPORT,
+                                 input_dev->input_buf, len, 1);
                 break;
         default:
                 pr_err("unsupported hid msg type - type %d len %d",
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5a5248f2cc07..22f28d6b33a8 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -135,6 +135,7 @@
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI  0x0255
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
+#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS   0x0257
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
@@ -240,6 +241,7 @@
 
 #define USB_VENDOR_ID_CYGNAL            0x10c4
 #define USB_DEVICE_ID_CYGNAL_RADIO_SI470X       0x818a
+#define USB_DEVICE_ID_FOCALTECH_FTXXXX_MULTITOUCH       0x81b9
 
 #define USB_DEVICE_ID_CYGNAL_RADIO_SI4713       0x8244
 
@@ -451,6 +453,9 @@
 #define USB_VENDOR_ID_INTEL_1           0x8087
 #define USB_DEVICE_ID_INTEL_HID_SENSOR  0x09fa
 
+#define USB_VENDOR_ID_STM_0             0x0483
+#define USB_DEVICE_ID_STM_HID_SENSOR    0x91d1
+
 #define USB_VENDOR_ID_ION               0x15e4
 #define USB_DEVICE_ID_ICADE             0x0132
 
@@ -619,6 +624,8 @@
 #define USB_DEVICE_ID_MS_PRESENTER_8K_USB       0x0713
 #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K       0x0730
 #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500     0x076c
+#define USB_DEVICE_ID_MS_TOUCH_COVER_2  0x07a7
+#define USB_DEVICE_ID_MS_TYPE_COVER_2   0x07a9
 
 #define USB_VENDOR_ID_MOJO              0x8282
 #define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
@@ -644,6 +651,7 @@
 
 #define USB_VENDOR_ID_NEXIO             0x1870
 #define USB_DEVICE_ID_NEXIO_MULTITOUCH_420      0x010d
+#define USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750  0x0110
 
 #define USB_VENDOR_ID_NEXTWINDOW        0x1926
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index d50e7313b171..a713e6211419 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1178,7 +1178,7 @@ static void hidinput_led_worker(struct work_struct *work)
 
         /* fall back to generic raw-output-report */
         len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
-        buf = kmalloc(len, GFP_KERNEL);
+        buf = hid_alloc_report_buf(report, GFP_KERNEL);
         if (!buf)
                 return;
 
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index c6ef6eed3091..404a3a8a82f1 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -208,6 +208,10 @@ static const struct hid_device_id ms_devices[] = {
                 .driver_data = MS_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
                 .driver_data = MS_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2),
+                .driver_data = 0 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2),
+                .driver_data = 0 },
 
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
                 .driver_data = MS_PRESENTER },
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f134d73beca1..221d503f1c24 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1166,6 +1166,11 @@ static const struct hid_device_id mt_devices[] = {
                 MT_USB_DEVICE(USB_VENDOR_ID_FLATFROG,
                         USB_DEVICE_ID_MULTITOUCH_3200) },
 
+        /* FocalTech Panels */
+        { .driver_data = MT_CLS_SERIAL,
+                MT_USB_DEVICE(USB_VENDOR_ID_CYGNAL,
+                        USB_DEVICE_ID_FOCALTECH_FTXXXX_MULTITOUCH) },
+
         /* GeneralTouch panel */
         { .driver_data = MT_CLS_GENERALTOUCH_TWOFINGERS,
                 MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 46f4480035bc..9c22e14c57f0 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -665,6 +665,9 @@ static const struct hid_device_id sensor_hub_devices[] = {
         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_INTEL_1,
                         USB_DEVICE_ID_INTEL_HID_SENSOR),
                         .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
+        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_STM_0,
+                        USB_DEVICE_ID_STM_HID_SENSOR),
+                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, HID_ANY_ID,
                      HID_ANY_ID) },
         { }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index d1f81f52481a..42eebd14de1f 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -582,7 +582,7 @@ static void i2c_hid_request(struct hid_device *hid, struct hid_report *rep,
         int ret;
         int len = i2c_hid_get_report_length(rep) - 2;
 
-        buf = kzalloc(len, GFP_KERNEL);
+        buf = hid_alloc_report_buf(rep, GFP_KERNEL);
         if (!buf)
                 return;
 
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 175ec0afb70c..dbd83878ff99 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -74,6 +74,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hwmon/max1668.c b/drivers/hwmon/max1668.c
index a7626358c95d..029b65e6c589 100644
--- a/drivers/hwmon/max1668.c
+++ b/drivers/hwmon/max1668.c
@@ -243,7 +243,7 @@ static ssize_t set_temp_min(struct device *dev,
         data->temp_min[index] = clamp_val(temp/1000, -128, 127);
         if (i2c_smbus_write_byte_data(client,
                                         MAX1668_REG_LIML_WR(index),
-                                        data->temp_max[index]))
+                                        data->temp_min[index]))
                 count = -EIO;
         mutex_unlock(&data->update_lock);
 
diff --git a/drivers/iio/gyro/Kconfig b/drivers/iio/gyro/Kconfig
index 41c64a43bcab..ac2d69e34c8c 100644
--- a/drivers/iio/gyro/Kconfig
+++ b/drivers/iio/gyro/Kconfig
@@ -70,7 +70,7 @@ config IIO_ST_GYRO_3AXIS
         select IIO_TRIGGERED_BUFFER if (IIO_BUFFER)
         help
           Say yes here to build support for STMicroelectronics gyroscopes:
-          L3G4200D, LSM330DL, L3GD20, L3GD20H, LSM330DLC, L3G4IS, LSM330.
+          L3G4200D, LSM330DL, L3GD20, LSM330DLC, L3G4IS, LSM330.
 
           This driver can also be built as a module. If so, these modules
           will be created:
diff --git a/drivers/iio/gyro/st_gyro.h b/drivers/iio/gyro/st_gyro.h
index f8f2bf84a5a2..c197360c450b 100644
--- a/drivers/iio/gyro/st_gyro.h
+++ b/drivers/iio/gyro/st_gyro.h
@@ -19,7 +19,6 @@
 #define LSM330DL_GYRO_DEV_NAME          "lsm330dl_gyro"
 #define LSM330DLC_GYRO_DEV_NAME         "lsm330dlc_gyro"
 #define L3GD20_GYRO_DEV_NAME            "l3gd20"
-#define L3GD20H_GYRO_DEV_NAME           "l3gd20h"
 #define L3G4IS_GYRO_DEV_NAME            "l3g4is_ui"
 #define LSM330_GYRO_DEV_NAME            "lsm330_gyro"
 
diff --git a/drivers/iio/gyro/st_gyro_core.c b/drivers/iio/gyro/st_gyro_core.c
index d53d91adfb55..a8e174a47bc4 100644
--- a/drivers/iio/gyro/st_gyro_core.c
+++ b/drivers/iio/gyro/st_gyro_core.c
@@ -167,11 +167,10 @@ static const struct st_sensors st_gyro_sensors[] = {
                 .wai = ST_GYRO_2_WAI_EXP,
                 .sensors_supported = {
                         [0] = L3GD20_GYRO_DEV_NAME,
-                        [1] = L3GD20H_GYRO_DEV_NAME,
-                        [2] = LSM330D_GYRO_DEV_NAME,
-                        [3] = LSM330DLC_GYRO_DEV_NAME,
-                        [4] = L3G4IS_GYRO_DEV_NAME,
-                        [5] = LSM330_GYRO_DEV_NAME,
+                        [1] = LSM330D_GYRO_DEV_NAME,
+                        [2] = LSM330DLC_GYRO_DEV_NAME,
+                        [3] = L3G4IS_GYRO_DEV_NAME,
+                        [4] = LSM330_GYRO_DEV_NAME,
                 },
                 .ch = (struct iio_chan_spec *)st_gyro_16bit_channels,
                 .odr = {
diff --git a/drivers/iio/gyro/st_gyro_i2c.c b/drivers/iio/gyro/st_gyro_i2c.c
index 16b8b8d70bf1..23c12f361b05 100644
--- a/drivers/iio/gyro/st_gyro_i2c.c
+++ b/drivers/iio/gyro/st_gyro_i2c.c
@@ -55,7 +55,6 @@ static const struct i2c_device_id st_gyro_id_table[] = {
         { LSM330DL_GYRO_DEV_NAME },
         { LSM330DLC_GYRO_DEV_NAME },
         { L3GD20_GYRO_DEV_NAME },
-        { L3GD20H_GYRO_DEV_NAME },
         { L3G4IS_GYRO_DEV_NAME },
         { LSM330_GYRO_DEV_NAME },
         {},
diff --git a/drivers/iio/gyro/st_gyro_spi.c b/drivers/iio/gyro/st_gyro_spi.c
index 94763e25caf9..b4ad3be26687 100644
--- a/drivers/iio/gyro/st_gyro_spi.c
+++ b/drivers/iio/gyro/st_gyro_spi.c
@@ -54,7 +54,6 @@ static const struct spi_device_id st_gyro_id_table[] = {
         { LSM330DL_GYRO_DEV_NAME },
         { LSM330DLC_GYRO_DEV_NAME },
         { L3GD20_GYRO_DEV_NAME },
-        { L3GD20H_GYRO_DEV_NAME },
         { L3G4IS_GYRO_DEV_NAME },
         { LSM330_GYRO_DEV_NAME },
         {},
diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
index f17b4e6183c6..47a6dbac2d0c 100644
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -103,13 +103,13 @@ static int cm32181_reg_init(struct cm32181_chip *cm32181)
 /**
  *  cm32181_read_als_it() - Get sensor integration time (ms)
  *  @cm32181:   pointer of struct cm32181
- *  @val:       pointer of int to load the als_it value.
+ *  @val2:      pointer of int to load the als_it value.
  *
  *  Report the current integartion time by millisecond.
  *
- *  Return: IIO_VAL_INT for success, otherwise -EINVAL.
+ *  Return: IIO_VAL_INT_PLUS_MICRO for success, otherwise -EINVAL.
  */
-static int cm32181_read_als_it(struct cm32181_chip *cm32181, int *val)
+static int cm32181_read_als_it(struct cm32181_chip *cm32181, int *val2)
 {
         u16 als_it;
         int i;
@@ -119,8 +119,8 @@ static int cm32181_read_als_it(struct cm32181_chip *cm32181, int *val)
         als_it >>= CM32181_CMD_ALS_IT_SHIFT;
         for (i = 0; i < ARRAY_SIZE(als_it_bits); i++) {
                 if (als_it == als_it_bits[i]) {
-                        *val = als_it_value[i];
-                        return IIO_VAL_INT;
+                        *val2 = als_it_value[i];
+                        return IIO_VAL_INT_PLUS_MICRO;
                 }
         }
 
@@ -221,7 +221,7 @@ static int cm32181_read_raw(struct iio_dev *indio_dev,
                 *val = cm32181->calibscale;
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_INT_TIME:
-                ret = cm32181_read_als_it(cm32181, val);
+                ret = cm32181_read_als_it(cm32181, val2);
                 return ret;
         }
 
@@ -240,7 +240,7 @@ static int cm32181_write_raw(struct iio_dev *indio_dev,
                 cm32181->calibscale = val;
                 return val;
         case IIO_CHAN_INFO_INT_TIME:
-                ret = cm32181_write_als_it(cm32181, val);
+                ret = cm32181_write_als_it(cm32181, val2);
                 return ret;
         }
 
@@ -264,7 +264,7 @@ static ssize_t cm32181_get_it_available(struct device *dev,
 
         n = ARRAY_SIZE(als_it_value);
         for (i = 0, len = 0; i < n; i++)
-                len += sprintf(buf + len, "%d ", als_it_value[i]);
+                len += sprintf(buf + len, "0.%06u ", als_it_value[i]);
         return len + sprintf(buf + len, "\n");
 }
 
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index 0a142af83e25..a45e07492db3 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -50,10 +50,10 @@
 #define CM36651_CS_CONF2_DEFAULT_BIT    0x08
 
 /* CS_CONF3 channel integration time */
-#define CM36651_CS_IT1                  0x00 /* Integration time 80000 usec */
-#define CM36651_CS_IT2                  0x40 /* Integration time 160000 usec */
-#define CM36651_CS_IT3                  0x80 /* Integration time 320000 usec */
-#define CM36651_CS_IT4                  0xC0 /* Integration time 640000 usec */
+#define CM36651_CS_IT1                  0x00 /* Integration time 80 msec */
+#define CM36651_CS_IT2                  0x40 /* Integration time 160 msec */
+#define CM36651_CS_IT3                  0x80 /* Integration time 320 msec */
+#define CM36651_CS_IT4                  0xC0 /* Integration time 640 msec */
 
 /* PS_CONF1 command code */
 #define CM36651_PS_ENABLE               0x00
@@ -64,10 +64,10 @@
 #define CM36651_PS_PERS4                0x0C
 
 /* PS_CONF1 command code: integration time */
-#define CM36651_PS_IT1                  0x00 /* Integration time 320 usec */
-#define CM36651_PS_IT2                  0x10 /* Integration time 420 usec */
-#define CM36651_PS_IT3                  0x20 /* Integration time 520 usec */
-#define CM36651_PS_IT4                  0x30 /* Integration time 640 usec */
+#define CM36651_PS_IT1                  0x00 /* Integration time 0.32 msec */
+#define CM36651_PS_IT2                  0x10 /* Integration time 0.42 msec */
+#define CM36651_PS_IT3                  0x20 /* Integration time 0.52 msec */
+#define CM36651_PS_IT4                  0x30 /* Integration time 0.64 msec */
 
 /* PS_CONF1 command code: duty ratio */
 #define CM36651_PS_DR1                  0x00 /* Duty ratio 1/80 */
@@ -93,8 +93,8 @@
 #define CM36651_CLOSE_PROXIMITY         0x32
 #define CM36651_FAR_PROXIMITY                   0x33
 
-#define CM36651_CS_INT_TIME_AVAIL       "80000 160000 320000 640000"
-#define CM36651_PS_INT_TIME_AVAIL       "320 420 520 640"
+#define CM36651_CS_INT_TIME_AVAIL       "0.08 0.16 0.32 0.64"
+#define CM36651_PS_INT_TIME_AVAIL       "0.000320 0.000420 0.000520 0.000640"
 
 enum cm36651_operation_mode {
         CM36651_LIGHT_EN,
@@ -356,30 +356,30 @@ static int cm36651_read_channel(struct cm36651_data *cm36651,
 }
 
 static int cm36651_read_int_time(struct cm36651_data *cm36651,
-                                struct iio_chan_spec const *chan, int *val)
+                                struct iio_chan_spec const *chan, int *val2)
 {
         switch (chan->type) {
         case IIO_LIGHT:
                 if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT1)
-                        *val = 80000;
+                        *val2 = 80000;
                 else if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT2)
-                        *val = 160000;
+                        *val2 = 160000;
                 else if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT3)
-                        *val = 320000;
+                        *val2 = 320000;
                 else if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT4)
-                        *val = 640000;
+                        *val2 = 640000;
                 else
                         return -EINVAL;
                 break;
         case IIO_PROXIMITY:
                 if (cm36651->ps_int_time == CM36651_PS_IT1)
-                        *val = 320;
+                        *val2 = 320;
                 else if (cm36651->ps_int_time == CM36651_PS_IT2)
-                        *val = 420;
+                        *val2 = 420;
                 else if (cm36651->ps_int_time == CM36651_PS_IT3)
-                        *val = 520;
+                        *val2 = 520;
                 else if (cm36651->ps_int_time == CM36651_PS_IT4)
-                        *val = 640;
+                        *val2 = 640;
                 else
                         return -EINVAL;
                 break;
@@ -387,7 +387,7 @@ static int cm36651_read_int_time(struct cm36651_data *cm36651,
                 return -EINVAL;
         }
 
-        return IIO_VAL_INT;
+        return IIO_VAL_INT_PLUS_MICRO;
 }
 
 static int cm36651_write_int_time(struct cm36651_data *cm36651,
@@ -459,7 +459,8 @@ static int cm36651_read_raw(struct iio_dev *indio_dev,
                 ret = cm36651_read_channel(cm36651, chan, val);
                 break;
         case IIO_CHAN_INFO_INT_TIME:
-                ret = cm36651_read_int_time(cm36651, chan, val);
+                *val = 0;
+                ret = cm36651_read_int_time(cm36651, chan, val2);
                 break;
         default:
                 ret = -EINVAL;
@@ -479,7 +480,7 @@ static int cm36651_write_raw(struct iio_dev *indio_dev,
         int ret = -EINVAL;
 
         if (mask == IIO_CHAN_INFO_INT_TIME) {
-                ret = cm36651_write_int_time(cm36651, chan, val);
+                ret = cm36651_write_int_time(cm36651, chan, val2);
                 if (ret < 0)
                         dev_err(&client->dev, "Integration time write failed\n");
         }
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index e81c5547e647..f9c12e92fdd6 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -53,8 +53,8 @@
 #include "user.h"
 
 #define DRV_NAME        MLX4_IB_DRV_NAME
-#define DRV_VERSION     "1.0"
-#define DRV_RELDATE     "April 4, 2008"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb 2014"
 
 #define MLX4_IB_FLOW_MAX_PRIO 0xFFF
 #define MLX4_IB_FLOW_QPN_MASK 0xFFFFFF
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index aa03e732b6a8..bf900579ac08 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -46,8 +46,8 @@
 #include "mlx5_ib.h"
 
 #define DRIVER_NAME "mlx5_ib"
-#define DRIVER_VERSION "1.0"
-#define DRIVER_RELDATE  "June 2013"
+#define DRIVER_VERSION "2.2-1"
+#define DRIVER_RELDATE  "Feb 2014"
 
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox Connect-IB HCA IB driver");
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index d18d08a076e8..8ee228e9ab5a 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -492,12 +492,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         isert_conn->state = ISER_CONN_INIT;
         INIT_LIST_HEAD(&isert_conn->conn_accept_node);
         init_completion(&isert_conn->conn_login_comp);
-        init_waitqueue_head(&isert_conn->conn_wait);
-        init_waitqueue_head(&isert_conn->conn_wait_comp_err);
+        init_completion(&isert_conn->conn_wait);
+        init_completion(&isert_conn->conn_wait_comp_err);
         kref_init(&isert_conn->conn_kref);
         kref_get(&isert_conn->conn_kref);
         mutex_init(&isert_conn->conn_mutex);
-        mutex_init(&isert_conn->conn_comp_mutex);
         spin_lock_init(&isert_conn->conn_lock);
 
         cma_id->context = isert_conn;
@@ -688,11 +687,11 @@ isert_disconnect_work(struct work_struct *work)
 
         pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
         mutex_lock(&isert_conn->conn_mutex);
-        isert_conn->state = ISER_CONN_DOWN;
+        if (isert_conn->state == ISER_CONN_UP)
+                isert_conn->state = ISER_CONN_TERMINATING;
 
         if (isert_conn->post_recv_buf_count == 0 &&
             atomic_read(&isert_conn->post_send_buf_count) == 0) {
-                pr_debug("Calling wake_up(&isert_conn->conn_wait);\n");
                 mutex_unlock(&isert_conn->conn_mutex);
                 goto wake_up;
         }
@@ -712,7 +711,7 @@ isert_disconnect_work(struct work_struct *work)
         mutex_unlock(&isert_conn->conn_mutex);
 
 wake_up:
-        wake_up(&isert_conn->conn_wait);
+        complete(&isert_conn->conn_wait);
         isert_put_conn(isert_conn);
 }
 
@@ -888,16 +887,17 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
          * Coalesce send completion interrupts by only setting IB_SEND_SIGNALED
          * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls.
          */
-        mutex_lock(&isert_conn->conn_comp_mutex);
-        if (coalesce &&
+        mutex_lock(&isert_conn->conn_mutex);
+        if (coalesce && isert_conn->state == ISER_CONN_UP &&
             ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) {
+                tx_desc->llnode_active = true;
                 llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist);
-                mutex_unlock(&isert_conn->conn_comp_mutex);
+                mutex_unlock(&isert_conn->conn_mutex);
                 return;
         }
         isert_conn->conn_comp_batch = 0;
         tx_desc->comp_llnode_batch = llist_del_all(&isert_conn->conn_comp_llist);
-        mutex_unlock(&isert_conn->conn_comp_mutex);
+        mutex_unlock(&isert_conn->conn_mutex);
 
         send_wr->send_flags = IB_SEND_SIGNALED;
 }
@@ -1464,7 +1464,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
         case ISCSI_OP_SCSI_CMD:
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 if (cmd->data_direction == DMA_TO_DEVICE)
@@ -1476,7 +1476,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
         case ISCSI_OP_SCSI_TMFUNC:
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 transport_generic_free_cmd(&cmd->se_cmd, 0);
@@ -1486,7 +1486,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
         case ISCSI_OP_TEXT:
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 /*
@@ -1549,6 +1549,7 @@ isert_completion_rdma_read(struct iser_tx_desc *tx_desc,
         iscsit_stop_dataout_timer(cmd);
         device->unreg_rdma_mem(isert_cmd, isert_conn);
         cmd->write_data_done = wr->cur_rdma_length;
+        wr->send_wr_num = 0;
 
         pr_debug("Cmd: %p RDMA_READ comp calling execute_cmd\n", isert_cmd);
         spin_lock_bh(&cmd->istate_lock);
@@ -1589,7 +1590,7 @@ isert_do_control_comp(struct work_struct *work)
                 pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n");
                 /*
                  * Call atomic_dec(&isert_conn->post_send_buf_count)
-                 * from isert_free_conn()
+                 * from isert_wait_conn()
                  */
                 isert_conn->logout_posted = true;
                 iscsit_logout_post_handler(cmd, cmd->conn);
@@ -1613,6 +1614,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
                           struct ib_device *ib_dev)
 {
         struct iscsi_cmd *cmd = isert_cmd->iscsi_cmd;
+        struct isert_rdma_wr *wr = &isert_cmd->rdma_wr;
 
         if (cmd->i_state == ISTATE_SEND_TASKMGTRSP ||
             cmd->i_state == ISTATE_SEND_LOGOUTRSP ||
@@ -1624,7 +1626,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
                 queue_work(isert_comp_wq, &isert_cmd->comp_work);
                 return;
         }
-        atomic_dec(&isert_conn->post_send_buf_count);
+        atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
 
         cmd->i_state = ISTATE_SENT_STATUS;
         isert_completion_put(tx_desc, isert_cmd, ib_dev);
@@ -1662,7 +1664,7 @@ __isert_send_completion(struct iser_tx_desc *tx_desc,
         case ISER_IB_RDMA_READ:
                 pr_debug("isert_send_completion: Got ISER_IB_RDMA_READ:\n");
 
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
                 isert_completion_rdma_read(tx_desc, isert_cmd);
                 break;
         default:
@@ -1691,31 +1693,76 @@ isert_send_completion(struct iser_tx_desc *tx_desc,
 }
 
 static void
-isert_cq_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
+isert_cq_drain_comp_llist(struct isert_conn *isert_conn, struct ib_device *ib_dev)
+{
+        struct llist_node *llnode;
+        struct isert_rdma_wr *wr;
+        struct iser_tx_desc *t;
+
+        mutex_lock(&isert_conn->conn_mutex);
+        llnode = llist_del_all(&isert_conn->conn_comp_llist);
+        isert_conn->conn_comp_batch = 0;
+        mutex_unlock(&isert_conn->conn_mutex);
+
+        while (llnode) {
+                t = llist_entry(llnode, struct iser_tx_desc, comp_llnode);
+                llnode = llist_next(llnode);
+                wr = &t->isert_cmd->rdma_wr;
+
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+                isert_completion_put(t, t->isert_cmd, ib_dev);
+        }
+}
+
+static void
+isert_cq_tx_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
 {
         struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
+        struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
+        struct llist_node *llnode = tx_desc->comp_llnode_batch;
+        struct isert_rdma_wr *wr;
+        struct iser_tx_desc *t;
 
-        if (tx_desc) {
-                struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
+        while (llnode) {
+                t = llist_entry(llnode, struct iser_tx_desc, comp_llnode);
+                llnode = llist_next(llnode);
+                wr = &t->isert_cmd->rdma_wr;
 
-                if (!isert_cmd)
-                        isert_unmap_tx_desc(tx_desc, ib_dev);
-                else
-                        isert_completion_put(tx_desc, isert_cmd, ib_dev);
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+                isert_completion_put(t, t->isert_cmd, ib_dev);
         }
+        tx_desc->comp_llnode_batch = NULL;
 
-        if (isert_conn->post_recv_buf_count == 0 &&
-            atomic_read(&isert_conn->post_send_buf_count) == 0) {
-                pr_debug("isert_cq_comp_err >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-                pr_debug("Calling wake_up from isert_cq_comp_err\n");
+        if (!isert_cmd)
+                isert_unmap_tx_desc(tx_desc, ib_dev);
+        else
+                isert_completion_put(tx_desc, isert_cmd, ib_dev);
+}
 
-                mutex_lock(&isert_conn->conn_mutex);
-                if (isert_conn->state != ISER_CONN_DOWN)
-                        isert_conn->state = ISER_CONN_TERMINATING;
-                mutex_unlock(&isert_conn->conn_mutex);
+static void
+isert_cq_rx_comp_err(struct isert_conn *isert_conn)
+{
+        struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
+        struct iscsi_conn *conn = isert_conn->conn;
 
-                wake_up(&isert_conn->conn_wait_comp_err);
+        if (isert_conn->post_recv_buf_count)
+                return;
+
+        isert_cq_drain_comp_llist(isert_conn, ib_dev);
+
+        if (conn->sess) {
+                target_sess_cmd_list_set_waiting(conn->sess->se_sess);
+                target_wait_for_sess_cmds(conn->sess->se_sess);
         }
+
+        while (atomic_read(&isert_conn->post_send_buf_count))
+                msleep(3000);
+
+        mutex_lock(&isert_conn->conn_mutex);
+        isert_conn->state = ISER_CONN_DOWN;
+        mutex_unlock(&isert_conn->conn_mutex);
+
+        complete(&isert_conn->conn_wait_comp_err);
 }
 
 static void
@@ -1740,8 +1787,14 @@ isert_cq_tx_work(struct work_struct *work)
                         pr_debug("TX wc.status != IB_WC_SUCCESS >>>>>>>>>>>>>>\n");
                         pr_debug("TX wc.status: 0x%08x\n", wc.status);
                         pr_debug("TX wc.vendor_err: 0x%08x\n", wc.vendor_err);
-                        atomic_dec(&isert_conn->post_send_buf_count);
-                        isert_cq_comp_err(tx_desc, isert_conn);
+
+                        if (wc.wr_id != ISER_FASTREG_LI_WRID) {
+                                if (tx_desc->llnode_active)
+                                        continue;
+
+                                atomic_dec(&isert_conn->post_send_buf_count);
+                                isert_cq_tx_comp_err(tx_desc, isert_conn);
+                        }
                 }
         }
 
@@ -1784,7 +1837,7 @@ isert_cq_rx_work(struct work_struct *work)
                                          wc.vendor_err);
                         }
                         isert_conn->post_recv_buf_count--;
-                        isert_cq_comp_err(NULL, isert_conn);
+                        isert_cq_rx_comp_err(isert_conn);
                 }
         }
 
@@ -2202,6 +2255,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
 
         if (!fr_desc->valid) {
                 memset(&inv_wr, 0, sizeof(inv_wr));
+                inv_wr.wr_id = ISER_FASTREG_LI_WRID;
                 inv_wr.opcode = IB_WR_LOCAL_INV;
                 inv_wr.ex.invalidate_rkey = fr_desc->data_mr->rkey;
                 wr = &inv_wr;
@@ -2212,6 +2266,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
 
         /* Prepare FASTREG WR */
         memset(&fr_wr, 0, sizeof(fr_wr));
+        fr_wr.wr_id = ISER_FASTREG_LI_WRID;
         fr_wr.opcode = IB_WR_FAST_REG_MR;
         fr_wr.wr.fast_reg.iova_start =
                 fr_desc->data_frpl->page_list[0] + page_off;
@@ -2377,12 +2432,12 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
         isert_init_send_wr(isert_conn, isert_cmd,
                            &isert_cmd->tx_desc.send_wr, true);
 
-        atomic_inc(&isert_conn->post_send_buf_count);
+        atomic_add(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
 
         rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
         if (rc) {
                 pr_warn("ib_post_send() failed for IB_WR_RDMA_WRITE\n");
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
         }
         pr_debug("Cmd: %p posted RDMA_WRITE + Response for iSER Data READ\n",
                  isert_cmd);
@@ -2410,12 +2465,12 @@ isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
                 return rc;
         }
 
-        atomic_inc(&isert_conn->post_send_buf_count);
+        atomic_add(wr->send_wr_num, &isert_conn->post_send_buf_count);
 
         rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
         if (rc) {
                 pr_warn("ib_post_send() failed for IB_WR_RDMA_READ\n");
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
         }
         pr_debug("Cmd: %p posted RDMA_READ memory for ISER Data WRITE\n",
                  isert_cmd);
@@ -2702,22 +2757,11 @@ isert_free_np(struct iscsi_np *np)
         kfree(isert_np);
 }
 
-static int isert_check_state(struct isert_conn *isert_conn, int state)
-{
-        int ret;
-
-        mutex_lock(&isert_conn->conn_mutex);
-        ret = (isert_conn->state == state);
-        mutex_unlock(&isert_conn->conn_mutex);
-
-        return ret;
-}
-
-static void isert_free_conn(struct iscsi_conn *conn)
+static void isert_wait_conn(struct iscsi_conn *conn)
 {
         struct isert_conn *isert_conn = conn->context;
 
-        pr_debug("isert_free_conn: Starting \n");
+        pr_debug("isert_wait_conn: Starting \n");
         /*
          * Decrement post_send_buf_count for special case when called
          * from isert_do_control_comp() -> iscsit_logout_post_handler()
@@ -2727,38 +2771,29 @@ static void isert_free_conn(struct iscsi_conn *conn)
                 atomic_dec(&isert_conn->post_send_buf_count);
 
         if (isert_conn->conn_cm_id && isert_conn->state != ISER_CONN_DOWN) {
-                pr_debug("Calling rdma_disconnect from isert_free_conn\n");
+                pr_debug("Calling rdma_disconnect from isert_wait_conn\n");
                 rdma_disconnect(isert_conn->conn_cm_id);
         }
         /*
          * Only wait for conn_wait_comp_err if the isert_conn made it
          * into full feature phase..
          */
-        if (isert_conn->state == ISER_CONN_UP) {
-                pr_debug("isert_free_conn: Before wait_event comp_err %d\n",
-                         isert_conn->state);
-                mutex_unlock(&isert_conn->conn_mutex);
-
-                wait_event(isert_conn->conn_wait_comp_err,
-                          (isert_check_state(isert_conn, ISER_CONN_TERMINATING)));
-
-                wait_event(isert_conn->conn_wait,
-                          (isert_check_state(isert_conn, ISER_CONN_DOWN)));
-
-                isert_put_conn(isert_conn);
-                return;
-        }
         if (isert_conn->state == ISER_CONN_INIT) {
                 mutex_unlock(&isert_conn->conn_mutex);
-                isert_put_conn(isert_conn);
                 return;
         }
-        pr_debug("isert_free_conn: wait_event conn_wait %d\n",
-                 isert_conn->state);
+        if (isert_conn->state == ISER_CONN_UP)
+                isert_conn->state = ISER_CONN_TERMINATING;
         mutex_unlock(&isert_conn->conn_mutex);
 
-        wait_event(isert_conn->conn_wait,
-                  (isert_check_state(isert_conn, ISER_CONN_DOWN)));
+        wait_for_completion(&isert_conn->conn_wait_comp_err);
+
+        wait_for_completion(&isert_conn->conn_wait);
+}
+
+static void isert_free_conn(struct iscsi_conn *conn)
+{
+        struct isert_conn *isert_conn = conn->context;
 
         isert_put_conn(isert_conn);
 }
@@ -2771,6 +2806,7 @@ static struct iscsit_transport iser_target_transport = {
         .iscsit_setup_np        = isert_setup_np,
         .iscsit_accept_np       = isert_accept_np,
         .iscsit_free_np         = isert_free_np,
+        .iscsit_wait_conn       = isert_wait_conn,
         .iscsit_free_conn       = isert_free_conn,
         .iscsit_get_login_rx    = isert_get_login_rx,
         .iscsit_put_login_tx    = isert_put_login_tx,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 708a069002f3..f6ae7f5dd408 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -6,6 +6,7 @@
 
 #define ISERT_RDMA_LISTEN_BACKLOG       10
 #define ISCSI_ISER_SG_TABLESIZE         256
+#define ISER_FASTREG_LI_WRID            0xffffffffffffffffULL
 
 enum isert_desc_type {
         ISCSI_TX_CONTROL,
@@ -45,6 +46,7 @@ struct iser_tx_desc {
         struct isert_cmd *isert_cmd;
         struct llist_node *comp_llnode_batch;
         struct llist_node comp_llnode;
+        bool            llnode_active;
         struct ib_send_wr send_wr;
 } __packed;
 
@@ -116,8 +118,8 @@ struct isert_conn {
         struct isert_device     *conn_device;
         struct work_struct      conn_logout_work;
         struct mutex            conn_mutex;
-        wait_queue_head_t       conn_wait;
-        wait_queue_head_t       conn_wait_comp_err;
+        struct completion       conn_wait;
+        struct completion       conn_wait_comp_err;
         struct kref             conn_kref;
         struct list_head        conn_fr_pool;
         int                     conn_fr_pool_size;
@@ -126,7 +128,6 @@ struct isert_conn {
 #define ISERT_COMP_BATCH_COUNT  8
         int                     conn_comp_batch;
         struct llist_head       conn_comp_llist;
-        struct mutex            conn_comp_mutex;
 };
 
 #define ISERT_MAX_CQ 64
diff --git a/drivers/input/misc/arizona-haptics.c b/drivers/input/misc/arizona-haptics.c
index 7a04f54ef961..ef2e281b0a43 100644
--- a/drivers/input/misc/arizona-haptics.c
+++ b/drivers/input/misc/arizona-haptics.c
@@ -37,7 +37,6 @@ static void arizona_haptics_work(struct work_struct *work)
                                                        struct arizona_haptics,
                                                        work);
         struct arizona *arizona = haptics->arizona;
-        struct mutex *dapm_mutex = &arizona->dapm->card->dapm_mutex;
         int ret;
 
         if (!haptics->arizona->dapm) {
@@ -67,13 +66,10 @@ static void arizona_haptics_work(struct work_struct *work)
                         return;
                 }
 
-                mutex_lock_nested(dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
-
                 ret = snd_soc_dapm_enable_pin(arizona->dapm, "HAPTICS");
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to start HAPTICS: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
 
@@ -81,21 +77,14 @@ static void arizona_haptics_work(struct work_struct *work)
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to sync DAPM: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
-
-                mutex_unlock(dapm_mutex);
-
         } else {
                 /* This disable sequence will be a noop if already enabled */
-                mutex_lock_nested(dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
-
                 ret = snd_soc_dapm_disable_pin(arizona->dapm, "HAPTICS");
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to disable HAPTICS: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
 
@@ -103,12 +92,9 @@ static void arizona_haptics_work(struct work_struct *work)
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to sync DAPM: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
 
-                mutex_unlock(dapm_mutex);
-
                 ret = regmap_update_bits(arizona->regmap,
                                          ARIZONA_HAPTICS_CONTROL_1,
                                          ARIZONA_HAP_CTRL_MASK,
@@ -155,16 +141,11 @@ static int arizona_haptics_play(struct input_dev *input, void *data,
 static void arizona_haptics_close(struct input_dev *input)
 {
         struct arizona_haptics *haptics = input_get_drvdata(input);
-        struct mutex *dapm_mutex = &haptics->arizona->dapm->card->dapm_mutex;
 
         cancel_work_sync(&haptics->work);
 
-        mutex_lock_nested(dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
-
         if (haptics->arizona->dapm)
                 snd_soc_dapm_disable_pin(haptics->arizona->dapm, "HAPTICS");
-
-        mutex_unlock(dapm_mutex);
 }
 
 static int arizona_haptics_probe(struct platform_device *pdev)
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 8911850c9444..1d9ab39af29f 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -79,7 +79,6 @@
 
 #define ARM_SMMU_PTE_CONT_SIZE          (PAGE_SIZE * ARM_SMMU_PTE_CONT_ENTRIES)
 #define ARM_SMMU_PTE_CONT_MASK          (~(ARM_SMMU_PTE_CONT_SIZE - 1))
-#define ARM_SMMU_PTE_HWTABLE_SIZE       (PTRS_PER_PTE * sizeof(pte_t))
 
 /* Stage-1 PTE */
 #define ARM_SMMU_PTE_AP_UNPRIV          (((pteval_t)1) << 6)
@@ -191,6 +190,9 @@
 #define ARM_SMMU_GR1_CBAR(n)            (0x0 + ((n) << 2))
 #define CBAR_VMID_SHIFT                 0
 #define CBAR_VMID_MASK                  0xff
+#define CBAR_S1_BPSHCFG_SHIFT           8
+#define CBAR_S1_BPSHCFG_MASK            3
+#define CBAR_S1_BPSHCFG_NSH             3
 #define CBAR_S1_MEMATTR_SHIFT           12
 #define CBAR_S1_MEMATTR_MASK            0xf
 #define CBAR_S1_MEMATTR_WB              0xf
@@ -393,7 +395,7 @@ struct arm_smmu_domain {
         struct arm_smmu_cfg             root_cfg;
         phys_addr_t                     output_mask;
 
-        struct mutex                    lock;
+        spinlock_t                      lock;
 };
 
 static DEFINE_SPINLOCK(arm_smmu_devices_lock);
@@ -632,6 +634,28 @@ static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
+static void arm_smmu_flush_pgtable(struct arm_smmu_device *smmu, void *addr,
+                                   size_t size)
+{
+        unsigned long offset = (unsigned long)addr & ~PAGE_MASK;
+
+
+        /* Ensure new page tables are visible to the hardware walker */
+        if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK) {
+                dsb();
+        } else {
+                /*
+                 * If the SMMU can't walk tables in the CPU caches, treat them
+                 * like non-coherent DMA since we need to flush the new entries
+                 * all the way out to memory. There's no possibility of
+                 * recursion here as the SMMU table walker will not be wired
+                 * through another SMMU.
+                 */
+                dma_map_page(smmu->dev, virt_to_page(addr), offset, size,
+                                DMA_TO_DEVICE);
+        }
+}
+
 static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain)
 {
         u32 reg;
@@ -650,11 +674,16 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain)
         if (smmu->version == 1)
               reg |= root_cfg->irptndx << CBAR_IRPTNDX_SHIFT;
 
-        /* Use the weakest memory type, so it is overridden by the pte */
-        if (stage1)
-                reg |= (CBAR_S1_MEMATTR_WB << CBAR_S1_MEMATTR_SHIFT);
-        else
+        /*
+         * Use the weakest shareability/memory types, so they are
+         * overridden by the ttbcr/pte.
+         */
+        if (stage1) {
+                reg |= (CBAR_S1_BPSHCFG_NSH << CBAR_S1_BPSHCFG_SHIFT) |
+                        (CBAR_S1_MEMATTR_WB << CBAR_S1_MEMATTR_SHIFT);
+        } else {
                 reg |= ARM_SMMU_CB_VMID(root_cfg) << CBAR_VMID_SHIFT;
+        }
         writel_relaxed(reg, gr1_base + ARM_SMMU_GR1_CBAR(root_cfg->cbndx));
 
         if (smmu->version > 1) {
@@ -715,6 +744,8 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain)
         }
 
         /* TTBR0 */
+        arm_smmu_flush_pgtable(smmu, root_cfg->pgd,
+                               PTRS_PER_PGD * sizeof(pgd_t));
         reg = __pa(root_cfg->pgd);
         writel_relaxed(reg, cb_base + ARM_SMMU_CB_TTBR0_LO);
         reg = (phys_addr_t)__pa(root_cfg->pgd) >> 32;
@@ -901,7 +932,7 @@ static int arm_smmu_domain_init(struct iommu_domain *domain)
                 goto out_free_domain;
         smmu_domain->root_cfg.pgd = pgd;
 
-        mutex_init(&smmu_domain->lock);
+        spin_lock_init(&smmu_domain->lock);
         domain->priv = smmu_domain;
         return 0;
 
@@ -1128,6 +1159,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
         struct arm_smmu_domain *smmu_domain = domain->priv;
         struct arm_smmu_device *device_smmu = dev->archdata.iommu;
         struct arm_smmu_master *master;
+        unsigned long flags;
 
         if (!device_smmu) {
                 dev_err(dev, "cannot attach to SMMU, is it on the same bus?\n");
@@ -1138,7 +1170,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
          * Sanity check the domain. We don't currently support domains
          * that cross between different SMMU chains.
          */
-        mutex_lock(&smmu_domain->lock);
+        spin_lock_irqsave(&smmu_domain->lock, flags);
         if (!smmu_domain->leaf_smmu) {
                 /* Now that we have a master, we can finalise the domain */
                 ret = arm_smmu_init_domain_context(domain, dev);
@@ -1153,7 +1185,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                         dev_name(device_smmu->dev));
                 goto err_unlock;
         }
-        mutex_unlock(&smmu_domain->lock);
+        spin_unlock_irqrestore(&smmu_domain->lock, flags);
 
         /* Looks ok, so add the device to the domain */
         master = find_smmu_master(smmu_domain->leaf_smmu, dev->of_node);
@@ -1163,7 +1195,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
         return arm_smmu_domain_add_master(smmu_domain, master);
 
 err_unlock:
-        mutex_unlock(&smmu_domain->lock);
+        spin_unlock_irqrestore(&smmu_domain->lock, flags);
         return ret;
 }
 
@@ -1177,23 +1209,6 @@ static void arm_smmu_detach_dev(struct iommu_domain *domain, struct device *dev)
                 arm_smmu_domain_remove_master(smmu_domain, master);
 }
 
-static void arm_smmu_flush_pgtable(struct arm_smmu_device *smmu, void *addr,
-                                   size_t size)
-{
-        unsigned long offset = (unsigned long)addr & ~PAGE_MASK;
-
-        /*
-         * If the SMMU can't walk tables in the CPU caches, treat them
-         * like non-coherent DMA since we need to flush the new entries
-         * all the way out to memory. There's no possibility of recursion
-         * here as the SMMU table walker will not be wired through another
-         * SMMU.
-         */
-        if (!(smmu->features & ARM_SMMU_FEAT_COHERENT_WALK))
-                dma_map_page(smmu->dev, virt_to_page(addr), offset, size,
-                             DMA_TO_DEVICE);
-}
-
 static bool arm_smmu_pte_is_contiguous_range(unsigned long addr,
                                              unsigned long end)
 {
@@ -1210,12 +1225,11 @@ static int arm_smmu_alloc_init_pte(struct arm_smmu_device *smmu, pmd_t *pmd,
 
         if (pmd_none(*pmd)) {
                 /* Allocate a new set of tables */
-                pgtable_t table = alloc_page(PGALLOC_GFP);
+                pgtable_t table = alloc_page(GFP_ATOMIC|__GFP_ZERO);
                 if (!table)
                         return -ENOMEM;
 
-                arm_smmu_flush_pgtable(smmu, page_address(table),
-                                       ARM_SMMU_PTE_HWTABLE_SIZE);
+                arm_smmu_flush_pgtable(smmu, page_address(table), PAGE_SIZE);
                 if (!pgtable_page_ctor(table)) {
                         __free_page(table);
                         return -ENOMEM;
@@ -1317,9 +1331,15 @@ static int arm_smmu_alloc_init_pmd(struct arm_smmu_device *smmu, pud_t *pud,
 
 #ifndef __PAGETABLE_PMD_FOLDED
         if (pud_none(*pud)) {
-                pmd = pmd_alloc_one(NULL, addr);
+                pmd = (pmd_t *)get_zeroed_page(GFP_ATOMIC);
                 if (!pmd)
                         return -ENOMEM;
+
+                arm_smmu_flush_pgtable(smmu, pmd, PAGE_SIZE);
+                pud_populate(NULL, pud, pmd);
+                arm_smmu_flush_pgtable(smmu, pud, sizeof(*pud));
+
+                pmd += pmd_index(addr);
         } else
 #endif
                 pmd = pmd_offset(pud, addr);
@@ -1328,8 +1348,6 @@ static int arm_smmu_alloc_init_pmd(struct arm_smmu_device *smmu, pud_t *pud,
                 next = pmd_addr_end(addr, end);
                 ret = arm_smmu_alloc_init_pte(smmu, pmd, addr, end, pfn,
                                               flags, stage);
-                pud_populate(NULL, pud, pmd);
-                arm_smmu_flush_pgtable(smmu, pud, sizeof(*pud));
                 phys += next - addr;
         } while (pmd++, addr = next, addr < end);
 
@@ -1346,9 +1364,15 @@ static int arm_smmu_alloc_init_pud(struct arm_smmu_device *smmu, pgd_t *pgd,
 
 #ifndef __PAGETABLE_PUD_FOLDED
         if (pgd_none(*pgd)) {
-                pud = pud_alloc_one(NULL, addr);
+                pud = (pud_t *)get_zeroed_page(GFP_ATOMIC);
                 if (!pud)
                         return -ENOMEM;
+
+                arm_smmu_flush_pgtable(smmu, pud, PAGE_SIZE);
+                pgd_populate(NULL, pgd, pud);
+                arm_smmu_flush_pgtable(smmu, pgd, sizeof(*pgd));
+
+                pud += pud_index(addr);
         } else
 #endif
                 pud = pud_offset(pgd, addr);
@@ -1357,8 +1381,6 @@ static int arm_smmu_alloc_init_pud(struct arm_smmu_device *smmu, pgd_t *pgd,
                 next = pud_addr_end(addr, end);
                 ret = arm_smmu_alloc_init_pmd(smmu, pud, addr, next, phys,
                                               flags, stage);
-                pgd_populate(NULL, pud, pgd);
-                arm_smmu_flush_pgtable(smmu, pgd, sizeof(*pgd));
                 phys += next - addr;
         } while (pud++, addr = next, addr < end);
 
@@ -1375,6 +1397,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         struct arm_smmu_cfg *root_cfg = &smmu_domain->root_cfg;
         pgd_t *pgd = root_cfg->pgd;
         struct arm_smmu_device *smmu = root_cfg->smmu;
+        unsigned long irqflags;
 
         if (root_cfg->cbar == CBAR_TYPE_S2_TRANS) {
                 stage = 2;
@@ -1397,7 +1420,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         if (paddr & ~output_mask)
                 return -ERANGE;
 
-        mutex_lock(&smmu_domain->lock);
+        spin_lock_irqsave(&smmu_domain->lock, irqflags);
         pgd += pgd_index(iova);
         end = iova + size;
         do {
@@ -1413,11 +1436,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         } while (pgd++, iova != end);
 
 out_unlock:
-        mutex_unlock(&smmu_domain->lock);
-
-        /* Ensure new page tables are visible to the hardware walker */
-        if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
-                dsb();
+        spin_unlock_irqrestore(&smmu_domain->lock, irqflags);
 
         return ret;
 }
@@ -1987,8 +2006,10 @@ static int __init arm_smmu_init(void)
         if (!iommu_present(&platform_bus_type))
                 bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
 
+#ifdef CONFIG_ARM_AMBA
         if (!iommu_present(&amba_bustype))
                 bus_set_iommu(&amba_bustype, &arm_smmu_ops);
+#endif
 
         return 0;
 }
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index d97fbe4fb9b1..80fffba7f12d 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -354,8 +354,8 @@ DEBUG_FOPS(mem);
                         return -ENOMEM;                                 \
         }
 
-#define DEBUG_ADD_FILE(name) __DEBUG_ADD_FILE(name, 600)
-#define DEBUG_ADD_FILE_RO(name) __DEBUG_ADD_FILE(name, 400)
+#define DEBUG_ADD_FILE(name) __DEBUG_ADD_FILE(name, 0600)
+#define DEBUG_ADD_FILE_RO(name) __DEBUG_ADD_FILE(name, 0400)
 
 static int iommu_debug_register(struct device *dev, void *data)
 {
diff --git a/drivers/irqchip/irq-metag-ext.c b/drivers/irqchip/irq-metag-ext.c
index 92c41ab4dbfd..2cb474ad8809 100644
--- a/drivers/irqchip/irq-metag-ext.c
+++ b/drivers/irqchip/irq-metag-ext.c
@@ -515,7 +515,7 @@ static int meta_intc_set_affinity(struct irq_data *data,
          * one cpu (the interrupt code doesn't support it), so we just
          * pick the first cpu we find in 'cpumask'.
          */
-        cpu = cpumask_any(cpumask);
+        cpu = cpumask_any_and(cpumask, cpu_online_mask);
         thread = cpu_2_hwthread_id[cpu];
 
         metag_out32(TBI_TRIG_VEC(TBID_SIGNUM_TR2(thread)), vec_addr);
diff --git a/drivers/irqchip/irq-metag.c b/drivers/irqchip/irq-metag.c
index 8e94d7a3b20d..c16c186d97d3 100644
--- a/drivers/irqchip/irq-metag.c
+++ b/drivers/irqchip/irq-metag.c
@@ -201,7 +201,7 @@ static int metag_internal_irq_set_affinity(struct irq_data *data,
          * one cpu (the interrupt code doesn't support it), so we just
          * pick the first cpu we find in 'cpumask'.
          */
-        cpu = cpumask_any(cpumask);
+        cpu = cpumask_any_and(cpumask, cpu_online_mask);
         thread = cpu_2_hwthread_id[cpu];
 
         metag_out32(TBI_TRIG_VEC(TBID_SIGNUM_TR1(thread)),
diff --git a/drivers/irqchip/irq-orion.c b/drivers/irqchip/irq-orion.c
index c3f0f41ad753..e25f246cd2fb 100644
--- a/drivers/irqchip/irq-orion.c
+++ b/drivers/irqchip/irq-orion.c
@@ -111,7 +111,8 @@ IRQCHIP_DECLARE(orion_intc, "marvell,orion-intc", orion_irq_init);
 static void orion_bridge_irq_handler(unsigned int irq, struct irq_desc *desc)
 {
         struct irq_domain *d = irq_get_handler_data(irq);
-        struct irq_chip_generic *gc = irq_get_domain_generic_chip(d, irq);
+
+        struct irq_chip_generic *gc = irq_get_domain_generic_chip(d, 0);
         u32 stat = readl_relaxed(gc->reg_base + ORION_BRIDGE_IRQ_CAUSE) &
                    gc->mask_cache;
 
@@ -123,6 +124,19 @@ static void orion_bridge_irq_handler(unsigned int irq, struct irq_desc *desc)
         }
 }
 
+/*
+ * Bridge IRQ_CAUSE is asserted regardless of IRQ_MASK register.
+ * To avoid interrupt events on stale irqs, we clear them before unmask.
+ */
+static unsigned int orion_bridge_irq_startup(struct irq_data *d)
+{
+        struct irq_chip_type *ct = irq_data_get_chip_type(d);
+
+        ct->chip.irq_ack(d);
+        ct->chip.irq_unmask(d);
+        return 0;
+}
+
 static int __init orion_bridge_irq_init(struct device_node *np,
                                         struct device_node *parent)
 {
@@ -143,7 +157,7 @@ static int __init orion_bridge_irq_init(struct device_node *np,
         }
 
         ret = irq_alloc_domain_generic_chips(domain, nrirqs, 1, np->name,
-                             handle_level_irq, clr, 0, IRQ_GC_INIT_MASK_CACHE);
+                             handle_edge_irq, clr, 0, IRQ_GC_INIT_MASK_CACHE);
         if (ret) {
                 pr_err("%s: unable to alloc irq domain gc\n", np->name);
                 return ret;
@@ -176,12 +190,14 @@ static int __init orion_bridge_irq_init(struct device_node *np,
 
         gc->chip_types[0].regs.ack = ORION_BRIDGE_IRQ_CAUSE;
         gc->chip_types[0].regs.mask = ORION_BRIDGE_IRQ_MASK;
+        gc->chip_types[0].chip.irq_startup = orion_bridge_irq_startup;
         gc->chip_types[0].chip.irq_ack = irq_gc_ack_clr_bit;
         gc->chip_types[0].chip.irq_mask = irq_gc_mask_clr_bit;
         gc->chip_types[0].chip.irq_unmask = irq_gc_mask_set_bit;
 
-        /* mask all interrupts */
+        /* mask and clear all interrupts */
         writel(0, gc->reg_base + ORION_BRIDGE_IRQ_MASK);
+        writel(0, gc->reg_base + ORION_BRIDGE_IRQ_CAUSE);
 
         irq_set_handler_data(irq, domain);
         irq_set_chained_handler(irq, orion_bridge_irq_handler);
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 9a06fe883766..95ad936e6048 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -254,16 +254,6 @@ config DM_THIN_PROVISIONING
        ---help---
          Provides thin provisioning and snapshots that share a data store.
 
-config DM_DEBUG_BLOCK_STACK_TRACING
-        boolean "Keep stack trace of persistent data block lock holders"
-        depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
-        select STACKTRACE
-        ---help---
-          Enable this for messages that may help debug problems with the
-          block manager locking used by thin provisioning and caching.
-
-          If unsure, say N.
-
 config DM_CACHE
        tristate "Cache target (EXPERIMENTAL)"
        depends on BLK_DEV_DM
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 1e018e986610..0e385e40909e 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -872,7 +872,7 @@ static void mq_destroy(struct dm_cache_policy *p)
 {
         struct mq_policy *mq = to_mq_policy(p);
 
-        kfree(mq->table);
+        vfree(mq->table);
         epool_exit(&mq->cache_pool);
         epool_exit(&mq->pre_cache_pool);
         kfree(mq);
@@ -1245,7 +1245,7 @@ static struct dm_cache_policy *mq_create(dm_cblock_t cache_size,
 
         mq->nr_buckets = next_power(from_cblock(cache_size) / 2, 16);
         mq->hash_bits = ffs(mq->nr_buckets) - 1;
-        mq->table = kzalloc(sizeof(*mq->table) * mq->nr_buckets, GFP_KERNEL);
+        mq->table = vzalloc(sizeof(*mq->table) * mq->nr_buckets);
         if (!mq->table)
                 goto bad_alloc_table;
 
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index ffd472e015ca..1af70145fab9 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -289,6 +289,7 @@ struct per_bio_data {
         bool tick:1;
         unsigned req_nr:2;
         struct dm_deferred_entry *all_io_entry;
+        struct dm_hook_info hook_info;
 
         /*
          * writethrough fields.  These MUST remain at the end of this
@@ -297,7 +298,6 @@ struct per_bio_data {
          */
         struct cache *cache;
         dm_cblock_t cblock;
-        struct dm_hook_info hook_info;
         struct dm_bio_details bio_details;
 };
 
@@ -671,15 +671,16 @@ static void remap_to_cache(struct cache *cache, struct bio *bio,
                            dm_cblock_t cblock)
 {
         sector_t bi_sector = bio->bi_iter.bi_sector;
+        sector_t block = from_cblock(cblock);
 
         bio->bi_bdev = cache->cache_dev->bdev;
         if (!block_size_is_power_of_two(cache))
                 bio->bi_iter.bi_sector =
-                        (from_cblock(cblock) * cache->sectors_per_block) +
+                        (block * cache->sectors_per_block) +
                         sector_div(bi_sector, cache->sectors_per_block);
         else
                 bio->bi_iter.bi_sector =
-                        (from_cblock(cblock) << cache->sectors_per_block_shift) |
+                        (block << cache->sectors_per_block_shift) |
                         (bi_sector & (cache->sectors_per_block - 1));
 }
 
@@ -1010,13 +1011,15 @@ static void overwrite_endio(struct bio *bio, int err)
         struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
         unsigned long flags;
 
+        dm_unhook_bio(&pb->hook_info, bio);
+
         if (err)
                 mg->err = true;
 
+        mg->requeue_holder = false;
+
         spin_lock_irqsave(&cache->lock, flags);
         list_add_tail(&mg->list, &cache->completed_migrations);
-        dm_unhook_bio(&pb->hook_info, bio);
-        mg->requeue_holder = false;
         spin_unlock_irqrestore(&cache->lock, flags);
 
         wake_worker(cache);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index b2b8a10e8427..3842ac738f98 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -201,29 +201,28 @@ static void list_dp_init(struct dpages *dp, struct page_list *pl, unsigned offse
 /*
  * Functions for getting the pages from a bvec.
  */
-static void bio_get_page(struct dpages *dp,
-                  struct page **p, unsigned long *len, unsigned *offset)
+static void bio_get_page(struct dpages *dp, struct page **p,
+                         unsigned long *len, unsigned *offset)
 {
-        struct bio *bio = dp->context_ptr;
-        struct bio_vec bvec = bio_iovec(bio);
-        *p = bvec.bv_page;
-        *len = bvec.bv_len;
-        *offset = bvec.bv_offset;
+        struct bio_vec *bvec = dp->context_ptr;
+        *p = bvec->bv_page;
+        *len = bvec->bv_len - dp->context_u;
+        *offset = bvec->bv_offset + dp->context_u;
 }
 
 static void bio_next_page(struct dpages *dp)
 {
-        struct bio *bio = dp->context_ptr;
-        struct bio_vec bvec = bio_iovec(bio);
-
-        bio_advance(bio, bvec.bv_len);
+        struct bio_vec *bvec = dp->context_ptr;
+        dp->context_ptr = bvec + 1;
+        dp->context_u = 0;
 }
 
 static void bio_dp_init(struct dpages *dp, struct bio *bio)
 {
         dp->get_page = bio_get_page;
         dp->next_page = bio_next_page;
-        dp->context_ptr = bio;
+        dp->context_ptr = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter);
+        dp->context_u = bio->bi_iter.bi_bvec_done;
 }
 
 /*
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 6eb9dc9ef8f3..422a9fdeb53e 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1626,8 +1626,11 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
         /*
          * Only pass ioctls through if the device sizes match exactly.
          */
-        if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
-                r = scsi_verify_blk_ioctl(NULL, cmd);
+        if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) {
+                int err = scsi_verify_blk_ioctl(NULL, cmd);
+                if (err)
+                        r = err;
+        }
 
         if (r == -ENOTCONN && !fatal_signal_pending(current))
                 queue_work(kmultipathd, &m->process_queued_ios);
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index f284e0bfb25f..7dfdb5c746d6 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -1244,6 +1244,9 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
 
                         dm_bio_restore(bd, bio);
                         bio_record->details.bi_bdev = NULL;
+
+                        atomic_inc(&bio->bi_remaining);
+
                         queue_bio(ms, bio, rw);
                         return DM_ENDIO_INCOMPLETE;
                 }
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index afc3d017de4c..d6e88178d22c 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -546,6 +546,9 @@ static int read_exceptions(struct pstore *ps,
                 r = insert_exceptions(ps, area, callback, callback_context,
                                       &full);
 
+                if (!full)
+                        memcpy(ps->area, area, ps->store->chunk_size << SECTOR_SHIFT);
+
                 dm_bufio_release(bp);
 
                 dm_bufio_forget(client, chunk);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 7da347665552..fb9efc829182 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -76,7 +76,7 @@
 
 #define THIN_SUPERBLOCK_MAGIC 27022010
 #define THIN_SUPERBLOCK_LOCATION 0
-#define THIN_VERSION 1
+#define THIN_VERSION 2
 #define THIN_METADATA_CACHE_SIZE 64
 #define SECTOR_TO_BLOCK_SHIFT 3
 
@@ -483,7 +483,7 @@ static int __write_initial_superblock(struct dm_pool_metadata *pmd)
 
         disk_super->data_mapping_root = cpu_to_le64(pmd->root);
         disk_super->device_details_root = cpu_to_le64(pmd->details_root);
-        disk_super->metadata_block_size = cpu_to_le32(THIN_METADATA_BLOCK_SIZE >> SECTOR_SHIFT);
+        disk_super->metadata_block_size = cpu_to_le32(THIN_METADATA_BLOCK_SIZE);
         disk_super->metadata_nr_blocks = cpu_to_le64(bdev_size >> SECTOR_TO_BLOCK_SHIFT);
         disk_super->data_block_size = cpu_to_le32(pmd->data_block_size);
 
@@ -651,7 +651,7 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f
 {
         int r;
 
-        pmd->bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE,
+        pmd->bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE << SECTOR_SHIFT,
                                           THIN_METADATA_CACHE_SIZE,
                                           THIN_MAX_CONCURRENT_LOCKS);
         if (IS_ERR(pmd->bm)) {
@@ -1489,6 +1489,23 @@ bool dm_thin_changed_this_transaction(struct dm_thin_device *td)
         return r;
 }
 
+bool dm_pool_changed_this_transaction(struct dm_pool_metadata *pmd)
+{
+        bool r = false;
+        struct dm_thin_device *td, *tmp;
+
+        down_read(&pmd->root_lock);
+        list_for_each_entry_safe(td, tmp, &pmd->thin_devices, list) {
+                if (td->changed) {
+                        r = td->changed;
+                        break;
+                }
+        }
+        up_read(&pmd->root_lock);
+
+        return r;
+}
+
 bool dm_thin_aborted_changes(struct dm_thin_device *td)
 {
         bool r;
@@ -1738,3 +1755,38 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
 
         return r;
 }
+
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd)
+{
+        int r;
+        struct dm_block *sblock;
+        struct thin_disk_superblock *disk_super;
+
+        down_write(&pmd->root_lock);
+        pmd->flags |= THIN_METADATA_NEEDS_CHECK_FLAG;
+
+        r = superblock_lock(pmd, &sblock);
+        if (r) {
+                DMERR("couldn't read superblock");
+                goto out;
+        }
+
+        disk_super = dm_block_data(sblock);
+        disk_super->flags = cpu_to_le32(pmd->flags);
+
+        dm_bm_unlock(sblock);
+out:
+        up_write(&pmd->root_lock);
+        return r;
+}
+
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd)
+{
+        bool needs_check;
+
+        down_read(&pmd->root_lock);
+        needs_check = pmd->flags & THIN_METADATA_NEEDS_CHECK_FLAG;
+        up_read(&pmd->root_lock);
+
+        return needs_check;
+}
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 9a368567632f..e3c857db195a 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -9,16 +9,14 @@
 
 #include "persistent-data/dm-block-manager.h"
 #include "persistent-data/dm-space-map.h"
+#include "persistent-data/dm-space-map-metadata.h"
 
-#define THIN_METADATA_BLOCK_SIZE 4096
+#define THIN_METADATA_BLOCK_SIZE DM_SM_METADATA_BLOCK_SIZE
 
 /*
  * The metadata device is currently limited in size.
- *
- * We have one block of index, which can hold 255 index entries.  Each
- * index entry contains allocation info about 16k metadata blocks.
  */
-#define THIN_METADATA_MAX_SECTORS (255 * (1 << 14) * (THIN_METADATA_BLOCK_SIZE / (1 << SECTOR_SHIFT)))
+#define THIN_METADATA_MAX_SECTORS DM_SM_METADATA_MAX_SECTORS
 
 /*
  * A metadata device larger than 16GB triggers a warning.
@@ -27,6 +25,11 @@
 
 /*----------------------------------------------------------------*/
 
+/*
+ * Thin metadata superblock flags.
+ */
+#define THIN_METADATA_NEEDS_CHECK_FLAG (1 << 0)
+
 struct dm_pool_metadata;
 struct dm_thin_device;
 
@@ -161,6 +164,8 @@ int dm_thin_remove_block(struct dm_thin_device *td, dm_block_t block);
  */
 bool dm_thin_changed_this_transaction(struct dm_thin_device *td);
 
+bool dm_pool_changed_this_transaction(struct dm_pool_metadata *pmd);
+
 bool dm_thin_aborted_changes(struct dm_thin_device *td);
 
 int dm_thin_get_highest_mapped_block(struct dm_thin_device *td,
@@ -202,6 +207,12 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                         dm_sm_threshold_fn fn,
                                         void *context);
 
+/*
+ * Updates the superblock immediately.
+ */
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd);
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd);
+
 /*----------------------------------------------------------------*/
 
 #endif
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index faaf944597ab..be70d38745f7 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -130,10 +130,11 @@ static void build_virtual_key(struct dm_thin_device *td, dm_block_t b,
 struct dm_thin_new_mapping;
 
 /*
- * The pool runs in 3 modes.  Ordered in degraded order for comparisons.
+ * The pool runs in 4 modes.  Ordered in degraded order for comparisons.
  */
 enum pool_mode {
         PM_WRITE,               /* metadata may be changed */
+        PM_OUT_OF_DATA_SPACE,   /* metadata may be changed, though data may not be allocated */
         PM_READ_ONLY,           /* metadata may not be changed */
         PM_FAIL,                /* all I/O fails */
 };
@@ -198,7 +199,6 @@ struct pool {
 };
 
 static enum pool_mode get_pool_mode(struct pool *pool);
-static void out_of_data_space(struct pool *pool);
 static void metadata_operation_failed(struct pool *pool, const char *op, int r);
 
 /*
@@ -226,6 +226,7 @@ struct thin_c {
 
         struct pool *pool;
         struct dm_thin_device *td;
+        bool requeue_mode:1;
 };
 
 /*----------------------------------------------------------------*/
@@ -369,14 +370,18 @@ struct dm_thin_endio_hook {
         struct dm_thin_new_mapping *overwrite_mapping;
 };
 
-static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
+static void requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 {
         struct bio *bio;
         struct bio_list bios;
+        unsigned long flags;
 
         bio_list_init(&bios);
+
+        spin_lock_irqsave(&tc->pool->lock, flags);
         bio_list_merge(&bios, master);
         bio_list_init(master);
+        spin_unlock_irqrestore(&tc->pool->lock, flags);
 
         while ((bio = bio_list_pop(&bios))) {
                 struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
@@ -391,12 +396,26 @@ static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 static void requeue_io(struct thin_c *tc)
 {
         struct pool *pool = tc->pool;
+
+        requeue_bio_list(tc, &pool->deferred_bios);
+        requeue_bio_list(tc, &pool->retry_on_resume_list);
+}
+
+static void error_retry_list(struct pool *pool)
+{
+        struct bio *bio;
         unsigned long flags;
+        struct bio_list bios;
+
+        bio_list_init(&bios);
 
         spin_lock_irqsave(&pool->lock, flags);
-        __requeue_bio_list(tc, &pool->deferred_bios);
-        __requeue_bio_list(tc, &pool->retry_on_resume_list);
+        bio_list_merge(&bios, &pool->retry_on_resume_list);
+        bio_list_init(&pool->retry_on_resume_list);
         spin_unlock_irqrestore(&pool->lock, flags);
+
+        while ((bio = bio_list_pop(&bios)))
+                bio_io_error(bio);
 }
 
 /*
@@ -925,13 +944,15 @@ static void check_low_water_mark(struct pool *pool, dm_block_t free_blocks)
         }
 }
 
+static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+
 static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
 {
         int r;
         dm_block_t free_blocks;
         struct pool *pool = tc->pool;
 
-        if (get_pool_mode(pool) != PM_WRITE)
+        if (WARN_ON(get_pool_mode(pool) != PM_WRITE))
                 return -EINVAL;
 
         r = dm_pool_get_free_block_count(pool->pmd, &free_blocks);
@@ -958,7 +979,7 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                 }
 
                 if (!free_blocks) {
-                        out_of_data_space(pool);
+                        set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
                         return -ENOSPC;
                 }
         }
@@ -988,15 +1009,32 @@ static void retry_on_resume(struct bio *bio)
         spin_unlock_irqrestore(&pool->lock, flags);
 }
 
-static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+static bool should_error_unserviceable_bio(struct pool *pool)
 {
-        /*
-         * When pool is read-only, no cell locking is needed because
-         * nothing is changing.
-         */
-        WARN_ON_ONCE(get_pool_mode(pool) != PM_READ_ONLY);
+        enum pool_mode m = get_pool_mode(pool);
 
-        if (pool->pf.error_if_no_space)
+        switch (m) {
+        case PM_WRITE:
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool is in PM_WRITE mode");
+                return true;
+
+        case PM_OUT_OF_DATA_SPACE:
+                return pool->pf.error_if_no_space;
+
+        case PM_READ_ONLY:
+        case PM_FAIL:
+                return true;
+        default:
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool has an unknown mode");
+                return true;
+        }
+}
+
+static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+{
+        if (should_error_unserviceable_bio(pool))
                 bio_io_error(bio);
         else
                 retry_on_resume(bio);
@@ -1007,11 +1045,20 @@ static void retry_bios_on_resume(struct pool *pool, struct dm_bio_prison_cell *c
         struct bio *bio;
         struct bio_list bios;
 
+        if (should_error_unserviceable_bio(pool)) {
+                cell_error(pool, cell);
+                return;
+        }
+
         bio_list_init(&bios);
         cell_release(pool, cell, &bios);
 
-        while ((bio = bio_list_pop(&bios)))
-                handle_unserviceable_bio(pool, bio);
+        if (should_error_unserviceable_bio(pool))
+                while ((bio = bio_list_pop(&bios)))
+                        bio_io_error(bio);
+        else
+                while ((bio = bio_list_pop(&bios)))
+                        retry_on_resume(bio);
 }
 
 static void process_discard(struct thin_c *tc, struct bio *bio)
@@ -1296,6 +1343,11 @@ static void process_bio_read_only(struct thin_c *tc, struct bio *bio)
         }
 }
 
+static void process_bio_success(struct thin_c *tc, struct bio *bio)
+{
+        bio_endio(bio, 0);
+}
+
 static void process_bio_fail(struct thin_c *tc, struct bio *bio)
 {
         bio_io_error(bio);
@@ -1328,6 +1380,11 @@ static void process_deferred_bios(struct pool *pool)
                 struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
                 struct thin_c *tc = h->tc;
 
+                if (tc->requeue_mode) {
+                        bio_endio(bio, DM_ENDIO_REQUEUE);
+                        continue;
+                }
+
                 /*
                  * If we've got no free new_mapping structs, and processing
                  * this bio might require one, we pause until there are some
@@ -1357,7 +1414,8 @@ static void process_deferred_bios(struct pool *pool)
         bio_list_init(&pool->deferred_flush_bios);
         spin_unlock_irqrestore(&pool->lock, flags);
 
-        if (bio_list_empty(&bios) && !need_commit_due_to_time(pool))
+        if (bio_list_empty(&bios) &&
+            !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool)))
                 return;
 
         if (commit(pool)) {
@@ -1393,51 +1451,134 @@ static void do_waker(struct work_struct *ws)
 
 /*----------------------------------------------------------------*/
 
+struct noflush_work {
+        struct work_struct worker;
+        struct thin_c *tc;
+
+        atomic_t complete;
+        wait_queue_head_t wait;
+};
+
+static void complete_noflush_work(struct noflush_work *w)
+{
+        atomic_set(&w->complete, 1);
+        wake_up(&w->wait);
+}
+
+static void do_noflush_start(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = true;
+        requeue_io(w->tc);
+        complete_noflush_work(w);
+}
+
+static void do_noflush_stop(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = false;
+        complete_noflush_work(w);
+}
+
+static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
+{
+        struct noflush_work w;
+
+        INIT_WORK(&w.worker, fn);
+        w.tc = tc;
+        atomic_set(&w.complete, 0);
+        init_waitqueue_head(&w.wait);
+
+        queue_work(tc->pool->wq, &w.worker);
+
+        wait_event(w.wait, atomic_read(&w.complete));
+}
+
+/*----------------------------------------------------------------*/
+
 static enum pool_mode get_pool_mode(struct pool *pool)
 {
         return pool->pf.mode;
 }
 
+static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
+{
+        dm_table_event(pool->ti->table);
+        DMINFO("%s: switching pool to %s mode",
+               dm_device_name(pool->pool_md), new_mode);
+}
+
 static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
 {
-        int r;
-        enum pool_mode old_mode = pool->pf.mode;
+        struct pool_c *pt = pool->ti->private;
+        bool needs_check = dm_pool_metadata_needs_check(pool->pmd);
+        enum pool_mode old_mode = get_pool_mode(pool);
+
+        /*
+         * Never allow the pool to transition to PM_WRITE mode if user
+         * intervention is required to verify metadata and data consistency.
+         */
+        if (new_mode == PM_WRITE && needs_check) {
+                DMERR("%s: unable to switch pool to write mode until repaired.",
+                      dm_device_name(pool->pool_md));
+                if (old_mode != new_mode)
+                        new_mode = old_mode;
+                else
+                        new_mode = PM_READ_ONLY;
+        }
+        /*
+         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
+         * not going to recover without a thin_repair.  So we never let the
+         * pool move out of the old mode.
+         */
+        if (old_mode == PM_FAIL)
+                new_mode = old_mode;
 
         switch (new_mode) {
         case PM_FAIL:
                 if (old_mode != new_mode)
-                        DMERR("%s: switching pool to failure mode",
-                              dm_device_name(pool->pool_md));
+                        notify_of_pool_mode_change(pool, "failure");
                 dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_fail;
                 pool->process_discard = process_bio_fail;
                 pool->process_prepared_mapping = process_prepared_mapping_fail;
                 pool->process_prepared_discard = process_prepared_discard_fail;
+
+                error_retry_list(pool);
                 break;
 
         case PM_READ_ONLY:
                 if (old_mode != new_mode)
-                        DMERR("%s: switching pool to read-only mode",
-                              dm_device_name(pool->pool_md));
-                r = dm_pool_abort_metadata(pool->pmd);
-                if (r) {
-                        DMERR("%s: aborting transaction failed",
-                              dm_device_name(pool->pool_md));
-                        new_mode = PM_FAIL;
-                        set_pool_mode(pool, new_mode);
-                } else {
-                        dm_pool_metadata_read_only(pool->pmd);
-                        pool->process_bio = process_bio_read_only;
-                        pool->process_discard = process_discard;
-                        pool->process_prepared_mapping = process_prepared_mapping_fail;
-                        pool->process_prepared_discard = process_prepared_discard_passdown;
-                }
+                        notify_of_pool_mode_change(pool, "read-only");
+                dm_pool_metadata_read_only(pool->pmd);
+                pool->process_bio = process_bio_read_only;
+                pool->process_discard = process_bio_success;
+                pool->process_prepared_mapping = process_prepared_mapping_fail;
+                pool->process_prepared_discard = process_prepared_discard_passdown;
+
+                error_retry_list(pool);
+                break;
+
+        case PM_OUT_OF_DATA_SPACE:
+                /*
+                 * Ideally we'd never hit this state; the low water mark
+                 * would trigger userland to extend the pool before we
+                 * completely run out of data space.  However, many small
+                 * IOs to unprovisioned space can consume data space at an
+                 * alarming rate.  Adjust your low water mark if you're
+                 * frequently seeing this mode.
+                 */
+                if (old_mode != new_mode)
+                        notify_of_pool_mode_change(pool, "out-of-data-space");
+                pool->process_bio = process_bio_read_only;
+                pool->process_discard = process_discard;
+                pool->process_prepared_mapping = process_prepared_mapping;
+                pool->process_prepared_discard = process_prepared_discard_passdown;
                 break;
 
         case PM_WRITE:
                 if (old_mode != new_mode)
-                        DMINFO("%s: switching pool to write mode",
-                               dm_device_name(pool->pool_md));
+                        notify_of_pool_mode_change(pool, "write");
                 dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard;
@@ -1447,32 +1588,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
         }
 
         pool->pf.mode = new_mode;
+        /*
+         * The pool mode may have changed, sync it so bind_control_target()
+         * doesn't cause an unexpected mode transition on resume.
+         */
+        pt->adjusted_pf.mode = new_mode;
 }
 
-/*
- * Rather than calling set_pool_mode directly, use these which describe the
- * reason for mode degradation.
- */
-static void out_of_data_space(struct pool *pool)
+static void abort_transaction(struct pool *pool)
 {
-        DMERR_LIMIT("%s: no free data space available.",
-                    dm_device_name(pool->pool_md));
-        set_pool_mode(pool, PM_READ_ONLY);
+        const char *dev_name = dm_device_name(pool->pool_md);
+
+        DMERR_LIMIT("%s: aborting current metadata transaction", dev_name);
+        if (dm_pool_abort_metadata(pool->pmd)) {
+                DMERR("%s: failed to abort metadata transaction", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
+
+        if (dm_pool_metadata_set_needs_check(pool->pmd)) {
+                DMERR("%s: failed to set 'needs_check' flag in metadata", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
 }
 
 static void metadata_operation_failed(struct pool *pool, const char *op, int r)
 {
-        dm_block_t free_blocks;
-
         DMERR_LIMIT("%s: metadata operation '%s' failed: error = %d",
                     dm_device_name(pool->pool_md), op, r);
 
-        if (r == -ENOSPC &&
-            !dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks) &&
-            !free_blocks)
-                DMERR_LIMIT("%s: no free metadata space available.",
-                            dm_device_name(pool->pool_md));
-
+        abort_transaction(pool);
         set_pool_mode(pool, PM_READ_ONLY);
 }
 
@@ -1523,6 +1667,11 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
 
         thin_hook_bio(tc, bio);
 
+        if (tc->requeue_mode) {
+                bio_endio(bio, DM_ENDIO_REQUEUE);
+                return DM_MAPIO_SUBMITTED;
+        }
+
         if (get_pool_mode(tc->pool) == PM_FAIL) {
                 bio_io_error(bio);
                 return DM_MAPIO_SUBMITTED;
@@ -1686,7 +1835,7 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         /*
          * We want to make sure that a pool in PM_FAIL mode is never upgraded.
          */
-        enum pool_mode old_mode = pool->pf.mode;
+        enum pool_mode old_mode = get_pool_mode(pool);
         enum pool_mode new_mode = pt->adjusted_pf.mode;
 
         /*
@@ -1700,16 +1849,6 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         pool->pf = pt->adjusted_pf;
         pool->low_water_blocks = pt->low_water_blocks;
 
-        /*
-         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
-         * not going to recover without a thin_repair.  So we never let the
-         * pool move out of the old mode.  On the other hand a PM_READ_ONLY
-         * may have been due to a lack of metadata or data space, and may
-         * now work (ie. if the underlying devices have been resized).
-         */
-        if (old_mode == PM_FAIL)
-                new_mode = old_mode;
-
         set_pool_mode(pool, new_mode);
 
         return 0;
@@ -1999,16 +2138,27 @@ static void metadata_low_callback(void *context)
         dm_table_event(pool->ti->table);
 }
 
-static sector_t get_metadata_dev_size(struct block_device *bdev)
+static sector_t get_dev_size(struct block_device *bdev)
+{
+        return i_size_read(bdev->bd_inode) >> SECTOR_SHIFT;
+}
+
+static void warn_if_metadata_device_too_big(struct block_device *bdev)
 {
-        sector_t metadata_dev_size = i_size_read(bdev->bd_inode) >> SECTOR_SHIFT;
+        sector_t metadata_dev_size = get_dev_size(bdev);
         char buffer[BDEVNAME_SIZE];
 
-        if (metadata_dev_size > THIN_METADATA_MAX_SECTORS_WARNING) {
+        if (metadata_dev_size > THIN_METADATA_MAX_SECTORS_WARNING)
                 DMWARN("Metadata device %s is larger than %u sectors: excess space will not be used.",
                        bdevname(bdev, buffer), THIN_METADATA_MAX_SECTORS);
-                metadata_dev_size = THIN_METADATA_MAX_SECTORS_WARNING;
-        }
+}
+
+static sector_t get_metadata_dev_size(struct block_device *bdev)
+{
+        sector_t metadata_dev_size = get_dev_size(bdev);
+
+        if (metadata_dev_size > THIN_METADATA_MAX_SECTORS)
+                metadata_dev_size = THIN_METADATA_MAX_SECTORS;
 
         return metadata_dev_size;
 }
@@ -2017,7 +2167,7 @@ static dm_block_t get_metadata_dev_size_in_blocks(struct block_device *bdev)
 {
         sector_t metadata_dev_size = get_metadata_dev_size(bdev);
 
-        sector_div(metadata_dev_size, THIN_METADATA_BLOCK_SIZE >> SECTOR_SHIFT);
+        sector_div(metadata_dev_size, THIN_METADATA_BLOCK_SIZE);
 
         return metadata_dev_size;
 }
@@ -2095,12 +2245,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 ti->error = "Error opening metadata block device";
                 goto out_unlock;
         }
-
-        /*
-         * Run for the side-effect of possibly issuing a warning if the
-         * device is too big.
-         */
-        (void) get_metadata_dev_size(metadata_dev->bdev);
+        warn_if_metadata_device_too_big(metadata_dev->bdev);
 
         r = dm_get_device(ti, argv[1], FMODE_READ | FMODE_WRITE, &data_dev);
         if (r) {
@@ -2246,6 +2391,12 @@ static int maybe_resize_data_dev(struct dm_target *ti, bool *need_commit)
                 return -EINVAL;
 
         } else if (data_size > sb_data_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the data device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
+
                 if (sb_data_size)
                         DMINFO("%s: growing the data device from %llu to %llu blocks",
                                dm_device_name(pool->pool_md),
@@ -2287,6 +2438,13 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit)
                 return -EINVAL;
 
         } else if (metadata_dev_size > sb_metadata_dev_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the metadata device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
+
+                warn_if_metadata_device_too_big(pool->md_dev);
                 DMINFO("%s: growing the metadata device from %llu to %llu blocks",
                        dm_device_name(pool->pool_md),
                        sb_metadata_dev_size, metadata_dev_size);
@@ -2673,7 +2831,9 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                 else
                         DMEMIT("- ");
 
-                if (pool->pf.mode == PM_READ_ONLY)
+                if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
+                        DMEMIT("out_of_data_space ");
+                else if (pool->pf.mode == PM_READ_ONLY)
                         DMEMIT("ro ");
                 else
                         DMEMIT("rw ");
@@ -2787,7 +2947,7 @@ static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -2894,6 +3054,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         if (get_pool_mode(tc->pool) == PM_FAIL) {
                 ti->error = "Couldn't open thin device, Pool is in fail mode";
+                r = -EINVAL;
                 goto bad_thin_open;
         }
 
@@ -2905,7 +3066,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         r = dm_set_target_max_io_len(ti, tc->pool->sectors_per_block);
         if (r)
-                goto bad_thin_open;
+                goto bad_target_max_io_len;
 
         ti->num_flush_bios = 1;
         ti->flush_supported = true;
@@ -2926,6 +3087,8 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         return 0;
 
+bad_target_max_io_len:
+        dm_pool_close_thin_device(tc->td);
 bad_thin_open:
         __pool_dec(tc->pool);
 bad_pool_lookup:
@@ -2986,10 +3149,23 @@ static int thin_endio(struct dm_target *ti, struct bio *bio, int err)
         return 0;
 }
 
-static void thin_postsuspend(struct dm_target *ti)
+static void thin_presuspend(struct dm_target *ti)
 {
+        struct thin_c *tc = ti->private;
+
         if (dm_noflush_suspending(ti))
-                requeue_io((struct thin_c *)ti->private);
+                noflush_work(tc, do_noflush_start);
+}
+
+static void thin_postsuspend(struct dm_target *ti)
+{
+        struct thin_c *tc = ti->private;
+
+        /*
+         * The dm_noflush_suspending flag has been cleared by now, so
+         * unfortunately we must always run this.
+         */
+        noflush_work(tc, do_noflush_stop);
 }
 
 /*
@@ -3074,12 +3250,13 @@ static int thin_iterate_devices(struct dm_target *ti,
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
         .map = thin_map,
         .end_io = thin_endio,
+        .presuspend = thin_presuspend,
         .postsuspend = thin_postsuspend,
         .status = thin_status,
         .iterate_devices = thin_iterate_devices,
diff --git a/drivers/md/persistent-data/Kconfig b/drivers/md/persistent-data/Kconfig
index 19b268795415..0c2dec7aec20 100644
--- a/drivers/md/persistent-data/Kconfig
+++ b/drivers/md/persistent-data/Kconfig
@@ -6,3 +6,13 @@ config DM_PERSISTENT_DATA
        ---help---
          Library providing immutable on-disk data structure support for
          device-mapper targets such as the thin provisioning target.
+
+config DM_DEBUG_BLOCK_STACK_TRACING
+       boolean "Keep stack trace of persistent data block lock holders"
+       depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
+       select STACKTRACE
+       ---help---
+         Enable this for messages that may help debug problems with the
+         block manager locking used by thin provisioning and caching.
+
+         If unsure, say N.
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 536782e3bcb7..786b689bdfc7 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -91,6 +91,69 @@ struct block_op {
         dm_block_t block;
 };
 
+struct bop_ring_buffer {
+        unsigned begin;
+        unsigned end;
+        struct block_op bops[MAX_RECURSIVE_ALLOCATIONS + 1];
+};
+
+static void brb_init(struct bop_ring_buffer *brb)
+{
+        brb->begin = 0;
+        brb->end = 0;
+}
+
+static bool brb_empty(struct bop_ring_buffer *brb)
+{
+        return brb->begin == brb->end;
+}
+
+static unsigned brb_next(struct bop_ring_buffer *brb, unsigned old)
+{
+        unsigned r = old + 1;
+        return (r >= (sizeof(brb->bops) / sizeof(*brb->bops))) ? 0 : r;
+}
+
+static int brb_push(struct bop_ring_buffer *brb,
+                    enum block_op_type type, dm_block_t b)
+{
+        struct block_op *bop;
+        unsigned next = brb_next(brb, brb->end);
+
+        /*
+         * We don't allow the last bop to be filled, this way we can
+         * differentiate between full and empty.
+         */
+        if (next == brb->begin)
+                return -ENOMEM;
+
+        bop = brb->bops + brb->end;
+        bop->type = type;
+        bop->block = b;
+
+        brb->end = next;
+
+        return 0;
+}
+
+static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+{
+        struct block_op *bop;
+
+        if (brb_empty(brb))
+                return -ENODATA;
+
+        bop = brb->bops + brb->begin;
+        result->type = bop->type;
+        result->block = bop->block;
+
+        brb->begin = brb_next(brb, brb->begin);
+
+        return 0;
+}
+
+/*----------------------------------------------------------------*/
+
 struct sm_metadata {
         struct dm_space_map sm;
 
@@ -101,25 +164,20 @@ struct sm_metadata {
 
         unsigned recursion_count;
         unsigned allocated_this_transaction;
-        unsigned nr_uncommitted;
-        struct block_op uncommitted[MAX_RECURSIVE_ALLOCATIONS];
+        struct bop_ring_buffer uncommitted;
 
         struct threshold threshold;
 };
 
 static int add_bop(struct sm_metadata *smm, enum block_op_type type, dm_block_t b)
 {
-        struct block_op *op;
+        int r = brb_push(&smm->uncommitted, type, b);
 
-        if (smm->nr_uncommitted == MAX_RECURSIVE_ALLOCATIONS) {
+        if (r) {
                 DMERR("too many recursive allocations");
                 return -ENOMEM;
         }
 
-        op = smm->uncommitted + smm->nr_uncommitted++;
-        op->type = type;
-        op->block = b;
-
         return 0;
 }
 
@@ -158,11 +216,17 @@ static int out(struct sm_metadata *smm)
                 return -ENOMEM;
         }
 
-        if (smm->recursion_count == 1 && smm->nr_uncommitted) {
-                while (smm->nr_uncommitted && !r) {
-                        smm->nr_uncommitted--;
-                        r = commit_bop(smm, smm->uncommitted +
-                                       smm->nr_uncommitted);
+        if (smm->recursion_count == 1) {
+                while (!brb_empty(&smm->uncommitted)) {
+                        struct block_op bop;
+
+                        r = brb_pop(&smm->uncommitted, &bop);
+                        if (r) {
+                                DMERR("bug in bop ring buffer");
+                                break;
+                        }
+
+                        r = commit_bop(smm, &bop);
                         if (r)
                                 break;
                 }
@@ -217,7 +281,8 @@ static int sm_metadata_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
 static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
                                  uint32_t *result)
 {
-        int r, i;
+        int r;
+        unsigned i;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         unsigned adjustment = 0;
 
@@ -225,8 +290,10 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
          * We may have some uncommitted adjustments to add.  This list
          * should always be really short.
          */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
-                struct block_op *op = smm->uncommitted + i;
+        for (i = smm->uncommitted.begin;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+                struct block_op *op = smm->uncommitted.bops + i;
 
                 if (op->block != b)
                         continue;
@@ -254,7 +321,8 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
 static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
                                               dm_block_t b, int *result)
 {
-        int r, i, adjustment = 0;
+        int r, adjustment = 0;
+        unsigned i;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         uint32_t rc;
 
@@ -262,8 +330,11 @@ static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
          * We may have some uncommitted adjustments to add.  This list
          * should always be really short.
          */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
-                struct block_op *op = smm->uncommitted + i;
+        for (i = smm->uncommitted.begin;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+
+                struct block_op *op = smm->uncommitted.bops + i;
 
                 if (op->block != b)
                         continue;
@@ -671,7 +742,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
         smm->begin = superblock + 1;
         smm->recursion_count = 0;
         smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
         threshold_init(&smm->threshold);
 
         memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm));
@@ -680,6 +751,8 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
         if (r)
                 return r;
 
+        if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS)
+                nr_blocks = DM_SM_METADATA_MAX_BLOCKS;
         r = sm_ll_extend(&smm->ll, nr_blocks);
         if (r)
                 return r;
@@ -713,7 +786,7 @@ int dm_sm_metadata_open(struct dm_space_map *sm,
         smm->begin = 0;
         smm->recursion_count = 0;
         smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
         threshold_init(&smm->threshold);
 
         memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.h b/drivers/md/persistent-data/dm-space-map-metadata.h
index 39bba0801cf2..64df923974d8 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.h
+++ b/drivers/md/persistent-data/dm-space-map-metadata.h
@@ -9,6 +9,17 @@
 
 #include "dm-transaction-manager.h"
 
+#define DM_SM_METADATA_BLOCK_SIZE (4096 >> SECTOR_SHIFT)
+
+/*
+ * The metadata device is currently limited in size.
+ *
+ * We have one block of index, which can hold 255 index entries.  Each
+ * index entry contains allocation info about ~16k metadata blocks.
+ */
+#define DM_SM_METADATA_MAX_BLOCKS (255 * ((1 << 14) - 64))
+#define DM_SM_METADATA_MAX_SECTORS (DM_SM_METADATA_MAX_BLOCKS * DM_SM_METADATA_BLOCK_SIZE)
+
 /*
  * Unfortunately we have to use two-phase construction due to the cycle
  * between the tm and sm.
diff --git a/drivers/mfd/da9055-i2c.c b/drivers/mfd/da9055-i2c.c
index 13af7e50021e..8103e4362132 100644
--- a/drivers/mfd/da9055-i2c.c
+++ b/drivers/mfd/da9055-i2c.c
@@ -53,17 +53,25 @@ static int da9055_i2c_remove(struct i2c_client *i2c)
         return 0;
 }
 
+/*
+ * DO NOT change the device Ids. The naming is intentionally specific as both
+ * the PMIC and CODEC parts of this chip are instantiated separately as I2C
+ * devices (both have configurable I2C addresses, and are to all intents and
+ * purposes separate). As a result there are specific DA9055 ids for PMIC
+ * and CODEC, which must be different to operate together.
+ */
 static struct i2c_device_id da9055_i2c_id[] = {
-        {"da9055", 0},
+        {"da9055-pmic", 0},
         { }
 };
+MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
 
 static struct i2c_driver da9055_i2c_driver = {
         .probe = da9055_i2c_probe,
         .remove = da9055_i2c_remove,
         .id_table = da9055_i2c_id,
         .driver = {
-                .name = "da9055",
+                .name = "da9055-pmic",
                 .owner = THIS_MODULE,
         },
 };
diff --git a/drivers/mfd/max14577.c b/drivers/mfd/max14577.c
index ac514fb2b877..71aa14a6bfbb 100644
--- a/drivers/mfd/max14577.c
+++ b/drivers/mfd/max14577.c
@@ -173,6 +173,7 @@ static const struct i2c_device_id max14577_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, max14577_i2c_id);
 
+#ifdef CONFIG_PM_SLEEP
 static int max14577_suspend(struct device *dev)
 {
         struct i2c_client *i2c = container_of(dev, struct i2c_client, dev);
@@ -208,6 +209,7 @@ static int max14577_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP */
 
 static struct of_device_id max14577_dt_match[] = {
         { .compatible = "maxim,max14577", },
diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
index be88a3bf7b85..5adede0fb04c 100644
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -164,15 +164,15 @@ static struct max8997_platform_data *max8997_i2c_parse_dt_pdata(
         return pd;
 }
 
-static inline int max8997_i2c_get_driver_data(struct i2c_client *i2c,
+static inline unsigned long max8997_i2c_get_driver_data(struct i2c_client *i2c,
                                                 const struct i2c_device_id *id)
 {
         if (IS_ENABLED(CONFIG_OF) && i2c->dev.of_node) {
                 const struct of_device_id *match;
                 match = of_match_node(max8997_pmic_dt_match, i2c->dev.of_node);
-                return (int)match->data;
+                return (unsigned long)match->data;
         }
-        return (int)id->driver_data;
+        return id->driver_data;
 }
 
 static int max8997_i2c_probe(struct i2c_client *i2c,
diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
index 612ca404e150..5d5e186b5d8b 100644
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -169,16 +169,16 @@ static struct max8998_platform_data *max8998_i2c_parse_dt_pdata(
         return pd;
 }
 
-static inline int max8998_i2c_get_driver_data(struct i2c_client *i2c,
+static inline unsigned long max8998_i2c_get_driver_data(struct i2c_client *i2c,
                                                 const struct i2c_device_id *id)
 {
         if (IS_ENABLED(CONFIG_OF) && i2c->dev.of_node) {
                 const struct of_device_id *match;
                 match = of_match_node(max8998_dt_match, i2c->dev.of_node);
-                return (int)(long)match->data;
+                return (unsigned long)match->data;
         }
 
-        return (int)id->driver_data;
+        return id->driver_data;
 }
 
 static int max8998_i2c_probe(struct i2c_client *i2c,
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index a139798b8065..714e2135210e 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -315,6 +315,7 @@ static int sec_pmic_remove(struct i2c_client *i2c)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int sec_pmic_suspend(struct device *dev)
 {
         struct i2c_client *i2c = container_of(dev, struct i2c_client, dev);
@@ -349,6 +350,7 @@ static int sec_pmic_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP */
 
 static SIMPLE_DEV_PM_OPS(sec_pmic_pm_ops, sec_pmic_suspend, sec_pmic_resume);
 
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index 966cf65c5c36..3cc4c7084b92 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -158,7 +158,7 @@ static int tps65217_probe(struct i2c_client *client,
 {
         struct tps65217 *tps;
         unsigned int version;
-        unsigned int chip_id = ids->driver_data;
+        unsigned long chip_id = ids->driver_data;
         const struct of_device_id *match;
         bool status_off = false;
         int ret;
@@ -170,7 +170,7 @@ static int tps65217_probe(struct i2c_client *client,
                                 "Failed to find matching dt id\n");
                         return -EINVAL;
                 }
-                chip_id = (unsigned int)(unsigned long)match->data;
+                chip_id = (unsigned long)match->data;
                 status_off = of_property_read_bool(client->dev.of_node,
                                         "ti,pmic-shutdown-controller");
         }
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index ba04f1bc70eb..e6fab94e2c8a 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -636,7 +636,7 @@ static int wm8994_i2c_probe(struct i2c_client *i2c,
         if (i2c->dev.of_node) {
                 of_id = of_match_device(wm8994_of_match, &i2c->dev);
                 if (of_id)
-                        wm8994->type = (int)of_id->data;
+                        wm8994->type = (enum wm8994_type)of_id->data;
         } else {
                 wm8994->type = id->driver_data;
         }
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 9b809cfc2899..89a557972d1b 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -666,7 +666,6 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
                 goto err;
 
         cb->fop_type = MEI_FOP_READ;
-        cl->read_cb = cb;
         if (dev->hbuf_is_ready) {
                 dev->hbuf_is_ready = false;
                 if (mei_hbm_cl_flow_control_req(dev, cl)) {
@@ -678,6 +677,9 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
         } else {
                 list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
         }
+
+        cl->read_cb = cb;
+
         return rets;
 err:
         mei_io_cb_free(cb);
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index 357bbc54fe4b..3e049c13429c 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -197,7 +197,7 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         struct mmc_queue_req *mqrq_prev = &mq->mqrq[1];
 
         if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
-                limit = dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
+                limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
 
         mq->card = card;
         mq->queue = blk_init_queue(mmc_request_fn, lock);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 59eba5d2c685..9715a7ba164a 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1584,7 +1584,7 @@ read_retry:
                         }
 
                         if (mtd->ecc_stats.failed - ecc_failures) {
-                                if (retry_mode + 1 <= chip->read_retries) {
+                                if (retry_mode + 1 < chip->read_retries) {
                                         retry_mode++;
                                         ret = nand_setup_read_retry(mtd,
                                                         retry_mode);
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index ef4190a02b7b..bf642ceef681 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -1633,6 +1633,7 @@ static int omap_nand_probe(struct platform_device *pdev)
         int                             i;
         dma_cap_mask_t                  mask;
         unsigned                        sig;
+        unsigned                        oob_index;
         struct resource                 *res;
         struct mtd_part_parser_data     ppdata = {};
 
@@ -1826,11 +1827,14 @@ static int omap_nand_probe(struct platform_device *pdev)
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
                 if (nand_chip->options & NAND_BUSWIDTH_16)
-                        ecclayout->eccpos[0]    = BADBLOCK_MARKER_LENGTH;
+                        oob_index               = BADBLOCK_MARKER_LENGTH;
                 else
-                        ecclayout->eccpos[0]    = 1;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                        oob_index               = 1;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* no reserved-marker in ecclayout for this ecc-scheme */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 break;
 
         case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
@@ -1847,9 +1851,15 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
+                        ecclayout->eccpos[i] = oob_index;
+                        if (((i + 1) % nand_chip->ecc.bytes) == 0)
+                                oob_index++;
+                }
+                /* include reserved-marker in ecclayout->oobfree calculation */
+                ecclayout->oobfree->offset      = 1 +
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* software bch library is used for locating errors */
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
@@ -1883,9 +1893,12 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* reserved marker already included in ecclayout->eccbytes */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* This ECC scheme requires ELM H/W block */
                 if (is_elm_present(info, pdata->elm_of_node, BCH4_ECC) < 0) {
                         pr_err("nand: error: could not initialize ELM\n");
@@ -1913,9 +1926,15 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
+                        ecclayout->eccpos[i] = oob_index;
+                        if (((i + 1) % nand_chip->ecc.bytes) == 0)
+                                oob_index++;
+                }
+                /* include reserved-marker in ecclayout->oobfree calculation */
+                ecclayout->oobfree->offset      = 1 +
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* software bch library is used for locating errors */
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
@@ -1956,9 +1975,12 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* reserved marker already included in ecclayout->eccbytes */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 break;
 #else
                 pr_err("nand: error: CONFIG_MTD_NAND_OMAP_BCH not enabled\n");
@@ -1972,11 +1994,8 @@ static int omap_nand_probe(struct platform_device *pdev)
                 goto return_error;
         }
 
-        /* populate remaining ECC layout data */
-        ecclayout->oobfree->length = mtd->oobsize - (BADBLOCK_MARKER_LENGTH +
-                                                        ecclayout->eccbytes);
-        for (i = 1; i < ecclayout->eccbytes; i++)
-                ecclayout->eccpos[i] = ecclayout->eccpos[0] + i;
+        /* all OOB bytes from oobfree->offset till end off OOB are free */
+        ecclayout->oobfree->length = mtd->oobsize - ecclayout->oobfree->offset;
         /* check if NAND device's OOB is enough to store ECC signatures */
         if (mtd->oobsize < (ecclayout->eccbytes + BADBLOCK_MARKER_LENGTH)) {
                 pr_err("not enough OOB bytes required = %d, available=%d\n",
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index ead861307b3c..c5dad652614d 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -463,8 +463,8 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                                 }
                         }
                         if (found_orphan) {
-                                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                                 list_del(&tmp_aeb->u.list);
+                                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                         }
 
                         new_aeb = kmem_cache_alloc(ai->aeb_slab_cache,
@@ -846,16 +846,16 @@ fail_bad:
         ret = UBI_BAD_FASTMAP;
 fail:
         list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &used, u.list) {
-                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                 list_del(&tmp_aeb->u.list);
+                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
         }
         list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &eba_orphans, u.list) {
-                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                 list_del(&tmp_aeb->u.list);
+                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
         }
         list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &free, u.list) {
-                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                 list_del(&tmp_aeb->u.list);
+                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
         }
 
         return ret;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index f342278539d5..494b888a6568 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -139,7 +139,7 @@ config MACVTAP
           This adds a specialized tap character device driver that is based
           on the MAC-VLAN network interface, called macvtap. A macvtap device
           can be added in the same way as a macvlan device, using 'type
-          macvlan', and then be accessed through the tap user space interface.
+          macvtap', and then be accessed through the tap user space interface.
 
           To compile this driver as a module, choose M here: the module
           will be called macvtap.
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index cce1f1bf90b4..dcde56057fe1 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -181,7 +181,7 @@ static inline int __agg_has_partner(struct aggregator *agg)
  */
 static inline void __disable_port(struct port *port)
 {
-        bond_set_slave_inactive_flags(port->slave);
+        bond_set_slave_inactive_flags(port->slave, BOND_SLAVE_NOTIFY_LATER);
 }
 
 /**
@@ -193,7 +193,7 @@ static inline void __enable_port(struct port *port)
         struct slave *slave = port->slave;
 
         if ((slave->link == BOND_LINK_UP) && IS_UP(slave->dev))
-                bond_set_slave_active_flags(slave);
+                bond_set_slave_active_flags(slave, BOND_SLAVE_NOTIFY_LATER);
 }
 
 /**
@@ -1796,8 +1796,6 @@ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout)
         BOND_AD_INFO(bond).agg_select_timer = timeout;
 }
 
-static u16 aggregator_identifier;
-
 /**
  * bond_3ad_initialize - initialize a bond's 802.3ad parameters and structures
  * @bond: bonding struct to work on
@@ -1811,7 +1809,7 @@ void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution)
         if (!MAC_ADDRESS_EQUAL(&(BOND_AD_INFO(bond).system.sys_mac_addr),
                                 bond->dev->dev_addr)) {
 
-                aggregator_identifier = 0;
+                BOND_AD_INFO(bond).aggregator_identifier = 0;
 
                 BOND_AD_INFO(bond).system.sys_priority = 0xFFFF;
                 BOND_AD_INFO(bond).system.sys_mac_addr = *((struct mac_addr *)bond->dev->dev_addr);
@@ -1880,7 +1878,7 @@ void bond_3ad_bind_slave(struct slave *slave)
                 ad_initialize_agg(aggregator);
 
                 aggregator->aggregator_mac_address = *((struct mac_addr *)bond->dev->dev_addr);
-                aggregator->aggregator_identifier = (++aggregator_identifier);
+                aggregator->aggregator_identifier = ++BOND_AD_INFO(bond).aggregator_identifier;
                 aggregator->slave = slave;
                 aggregator->is_active = 0;
                 aggregator->num_of_ports = 0;
@@ -2064,6 +2062,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         struct list_head *iter;
         struct slave *slave;
         struct port *port;
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
 
         read_lock(&bond->lock);
         rcu_read_lock();
@@ -2121,8 +2120,19 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         }
 
 re_arm:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
         rcu_read_unlock();
         read_unlock(&bond->lock);
+
+        if (should_notify_rtnl && rtnl_trylock()) {
+                bond_slave_state_notify(bond);
+                rtnl_unlock();
+        }
         queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 }
 
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index 13dc9d3c5e34..f4dd9592ac62 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -253,6 +253,7 @@ struct ad_system {
 struct ad_bond_info {
         struct ad_system system;            /* 802.3ad system structure */
         u32 agg_select_timer;       // Timer to select aggregator after all adapter's hand shakes
+        u16 aggregator_identifier;
 };
 
 struct ad_slave_info {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 71ba18efa15b..e5628fc725c3 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -829,21 +829,25 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
         if (bond_is_lb(bond)) {
                 bond_alb_handle_active_change(bond, new_active);
                 if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
                 if (new_active)
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
         } else {
                 rcu_assign_pointer(bond->curr_active_slave, new_active);
         }
 
         if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) {
                 if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
 
                 if (new_active) {
                         bool should_notify_peers = false;
 
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
 
                         if (bond->params.fail_over_mac)
                                 bond_do_fail_over_mac(bond, new_active,
@@ -1193,6 +1197,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 return -EBUSY;
         }
 
+        if (bond_dev == slave_dev) {
+                pr_err("%s: cannot enslave bond to itself.\n", bond_dev->name);
+                return -EPERM;
+        }
+
         /* vlan challenged mutual exclusion */
         /* no need to lock since we're protected by rtnl_lock */
         if (slave_dev->features & NETIF_F_VLAN_CHALLENGED) {
@@ -1463,14 +1472,15 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         switch (bond->params.mode) {
         case BOND_MODE_ACTIVEBACKUP:
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave,
+                                              BOND_SLAVE_NOTIFY_NOW);
                 break;
         case BOND_MODE_8023AD:
                 /* in 802.3ad mode, the internal mechanism
                  * will activate the slaves in the selected
                  * aggregator
                  */
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                 /* if this is the first slave */
                 if (!prev_slave) {
                         SLAVE_AD_INFO(new_slave).id = 1;
@@ -1488,7 +1498,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         case BOND_MODE_TLB:
         case BOND_MODE_ALB:
                 bond_set_active_slave(new_slave);
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                 break;
         default:
                 pr_debug("This slave is always active in trunk mode\n");
@@ -1543,9 +1553,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         bond_set_carrier(bond);
 
         if (USES_PRIMARY(bond->params.mode)) {
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         }
 
         pr_info("%s: enslaving %s as a%s interface with a%s link.\n",
@@ -1571,10 +1583,12 @@ err_detach:
         if (bond->primary_slave == new_slave)
                 bond->primary_slave = NULL;
         if (bond->curr_active_slave == new_slave) {
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_change_active_slave(bond, NULL);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
         }
         slave_disable_netpoll(new_slave);
 
@@ -1650,9 +1664,6 @@ static int __bond_release_one(struct net_device *bond_dev,
                 return -EINVAL;
         }
 
-        /* release the slave from its bond */
-        bond->slave_cnt--;
-
         bond_sysfs_slave_del(slave);
 
         bond_upper_dev_unlink(bond_dev, slave_dev);
@@ -1734,6 +1745,7 @@ static int __bond_release_one(struct net_device *bond_dev,
 
         unblock_netpoll_tx();
         synchronize_rcu();
+        bond->slave_cnt--;
 
         if (!bond_has_slaves(bond)) {
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, bond->dev);
@@ -2011,7 +2023,8 @@ static void bond_miimon_commit(struct bonding *bond)
 
                         if (bond->params.mode == BOND_MODE_ACTIVEBACKUP ||
                             bond->params.mode == BOND_MODE_8023AD)
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
 
                         pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                 bond->dev->name, slave->dev->name);
@@ -2558,7 +2571,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                 slave->link = BOND_LINK_UP;
                                 if (bond->current_arp_slave) {
                                         bond_set_slave_inactive_flags(
-                                                bond->current_arp_slave);
+                                                bond->current_arp_slave,
+                                                BOND_SLAVE_NOTIFY_NOW);
                                         bond->current_arp_slave = NULL;
                                 }
 
@@ -2578,7 +2592,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                 slave->link_failure_count++;
 
                         slave->link = BOND_LINK_DOWN;
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_NOW);
 
                         pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                 bond->dev->name, slave->dev->name);
@@ -2611,17 +2626,17 @@ do_failover:
 
 /*
  * Send ARP probes for active-backup mode ARP monitor.
+ *
+ * Called with rcu_read_lock hold.
  */
 static bool bond_ab_arp_probe(struct bonding *bond)
 {
         struct slave *slave, *before = NULL, *new_slave = NULL,
-                     *curr_arp_slave, *curr_active_slave;
+                     *curr_arp_slave = rcu_dereference(bond->current_arp_slave),
+                     *curr_active_slave = rcu_dereference(bond->curr_active_slave);
         struct list_head *iter;
         bool found = false;
-
-        rcu_read_lock();
-        curr_arp_slave = rcu_dereference(bond->current_arp_slave);
-        curr_active_slave = rcu_dereference(bond->curr_active_slave);
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
 
         if (curr_arp_slave && curr_active_slave)
                 pr_info("PROBE: c_arp %s && cas %s BAD\n",
@@ -2630,32 +2645,23 @@ static bool bond_ab_arp_probe(struct bonding *bond)
 
         if (curr_active_slave) {
                 bond_arp_send_all(bond, curr_active_slave);
-                rcu_read_unlock();
-                return true;
+                return should_notify_rtnl;
         }
-        rcu_read_unlock();
 
         /* if we don't have a curr_active_slave, search for the next available
          * backup slave from the current_arp_slave and make it the candidate
          * for becoming the curr_active_slave
          */
 
-        if (!rtnl_trylock())
-                return false;
-        /* curr_arp_slave might have gone away */
-        curr_arp_slave = ACCESS_ONCE(bond->current_arp_slave);
-
         if (!curr_arp_slave) {
-                curr_arp_slave = bond_first_slave(bond);
-                if (!curr_arp_slave) {
-                        rtnl_unlock();
-                        return true;
-                }
+                curr_arp_slave = bond_first_slave_rcu(bond);
+                if (!curr_arp_slave)
+                        return should_notify_rtnl;
         }
 
-        bond_set_slave_inactive_flags(curr_arp_slave);
+        bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER);
 
-        bond_for_each_slave(bond, slave, iter) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                 if (!found && !before && IS_UP(slave->dev))
                         before = slave;
 
@@ -2673,7 +2679,8 @@ static bool bond_ab_arp_probe(struct bonding *bond)
                         if (slave->link_failure_count < UINT_MAX)
                                 slave->link_failure_count++;
 
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_LATER);
 
                         pr_info("%s: backup interface %s is now down.\n",
                                 bond->dev->name, slave->dev->name);
@@ -2685,26 +2692,31 @@ static bool bond_ab_arp_probe(struct bonding *bond)
         if (!new_slave && before)
                 new_slave = before;
 
-        if (!new_slave) {
-                rtnl_unlock();
-                return true;
-        }
+        if (!new_slave)
+                goto check_state;
 
         new_slave->link = BOND_LINK_BACK;
-        bond_set_slave_active_flags(new_slave);
+        bond_set_slave_active_flags(new_slave, BOND_SLAVE_NOTIFY_LATER);
         bond_arp_send_all(bond, new_slave);
         new_slave->jiffies = jiffies;
         rcu_assign_pointer(bond->current_arp_slave, new_slave);
-        rtnl_unlock();
 
-        return true;
+check_state:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
+        return should_notify_rtnl;
 }
 
 static void bond_activebackup_arp_mon(struct work_struct *work)
 {
         struct bonding *bond = container_of(work, struct bonding,
                                             arp_work.work);
-        bool should_notify_peers = false, should_commit = false;
+        bool should_notify_peers = false;
+        bool should_notify_rtnl = false;
         int delta_in_ticks;
 
         delta_in_ticks = msecs_to_jiffies(bond->params.arp_interval);
@@ -2713,11 +2725,12 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                 goto re_arm;
 
         rcu_read_lock();
+
         should_notify_peers = bond_should_notify_peers(bond);
-        should_commit = bond_ab_arp_inspect(bond);
-        rcu_read_unlock();
 
-        if (should_commit) {
+        if (bond_ab_arp_inspect(bond)) {
+                rcu_read_unlock();
+
                 /* Race avoidance with bond_close flush of workqueue */
                 if (!rtnl_trylock()) {
                         delta_in_ticks = 1;
@@ -2726,23 +2739,28 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                 }
 
                 bond_ab_arp_commit(bond);
+
                 rtnl_unlock();
+                rcu_read_lock();
         }
 
-        if (!bond_ab_arp_probe(bond)) {
-                /* rtnl locking failed, re-arm */
-                delta_in_ticks = 1;
-                should_notify_peers = false;
-        }
+        should_notify_rtnl = bond_ab_arp_probe(bond);
+        rcu_read_unlock();
 
 re_arm:
         if (bond->params.arp_interval)
                 queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 
-        if (should_notify_peers) {
+        if (should_notify_peers || should_notify_rtnl) {
                 if (!rtnl_trylock())
                         return;
-                call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
+
+                if (should_notify_peers)
+                        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
+                                                 bond->dev);
+                if (should_notify_rtnl)
+                        bond_slave_state_notify(bond);
+
                 rtnl_unlock();
         }
 }
@@ -2864,9 +2882,12 @@ static int bond_slave_netdev_event(unsigned long event,
                 pr_info("%s: Primary slave changed to %s, reselecting active slave.\n",
                         bond->dev->name, bond->primary_slave ? slave_dev->name :
                                                                "none");
+
+                block_netpoll_tx();
                 write_lock_bh(&bond->curr_slave_lock);
                 bond_select_active_slave(bond);
                 write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
                 break;
         case NETDEV_FEAT_CHANGE:
                 bond_compute_features(bond);
@@ -3039,9 +3060,11 @@ static int bond_open(struct net_device *bond_dev)
                 bond_for_each_slave(bond, slave, iter) {
                         if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                                 && (slave != bond->curr_active_slave)) {
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
                         } else {
-                                bond_set_slave_active_flags(slave);
+                                bond_set_slave_active_flags(slave,
+                                                            BOND_SLAVE_NOTIFY_NOW);
                         }
                 }
                 read_unlock(&bond->curr_slave_lock);
@@ -3700,7 +3723,7 @@ static inline int bond_slave_override(struct bonding *bond,
 
 
 static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb,
-                             void *accel_priv)
+                             void *accel_priv, select_queue_fallback_t fallback)
 {
         /*
          * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 11cb943222d5..c37878432717 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -14,7 +14,7 @@
 #include <linux/errno.h>
 #include <linux/if.h>
 #include <linux/netdevice.h>
-#include <linux/rwlock.h>
+#include <linux/spinlock.h>
 #include <linux/rcupdate.h>
 #include <linux/ctype.h>
 #include <linux/inet.h>
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 86ccfb9f71cc..2b0fdec695f7 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -195,7 +195,8 @@ struct slave {
         s8     new_link;
         u8     backup:1,   /* indicates backup slave. Value corresponds with
                               BOND_STATE_ACTIVE and BOND_STATE_BACKUP */
-               inactive:1; /* indicates inactive slave */
+               inactive:1, /* indicates inactive slave */
+               should_notify:1; /* indicateds whether the state changed */
         u8     duplex;
         u32    original_mtu;
         u32    link_failure_count;
@@ -303,6 +304,24 @@ static inline void bond_set_backup_slave(struct slave *slave)
         }
 }
 
+static inline void bond_set_slave_state(struct slave *slave,
+                                        int slave_state, bool notify)
+{
+        if (slave->backup == slave_state)
+                return;
+
+        slave->backup = slave_state;
+        if (notify) {
+                rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_KERNEL);
+                slave->should_notify = 0;
+        } else {
+                if (slave->should_notify)
+                        slave->should_notify = 0;
+                else
+                        slave->should_notify = 1;
+        }
+}
+
 static inline void bond_slave_state_change(struct bonding *bond)
 {
         struct list_head *iter;
@@ -316,6 +335,19 @@ static inline void bond_slave_state_change(struct bonding *bond)
         }
 }
 
+static inline void bond_slave_state_notify(struct bonding *bond)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave(bond, tmp, iter) {
+                if (tmp->should_notify) {
+                        rtmsg_ifinfo(RTM_NEWLINK, tmp->dev, 0, GFP_KERNEL);
+                        tmp->should_notify = 0;
+                }
+        }
+}
+
 static inline int bond_slave_state(struct slave *slave)
 {
         return slave->backup;
@@ -343,6 +375,9 @@ static inline bool bond_is_active_slave(struct slave *slave)
 #define BOND_ARP_VALIDATE_ALL           (BOND_ARP_VALIDATE_ACTIVE | \
                                          BOND_ARP_VALIDATE_BACKUP)
 
+#define BOND_SLAVE_NOTIFY_NOW           true
+#define BOND_SLAVE_NOTIFY_LATER         false
+
 static inline int slave_do_arp_validate(struct bonding *bond,
                                         struct slave *slave)
 {
@@ -394,17 +429,19 @@ static inline void bond_netpoll_send_skb(const struct slave *slave,
 }
 #endif
 
-static inline void bond_set_slave_inactive_flags(struct slave *slave)
+static inline void bond_set_slave_inactive_flags(struct slave *slave,
+                                                 bool notify)
 {
         if (!bond_is_lb(slave->bond))
-                bond_set_backup_slave(slave);
+                bond_set_slave_state(slave, BOND_STATE_BACKUP, notify);
         if (!slave->bond->params.all_slaves_active)
                 slave->inactive = 1;
 }
 
-static inline void bond_set_slave_active_flags(struct slave *slave)
+static inline void bond_set_slave_active_flags(struct slave *slave,
+                                               bool notify)
 {
-        bond_set_active_slave(slave);
+        bond_set_slave_state(slave, BOND_STATE_ACTIVE, notify);
         slave->inactive = 0;
 }
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 320bef2dba42..61376abdab39 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -144,6 +144,8 @@
 
 #define FLEXCAN_MB_CODE_MASK            (0xf0ffffff)
 
+#define FLEXCAN_TIMEOUT_US             (50)
+
 /*
  * FLEXCAN hardware feature flags
  *
@@ -262,6 +264,22 @@ static inline void flexcan_write(u32 val, void __iomem *addr)
 }
 #endif
 
+static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+
+        return regulator_enable(priv->reg_xceiver);
+}
+
+static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+
+        return regulator_disable(priv->reg_xceiver);
+}
+
 static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                                               u32 reg_esr)
 {
@@ -269,26 +287,95 @@ static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                 (reg_esr & FLEXCAN_ESR_ERR_BUS);
 }
 
-static inline void flexcan_chip_enable(struct flexcan_priv *priv)
+static int flexcan_chip_enable(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
         u32 reg;
 
         reg = flexcan_read(&regs->mcr);
         reg &= ~FLEXCAN_MCR_MDIS;
         flexcan_write(reg, &regs->mcr);
 
-        udelay(10);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK)
+                return -ETIMEDOUT;
+
+        return 0;
 }
 
-static inline void flexcan_chip_disable(struct flexcan_priv *priv)
+static int flexcan_chip_disable(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
         u32 reg;
 
         reg = flexcan_read(&regs->mcr);
         reg |= FLEXCAN_MCR_MDIS;
         flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_freeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate;
+        u32 reg;
+
+        reg = flexcan_read(&regs->mcr);
+        reg |= FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(100, 200);
+
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_unfreeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+        u32 reg;
+
+        reg = flexcan_read(&regs->mcr);
+        reg &= ~FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK)
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_softreset(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+
+        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST)
+                return -ETIMEDOUT;
+
+        return 0;
 }
 
 static int flexcan_get_berr_counter(const struct net_device *dev,
@@ -709,19 +796,14 @@ static int flexcan_chip_start(struct net_device *dev)
         u32 reg_mcr, reg_ctrl;
 
         /* enable module */
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                return err;
 
         /* soft reset */
-        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
-        udelay(10);
-
-        reg_mcr = flexcan_read(&regs->mcr);
-        if (reg_mcr & FLEXCAN_MCR_SOFTRST) {
-                netdev_err(dev, "Failed to softreset can module (mcr=0x%08x)\n",
-                           reg_mcr);
-                err = -ENODEV;
-                goto out;
-        }
+        err = flexcan_chip_softreset(priv);
+        if (err)
+                goto out_chip_disable;
 
         flexcan_set_bittiming(dev);
 
@@ -788,16 +870,14 @@ static int flexcan_chip_start(struct net_device *dev)
         if (priv->devtype_data->features & FLEXCAN_HAS_V10_FEATURES)
                 flexcan_write(0x0, &regs->rxfgmask);
 
-        if (priv->reg_xceiver)  {
-                err = regulator_enable(priv->reg_xceiver);
-                if (err)
-                        goto out;
-        }
+        err = flexcan_transceiver_enable(priv);
+        if (err)
+                goto out_chip_disable;
 
         /* synchronize with the can bus */
-        reg_mcr = flexcan_read(&regs->mcr);
-        reg_mcr &= ~FLEXCAN_MCR_HALT;
-        flexcan_write(reg_mcr, &regs->mcr);
+        err = flexcan_chip_unfreeze(priv);
+        if (err)
+                goto out_transceiver_disable;
 
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
@@ -810,7 +890,9 @@ static int flexcan_chip_start(struct net_device *dev)
 
         return 0;
 
- out:
+ out_transceiver_disable:
+        flexcan_transceiver_disable(priv);
+ out_chip_disable:
         flexcan_chip_disable(priv);
         return err;
 }
@@ -825,18 +907,17 @@ static void flexcan_chip_stop(struct net_device *dev)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
         struct flexcan_regs __iomem *regs = priv->base;
-        u32 reg;
+
+        /* freeze + disable module */
+        flexcan_chip_freeze(priv);
+        flexcan_chip_disable(priv);
 
         /* Disable all interrupts */
         flexcan_write(0, &regs->imask1);
+        flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
+                      &regs->ctrl);
 
-        /* Disable + halt module */
-        reg = flexcan_read(&regs->mcr);
-        reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT;
-        flexcan_write(reg, &regs->mcr);
-
-        if (priv->reg_xceiver)
-                regulator_disable(priv->reg_xceiver);
+        flexcan_transceiver_disable(priv);
         priv->can.state = CAN_STATE_STOPPED;
 
         return;
@@ -866,7 +947,7 @@ static int flexcan_open(struct net_device *dev)
         /* start chip and queuing */
         err = flexcan_chip_start(dev);
         if (err)
-                goto out_close;
+                goto out_free_irq;
 
         can_led_event(dev, CAN_LED_EVENT_OPEN);
 
@@ -875,6 +956,8 @@ static int flexcan_open(struct net_device *dev)
 
         return 0;
 
+ out_free_irq:
+        free_irq(dev->irq, dev);
  out_close:
         close_candev(dev);
  out_disable_per:
@@ -945,12 +1028,16 @@ static int register_flexcandev(struct net_device *dev)
                 goto out_disable_ipg;
 
         /* select "bus clock", chip must be disabled */
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                goto out_disable_per;
         reg = flexcan_read(&regs->ctrl);
         reg |= FLEXCAN_CTRL_CLK_SRC;
         flexcan_write(reg, &regs->ctrl);
 
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                goto out_chip_disable;
 
         /* set freeze, halt and activate FIFO, restrict register access */
         reg = flexcan_read(&regs->mcr);
@@ -967,14 +1054,15 @@ static int register_flexcandev(struct net_device *dev)
         if (!(reg & FLEXCAN_MCR_FEN)) {
                 netdev_err(dev, "Could not enable RX FIFO, unsupported core\n");
                 err = -ENODEV;
-                goto out_disable_per;
+                goto out_chip_disable;
         }
 
         err = register_candev(dev);
 
- out_disable_per:
         /* disable core and turn off clocks */
+ out_chip_disable:
         flexcan_chip_disable(priv);
+ out_disable_per:
         clk_disable_unprepare(priv->clk_per);
  out_disable_ipg:
         clk_disable_unprepare(priv->clk_ipg);
@@ -1104,9 +1192,10 @@ static int flexcan_probe(struct platform_device *pdev)
 static int flexcan_remove(struct platform_device *pdev)
 {
         struct net_device *dev = platform_get_drvdata(pdev);
+        struct flexcan_priv *priv = netdev_priv(dev);
 
         unregister_flexcandev(dev);
-
+        netif_napi_del(&priv->napi);
         free_candev(dev);
 
         return 0;
@@ -1117,8 +1206,11 @@ static int flexcan_suspend(struct device *device)
 {
         struct net_device *dev = dev_get_drvdata(device);
         struct flexcan_priv *priv = netdev_priv(dev);
+        int err;
 
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                return err;
 
         if (netif_running(dev)) {
                 netif_stop_queue(dev);
@@ -1139,9 +1231,7 @@ static int flexcan_resume(struct device *device)
                 netif_device_attach(dev);
                 netif_start_queue(dev);
         }
-        flexcan_chip_enable(priv);
-
-        return 0;
+        return flexcan_chip_enable(priv);
 }
 #endif /* CONFIG_PM_SLEEP */
 
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 6c859bba8b65..e77d11049747 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -473,6 +473,8 @@ static int kvaser_usb_get_card_info(struct kvaser_usb *dev)
                 return err;
 
         dev->nchannels = msg.u.cardinfo.nchannels;
+        if (dev->nchannels > MAX_NET_DEVICES)
+                return -EINVAL;
 
         return 0;
 }
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 1f7b5aa114fa..8a7bf7dad898 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -1484,6 +1484,10 @@ static int b44_open(struct net_device *dev)
         add_timer(&bp->timer);
 
         b44_enable_ints(bp);
+
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_start(bp->phydev);
+
         netif_start_queue(dev);
 out:
         return err;
@@ -1646,6 +1650,9 @@ static int b44_close(struct net_device *dev)
 
         netif_stop_queue(dev);
 
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_stop(bp->phydev);
+
         napi_disable(&bp->napi);
 
         del_timer_sync(&bp->timer);
@@ -2222,7 +2229,12 @@ static void b44_adjust_link(struct net_device *dev)
         }
 
         if (status_changed) {
-                b44_check_phy(bp);
+                u32 val = br32(bp, B44_TX_CTRL);
+                if (bp->flags & B44_FLAG_FULL_DUPLEX)
+                        val |= TX_CTRL_DUPLEX;
+                else
+                        val &= ~TX_CTRL_DUPLEX;
+                bw32(bp, B44_TX_CTRL, val);
                 phy_print_status(phydev);
         }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 9d7419e0390b..dbcff509dc3f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1873,7 +1873,7 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 }
 
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
-                       void *accel_priv)
+                       void *accel_priv, select_queue_fallback_t fallback)
 {
         struct bnx2x *bp = netdev_priv(dev);
 
@@ -1895,7 +1895,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
         }
 
         /* select a non-FCoE queue */
-        return __netdev_pick_tx(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
@@ -3875,7 +3875,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                      xmit_type);
                 }
 
-                /* Add the macs to the parsing BD this is a vf */
+                /* Add the macs to the parsing BD if this is a vf or if
+                 * Tx Switching is enabled.
+                 */
                 if (IS_VF(bp)) {
                         /* override GRE parameters in BD */
                         bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.src_hi,
@@ -3887,6 +3889,11 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                               &pbd_e2->data.mac_addr.dst_mid,
                                               &pbd_e2->data.mac_addr.dst_lo,
                                               eth->h_dest);
+                } else if (bp->flags & TX_SWITCHING) {
+                        bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.dst_hi,
+                                              &pbd_e2->data.mac_addr.dst_mid,
+                                              &pbd_e2->data.mac_addr.dst_lo,
+                                              eth->h_dest);
                 }
 
                 SET_FLAG(pbd_e2_parsing_data,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index bfc58d488bb5..a89a40f88c25 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -496,7 +496,7 @@ int bnx2x_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos);
 
 /* select_queue callback */
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
-                       void *accel_priv);
+                       void *accel_priv, select_queue_fallback_t fallback);
 
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
                                         struct bnx2x_fastpath *fp,
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3167ed6593b0..3b6d0ba86c71 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6843,8 +6843,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
 
                 work_mask |= opaque_key;
 
-                if ((desc->err_vlan & RXD_ERR_MASK) != 0 &&
-                    (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) {
+                if (desc->err_vlan & RXD_ERR_MASK) {
                 drop_it:
                         tg3_recycle_rx(tnapi, tpr, opaque_key,
                                        desc_idx, *post_ptr);
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index ef472385bce4..04321e5a356e 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2608,7 +2608,11 @@ struct tg3_rx_buffer_desc {
 #define RXD_ERR_TOO_SMALL               0x00400000
 #define RXD_ERR_NO_RESOURCES            0x00800000
 #define RXD_ERR_HUGE_FRAME              0x01000000
-#define RXD_ERR_MASK                    0xffff0000
+
+#define RXD_ERR_MASK    (RXD_ERR_BAD_CRC | RXD_ERR_COLLISION |          \
+                         RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE |       \
+                         RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL |         \
+                         RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME)
 
         u32                             reserved;
         u32                             opaque;
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index cf64f3d0b60d..4ad1187e82fb 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -707,7 +707,8 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
                 else
                         skb_checksum_none_assert(skb);
 
-                if (flags & BNA_CQ_EF_VLAN)
+                if ((flags & BNA_CQ_EF_VLAN) &&
+                    (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX))
                         __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), ntohs(cmpl->vlan_tag));
 
                 if (BNAD_RXBUF_IS_SK_BUFF(unmap_q->type))
@@ -2094,7 +2095,9 @@ bnad_init_rx_config(struct bnad *bnad, struct bna_rx_config *rx_config)
                 rx_config->q1_buf_size = BFI_SMALL_RXBUF_SIZE;
         }
 
-        rx_config->vlan_strip_status = BNA_STATUS_T_ENABLED;
+        rx_config->vlan_strip_status =
+                (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX) ?
+                BNA_STATUS_T_ENABLED : BNA_STATUS_T_DISABLED;
 }
 
 static void
@@ -3245,11 +3248,6 @@ bnad_set_rx_mode(struct net_device *netdev)
                         BNA_RXMODE_ALLMULTI;
         bna_rx_mode_set(bnad->rx_info[0].rx, new_mode, mode_mask, NULL);
 
-        if (bnad->cfg_flags & BNAD_CF_PROMISC)
-                bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
-        else
-                bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
-
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
 }
 
@@ -3374,6 +3372,27 @@ bnad_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto, u16 vid)
         return 0;
 }
 
+static int bnad_set_features(struct net_device *dev, netdev_features_t features)
+{
+        struct bnad *bnad = netdev_priv(dev);
+        netdev_features_t changed = features ^ dev->features;
+
+        if ((changed & NETIF_F_HW_VLAN_CTAG_RX) && netif_running(dev)) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+
+                if (features & NETIF_F_HW_VLAN_CTAG_RX)
+                        bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
+                else
+                        bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
+
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void
 bnad_netpoll(struct net_device *netdev)
@@ -3421,6 +3440,7 @@ static const struct net_device_ops bnad_netdev_ops = {
         .ndo_change_mtu         = bnad_change_mtu,
         .ndo_vlan_rx_add_vid    = bnad_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bnad_vlan_rx_kill_vid,
+        .ndo_set_features       = bnad_set_features,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = bnad_netpoll
 #endif
@@ -3433,14 +3453,14 @@ bnad_netdev_init(struct bnad *bnad, bool using_dac)
 
         netdev->hw_features = NETIF_F_SG | NETIF_F_RXCSUM |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX;
+                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX |
+                NETIF_F_HW_VLAN_CTAG_RX;
 
         netdev->vlan_features = NETIF_F_SG | NETIF_F_HIGHDMA |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                 NETIF_F_TSO | NETIF_F_TSO6;
 
-        netdev->features |= netdev->hw_features |
-                NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_CTAG_FILTER;
+        netdev->features |= netdev->hw_features | NETIF_F_HW_VLAN_CTAG_FILTER;
 
         if (using_dac)
                 netdev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 43ab35fea48d..34e2488767d9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -6179,6 +6179,7 @@ static struct pci_driver cxgb4_driver = {
         .id_table = cxgb4_pci_tbl,
         .probe    = init_one,
         .remove   = remove_one,
+        .shutdown = remove_one,
         .err_handler = &cxgb4_eeh,
 };
 
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index add05f14b38b..1642de78aac8 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -1939,6 +1939,7 @@ static void tulip_remove_one(struct pci_dev *pdev)
         pci_iounmap(pdev, tp->base_addr);
         free_netdev (dev);
         pci_release_regions (pdev);
+        pci_disable_device(pdev);
 
         /* pci_power_off (pdev, -1); */
 }
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 8d09615da585..05529e273050 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -350,11 +350,13 @@ struct be_drv_stats {
         u32 roce_drops_crc;
 };
 
+/* A vlan-id of 0xFFFF must be used to clear transparent vlan-tagging */
+#define BE_RESET_VLAN_TAG_ID    0xFFFF
+
 struct be_vf_cfg {
         unsigned char mac_addr[ETH_ALEN];
         int if_handle;
         int pmac_id;
-        u16 def_vid;
         u16 vlan_tag;
         u32 tx_rate;
 };
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 04ac9c6a0d39..36c80612e21a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -913,24 +913,14 @@ static int be_ipv6_tx_stall_chk(struct be_adapter *adapter,
         return BE3_chip(adapter) && be_ipv6_exthdr_check(skb);
 }
 
-static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
-                                           struct sk_buff *skb,
-                                           bool *skip_hw_vlan)
+static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
+                                                  struct sk_buff *skb,
+                                                  bool *skip_hw_vlan)
 {
         struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
         unsigned int eth_hdr_len;
         struct iphdr *ip;
 
-        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or less
-         * may cause a transmit stall on that port. So the work-around is to
-         * pad short packets (<= 32 bytes) to a 36-byte length.
-         */
-        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
-                if (skb_padto(skb, 36))
-                        goto tx_drop;
-                skb->len = 36;
-        }
-
         /* For padded packets, BE HW modifies tot_len field in IP header
          * incorrecly when VLAN tag is inserted by HW.
          * For padded packets, Lancer computes incorrect checksum.
@@ -959,7 +949,7 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
             vlan_tx_tag_present(skb)) {
                 skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                 if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
         }
 
         /* HW may lockup when VLAN HW tagging is requested on
@@ -981,15 +971,39 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
             be_vlan_tag_tx_chk(adapter, skb)) {
                 skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                 if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
         }
 
         return skb;
 tx_drop:
         dev_kfree_skb_any(skb);
+err:
         return NULL;
 }
 
+static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
+                                           struct sk_buff *skb,
+                                           bool *skip_hw_vlan)
+{
+        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or
+         * less may cause a transmit stall on that port. So the work-around is
+         * to pad short packets (<= 32 bytes) to a 36-byte length.
+         */
+        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
+                if (skb_padto(skb, 36))
+                        return NULL;
+                skb->len = 36;
+        }
+
+        if (BEx_chip(adapter) || lancer_chip(adapter)) {
+                skb = be_lancer_xmit_workarounds(adapter, skb, skip_hw_vlan);
+                if (!skb)
+                        return NULL;
+        }
+
+        return skb;
+}
+
 static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -1157,6 +1171,14 @@ ret:
         return status;
 }
 
+static void be_clear_promisc(struct be_adapter *adapter)
+{
+        adapter->promiscuous = false;
+        adapter->flags &= ~BE_FLAGS_VLAN_PROMISC;
+
+        be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
+}
+
 static void be_set_rx_mode(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -1170,9 +1192,7 @@ static void be_set_rx_mode(struct net_device *netdev)
 
         /* BE was previously in promiscuous mode; disable it */
         if (adapter->promiscuous) {
-                adapter->promiscuous = false;
-                be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
-
+                be_clear_promisc(adapter);
                 if (adapter->vlans_added)
                         be_vid_config(adapter);
         }
@@ -1287,24 +1307,20 @@ static int be_set_vf_vlan(struct net_device *netdev,
 
         if (vlan || qos) {
                 vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan) {
-                        /* If this is new value, program it. Else skip. */
-                        vf_cfg->vlan_tag = vlan;
+                if (vf_cfg->vlan_tag != vlan)
                         status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
                                                        vf_cfg->if_handle, 0);
-                }
         } else {
                 /* Reset Transparent Vlan Tagging. */
-                vf_cfg->vlan_tag = 0;
-                vlan = vf_cfg->def_vid;
-                status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                               vf_cfg->if_handle, 0);
+                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
+                                               vf + 1, vf_cfg->if_handle, 0);
         }
 
-
-        if (status)
+        if (!status)
+                vf_cfg->vlan_tag = vlan;
+        else
                 dev_info(&adapter->pdev->dev,
-                                "VLAN %d config on VF %d failed\n", vlan, vf);
+                         "VLAN %d config on VF %d failed\n", vlan, vf);
         return status;
 }
 
@@ -3013,11 +3029,11 @@ static int be_vf_setup_init(struct be_adapter *adapter)
 
 static int be_vf_setup(struct be_adapter *adapter)
 {
+        struct device *dev = &adapter->pdev->dev;
         struct be_vf_cfg *vf_cfg;
-        u16 def_vlan, lnk_speed;
         int status, old_vfs, vf;
-        struct device *dev = &adapter->pdev->dev;
         u32 privileges;
+        u16 lnk_speed;
 
         old_vfs = pci_num_vf(adapter->pdev);
         if (old_vfs) {
@@ -3084,12 +3100,6 @@ static int be_vf_setup(struct be_adapter *adapter)
                 if (!status)
                         vf_cfg->tx_rate = lnk_speed;
 
-                status = be_cmd_get_hsw_config(adapter, &def_vlan,
-                                               vf + 1, vf_cfg->if_handle, NULL);
-                if (status)
-                        goto err;
-                vf_cfg->def_vid = def_vlan;
-
                 if (!old_vfs)
                         be_cmd_enable_vf(adapter, vf + 1);
         }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d4782b42401b..479a7cba45c0 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -389,12 +389,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                         netdev_err(ndev, "Tx DMA memory map failed\n");
                 return NETDEV_TX_OK;
         }
-        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
-         * it's the last BD of the frame, and to put the CRC on the end.
-         */
-        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
-                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
-        bdp->cbd_sc = status;
 
         if (fep->bufdesc_ex) {
 
@@ -416,6 +410,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 }
         }
 
+        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
+         * it's the last BD of the frame, and to put the CRC on the end.
+         */
+        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
+                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
+        bdp->cbd_sc = status;
+
         bdp_pre = fec_enet_get_prevdesc(bdp, fep);
         if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
             !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
@@ -1778,8 +1779,6 @@ fec_enet_open(struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         int ret;
 
-        napi_enable(&fep->napi);
-
         /* I should reset the ring buffers here, but I don't yet know
          * a simple way to do that.
          */
@@ -1794,6 +1793,8 @@ fec_enet_open(struct net_device *ndev)
                 fec_enet_free_buffers(ndev);
                 return ret;
         }
+
+        napi_enable(&fep->napi);
         phy_start(fep->phy_dev);
         netif_start_queue(ndev);
         fep->opened = 1;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 6d4ada72dfd0..18076c4178b4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6881,7 +6881,7 @@ static inline int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, u16 size)
 }
 
 static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
-                              void *accel_priv)
+                              void *accel_priv, select_queue_fallback_t fallback)
 {
         struct ixgbe_fwd_adapter *fwd_adapter = accel_priv;
 #ifdef IXGBE_FCOE
@@ -6907,7 +6907,7 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
                 if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
                         break;
         default:
-                return __netdev_pick_tx(dev, skb);
+                return fallback(dev, skb);
         }
 
         f = &adapter->ring_feature[RING_F_FCOE];
@@ -6920,7 +6920,7 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
 
         return txq + f->offset;
 #else
-        return __netdev_pick_tx(dev, skb);
+        return fallback(dev, skb);
 #endif
 }
 
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 8f9266c64c75..fd4b6aecf6ee 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -619,7 +619,7 @@ ltq_etop_set_multicast_list(struct net_device *dev)
 
 static u16
 ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb,
-                      void *accel_priv)
+                      void *accel_priv, select_queue_fallback_t fallback)
 {
         /* we are currently only using the first queue */
         return 0;
diff --git a/drivers/net/ethernet/marvell/Kconfig b/drivers/net/ethernet/marvell/Kconfig
index 6300fd27f2db..68e6a6613e9a 100644
--- a/drivers/net/ethernet/marvell/Kconfig
+++ b/drivers/net/ethernet/marvell/Kconfig
@@ -43,12 +43,12 @@ config MVMDIO
           This driver is used by the MV643XX_ETH and MVNETA drivers.
 
 config MVNETA
-        tristate "Marvell Armada 370/XP network interface support"
-        depends on MACH_ARMADA_370_XP
+        tristate "Marvell Armada 370/38x/XP network interface support"
+        depends on PLAT_ORION
         select MVMDIO
         ---help---
           This driver supports the network interface units in the
-          Marvell ARMADA XP and ARMADA 370 SoC family.
+          Marvell ARMADA XP, ARMADA 370 and ARMADA 38x SoC family.
 
           Note that this driver is distinct from the mv643xx_eth
           driver, which should be used for the older Marvell SoCs
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 8e8a7eb43a2c..13457032d15f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -629,7 +629,7 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, struct sk_buff *sk
 }
 
 u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
-                         void *accel_priv)
+                         void *accel_priv, select_queue_fallback_t fallback)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         u16 rings_p_up = priv->num_tx_rings_p_up;
@@ -641,7 +641,7 @@ u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
         if (vlan_tx_tag_present(skb))
                 up = vlan_tx_tag_get(skb) >> VLAN_PRIO_SHIFT;
 
-        return __netdev_pick_tx(dev, skb) % rings_p_up + up * rings_p_up;
+        return fallback(dev, skb) % rings_p_up + up * rings_p_up;
 }
 
 static void mlx4_bf_copy(void __iomem *dst, unsigned long *src, unsigned bytecnt)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 6b65f7795215..7aec6c833973 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -51,8 +51,8 @@
 
 #define DRV_NAME        "mlx4_core"
 #define PFX             DRV_NAME ": "
-#define DRV_VERSION     "1.1"
-#define DRV_RELDATE     "Dec, 2011"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb, 2014"
 
 #define MLX4_FS_UDP_UC_EN               (1 << 1)
 #define MLX4_FS_TCP_UC_EN               (1 << 2)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 3af04c3f42ea..b57e8c87a34e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -57,8 +57,8 @@
 #include "en_port.h"
 
 #define DRV_NAME        "mlx4_en"
-#define DRV_VERSION     "2.0"
-#define DRV_RELDATE     "Dec 2011"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb 2014"
 
 #define MLX4_EN_MSG_LEVEL       (NETIF_MSG_LINK | NETIF_MSG_IFDOWN)
 
@@ -723,7 +723,7 @@ int mlx4_en_arm_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 
 void mlx4_en_tx_irq(struct mlx4_cq *mcq);
 u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
-                         void *accel_priv);
+                         void *accel_priv, select_queue_fallback_t fallback);
 netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev);
 
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index a064f06e0cb8..23b7e2d35a93 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -46,8 +46,8 @@
 #include "mlx5_core.h"
 
 #define DRIVER_NAME "mlx5_core"
-#define DRIVER_VERSION "1.0"
-#define DRIVER_RELDATE  "June 2013"
+#define DRIVER_VERSION "2.2-1"
+#define DRIVER_RELDATE  "Feb 2014"
 
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox ConnectX-IB HCA core library");
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4146664d4d6a..27c4f131863b 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -340,6 +340,7 @@ int qlcnic_83xx_setup_intr(struct qlcnic_adapter *adapter)
                         if (qlcnic_sriov_vf_check(adapter))
                                 return -EINVAL;
                         num_msix = 1;
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
                         adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
                 }
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index 77f1bce432d2..7d4f54912bad 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -807,7 +807,7 @@ qlcnic_dcb_get_pg_tc_cfg_tx(struct net_device *netdev, int tc, u8 *prio,
             !type->tc_param_valid)
                 return;
 
-        if (tc < 0 || (tc > QLC_DCB_MAX_TC))
+        if (tc < 0 || (tc >= QLC_DCB_MAX_TC))
                 return;
 
         tc_cfg = &type->tc_cfg[tc];
@@ -843,7 +843,7 @@ static void qlcnic_dcb_get_pg_bwg_cfg_tx(struct net_device *netdev, int pgid,
             !type->tc_param_valid)
                 return;
 
-        if (pgid < 0 || pgid > QLC_DCB_MAX_PG)
+        if (pgid < 0 || pgid >= QLC_DCB_MAX_PG)
                 return;
 
         pgcfg = &type->pg_cfg[pgid];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index ba78c7481fa3..1222865cfb73 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -816,9 +816,10 @@ static int qlcnic_82xx_setup_intr(struct qlcnic_adapter *adapter)
 
                 if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
                         qlcnic_disable_multi_tx(adapter);
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
 
                         err = qlcnic_enable_msi_legacy(adapter);
-                        if (!err)
+                        if (err)
                                 return err;
                 }
         }
@@ -3863,7 +3864,7 @@ int qlcnic_validate_rings(struct qlcnic_adapter *adapter, __u32 ring_cnt,
                 strcpy(buf, "Tx");
         }
 
-        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
+        if (!QLCNIC_IS_MSI_FAMILY(adapter)) {
                 netdev_err(netdev, "No RSS/TSS support in INT-x mode\n");
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 09acf15c3a56..e5277a632671 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -13,8 +13,6 @@
 #define QLC_VF_MIN_TX_RATE      100
 #define QLC_VF_MAX_TX_RATE      9999
 #define QLC_MAC_OPCODE_MASK     0x7
-#define QLC_MAC_STAR_ADD        6
-#define QLC_MAC_STAR_DEL        7
 #define QLC_VF_FLOOD_BIT        BIT_16
 #define QLC_FLOOD_MODE          0x5
 
@@ -1206,13 +1204,6 @@ static int qlcnic_sriov_validate_cfg_macvlan(struct qlcnic_adapter *adapter,
         struct qlcnic_vport *vp = vf->vp;
         u8 op, new_op;
 
-        if (((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_ADD) ||
-            ((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_DEL)) {
-                netdev_err(adapter->netdev, "MAC + any VLAN filter not allowed from VF %d\n",
-                           vf->pci_func);
-                return -EINVAL;
-        }
-
         if (!(cmd->req.arg[1] & BIT_8))
                 return -EINVAL;
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 91a67ae8f17b..e9779653cd4c 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7118,6 +7118,8 @@ rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         mutex_init(&tp->wk.mutex);
+        u64_stats_init(&tp->rx_stats.syncp);
+        u64_stats_init(&tp->tx_stats.syncp);
 
         /* Get MAC address */
         for (i = 0; i < ETH_ALEN; i++)
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index eb75fbd11a01..d7a36829649a 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -1668,6 +1668,13 @@ void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev)
         struct efx_ptp_data *ptp = efx->ptp_data;
         int code = EFX_QWORD_FIELD(*ev, MCDI_EVENT_CODE);
 
+        if (!ptp) {
+                if (net_ratelimit())
+                        netif_warn(efx, drv, efx->net_dev,
+                                   "Received PTP event but PTP not set up\n");
+                return;
+        }
+
         if (!ptp->enabled)
                 return;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index e2f202e3932f..f2d7c702c77f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -37,6 +37,17 @@ config DWMAC_SUNXI
           stmmac device driver. This driver is used for A20/A31
           GMAC    ethernet controller.
 
+config DWMAC_STI
+        bool "STi GMAC support"
+        depends on STMMAC_PLATFORM && ARCH_STI
+        default y
+        ---help---
+          Support for ethernet controller on STi SOCs.
+
+          This selects STi SoC glue layer support for the stmmac
+          device driver. This driver is used on for the STi series
+          SOCs GMAC ethernet controller.
+
 config STMMAC_PCI
         bool "STMMAC PCI bus support"
         depends on STMMAC_ETH && PCI
diff --git a/drivers/net/ethernet/stmicro/stmmac/Makefile b/drivers/net/ethernet/stmicro/stmmac/Makefile
index ecadecea79b2..dcef28775dad 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Makefile
+++ b/drivers/net/ethernet/stmicro/stmmac/Makefile
@@ -2,6 +2,7 @@ obj-$(CONFIG_STMMAC_ETH) += stmmac.o
 stmmac-$(CONFIG_STMMAC_PLATFORM) += stmmac_platform.o
 stmmac-$(CONFIG_STMMAC_PCI) += stmmac_pci.o
 stmmac-$(CONFIG_DWMAC_SUNXI) += dwmac-sunxi.o
+stmmac-$(CONFIG_DWMAC_STI) += dwmac-sti.o
 stmmac-objs:= stmmac_main.o stmmac_ethtool.o stmmac_mdio.o ring_mode.o  \
               chain_mode.o dwmac_lib.o dwmac1000_core.o  dwmac1000_dma.o \
               dwmac100_core.o dwmac100_dma.o enh_desc.o  norm_desc.o \
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
new file mode 100644
index 000000000000..552bbc17863c
--- /dev/null
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -0,0 +1,330 @@
+/**
+ * dwmac-sti.c - STMicroelectronics DWMAC Specific Glue layer
+ *
+ * Copyright (C) 2003-2014 STMicroelectronics (R&D) Limited
+ * Author: Srinivas Kandagatla <srinivas.kandagatla@st.com>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/stmmac.h>
+#include <linux/phy.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/of_net.h>
+
+/**
+ *                      STi GMAC glue logic.
+ *                      --------------------
+ *
+ *               _
+ *              |  \
+ *      --------|0  \ ETH_SEL_INTERNAL_NOTEXT_PHYCLK
+ * phyclk       |    |___________________________________________
+ *              |    |  |                       (phyclk-in)
+ *      --------|1  /   |
+ * int-clk      |_ /    |
+ *                      |        _
+ *                      |       |  \
+ *                      |_______|1  \ ETH_SEL_TX_RETIME_CLK
+ *                              |    |___________________________
+ *                              |    |          (tx-retime-clk)
+ *                       _______|0  /
+ *                      |       |_ /
+ *               _      |
+ *              |  \    |
+ *      --------|0  \   |
+ * clk_125      |    |__|
+ *              |    |  ETH_SEL_TXCLK_NOT_CLK125
+ *      --------|1  /
+ * txclk        |_ /
+ *
+ *
+ * ETH_SEL_INTERNAL_NOTEXT_PHYCLK is valid only for RMII where PHY can
+ * generate 50MHz clock or MAC can generate it.
+ * This bit is configured by "st,ext-phyclk" property.
+ *
+ * ETH_SEL_TXCLK_NOT_CLK125 is only valid for gigabit modes, where the 125Mhz
+ * clock either comes from clk-125 pin or txclk pin. This configuration is
+ * totally driven by the board wiring. This bit is configured by
+ * "st,tx-retime-src" property.
+ *
+ * TXCLK configuration is different for different phy interface modes
+ * and changes according to link speed in modes like RGMII.
+ *
+ * Below table summarizes the clock requirement and clock sources for
+ * supported phy interface modes with link speeds.
+ * ________________________________________________
+ *|  PHY_MODE   | 1000 Mbit Link | 100 Mbit Link   |
+ * ------------------------------------------------
+ *|     MII     |       n/a      |      25Mhz      |
+ *|             |                |      txclk      |
+ * ------------------------------------------------
+ *|     GMII    |     125Mhz     |      25Mhz      |
+ *|             |  clk-125/txclk |      txclk      |
+ * ------------------------------------------------
+ *|     RGMII   |     125Mhz     |      25Mhz      |
+ *|             |  clk-125/txclk |      clkgen     |
+ * ------------------------------------------------
+ *|     RMII    |       n/a      |      25Mhz      |
+ *|             |                |clkgen/phyclk-in |
+ * ------------------------------------------------
+ *
+ * TX lines are always retimed with a clk, which can vary depending
+ * on the board configuration. Below is the table of these bits
+ * in eth configuration register depending on source of retime clk.
+ *
+ *---------------------------------------------------------------
+ * src   | tx_rt_clk    | int_not_ext_phyclk    | txclk_n_clk125|
+ *---------------------------------------------------------------
+ * txclk |      0       |       n/a             |       1       |
+ *---------------------------------------------------------------
+ * ck_125|      0       |       n/a             |       0       |
+ *---------------------------------------------------------------
+ * phyclk|      1       |       0               |       n/a     |
+ *---------------------------------------------------------------
+ * clkgen|      1       |       1               |       n/a     |
+ *---------------------------------------------------------------
+ */
+
+ /* Register definition */
+
+ /* 3 bits [8:6]
+  *  [6:6]      ETH_SEL_TXCLK_NOT_CLK125
+  *  [7:7]      ETH_SEL_INTERNAL_NOTEXT_PHYCLK
+  *  [8:8]      ETH_SEL_TX_RETIME_CLK
+  *
+  */
+
+#define TX_RETIME_SRC_MASK              GENMASK(8, 6)
+#define ETH_SEL_TX_RETIME_CLK           BIT(8)
+#define ETH_SEL_INTERNAL_NOTEXT_PHYCLK  BIT(7)
+#define ETH_SEL_TXCLK_NOT_CLK125        BIT(6)
+
+#define ENMII_MASK                      GENMASK(5, 5)
+#define ENMII                           BIT(5)
+
+/**
+ * 3 bits [4:2]
+ *      000-GMII/MII
+ *      001-RGMII
+ *      010-SGMII
+ *      100-RMII
+*/
+#define MII_PHY_SEL_MASK                GENMASK(4, 2)
+#define ETH_PHY_SEL_RMII                BIT(4)
+#define ETH_PHY_SEL_SGMII               BIT(3)
+#define ETH_PHY_SEL_RGMII               BIT(2)
+#define ETH_PHY_SEL_GMII                0x0
+#define ETH_PHY_SEL_MII                 0x0
+
+#define IS_PHY_IF_MODE_RGMII(iface)     (iface == PHY_INTERFACE_MODE_RGMII || \
+                        iface == PHY_INTERFACE_MODE_RGMII_ID || \
+                        iface == PHY_INTERFACE_MODE_RGMII_RXID || \
+                        iface == PHY_INTERFACE_MODE_RGMII_TXID)
+
+#define IS_PHY_IF_MODE_GBIT(iface)      (IS_PHY_IF_MODE_RGMII(iface) || \
+                        iface == PHY_INTERFACE_MODE_GMII)
+
+struct sti_dwmac {
+        int interface;
+        bool ext_phyclk;
+        bool is_tx_retime_src_clk_125;
+        struct clk *clk;
+        int reg;
+        struct device *dev;
+        struct regmap *regmap;
+};
+
+static u32 phy_intf_sels[] = {
+        [PHY_INTERFACE_MODE_MII] = ETH_PHY_SEL_MII,
+        [PHY_INTERFACE_MODE_GMII] = ETH_PHY_SEL_GMII,
+        [PHY_INTERFACE_MODE_RGMII] = ETH_PHY_SEL_RGMII,
+        [PHY_INTERFACE_MODE_RGMII_ID] = ETH_PHY_SEL_RGMII,
+        [PHY_INTERFACE_MODE_SGMII] = ETH_PHY_SEL_SGMII,
+        [PHY_INTERFACE_MODE_RMII] = ETH_PHY_SEL_RMII,
+};
+
+enum {
+        TX_RETIME_SRC_NA = 0,
+        TX_RETIME_SRC_TXCLK = 1,
+        TX_RETIME_SRC_CLK_125,
+        TX_RETIME_SRC_PHYCLK,
+        TX_RETIME_SRC_CLKGEN,
+};
+
+static const char *const tx_retime_srcs[] = {
+        [TX_RETIME_SRC_NA] = "",
+        [TX_RETIME_SRC_TXCLK] = "txclk",
+        [TX_RETIME_SRC_CLK_125] = "clk_125",
+        [TX_RETIME_SRC_PHYCLK] = "phyclk",
+        [TX_RETIME_SRC_CLKGEN] = "clkgen",
+};
+
+static u32 tx_retime_val[] = {
+        [TX_RETIME_SRC_TXCLK] = ETH_SEL_TXCLK_NOT_CLK125,
+        [TX_RETIME_SRC_CLK_125] = 0x0,
+        [TX_RETIME_SRC_PHYCLK] = ETH_SEL_TX_RETIME_CLK,
+        [TX_RETIME_SRC_CLKGEN] = ETH_SEL_TX_RETIME_CLK |
+            ETH_SEL_INTERNAL_NOTEXT_PHYCLK,
+};
+
+static void setup_retime_src(struct sti_dwmac *dwmac, u32 spd)
+{
+        u32 src = 0, freq = 0;
+
+        if (spd == SPEED_100) {
+                if (dwmac->interface == PHY_INTERFACE_MODE_MII ||
+                    dwmac->interface == PHY_INTERFACE_MODE_GMII) {
+                        src = TX_RETIME_SRC_TXCLK;
+                } else if (dwmac->interface == PHY_INTERFACE_MODE_RMII) {
+                        if (dwmac->ext_phyclk) {
+                                src = TX_RETIME_SRC_PHYCLK;
+                        } else {
+                                src = TX_RETIME_SRC_CLKGEN;
+                                freq = 50000000;
+                        }
+
+                } else if (IS_PHY_IF_MODE_RGMII(dwmac->interface)) {
+                        src = TX_RETIME_SRC_CLKGEN;
+                        freq = 25000000;
+                }
+
+                if (src == TX_RETIME_SRC_CLKGEN && dwmac->clk)
+                        clk_set_rate(dwmac->clk, freq);
+
+        } else if (spd == SPEED_1000) {
+                if (dwmac->is_tx_retime_src_clk_125)
+                        src = TX_RETIME_SRC_CLK_125;
+                else
+                        src = TX_RETIME_SRC_TXCLK;
+        }
+
+        regmap_update_bits(dwmac->regmap, dwmac->reg,
+                           TX_RETIME_SRC_MASK, tx_retime_val[src]);
+}
+
+static void sti_dwmac_exit(struct platform_device *pdev, void *priv)
+{
+        struct sti_dwmac *dwmac = priv;
+
+        if (dwmac->clk)
+                clk_disable_unprepare(dwmac->clk);
+}
+
+static void sti_fix_mac_speed(void *priv, unsigned int spd)
+{
+        struct sti_dwmac *dwmac = priv;
+
+        setup_retime_src(dwmac, spd);
+
+        return;
+}
+
+static int sti_dwmac_parse_data(struct sti_dwmac *dwmac,
+                                struct platform_device *pdev)
+{
+        struct resource *res;
+        struct device *dev = &pdev->dev;
+        struct device_node *np = dev->of_node;
+        struct regmap *regmap;
+        int err;
+
+        if (!np)
+                return -EINVAL;
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "sti-ethconf");
+        if (!res)
+                return -ENODATA;
+
+        regmap = syscon_regmap_lookup_by_phandle(np, "st,syscon");
+        if (IS_ERR(regmap))
+                return PTR_ERR(regmap);
+
+        dwmac->dev = dev;
+        dwmac->interface = of_get_phy_mode(np);
+        dwmac->regmap = regmap;
+        dwmac->reg = res->start;
+        dwmac->ext_phyclk = of_property_read_bool(np, "st,ext-phyclk");
+        dwmac->is_tx_retime_src_clk_125 = false;
+
+        if (IS_PHY_IF_MODE_GBIT(dwmac->interface)) {
+                const char *rs;
+
+                err = of_property_read_string(np, "st,tx-retime-src", &rs);
+                if (err < 0) {
+                        dev_err(dev, "st,tx-retime-src not specified\n");
+                        return err;
+                }
+
+                if (!strcasecmp(rs, "clk_125"))
+                        dwmac->is_tx_retime_src_clk_125 = true;
+        }
+
+        dwmac->clk = devm_clk_get(dev, "sti-ethclk");
+
+        if (IS_ERR(dwmac->clk))
+                dwmac->clk = NULL;
+
+        return 0;
+}
+
+static int sti_dwmac_init(struct platform_device *pdev, void *priv)
+{
+        struct sti_dwmac *dwmac = priv;
+        struct regmap *regmap = dwmac->regmap;
+        int iface = dwmac->interface;
+        u32 reg = dwmac->reg;
+        u32 val, spd;
+
+        if (dwmac->clk)
+                clk_prepare_enable(dwmac->clk);
+
+        regmap_update_bits(regmap, reg, MII_PHY_SEL_MASK, phy_intf_sels[iface]);
+
+        val = (iface == PHY_INTERFACE_MODE_REVMII) ? 0 : ENMII;
+        regmap_update_bits(regmap, reg, ENMII_MASK, val);
+
+        if (IS_PHY_IF_MODE_GBIT(iface))
+                spd = SPEED_1000;
+        else
+                spd = SPEED_100;
+
+        setup_retime_src(dwmac, spd);
+
+        return 0;
+}
+
+static void *sti_dwmac_setup(struct platform_device *pdev)
+{
+        struct sti_dwmac *dwmac;
+        int ret;
+
+        dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
+        if (!dwmac)
+                return ERR_PTR(-ENOMEM);
+
+        ret = sti_dwmac_parse_data(dwmac, pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "Unable to parse OF data\n");
+                return ERR_PTR(ret);
+        }
+
+        return dwmac;
+}
+
+const struct stmmac_of_data sti_gmac_data = {
+        .fix_mac_speed = sti_fix_mac_speed,
+        .setup = sti_dwmac_setup,
+        .init = sti_dwmac_init,
+        .exit = sti_dwmac_exit,
+};
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index d9af26ed58ee..f9e60d7918c4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -133,6 +133,9 @@ bool stmmac_eee_init(struct stmmac_priv *priv);
 #ifdef CONFIG_DWMAC_SUNXI
 extern const struct stmmac_of_data sun7i_gmac_data;
 #endif
+#ifdef CONFIG_DWMAC_STI
+extern const struct stmmac_of_data sti_gmac_data;
+#endif
 extern struct platform_driver stmmac_pltfr_driver;
 static inline int stmmac_register_platform(void)
 {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a2e7d2c96e36..078ad0ec8593 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1705,7 +1705,7 @@ static int stmmac_open(struct net_device *dev)
         priv->dma_rx_size = STMMAC_ALIGN(dma_rxsize);
         priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
 
-        alloc_dma_desc_resources(priv);
+        ret = alloc_dma_desc_resources(priv);
         if (ret < 0) {
                 pr_err("%s: DMA descriptors allocation failed\n", __func__);
                 goto dma_desc_error;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 5884a7d2063b..c61bc72b8e90 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -33,6 +33,11 @@ static const struct of_device_id stmmac_dt_ids[] = {
 #ifdef CONFIG_DWMAC_SUNXI
         { .compatible = "allwinner,sun7i-a20-gmac", .data = &sun7i_gmac_data},
 #endif
+#ifdef CONFIG_DWMAC_STI
+        { .compatible = "st,stih415-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stih416-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stih127-dwmac", .data = &sti_gmac_data},
+#endif
         /* SoC specific glue layers should come before generic bindings */
         { .compatible = "st,spear600-gmac"},
         { .compatible = "snps,dwmac-3.610"},
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 1d860ce914ed..ffd4d12acf6d 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -554,7 +554,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                  * common for both the interface as the interface shares
                  * the same hardware resource.
                  */
-                for (i = 0; i <= priv->data.slaves; i++)
+                for (i = 0; i < priv->data.slaves; i++)
                         if (priv->slaves[i].ndev->flags & IFF_PROMISC)
                                 flag = true;
 
@@ -578,7 +578,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                         unsigned long timeout = jiffies + HZ;
 
                         /* Disable Learn for all ports */
-                        for (i = 0; i <= priv->data.slaves; i++) {
+                        for (i = 0; i < priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 1);
                                 cpsw_ale_control_set(ale, i,
@@ -606,7 +606,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 0);
 
                         /* Enable Learn for all ports */
-                        for (i = 0; i <= priv->data.slaves; i++) {
+                        for (i = 0; i < priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 0);
                                 cpsw_ale_control_set(ale, i,
@@ -1164,11 +1164,17 @@ static void cpsw_init_host_port(struct cpsw_priv *priv)
 
 static void cpsw_slave_stop(struct cpsw_slave *slave, struct cpsw_priv *priv)
 {
+        u32 slave_port;
+
+        slave_port = cpsw_get_slave_port(priv, slave->slave_num);
+
         if (!slave->phy)
                 return;
         phy_stop(slave->phy);
         phy_disconnect(slave->phy);
         slave->phy = NULL;
+        cpsw_ale_control_set(priv->ale, slave_port,
+                             ALE_PORT_STATE, ALE_PORT_STATE_DISABLE);
 }
 
 static int cpsw_ndo_open(struct net_device *ndev)
@@ -1896,6 +1902,11 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                         memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN);
 
                 slave_data->phy_if = of_get_phy_mode(slave_node);
+                if (slave_data->phy_if < 0) {
+                        pr_err("Missing or malformed slave[%d] phy-mode property\n",
+                               i);
+                        return slave_data->phy_if;
+                }
 
                 if (data->dual_emac) {
                         if (of_property_read_u32(slave_node, "dual_emac_res_vlan",
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 023237a65720..17503da9f7a5 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2071,7 +2071,7 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
 
 /* Return subqueue id on this core (one per core). */
 static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb,
-                                 void *accel_priv)
+                                 void *accel_priv, select_queue_fallback_t fallback)
 {
         return smp_processor_id();
 }
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 1ec65feebb9e..4bfdf8c7ada0 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -26,6 +26,7 @@
 #include <linux/netdevice.h>
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
+#include <linux/of_irq.h>
 #include <linux/of_address.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
@@ -600,7 +601,8 @@ static void axienet_start_xmit_done(struct net_device *ndev)
                 size += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK;
                 packets++;
 
-                lp->tx_bd_ci = ++lp->tx_bd_ci % TX_BD_NUM;
+                ++lp->tx_bd_ci;
+                lp->tx_bd_ci %= TX_BD_NUM;
                 cur_p = &lp->tx_bd_v[lp->tx_bd_ci];
                 status = cur_p->status;
         }
@@ -686,7 +688,8 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                      skb_headlen(skb), DMA_TO_DEVICE);
 
         for (ii = 0; ii < num_frag; ii++) {
-                lp->tx_bd_tail = ++lp->tx_bd_tail % TX_BD_NUM;
+                ++lp->tx_bd_tail;
+                lp->tx_bd_tail %= TX_BD_NUM;
                 cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
                 frag = &skb_shinfo(skb)->frags[ii];
                 cur_p->phys = dma_map_single(ndev->dev.parent,
@@ -702,7 +705,8 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         tail_p = lp->tx_bd_p + sizeof(*lp->tx_bd_v) * lp->tx_bd_tail;
         /* Start the transfer */
         axienet_dma_out32(lp, XAXIDMA_TX_TDESC_OFFSET, tail_p);
-        lp->tx_bd_tail = ++lp->tx_bd_tail % TX_BD_NUM;
+        ++lp->tx_bd_tail;
+        lp->tx_bd_tail %= TX_BD_NUM;
 
         return NETDEV_TX_OK;
 }
@@ -774,7 +778,8 @@ static void axienet_recv(struct net_device *ndev)
                 cur_p->status = 0;
                 cur_p->sw_id_offset = (u32) new_skb;
 
-                lp->rx_bd_ci = ++lp->rx_bd_ci % RX_BD_NUM;
+                ++lp->rx_bd_ci;
+                lp->rx_bd_ci %= RX_BD_NUM;
                 cur_p = &lp->rx_bd_v[lp->rx_bd_ci];
         }
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 7756118c2f0a..7141a1937360 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -88,8 +88,12 @@ static int netvsc_open(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
         struct hv_device *device_obj = net_device_ctx->device_ctx;
+        struct netvsc_device *nvdev;
+        struct rndis_device *rdev;
         int ret = 0;
 
+        netif_carrier_off(net);
+
         /* Open up the device */
         ret = rndis_filter_open(device_obj);
         if (ret != 0) {
@@ -99,6 +103,11 @@ static int netvsc_open(struct net_device *net)
 
         netif_start_queue(net);
 
+        nvdev = hv_get_drvdata(device_obj);
+        rdev = nvdev->extension;
+        if (!rdev->link_state)
+                netif_carrier_on(net);
+
         return ret;
 }
 
@@ -229,23 +238,24 @@ void netvsc_linkstatus_callback(struct hv_device *device_obj,
         struct net_device *net;
         struct net_device_context *ndev_ctx;
         struct netvsc_device *net_device;
+        struct rndis_device *rdev;
 
         net_device = hv_get_drvdata(device_obj);
+        rdev = net_device->extension;
+
+        rdev->link_state = status != 1;
+
         net = net_device->ndev;
 
-        if (!net) {
-                netdev_err(net, "got link status but net device "
-                                "not initialized yet\n");
+        if (!net || net->reg_state != NETREG_REGISTERED)
                 return;
-        }
 
+        ndev_ctx = netdev_priv(net);
         if (status == 1) {
-                netif_carrier_on(net);
-                ndev_ctx = netdev_priv(net);
                 schedule_delayed_work(&ndev_ctx->dwork, 0);
                 schedule_delayed_work(&ndev_ctx->dwork, msecs_to_jiffies(20));
         } else {
-                netif_carrier_off(net);
+                schedule_delayed_work(&ndev_ctx->dwork, 0);
         }
 }
 
@@ -388,17 +398,35 @@ static const struct net_device_ops device_ops = {
  * current context when receiving RNDIS_STATUS_MEDIA_CONNECT event. So, add
  * another netif_notify_peers() into a delayed work, otherwise GARP packet
  * will not be sent after quick migration, and cause network disconnection.
+ * Also, we update the carrier status here.
  */
-static void netvsc_send_garp(struct work_struct *w)
+static void netvsc_link_change(struct work_struct *w)
 {
         struct net_device_context *ndev_ctx;
         struct net_device *net;
         struct netvsc_device *net_device;
+        struct rndis_device *rdev;
+        bool notify;
+
+        rtnl_lock();
 
         ndev_ctx = container_of(w, struct net_device_context, dwork.work);
         net_device = hv_get_drvdata(ndev_ctx->device_ctx);
+        rdev = net_device->extension;
         net = net_device->ndev;
-        netdev_notify_peers(net);
+
+        if (rdev->link_state) {
+                netif_carrier_off(net);
+                notify = false;
+        } else {
+                netif_carrier_on(net);
+                notify = true;
+        }
+
+        rtnl_unlock();
+
+        if (notify)
+                netdev_notify_peers(net);
 }
 
 
@@ -414,13 +442,10 @@ static int netvsc_probe(struct hv_device *dev,
         if (!net)
                 return -ENOMEM;
 
-        /* Set initial state */
-        netif_carrier_off(net);
-
         net_device_ctx = netdev_priv(net);
         net_device_ctx->device_ctx = dev;
         hv_set_drvdata(dev, net);
-        INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_send_garp);
+        INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
         INIT_WORK(&net_device_ctx->work, do_set_multicast);
 
         net->netdev_ops = &device_ops;
@@ -443,8 +468,6 @@ static int netvsc_probe(struct hv_device *dev,
         }
         memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
 
-        netif_carrier_on(net);
-
         ret = register_netdev(net);
         if (ret != 0) {
                 pr_err("Unable to register netdev.\n");
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index 177441afeb96..24b6dddd7f2f 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -522,7 +522,6 @@ static void irtty_close(struct tty_struct *tty)
         sirdev_put_instance(priv->dev);
 
         /* Stop tty */
-        irtty_stop_receiver(tty, TRUE);
         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
         if (tty->ops->stop)
                 tty->ops->stop(tty);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 8433de4509c7..1831fb7cd017 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -506,6 +506,9 @@ static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
 static struct lock_class_key macvlan_netdev_xmit_lock_key;
 static struct lock_class_key macvlan_netdev_addr_lock_key;
 
+#define ALWAYS_ON_FEATURES \
+        (NETIF_F_SG | NETIF_F_GEN_CSUM | NETIF_F_GSO_SOFTWARE | NETIF_F_LLTX)
+
 #define MACVLAN_FEATURES \
         (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
          NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \
@@ -539,7 +542,7 @@ static int macvlan_init(struct net_device *dev)
         dev->state              = (dev->state & ~MACVLAN_STATE_MASK) |
                                   (lowerdev->state & MACVLAN_STATE_MASK);
         dev->features           = lowerdev->features & MACVLAN_FEATURES;
-        dev->features           |= NETIF_F_LLTX;
+        dev->features           |= ALWAYS_ON_FEATURES;
         dev->gso_max_size       = lowerdev->gso_max_size;
         dev->iflink             = lowerdev->ifindex;
         dev->hard_header_len    = lowerdev->hard_header_len;
@@ -699,7 +702,7 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
         features = netdev_increment_features(vlan->lowerdev->features,
                                              features,
                                              mask);
-        features |= NETIF_F_LLTX;
+        features |= ALWAYS_ON_FEATURES;
 
         return features;
 }
@@ -879,14 +882,15 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         dev->priv_flags |= IFF_MACVLAN;
         err = netdev_upper_dev_link(lowerdev, dev);
         if (err)
-                goto destroy_port;
-
+                goto unregister_netdev;
 
         list_add_tail_rcu(&vlan->list, &port->vlans);
         netif_stacked_transfer_operstate(lowerdev, dev);
 
         return 0;
 
+unregister_netdev:
+        unregister_netdevice(dev);
 destroy_port:
         port->count -= 1;
         if (!port->count)
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 9414fa272160..98e7cbf720a5 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1006,11 +1006,6 @@ static int dp83640_probe(struct phy_device *phydev)
         } else
                 list_add_tail(&dp83640->list, &clock->phylist);
 
-        if (clock->chosen && !list_empty(&clock->phylist))
-                recalibrate(clock);
-        else
-                enable_broadcast(dp83640->phydev, clock->page, 1);
-
         dp83640_clock_put(clock);
         return 0;
 
@@ -1063,6 +1058,14 @@ static void dp83640_remove(struct phy_device *phydev)
 
 static int dp83640_config_init(struct phy_device *phydev)
 {
+        struct dp83640_private *dp83640 = phydev->priv;
+        struct dp83640_clock *clock = dp83640->clock;
+
+        if (clock->chosen && !list_empty(&clock->phylist))
+                recalibrate(clock);
+        else
+                enable_broadcast(phydev, clock->page, 1);
+
         enable_status_frames(phydev, true);
         ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
         return 0;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 82514e72b3d8..4b970f7624c0 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -916,6 +916,8 @@ int genphy_read_status(struct phy_device *phydev)
         int err;
         int lpa;
         int lpagb = 0;
+        int common_adv;
+        int common_adv_gb = 0;
 
         /* Update the link, but return if there was an error */
         err = genphy_update_link(phydev);
@@ -937,7 +939,7 @@ int genphy_read_status(struct phy_device *phydev)
 
                         phydev->lp_advertising =
                                 mii_stat1000_to_ethtool_lpa_t(lpagb);
-                        lpagb &= adv << 2;
+                        common_adv_gb = lpagb & adv << 2;
                 }
 
                 lpa = phy_read(phydev, MII_LPA);
@@ -950,25 +952,25 @@ int genphy_read_status(struct phy_device *phydev)
                 if (adv < 0)
                         return adv;
 
-                lpa &= adv;
+                common_adv = lpa & adv;
 
                 phydev->speed = SPEED_10;
                 phydev->duplex = DUPLEX_HALF;
                 phydev->pause = 0;
                 phydev->asym_pause = 0;
 
-                if (lpagb & (LPA_1000FULL | LPA_1000HALF)) {
+                if (common_adv_gb & (LPA_1000FULL | LPA_1000HALF)) {
                         phydev->speed = SPEED_1000;
 
-                        if (lpagb & LPA_1000FULL)
+                        if (common_adv_gb & LPA_1000FULL)
                                 phydev->duplex = DUPLEX_FULL;
-                } else if (lpa & (LPA_100FULL | LPA_100HALF)) {
+                } else if (common_adv & (LPA_100FULL | LPA_100HALF)) {
                         phydev->speed = SPEED_100;
 
-                        if (lpa & LPA_100FULL)
+                        if (common_adv & LPA_100FULL)
                                 phydev->duplex = DUPLEX_FULL;
                 } else
-                        if (lpa & LPA_10FULL)
+                        if (common_adv & LPA_10FULL)
                                 phydev->duplex = DUPLEX_FULL;
 
                 if (phydev->duplex == DUPLEX_FULL) {
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 28407426fd6f..c8624a8235ab 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1648,7 +1648,7 @@ static netdev_tx_t team_xmit(struct sk_buff *skb, struct net_device *dev)
 }
 
 static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb,
-                             void *accel_priv)
+                             void *accel_priv, select_queue_fallback_t fallback)
 {
         /*
          * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 44c4db8450f0..26f8635b027d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -366,7 +366,7 @@ static inline void tun_flow_save_rps_rxhash(struct tun_flow_entry *e, u32 hash)
  * hope the rxq no. may help here.
  */
 static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
-                            void *accel_priv)
+                            void *accel_priv, select_queue_fallback_t fallback)
 {
         struct tun_struct *tun = netdev_priv(dev);
         struct tun_flow_entry *e;
@@ -1686,7 +1686,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                                    TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
                                    NETIF_F_HW_VLAN_STAG_TX;
                 dev->features = dev->hw_features;
-                dev->vlan_features = dev->features;
+                dev->vlan_features = dev->features &
+                                     ~(NETIF_F_HW_VLAN_CTAG_TX |
+                                       NETIF_F_HW_VLAN_STAG_TX);
 
                 INIT_LIST_HEAD(&tun->disabled);
                 err = tun_attach(tun, file, false);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 409499fdb157..7e7269fd3707 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -296,7 +296,6 @@ config USB_NET_SR9800
         tristate "CoreChip-sz SR9800 based USB 2.0 10/100 ethernet devices"
         depends on USB_USBNET
         select CRC32
-        default y
         ---help---
           Say Y if you want to use one of the following 100Mbps USB Ethernet
           device based on the CoreChip-sz SR9800 chip.
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 9765a7d4766d..5d194093f3e1 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -917,7 +917,8 @@ static const struct driver_info ax88178_info = {
         .status = asix_status,
         .link_reset = ax88178_link_reset,
         .reset = ax88178_reset,
-        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+                 FLAG_MULTI_PACKET,
         .rx_fixup = asix_rx_fixup_common,
         .tx_fixup = asix_tx_fixup,
 };
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index d6f64dad05bc..054e59ca6946 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,20 +1029,12 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.phy_id = 0x03;
         dev->mii.supports_gmii = 1;
 
-        if (usb_device_no_sg_constraint(dev->udev))
-                dev->can_dma_sg = 1;
-
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                               NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                                  NETIF_F_RXCSUM;
 
-        if (dev->can_dma_sg) {
-                dev->net->features |= NETIF_F_SG | NETIF_F_TSO;
-                dev->net->hw_features |= NETIF_F_SG | NETIF_F_TSO;
-        }
-
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
                AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
@@ -1118,6 +1110,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         u16 hdr_off;
         u32 *pkt_hdr;
 
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         skb_trim(skb, skb->len - 4);
         memcpy(&rx_hdr, skb_tail_pointer(skb), 4);
         le32_to_cpus(&rx_hdr);
@@ -1391,6 +1387,19 @@ static const struct driver_info ax88178a_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info dlink_dub1312_info = {
+        .description = "D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct driver_info sitecom_info = {
         .description = "Sitecom USB 3.0 to Gigabit Adapter",
         .bind = ax88179_bind,
@@ -1417,6 +1426,19 @@ static const struct driver_info samsung_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info lenovo_info = {
+        .description = "Lenovo OneLinkDock Gigabit LAN",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct usb_device_id products[] = {
 {
         /* ASIX AX88179 10/100/1000 */
@@ -1427,6 +1449,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0b95, 0x178a),
         .driver_info = (unsigned long)&ax88178a_info,
 }, {
+        /* D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter */
+        USB_DEVICE(0x2001, 0x4a00),
+        .driver_info = (unsigned long)&dlink_dub1312_info,
+}, {
         /* Sitecom USB 3.0 to Gigabit Adapter */
         USB_DEVICE(0x0df6, 0x0072),
         .driver_info = (unsigned long)&sitecom_info,
@@ -1434,6 +1460,10 @@ static const struct usb_device_id products[] = {
         /* Samsung USB Ethernet Adapter */
         USB_DEVICE(0x04e8, 0xa100),
         .driver_info = (unsigned long)&samsung_info,
+}, {
+        /* Lenovo OneLinkDock Gigabit LAN */
+        USB_DEVICE(0x17ef, 0x304b),
+        .driver_info = (unsigned long)&lenovo_info,
 },
         { },
 };
diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
index e4a8a93fbaf7..1cc24e6f23e2 100644
--- a/drivers/net/usb/gl620a.c
+++ b/drivers/net/usb/gl620a.c
@@ -84,6 +84,10 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         u32                     size;
         u32                     count;
 
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         header = (struct gl_header *) skb->data;
 
         // get the packet count of the received skb
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index a305a7b2dae6..82d844a8ebd0 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -526,8 +526,9 @@ static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
         u8 status;
 
-        if (skb->len == 0) {
-                dev_err(&dev->udev->dev, "unexpected empty rx frame\n");
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len) {
+                dev_err(&dev->udev->dev, "unexpected tiny rx frame\n");
                 return 0;
         }
 
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index 0a85d9227775..4cbdb1307f3e 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -364,6 +364,10 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         struct nc_trailer       *trailer;
         u16                     hdr_len, packet_len;
 
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         if (!(skb->len & 0x01)) {
                 netdev_dbg(dev->net, "rx framesize %d range %d..%d mtu %d\n",
                            skb->len, dev->net->hard_header_len, dev->hard_mtu,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index ff5c87128ffe..313cb6cd4848 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -80,10 +80,10 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
         __be16 proto;
 
-        /* usbnet rx_complete guarantees that skb->len is at least
-         * hard_header_len, so we can inspect the dest address without
-         * checking skb->len
-         */
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         switch (skb->data[0] & 0xf0) {
         case 0x40:
                 proto = htons(ETH_P_IP);
@@ -732,6 +732,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
         {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
+        {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},    /* Cinterion PHxx,PXxx */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index a48bc0f20c1a..524a47a28120 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -492,6 +492,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind);
  */
 int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         /* peripheral may have batched packets to us... */
         while (likely(skb->len)) {
                 struct rndis_data_hdr   *hdr = (void *)skb->data;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index f17b9e02dd34..d9e7892262fa 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2106,6 +2106,10 @@ static void smsc75xx_rx_csum_offload(struct usbnet *dev, struct sk_buff *skb,
 
 static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         while (skb->len > 0) {
                 u32 rx_cmd_a, rx_cmd_b, align_count, size;
                 struct sk_buff *ax_skb;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 8dd54a0f7b29..424db65e4396 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1723,6 +1723,10 @@ static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
 
 static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         while (skb->len > 0) {
                 u32 header, align_count;
                 struct sk_buff *ax_skb;
diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
index 4175eb9fdeca..b94a0fbb8b3b 100644
--- a/drivers/net/usb/sr9800.c
+++ b/drivers/net/usb/sr9800.c
@@ -63,6 +63,10 @@ static int sr_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
         int offset = 0;
 
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+
         while (offset + sizeof(u32) < skb->len) {
                 struct sk_buff *sr_skb;
                 u16 size;
@@ -823,7 +827,7 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf)
                 dev->rx_urb_size =
                         SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].size;
         }
-        netdev_dbg(dev->net, "%s : setting rx_urb_size with : %ld\n", __func__,
+        netdev_dbg(dev->net, "%s : setting rx_urb_size with : %zu\n", __func__,
                    dev->rx_urb_size);
         return 0;
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 4671da755e7b..dd10d5817d2a 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -542,17 +542,19 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
         }
         // else network stack removes extra byte if we forced a short packet
 
-        if (skb->len) {
-                /* all data was already cloned from skb inside the driver */
-                if (dev->driver_info->flags & FLAG_MULTI_PACKET)
-                        dev_kfree_skb_any(skb);
-                else
-                        usbnet_skb_return(dev, skb);
+        /* all data was already cloned from skb inside the driver */
+        if (dev->driver_info->flags & FLAG_MULTI_PACKET)
+                goto done;
+
+        if (skb->len < ETH_HLEN) {
+                dev->net->stats.rx_errors++;
+                dev->net->stats.rx_length_errors++;
+                netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len);
+        } else {
+                usbnet_skb_return(dev, skb);
                 return;
         }
 
-        netif_dbg(dev, rx_err, dev->net, "drop\n");
-        dev->net->stats.rx_errors++;
 done:
         skb_queue_tail(&dev->done, skb);
 }
@@ -574,13 +576,6 @@ static void rx_complete (struct urb *urb)
         switch (urb_status) {
         /* success */
         case 0:
-                if (skb->len < dev->net->hard_header_len) {
-                        state = rx_cleanup;
-                        dev->net->stats.rx_errors++;
-                        dev->net->stats.rx_length_errors++;
-                        netif_dbg(dev, rx_err, dev->net,
-                                  "rx length %d\n", skb->len);
-                }
                 break;
 
         /* stalls need manual reset. this is rare ... except that
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 2ec2041b62d4..5b374370f71c 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -285,7 +285,8 @@ static void veth_setup(struct net_device *dev)
         dev->ethtool_ops = &veth_ethtool_ops;
         dev->features |= NETIF_F_LLTX;
         dev->features |= VETH_FEATURES;
-        dev->vlan_features = dev->features;
+        dev->vlan_features = dev->features &
+                             ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX);
         dev->destructor = veth_dev_free;
 
         dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d75f8edf4fb3..5632a99cbbd2 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1711,7 +1711,8 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* If we can receive ANY GSO packets, we must allocate large ones. */
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
             virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
                 vi->big_packets = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index d6bc7cb61bfb..1a2973b7acf2 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -110,7 +110,7 @@ ath5k_hw_radio_revision(struct ath5k_hw *ah, enum ieee80211_band band)
                 ath5k_hw_reg_write(ah, 0x00010000, AR5K_PHY(0x20));
 
         if (ah->ah_version == AR5K_AR5210) {
-                srev = ath5k_hw_reg_read(ah, AR5K_PHY(256) >> 28) & 0xf;
+                srev = (ath5k_hw_reg_read(ah, AR5K_PHY(256)) >> 28) & 0xf;
                 ret = (u16)ath5k_hw_bitswap(srev, 4) + 1;
         } else {
                 srev = (ath5k_hw_reg_read(ah, AR5K_PHY(0x100)) >> 24) & 0xff;
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 1cc13569b17b..1b6b4d0cfa97 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -57,7 +57,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -96,7 +96,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 11eab9f01fd8..303ce27964c1 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1534,7 +1534,7 @@ EXPORT_SYMBOL(ath9k_hw_check_nav);
 bool ath9k_hw_check_alive(struct ath_hw *ah)
 {
         int count = 50;
-        u32 reg;
+        u32 reg, last_val;
 
         if (AR_SREV_9300(ah))
                 return !ath9k_hw_detect_mac_hang(ah);
@@ -1542,9 +1542,13 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
         if (AR_SREV_9285_12_OR_LATER(ah))
                 return true;
 
+        last_val = REG_READ(ah, AR_OBS_BUS_1);
         do {
                 reg = REG_READ(ah, AR_OBS_BUS_1);
+                if (reg != last_val)
+                        return true;
 
+                last_val = reg;
                 if ((reg & 0x7E7FFFEF) == 0x00702400)
                         continue;
 
@@ -1556,6 +1560,8 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
                 default:
                         return true;
                 }
+
+                udelay(1);
         } while (count-- > 0);
 
         return false;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a0ebdd000fc2..82e340d3ec60 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -732,11 +732,18 @@ static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
 
                 /*
-                 * mark descriptor as zero-length and set the 'more'
-                 * flag to ensure that both buffers get discarded
+                 * Re-check previous descriptor, in case it has been filled
+                 * in the mean time.
                  */
-                rs->rs_datalen = 0;
-                rs->rs_more = true;
+                ret = ath9k_hw_rxprocdesc(ah, ds, rs);
+                if (ret == -EINPROGRESS) {
+                        /*
+                         * mark descriptor as zero-length and set the 'more'
+                         * flag to ensure that both buffers get discarded
+                         */
+                        rs->rs_datalen = 0;
+                        rs->rs_more = true;
+                }
         }
 
         list_del(&bf->list);
@@ -985,32 +992,32 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_hdr *hdr;
         bool discard_current = sc->rx.discard_next;
-        int ret = 0;
 
         /*
          * Discard corrupt descriptors which are marked in
          * ath_get_next_rx_buf().
          */
-        sc->rx.discard_next = rx_stats->rs_more;
         if (discard_current)
-                return -EINVAL;
+                goto corrupt;
+
+        sc->rx.discard_next = false;
 
         /*
          * Discard zero-length packets.
          */
         if (!rx_stats->rs_datalen) {
                 RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
         }
 
-        /*
-         * rs_status follows rs_datalen so if rs_datalen is too large
-         * we can take a hint that hardware corrupted it, so ignore
-         * those frames.
-         */
+        /*
+         * rs_status follows rs_datalen so if rs_datalen is too large
+         * we can take a hint that hardware corrupted it, so ignore
+         * those frames.
+         */
         if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
                 RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
         }
 
         /* Only use status info from the last fragment */
@@ -1024,10 +1031,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
          * This is different from the other corrupt descriptor
          * condition handled above.
          */
-        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC)
+                goto corrupt;
 
         hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
 
@@ -1043,18 +1048,15 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
                         RX_STAT_INC(rx_spectral);
 
-                ret = -EINVAL;
-                goto exit;
+                return -EINVAL;
         }
 
         /*
          * everything but the rate is checked here, the rate check is done
          * separately to avoid doing two lookups for a rate for each frame.
          */
-        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
+                return -EINVAL;
 
         if (ath_is_mybeacon(common, hdr)) {
                 RX_STAT_INC(rx_beacons);
@@ -1064,15 +1066,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         /*
          * This shouldn't happen, but have a safety check anyway.
          */
-        if (WARN_ON(!ah->curchan)) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (WARN_ON(!ah->curchan))
+                return -EINVAL;
 
-        if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
-                ret =-EINVAL;
-                goto exit;
-        }
+        if (ath9k_process_rate(common, hw, rx_stats, rx_status))
+                return -EINVAL;
 
         ath9k_process_rssi(common, hw, rx_stats, rx_status);
 
@@ -1087,9 +1085,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 sc->rx.num_pkts++;
 #endif
 
-exit:
-        sc->rx.discard_next = false;
-        return ret;
+        return 0;
+
+corrupt:
+        sc->rx.discard_next = rx_stats->rs_more;
+        return -EINVAL;
 }
 
 static void ath9k_rx_skb_postprocess(struct ath_common *common,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 0a75e2f68c9d..f042a18c8495 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1444,14 +1444,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
         for (tidno = 0, tid = &an->tid[tidno];
              tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
 
-                if (!tid->sched)
-                        continue;
-
                 ac = tid->ac;
                 txq = ac->txq;
 
                 ath_txq_lock(sc, txq);
 
+                if (!tid->sched) {
+                        ath_txq_unlock(sc, txq);
+                        continue;
+                }
+
                 buffered = ath_tid_has_buffered(tid);
 
                 tid->sched = false;
@@ -2184,14 +2186,15 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 txq->stopped = true;
         }
 
+        if (txctl->an)
+                tid = ath_get_skb_tid(sc, txctl->an, skb);
+
         if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
                 ath_txq_unlock(sc, txq);
                 txq = sc->tx.uapsdq;
                 ath_txq_lock(sc, txq);
         } else if (txctl->an &&
                    ieee80211_is_data_present(hdr->frame_control)) {
-                tid = ath_get_skb_tid(sc, txctl->an, skb);
-
                 WARN_ON(tid->ac->txq != txctl->txq);
 
                 if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 3e991897d7ca..119ee6eaf1c3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -457,7 +457,6 @@ struct brcmf_sdio {
 
         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
         bool txglom;            /* host tx glomming enable flag */
-        struct sk_buff *txglom_sgpad;   /* scatter-gather padding buffer */
         u16 head_align;         /* buffer pointer alignment */
         u16 sgentry_align;      /* scatter-gather buffer alignment */
 };
@@ -1944,9 +1943,8 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
         if (lastfrm && chain_pad)
                 tail_pad += blksize - chain_pad;
         if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {
-                pkt_pad = bus->txglom_sgpad;
-                if (pkt_pad == NULL)
-                          brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
+                pkt_pad = brcmu_pkt_buf_get_skb(tail_pad + tail_chop +
+                                                bus->head_align);
                 if (pkt_pad == NULL)
                         return -ENOMEM;
                 ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
@@ -1957,6 +1955,7 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
                        tail_chop);
                 *(u32 *)(pkt_pad->cb) = ALIGN_SKB_FLAG + tail_chop;
                 skb_trim(pkt, pkt->len - tail_chop);
+                skb_trim(pkt_pad, tail_pad + tail_chop);
                 __skb_queue_after(pktq, pkt, pkt_pad);
         } else {
                 ntail = pkt->data_len + tail_pad -
@@ -2011,7 +2010,7 @@ brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
                         return ret;
                 head_pad = (u16)ret;
                 if (head_pad)
-                        memset(pkt_next->data, 0, head_pad + bus->tx_hdrlen);
+                        memset(pkt_next->data + bus->tx_hdrlen, 0, head_pad);
 
                 total_len += pkt_next->len;
 
@@ -3486,10 +3485,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                 bus->txglom = false;
                 value = 1;
                 pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
-                bus->txglom_sgpad = brcmu_pkt_buf_get_skb(pad_size);
-                if (!bus->txglom_sgpad)
-                        brcmf_err("allocating txglom padding skb failed, reduced performance\n");
-
                 err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
                                            &value, sizeof(u32));
                 if (err < 0) {
@@ -4053,7 +4048,6 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                         brcmf_sdio_chip_detach(&bus->ci);
                 }
 
-                brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
                 kfree(bus->rxbuf);
                 kfree(bus->hdrbuf);
                 kfree(bus);
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index d36e252d2ccb..596525528f50 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -147,7 +147,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
 
         if (!sta->ap && sta->u.sta.challenge)
                 kfree(sta->u.sta.challenge);
-        del_timer(&sta->timer);
+        del_timer_sync(&sta->timer);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
 
         kfree(sta);
diff --git a/drivers/net/wireless/hostap/hostap_proc.c b/drivers/net/wireless/hostap/hostap_proc.c
index aa7ad3a7a69b..4e5c0f8c9496 100644
--- a/drivers/net/wireless/hostap/hostap_proc.c
+++ b/drivers/net/wireless/hostap/hostap_proc.c
@@ -496,7 +496,7 @@ void hostap_init_proc(local_info_t *local)
 
 void hostap_remove_proc(local_info_t *local)
 {
-        remove_proc_subtree(local->ddev->name, hostap_proc);
+        proc_remove(local->proc);
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index c24d1d3d55f6..73086c1629ca 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -696,6 +696,24 @@ static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         return ret;
 }
 
+static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                return false;
+        return true;
+}
+
+static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                return false;
+        if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
+                return true;
+
+        /* disabled by default */
+        return false;
+}
+
 static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif,
                                    enum ieee80211_ampdu_mlme_action action,
@@ -717,7 +735,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
 
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                if (!iwl_enable_rx_ampdu(priv->cfg))
                         break;
                 IWL_DEBUG_HT(priv, "start Rx\n");
                 ret = iwl_sta_rx_agg_start(priv, sta, tid, *ssn);
@@ -729,7 +747,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_TX_START:
                 if (!priv->trans->ops->txq_enable)
                         break;
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                if (!iwl_enable_tx_ampdu(priv->cfg))
                         break;
                 IWL_DEBUG_HT(priv, "start Tx\n");
                 ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index c0d070c5df5e..9cdd91cdf661 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -590,6 +590,7 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
                         sizeof(priv->tid_data[sta_id][tid]));
 
         priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
 
         priv->num_stations--;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index a6839dfcb82d..398dd096674c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1291,8 +1291,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         struct iwl_compressed_ba_resp *ba_resp = (void *)pkt->data;
         struct iwl_ht_agg *agg;
         struct sk_buff_head reclaimed_skbs;
-        struct ieee80211_tx_info *info;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb;
         int sta_id;
         int tid;
@@ -1379,22 +1377,28 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         freed = 0;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (ieee80211_is_data_qos(hdr->frame_control))
                         freed++;
                 else
                         WARN_ON_ONCE(1);
 
-                info = IEEE80211_SKB_CB(skb);
                 iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
 
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
                         /* put the rate scaling data there */
                         info = IEEE80211_SKB_CB(skb);
                         memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                         info->flags |= IEEE80211_TX_STAT_AMPDU;
                         info->status.ampdu_ack_len = ba_resp->txed_2_done;
                         info->status.ampdu_len = ba_resp->txed;
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index c3728163be46..75103554cd63 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1286,7 +1286,7 @@ module_param_named(swcrypto, iwlwifi_mod_params.sw_crypto, int, S_IRUGO);
 MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
 module_param_named(11n_disable, iwlwifi_mod_params.disable_11n, uint, S_IRUGO);
 MODULE_PARM_DESC(11n_disable,
-        "disable 11n functionality, bitmap: 1: full, 2: agg TX, 4: agg RX");
+        "disable 11n functionality, bitmap: 1: full, 2: disable agg TX, 4: disable agg RX, 8 enable agg TX");
 module_param_named(amsdu_size_8K, iwlwifi_mod_params.amsdu_size_8K,
                    int, S_IRUGO);
 MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0)");
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index 0a84ade7edac..b29075c3da8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -79,9 +79,12 @@ enum iwl_power_level {
         IWL_POWER_NUM
 };
 
-#define IWL_DISABLE_HT_ALL      BIT(0)
-#define IWL_DISABLE_HT_TXAGG    BIT(1)
-#define IWL_DISABLE_HT_RXAGG    BIT(2)
+enum iwl_disable_11n {
+        IWL_DISABLE_HT_ALL       = BIT(0),
+        IWL_DISABLE_HT_TXAGG     = BIT(1),
+        IWL_DISABLE_HT_RXAGG     = BIT(2),
+        IWL_ENABLE_HT_TXAGG      = BIT(3),
+};
 
 /**
  * struct iwl_mod_params
@@ -90,7 +93,7 @@ enum iwl_power_level {
  *
  * @sw_crypto: using hardware encryption, default = 0
  * @disable_11n: disable 11n capabilities, default = 0,
- *      use IWL_DISABLE_HT_* constants
+ *      use IWL_[DIS,EN]ABLE_HT_* constants
  * @amsdu_size_8K: enable 8K amsdu size, default = 0
  * @restart_fw: restart firmware, default = 1
  * @wd_disable: enable stuck queue check, default = 0
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 6bf9766e5982..c35b8661b395 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -328,6 +328,24 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
         ieee80211_free_txskb(hw, skb);
 }
 
+static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                return false;
+        return true;
+}
+
+static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                return false;
+        if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
+                return true;
+
+        /* enabled by default */
+        return true;
+}
+
 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     enum ieee80211_ampdu_mlme_action action,
@@ -347,7 +365,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) {
+                if (!iwl_enable_rx_ampdu(mvm->cfg)) {
                         ret = -EINVAL;
                         break;
                 }
@@ -357,7 +375,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false);
                 break;
         case IEEE80211_AMPDU_TX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) {
+                if (!iwl_enable_tx_ampdu(mvm->cfg)) {
                         ret = -EINVAL;
                         break;
                 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index e4ead86f06d6..2b0ba1fc3c82 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -152,7 +152,7 @@ enum iwl_power_scheme {
         IWL_POWER_SCHEME_LP
 };
 
-#define IWL_CONN_MAX_LISTEN_INTERVAL    70
+#define IWL_CONN_MAX_LISTEN_INTERVAL    10
 #define IWL_UAPSD_AC_INFO               (IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 4df12fa9d336..76ee486039d7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -822,16 +822,12 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         struct iwl_mvm_ba_notif *ba_notif = (void *)pkt->data;
         struct sk_buff_head reclaimed_skbs;
         struct iwl_mvm_tid_data *tid_data;
-        struct ieee80211_tx_info *info;
         struct ieee80211_sta *sta;
         struct iwl_mvm_sta *mvmsta;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb;
         int sta_id, tid, freed;
-
         /* "flow" corresponds to Tx queue */
         u16 scd_flow = le16_to_cpu(ba_notif->scd_flow);
-
         /* "ssn" is start of block-ack Tx window, corresponds to index
          * (in Tx queue's circular buffer) of first TFD/frame in window */
         u16 ba_resp_scd_ssn = le16_to_cpu(ba_notif->scd_ssn);
@@ -888,22 +884,26 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         freed = 0;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (ieee80211_is_data_qos(hdr->frame_control))
                         freed++;
                 else
                         WARN_ON_ONCE(1);
 
-                info = IEEE80211_SKB_CB(skb);
                 iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
 
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
                         /* put the rate scaling data there */
-                        info = IEEE80211_SKB_CB(skb);
-                        memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                         info->flags |= IEEE80211_TX_STAT_AMPDU;
                         info->status.ampdu_ack_len = ba_notif->txed_2_done;
                         info->status.ampdu_len = ba_notif->txed;
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 32f75007a825..cb6d189bc3e6 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -621,7 +621,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                         id = *pos++;
                         elen = *pos++;
                         left -= 2;
-                        if (elen > left || elen == 0) {
+                        if (elen > left) {
                                 lbs_deb_scan("scan response: invalid IE fmt\n");
                                 goto done;
                         }
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 4d79761b9c87..9d3d2758ec35 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -748,7 +748,7 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 
 static u16
 mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
-                                void *accel_priv)
+                                void *accel_priv, select_queue_fallback_t fallback)
 {
         skb->priority = cfg80211_classify8021d(skb, NULL);
         return mwifiex_1d_to_wmm_queue[skb->priority];
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 03688aa14e8a..7fe7b53fb17a 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1211,6 +1211,12 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                 rd_index = card->rxbd_rdptr & reg->rx_mask;
                 skb_data = card->rx_buf_list[rd_index];
 
+                /* If skb allocation was failed earlier for Rx packet,
+                 * rx_buf_list[rd_index] would have been left with a NULL.
+                 */
+                if (!skb_data)
+                        return -ENOMEM;
+
                 MWIFIEX_SKB_PACB(skb_data, &buf_pa);
                 pci_unmap_single(card->dev, buf_pa, MWIFIEX_RX_DATA_BUF_SIZE,
                                  PCI_DMA_FROMDEVICE);
@@ -1525,6 +1531,14 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                         mwifiex_process_sleep_confirm_resp(adapter, skb->data,
                                                            skb->len);
+                        mwifiex_pcie_enable_host_int(adapter);
+                        if (mwifiex_write_reg(adapter,
+                                              PCIE_CPU_INT_EVENT,
+                                              CPU_INTR_SLEEP_CFM_DONE)) {
+                                dev_warn(adapter->dev,
+                                         "Write register failed\n");
+                                return -1;
+                        }
                         while (reg->sleep_cookie && (count++ < 10) &&
                                mwifiex_pcie_ok_to_access_hw(adapter))
                                 usleep_range(50, 60);
@@ -1993,23 +2007,9 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                 adapter->int_status |= pcie_ireg;
                 spin_unlock_irqrestore(&adapter->int_lock, flags);
 
-                if (pcie_ireg & HOST_INTR_CMD_DONE) {
-                        if ((adapter->ps_state == PS_STATE_SLEEP_CFM) ||
-                            (adapter->ps_state == PS_STATE_SLEEP)) {
-                                mwifiex_pcie_enable_host_int(adapter);
-                                if (mwifiex_write_reg(adapter,
-                                                      PCIE_CPU_INT_EVENT,
-                                                      CPU_INTR_SLEEP_CFM_DONE)
-                                                      ) {
-                                        dev_warn(adapter->dev,
-                                                 "Write register failed\n");
-                                        return;
-
-                                }
-                        }
-                } else if (!adapter->pps_uapsd_mode &&
-                           adapter->ps_state == PS_STATE_SLEEP &&
-                           mwifiex_pcie_ok_to_access_hw(adapter)) {
+                if (!adapter->pps_uapsd_mode &&
+                    adapter->ps_state == PS_STATE_SLEEP &&
+                    mwifiex_pcie_ok_to_access_hw(adapter)) {
                                 /* Potentially for PCIe we could get other
                                  * interrupts like shared. Don't change power
                                  * state until cookie is set */
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index e8ebbd4bc3cd..208748804a55 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -22,8 +22,6 @@
 
 #define USB_VERSION     "1.0"
 
-static const char usbdriver_name[] = "usb8xxx";
-
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
 static struct usb_card_rec *usb_card;
@@ -527,13 +525,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
                                                    MWIFIEX_BSS_ROLE_ANY),
                                   MWIFIEX_ASYNC_CMD);
 
-#ifdef CONFIG_PM
-        /* Resume handler may be called due to remote wakeup,
-         * force to exit suspend anyway
-         */
-        usb_disable_autosuspend(card->udev);
-#endif /* CONFIG_PM */
-
         return 0;
 }
 
@@ -567,13 +558,12 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
 }
 
 static struct usb_driver mwifiex_usb_driver = {
-        .name = usbdriver_name,
+        .name = "mwifiex_usb",
         .probe = mwifiex_usb_probe,
         .disconnect = mwifiex_usb_disconnect,
         .id_table = mwifiex_usb_table,
         .suspend = mwifiex_usb_suspend,
         .resume = mwifiex_usb_resume,
-        .supports_autosuspend = 1,
 };
 
 static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 13eaeed03898..981cf6e7c73b 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -559,7 +559,8 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
         mwifiex_wmm_delete_all_ralist(priv);
         memcpy(tos_to_tid, ac_to_tid, sizeof(tos_to_tid));
 
-        if (priv->adapter->if_ops.clean_pcie_ring)
+        if (priv->adapter->if_ops.clean_pcie_ring &&
+            !priv->adapter->surprise_removed)
                 priv->adapter->if_ops.clean_pcie_ring(priv->adapter);
         spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags);
 }
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
index 56aee067f324..a6ad79f61bf9 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
@@ -15,6 +15,8 @@
 #ifndef RTL8187_H
 #define RTL8187_H
 
+#include <linux/cache.h>
+
 #include "rtl818x.h"
 #include "leds.h"
 
@@ -139,7 +141,10 @@ struct rtl8187_priv {
         u8 aifsn[4];
         u8 rfkill_mask;
         struct {
-                __le64 buf;
+                union {
+                        __le64 buf;
+                        u8 dummy1[L1_CACHE_BYTES];
+                } ____cacheline_aligned;
                 struct sk_buff_head queue;
         } b_tx_status; /* This queue is used by both -b and non-b devices */
         struct mutex io_mutex;
@@ -147,7 +152,8 @@ struct rtl8187_priv {
                 u8 bits8;
                 __le16 bits16;
                 __le32 bits32;
-        } *io_dmabuf;
+                u8 dummy2[L1_CACHE_BYTES];
+        } *io_dmabuf ____cacheline_aligned;
         bool rfkill_off;
         u16 seqno;
 };
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index deedae3c5449..d1c0191a195b 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -48,7 +48,7 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw)
 
         /*<2> Enable Adapter */
         if (rtlpriv->cfg->ops->hw_init(hw))
-                return 1;
+                return false;
         RT_CLEAR_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
 
         /*<3> Enable Interrupt */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index a82b30a1996c..2eb0b38384dd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -937,14 +937,26 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
         bool is92c;
         int err;
         u8 tmp_u1b;
+        unsigned long flags;
 
         rtlpci->being_init_adapter = true;
+
+        /* Since this function can take a very long time (up to 350 ms)
+         * and can be called with irqs disabled, reenable the irqs
+         * to let the other devices continue being serviced.
+         *
+         * It is safe doing so since our own interrupts will only be enabled
+         * in a subsequent step.
+         */
+        local_save_flags(flags);
+        local_irq_enable();
+
         rtlpriv->intf_ops->disable_aspm(hw);
         rtstatus = _rtl92ce_init_mac(hw);
         if (!rtstatus) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n");
                 err = 1;
-                return err;
+                goto exit;
         }
 
         err = rtl92c_download_fw(hw);
@@ -952,7 +964,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
                          "Failed to download FW. Init HW without FW now..\n");
                 err = 1;
-                return err;
+                goto exit;
         }
 
         rtlhal->last_hmeboxnum = 0;
@@ -1032,6 +1044,8 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "under 1.5V\n");
         }
         rtl92c_dm_init(hw);
+exit:
+        local_irq_restore(flags);
         rtlpci->being_init_adapter = false;
         return err;
 }
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index f9daa9e183f2..e30d80033cbc 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -907,6 +907,7 @@ static int handle_incoming_queue(struct net_device *dev,
 
                 /* Ethernet work: Delayed to here as it peeks the header. */
                 skb->protocol = eth_type_trans(skb, dev);
+                skb_reset_network_header(skb);
 
                 if (checksum_setup(dev, skb)) {
                         kfree_skb(skb);
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 10b51106c854..89e888a78899 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -342,27 +342,72 @@ struct device_node *of_get_cpu_node(int cpu, unsigned int *thread)
 }
 EXPORT_SYMBOL(of_get_cpu_node);
 
-/** Checks if the given "compat" string matches one of the strings in
- * the device's "compatible" property
+/**
+ * __of_device_is_compatible() - Check if the node matches given constraints
+ * @device: pointer to node
+ * @compat: required compatible string, NULL or "" for any match
+ * @type: required device_type value, NULL or "" for any match
+ * @name: required node name, NULL or "" for any match
+ *
+ * Checks if the given @compat, @type and @name strings match the
+ * properties of the given @device. A constraints can be skipped by
+ * passing NULL or an empty string as the constraint.
+ *
+ * Returns 0 for no match, and a positive integer on match. The return
+ * value is a relative score with larger values indicating better
+ * matches. The score is weighted for the most specific compatible value
+ * to get the highest score. Matching type is next, followed by matching
+ * name. Practically speaking, this results in the following priority
+ * order for matches:
+ *
+ * 1. specific compatible && type && name
+ * 2. specific compatible && type
+ * 3. specific compatible && name
+ * 4. specific compatible
+ * 5. general compatible && type && name
+ * 6. general compatible && type
+ * 7. general compatible && name
+ * 8. general compatible
+ * 9. type && name
+ * 10. type
+ * 11. name
  */
 static int __of_device_is_compatible(const struct device_node *device,
-                                     const char *compat)
+                                     const char *compat, const char *type, const char *name)
 {
-        const char* cp;
-        int cplen, l;
+        struct property *prop;
+        const char *cp;
+        int index = 0, score = 0;
+
+        /* Compatible match has highest priority */
+        if (compat && compat[0]) {
+                prop = __of_find_property(device, "compatible", NULL);
+                for (cp = of_prop_next_string(prop, NULL); cp;
+                     cp = of_prop_next_string(prop, cp), index++) {
+                        if (of_compat_cmp(cp, compat, strlen(compat)) == 0) {
+                                score = INT_MAX/2 - (index << 2);
+                                break;
+                        }
+                }
+                if (!score)
+                        return 0;
+        }
 
-        cp = __of_get_property(device, "compatible", &cplen);
-        if (cp == NULL)
-                return 0;
-        while (cplen > 0) {
-                if (of_compat_cmp(cp, compat, strlen(compat)) == 0)
-                        return 1;
-                l = strlen(cp) + 1;
-                cp += l;
-                cplen -= l;
+        /* Matching type is better than matching name */
+        if (type && type[0]) {
+                if (!device->type || of_node_cmp(type, device->type))
+                        return 0;
+                score += 2;
         }
 
-        return 0;
+        /* Matching name is a bit better than not */
+        if (name && name[0]) {
+                if (!device->name || of_node_cmp(name, device->name))
+                        return 0;
+                score++;
+        }
+
+        return score;
 }
 
 /** Checks if the given "compat" string matches one of the strings in
@@ -375,7 +420,7 @@ int of_device_is_compatible(const struct device_node *device,
         int res;
 
         raw_spin_lock_irqsave(&devtree_lock, flags);
-        res = __of_device_is_compatible(device, compat);
+        res = __of_device_is_compatible(device, compat, NULL, NULL);
         raw_spin_unlock_irqrestore(&devtree_lock, flags);
         return res;
 }
@@ -681,10 +726,7 @@ struct device_node *of_find_compatible_node(struct device_node *from,
         raw_spin_lock_irqsave(&devtree_lock, flags);
         np = from ? from->allnext : of_allnodes;
         for (; np; np = np->allnext) {
-                if (type
-                    && !(np->type && (of_node_cmp(np->type, type) == 0)))
-                        continue;
-                if (__of_device_is_compatible(np, compatible) &&
+                if (__of_device_is_compatible(np, compatible, type, NULL) &&
                     of_node_get(np))
                         break;
         }
@@ -730,65 +772,26 @@ out:
 }
 EXPORT_SYMBOL(of_find_node_with_property);
 
-static const struct of_device_id *
-of_match_compatible(const struct of_device_id *matches,
-                        const struct device_node *node)
-{
-        const char *cp;
-        int cplen, l;
-        const struct of_device_id *m;
-
-        cp = __of_get_property(node, "compatible", &cplen);
-        while (cp && (cplen > 0)) {
-                m = matches;
-                while (m->name[0] || m->type[0] || m->compatible[0]) {
-                        /* Only match for the entries without type and name */
-                        if (m->name[0] || m->type[0] ||
-                                of_compat_cmp(m->compatible, cp,
-                                         strlen(m->compatible)))
-                                m++;
-                        else
-                                return m;
-                }
-
-                /* Get node's next compatible string */
-                l = strlen(cp) + 1;
-                cp += l;
-                cplen -= l;
-        }
-
-        return NULL;
-}
-
 static
 const struct of_device_id *__of_match_node(const struct of_device_id *matches,
                                            const struct device_node *node)
 {
-        const struct of_device_id *m;
+        const struct of_device_id *best_match = NULL;
+        int score, best_score = 0;
 
         if (!matches)
                 return NULL;
 
-        m = of_match_compatible(matches, node);
-        if (m)
-                return m;
-
-        while (matches->name[0] || matches->type[0] || matches->compatible[0]) {
-                int match = 1;
-                if (matches->name[0])
-                        match &= node->name
-                                && !strcmp(matches->name, node->name);
-                if (matches->type[0])
-                        match &= node->type
-                                && !strcmp(matches->type, node->type);
-                if (matches->compatible[0])
-                        match &= __of_device_is_compatible(node,
-                                                           matches->compatible);
-                if (match)
-                        return matches;
-                matches++;
+        for (; matches->name[0] || matches->type[0] || matches->compatible[0]; matches++) {
+                score = __of_device_is_compatible(node, matches->compatible,
+                                                  matches->type, matches->name);
+                if (score > best_score) {
+                        best_match = matches;
+                        best_score = score;
+                }
         }
-        return NULL;
+
+        return best_match;
 }
 
 /**
@@ -796,12 +799,7 @@ const struct of_device_id *__of_match_node(const struct of_device_id *matches,
  *      @matches:       array of of device match structures to search in
  *      @node:          the of device structure to match against
  *
- *      Low level utility function used by device matching. We have two ways
- *      of matching:
- *      - Try to find the best compatible match by comparing each compatible
- *        string of device node with all the given matches respectively.
- *      - If the above method failed, then try to match the compatible by using
- *        __of_device_is_compatible() besides the match in type and name.
+ *      Low level utility function used by device matching.
  */
 const struct of_device_id *of_match_node(const struct of_device_id *matches,
                                          const struct device_node *node)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 875b7b6f0d2a..5b3c24f3cde5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -24,7 +24,11 @@ MODULE_LICENSE("GPL");
 
 static void of_set_phy_supported(struct phy_device *phydev, u32 max_speed)
 {
-        phydev->supported |= PHY_DEFAULT_FEATURES;
+        /* The default values for phydev->supported are provided by the PHY
+         * driver "features" member, we want to reset to sane defaults fist
+         * before supporting higher speeds.
+         */
+        phydev->supported &= PHY_DEFAULT_FEATURES;
 
         switch (max_speed) {
         default:
@@ -44,7 +48,7 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio, struct device_node *chi
 {
         struct phy_device *phy;
         bool is_c45;
-        int rc, prev_irq;
+        int rc;
         u32 max_speed = 0;
 
         is_c45 = of_device_is_compatible(child,
@@ -54,12 +58,14 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio, struct device_node *chi
         if (!phy || IS_ERR(phy))
                 return 1;
 
-        if (mdio->irq) {
-                prev_irq = mdio->irq[addr];
-                mdio->irq[addr] =
-                        irq_of_parse_and_map(child, 0);
-                if (!mdio->irq[addr])
-                        mdio->irq[addr] = prev_irq;
+        rc = irq_of_parse_and_map(child, 0);
+        if (rc > 0) {
+                phy->irq = rc;
+                if (mdio->irq)
+                        mdio->irq[addr] = rc;
+        } else {
+                if (mdio->irq)
+                        phy->irq = mdio->irq[addr];
         }
 
         /* Associate the OF node with the device structure so it
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index e21012bde639..6643d1920985 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -300,6 +300,72 @@ static void __init of_selftest_parse_interrupts_extended(void)
         of_node_put(np);
 }
 
+static struct of_device_id match_node_table[] = {
+        { .data = "A", .name = "name0", }, /* Name alone is lowest priority */
+        { .data = "B", .type = "type1", }, /* followed by type alone */
+
+        { .data = "Ca", .name = "name2", .type = "type1", }, /* followed by both together */
+        { .data = "Cb", .name = "name2", }, /* Only match when type doesn't match */
+        { .data = "Cc", .name = "name2", .type = "type2", },
+
+        { .data = "E", .compatible = "compat3" },
+        { .data = "G", .compatible = "compat2", },
+        { .data = "H", .compatible = "compat2", .name = "name5", },
+        { .data = "I", .compatible = "compat2", .type = "type1", },
+        { .data = "J", .compatible = "compat2", .type = "type1", .name = "name8", },
+        { .data = "K", .compatible = "compat2", .name = "name9", },
+        {}
+};
+
+static struct {
+        const char *path;
+        const char *data;
+} match_node_tests[] = {
+        { .path = "/testcase-data/match-node/name0", .data = "A", },
+        { .path = "/testcase-data/match-node/name1", .data = "B", },
+        { .path = "/testcase-data/match-node/a/name2", .data = "Ca", },
+        { .path = "/testcase-data/match-node/b/name2", .data = "Cb", },
+        { .path = "/testcase-data/match-node/c/name2", .data = "Cc", },
+        { .path = "/testcase-data/match-node/name3", .data = "E", },
+        { .path = "/testcase-data/match-node/name4", .data = "G", },
+        { .path = "/testcase-data/match-node/name5", .data = "H", },
+        { .path = "/testcase-data/match-node/name6", .data = "G", },
+        { .path = "/testcase-data/match-node/name7", .data = "I", },
+        { .path = "/testcase-data/match-node/name8", .data = "J", },
+        { .path = "/testcase-data/match-node/name9", .data = "K", },
+};
+
+static void __init of_selftest_match_node(void)
+{
+        struct device_node *np;
+        const struct of_device_id *match;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(match_node_tests); i++) {
+                np = of_find_node_by_path(match_node_tests[i].path);
+                if (!np) {
+                        selftest(0, "missing testcase node %s\n",
+                                match_node_tests[i].path);
+                        continue;
+                }
+
+                match = of_match_node(match_node_table, np);
+                if (!match) {
+                        selftest(0, "%s didn't match anything\n",
+                                match_node_tests[i].path);
+                        continue;
+                }
+
+                if (strcmp(match->data, match_node_tests[i].data) != 0) {
+                        selftest(0, "%s got wrong match. expected %s, got %s\n",
+                                match_node_tests[i].path, match_node_tests[i].data,
+                                (const char *)match->data);
+                        continue;
+                }
+                selftest(1, "passed");
+        }
+}
+
 static int __init of_selftest(void)
 {
         struct device_node *np;
@@ -316,6 +382,7 @@ static int __init of_selftest(void)
         of_selftest_property_match_string();
         of_selftest_parse_interrupts();
         of_selftest_parse_interrupts_extended();
+        of_selftest_match_node();
         pr_info("end of selftest - %i passed, %i failed\n",
                 selftest_results.passed, selftest_results.failed);
         return 0;
diff --git a/drivers/of/testcase-data/testcases.dtsi b/drivers/of/testcase-data/testcases.dtsi
new file mode 100644
index 000000000000..3a5b75a8e4d7
--- /dev/null
+++ b/drivers/of/testcase-data/testcases.dtsi
@@ -0,0 +1,3 @@
+#include "tests-phandle.dtsi"
+#include "tests-interrupts.dtsi"
+#include "tests-match.dtsi"
diff --git a/arch/arm/boot/dts/testcases/tests-interrupts.dtsi b/drivers/of/testcase-data/tests-interrupts.dtsi
index c843720bd3e5..c843720bd3e5 100644
--- a/arch/arm/boot/dts/testcases/tests-interrupts.dtsi
+++ b/drivers/of/testcase-data/tests-interrupts.dtsi
diff --git a/drivers/of/testcase-data/tests-match.dtsi b/drivers/of/testcase-data/tests-match.dtsi
new file mode 100644
index 000000000000..c9e541129534
--- /dev/null
+++ b/drivers/of/testcase-data/tests-match.dtsi
@@ -0,0 +1,19 @@
+
+/ {
+        testcase-data {
+                match-node {
+                        name0 { };
+                        name1 { device_type = "type1"; };
+                        a { name2 { device_type = "type1"; }; };
+                        b { name2 { }; };
+                        c { name2 { device_type = "type2"; }; };
+                        name3 { compatible = "compat3"; };
+                        name4 { compatible = "compat2", "compat3"; };
+                        name5 { compatible = "compat2", "compat3"; };
+                        name6 { compatible = "compat1", "compat2", "compat3"; };
+                        name7 { compatible = "compat2"; device_type = "type1"; };
+                        name8 { compatible = "compat2"; device_type = "type1"; };
+                        name9 { compatible = "compat2"; };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/testcases/tests-phandle.dtsi b/drivers/of/testcase-data/tests-phandle.dtsi
index 0007d3cd7dc2..0007d3cd7dc2 100644
--- a/arch/arm/boot/dts/testcases/tests-phandle.dtsi
+++ b/drivers/of/testcase-data/tests-phandle.dtsi
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 13478ecd4113..0e79665afd44 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -60,14 +60,6 @@
 #define PCIE_DEBUG_CTRL         0x1a60
 #define  PCIE_DEBUG_SOFT_RESET          BIT(20)
 
-/*
- * This product ID is registered by Marvell, and used when the Marvell
- * SoC is not the root complex, but an endpoint on the PCIe bus. It is
- * therefore safe to re-use this PCI ID for our emulated PCI-to-PCI
- * bridge.
- */
-#define MARVELL_EMULATED_PCI_PCI_BRIDGE_ID 0x7846
-
 /* PCI configuration space of a PCI-to-PCI bridge */
 struct mvebu_sw_pci_bridge {
         u16 vendor;
@@ -388,7 +380,8 @@ static void mvebu_sw_pci_bridge_init(struct mvebu_pcie_port *port)
 
         bridge->class = PCI_CLASS_BRIDGE_PCI;
         bridge->vendor = PCI_VENDOR_ID_MARVELL;
-        bridge->device = MARVELL_EMULATED_PCI_PCI_BRIDGE_ID;
+        bridge->device = mvebu_readl(port, PCIE_DEV_ID_OFF) >> 16;
+        bridge->revision = mvebu_readl(port, PCIE_DEV_REV_OFF) & 0xff;
         bridge->header_type = PCI_HEADER_TYPE_BRIDGE;
         bridge->cache_line_size = 0x10;
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 7a0fec6ce571..955ab7990c5b 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -545,9 +545,15 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
                 return -ENOMEM;
         list_for_each_entry(entry, &pdev->msi_list, list) {
                 char *name = kmalloc(20, GFP_KERNEL);
+                if (!name)
+                        goto error_attrs;
+
                 msi_dev_attr = kzalloc(sizeof(*msi_dev_attr), GFP_KERNEL);
-                if (!msi_dev_attr)
+                if (!msi_dev_attr) {
+                        kfree(name);
                         goto error_attrs;
+                }
+
                 sprintf(name, "%d", entry->irq);
                 sysfs_attr_init(&msi_dev_attr->attr);
                 msi_dev_attr->attr.name = name;
@@ -589,6 +595,7 @@ error_attrs:
                 ++count;
                 msi_attr = msi_attrs[count];
         }
+        kfree(msi_attrs);
         return ret;
 }
 
@@ -959,7 +966,6 @@ EXPORT_SYMBOL(pci_disable_msi);
 /**
  * pci_msix_vec_count - return the number of device's MSI-X table entries
  * @dev: pointer to the pci_dev data structure of MSI-X device function
-
  * This function returns the number of device's MSI-X table entries and
  * therefore the number of MSI-X vectors device is capable of sending.
  * It returns a negative errno if the device is not capable of sending MSI-X
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 1febe90831b4..6b05f6134b68 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1181,6 +1181,8 @@ EXPORT_SYMBOL_GPL(pci_load_and_free_saved_state);
 static int do_pci_enable_device(struct pci_dev *dev, int bars)
 {
         int err;
+        u16 cmd;
+        u8 pin;
 
         err = pci_set_power_state(dev, PCI_D0);
         if (err < 0 && err != -EIO)
@@ -1190,6 +1192,14 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
                 return err;
         pci_fixup_device(pci_fixup_enable, dev);
 
+        pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
+        if (pin) {
+                pci_read_config_word(dev, PCI_COMMAND, &cmd);
+                if (cmd & PCI_COMMAND_INTX_DISABLE)
+                        pci_write_config_word(dev, PCI_COMMAND,
+                                              cmd & ~PCI_COMMAND_INTX_DISABLE);
+        }
+
         return 0;
 }
 
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index afa2354f6600..c7a551c2d5f1 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -5,7 +5,7 @@
 menu "PHY Subsystem"
 
 config GENERIC_PHY
-        tristate "PHY Core"
+        bool "PHY Core"
         help
           Generic PHY support.
 
@@ -61,6 +61,7 @@ config PHY_EXYNOS_DP_VIDEO
 config BCM_KONA_USB2_PHY
         tristate "Broadcom Kona USB2 PHY Driver"
         depends on GENERIC_PHY
+        depends on HAS_IOMEM
         help
           Enable this to support the Broadcom Kona USB 2.0 PHY.
 
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 5f5b0f4be5be..6c738376daff 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -176,6 +176,8 @@ int phy_init(struct phy *phy)
                         dev_err(&phy->dev, "phy init failed --> %d\n", ret);
                         goto out;
                 }
+        } else {
+                ret = 0; /* Override possible ret == -ENOTSUPP */
         }
         ++phy->init_count;
 
@@ -232,6 +234,8 @@ int phy_power_on(struct phy *phy)
                         dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
                         goto out;
                 }
+        } else {
+                ret = 0; /* Override possible ret == -ENOTSUPP */
         }
         ++phy->power_count;
         mutex_unlock(&phy->mutex);
@@ -404,17 +408,11 @@ struct phy *phy_get(struct device *dev, const char *string)
                 index = of_property_match_string(dev->of_node, "phy-names",
                         string);
                 phy = of_phy_get(dev, index);
-                if (IS_ERR(phy)) {
-                        dev_err(dev, "unable to find phy\n");
-                        return phy;
-                }
         } else {
                 phy = phy_lookup(dev, string);
-                if (IS_ERR(phy)) {
-                        dev_err(dev, "unable to find phy\n");
-                        return phy;
-                }
         }
+        if (IS_ERR(phy))
+                return phy;
 
         if (!try_module_get(phy->ops->owner))
                 return ERR_PTR(-EPROBE_DEFER);
diff --git a/drivers/phy/phy-exynos-dp-video.c b/drivers/phy/phy-exynos-dp-video.c
index 1dbe6ce7b2ce..0786fef842e7 100644
--- a/drivers/phy/phy-exynos-dp-video.c
+++ b/drivers/phy/phy-exynos-dp-video.c
@@ -76,10 +76,6 @@ static int exynos_dp_video_phy_probe(struct platform_device *pdev)
         if (IS_ERR(state->regs))
                 return PTR_ERR(state->regs);
 
-        phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         phy = devm_phy_create(dev, &exynos_dp_video_phy_ops, NULL);
         if (IS_ERR(phy)) {
                 dev_err(dev, "failed to create Display Port PHY\n");
@@ -87,6 +83,10 @@ static int exynos_dp_video_phy_probe(struct platform_device *pdev)
         }
         phy_set_drvdata(phy, state);
 
+        phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         return 0;
 }
 
diff --git a/drivers/phy/phy-exynos-mipi-video.c b/drivers/phy/phy-exynos-mipi-video.c
index 0c5efab11af1..7f139326a642 100644
--- a/drivers/phy/phy-exynos-mipi-video.c
+++ b/drivers/phy/phy-exynos-mipi-video.c
@@ -134,11 +134,6 @@ static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
         dev_set_drvdata(dev, state);
         spin_lock_init(&state->slock);
 
-        phy_provider = devm_of_phy_provider_register(dev,
-                                        exynos_mipi_video_phy_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         for (i = 0; i < EXYNOS_MIPI_PHYS_NUM; i++) {
                 struct phy *phy = devm_phy_create(dev,
                                         &exynos_mipi_video_phy_ops, NULL);
@@ -152,6 +147,11 @@ static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
                 phy_set_drvdata(phy, &state->phys[i]);
         }
 
+        phy_provider = devm_of_phy_provider_register(dev,
+                                        exynos_mipi_video_phy_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         return 0;
 }
 
diff --git a/drivers/phy/phy-mvebu-sata.c b/drivers/phy/phy-mvebu-sata.c
index d43786f62437..d70ecd6a1b3f 100644
--- a/drivers/phy/phy-mvebu-sata.c
+++ b/drivers/phy/phy-mvebu-sata.c
@@ -99,17 +99,17 @@ static int phy_mvebu_sata_probe(struct platform_device *pdev)
         if (IS_ERR(priv->clk))
                 return PTR_ERR(priv->clk);
 
-        phy_provider = devm_of_phy_provider_register(&pdev->dev,
-                                                     of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         phy = devm_phy_create(&pdev->dev, &phy_mvebu_sata_ops, NULL);
         if (IS_ERR(phy))
                 return PTR_ERR(phy);
 
         phy_set_drvdata(phy, priv);
 
+        phy_provider = devm_of_phy_provider_register(&pdev->dev,
+                                                     of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         /* The boot loader may of left it on. Turn it off. */
         phy_mvebu_sata_power_off(phy);
 
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index bfc5c337f99a..7699752fba11 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -177,11 +177,6 @@ static int omap_usb2_probe(struct platform_device *pdev)
         phy->phy.otg            = otg;
         phy->phy.type           = USB_PHY_TYPE_USB2;
 
-        phy_provider = devm_of_phy_provider_register(phy->dev,
-                        of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         control_node = of_parse_phandle(node, "ctrl-module", 0);
         if (!control_node) {
                 dev_err(&pdev->dev, "Failed to get control device phandle\n");
@@ -214,6 +209,11 @@ static int omap_usb2_probe(struct platform_device *pdev)
 
         phy_set_drvdata(generic_phy, phy);
 
+        phy_provider = devm_of_phy_provider_register(phy->dev,
+                        of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         phy->wkupclk = devm_clk_get(phy->dev, "usb_phy_cm_clk32k");
         if (IS_ERR(phy->wkupclk)) {
                 dev_err(&pdev->dev, "unable to get usb_phy_cm_clk32k\n");
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index daf65e68aaab..c3ace1db8136 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -695,11 +695,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
         otg->set_host           = twl4030_set_host;
         otg->set_peripheral     = twl4030_set_peripheral;
 
-        phy_provider = devm_of_phy_provider_register(twl->dev,
-                of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
-                return PTR_ERR(phy_provider);
-
         phy = devm_phy_create(twl->dev, &ops, init_data);
         if (IS_ERR(phy)) {
                 dev_dbg(&pdev->dev, "Failed to create PHY\n");
@@ -708,6 +703,11 @@ static int twl4030_usb_probe(struct platform_device *pdev)
 
         phy_set_drvdata(phy, twl);
 
+        phy_provider = devm_of_phy_provider_register(twl->dev,
+                of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+
         /* init spinlock for workqueue */
         spin_lock_init(&twl->lock);
 
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index be361b7cd30f..1e4e69384baa 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -217,7 +217,7 @@ config PINCTRL_IMX28
         select PINCTRL_MXS
 
 config PINCTRL_MSM
-        tristate
+        bool
         select PINMUX
         select PINCONF
         select GENERIC_PINCONF
diff --git a/drivers/pinctrl/pinctrl-capri.c b/drivers/pinctrl/pinctrl-capri.c
index 4669c53f99b0..eb2500212147 100644
--- a/drivers/pinctrl/pinctrl-capri.c
+++ b/drivers/pinctrl/pinctrl-capri.c
@@ -1435,7 +1435,7 @@ int __init capri_pinctrl_probe(struct platform_device *pdev)
 }
 
 static struct of_device_id capri_pinctrl_of_match[] = {
-        { .compatible = "brcm,capri-pinctrl", },
+        { .compatible = "brcm,bcm11351-pinctrl", },
         { },
 };
 
diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
index 9ccf681dad2f..f9fabe9bf47d 100644
--- a/drivers/pinctrl/pinctrl-sunxi.c
+++ b/drivers/pinctrl/pinctrl-sunxi.c
@@ -14,6 +14,7 @@
 #include <linux/clk.h>
 #include <linux/gpio.h>
 #include <linux/irqdomain.h>
+#include <linux/irqchip/chained_irq.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
@@ -584,7 +585,7 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
         spin_lock_irqsave(&pctl->lock, flags);
 
         regval = readl(pctl->membase + reg);
-        regval &= ~IRQ_CFG_IRQ_MASK;
+        regval &= ~(IRQ_CFG_IRQ_MASK << index);
         writel(regval | (mode << index), pctl->membase + reg);
 
         spin_unlock_irqrestore(&pctl->lock, flags);
@@ -665,6 +666,7 @@ static struct irq_chip sunxi_pinctrl_irq_chip = {
 
 static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
 {
+        struct irq_chip *chip = irq_get_chip(irq);
         struct sunxi_pinctrl *pctl = irq_get_handler_data(irq);
         const unsigned long reg = readl(pctl->membase + IRQ_STATUS_REG);
 
@@ -674,10 +676,12 @@ static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
         if (reg) {
                 int irqoffset;
 
+                chained_irq_enter(chip, desc);
                 for_each_set_bit(irqoffset, &reg, SUNXI_IRQ_NUMBER) {
                         int pin_irq = irq_find_mapping(pctl->domain, irqoffset);
                         generic_handle_irq(pin_irq);
                 }
+                chained_irq_exit(chip, desc);
         }
 }
 
diff --git a/drivers/pinctrl/pinctrl-sunxi.h b/drivers/pinctrl/pinctrl-sunxi.h
index 01c494f8a14f..552b0e97077a 100644
--- a/drivers/pinctrl/pinctrl-sunxi.h
+++ b/drivers/pinctrl/pinctrl-sunxi.h
@@ -511,7 +511,7 @@ static inline u32 sunxi_pull_offset(u16 pin)
 
 static inline u32 sunxi_irq_cfg_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CFG_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CFG_IRQ_PER_REG * 0x04;
         return reg + IRQ_CFG_REG;
 }
 
@@ -523,7 +523,7 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq)
 
 static inline u32 sunxi_irq_ctrl_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG * 0x04;
         return reg + IRQ_CTRL_REG;
 }
 
@@ -535,7 +535,7 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq)
 
 static inline u32 sunxi_irq_status_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG;
+        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG * 0x04;
         return reg + IRQ_STATUS_REG;
 }
 
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 77d103fe39d9..567d6918d50b 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -89,7 +89,8 @@ enum {
 
         /* GPSR6 */
         FN_IP13_10, FN_IP13_11, FN_IP13_12, FN_IP13_13, FN_IP13_14,
-        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19, FN_IP13_22, FN_IP13_24_23,
+        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19,
+        FN_IP13_22, FN_IP13_24_23, FN_SD1_CLK,
         FN_IP13_25, FN_IP13_26, FN_IP13_27, FN_IP13_30_28, FN_IP14_1_0,
         FN_IP14_2, FN_IP14_3, FN_IP14_4, FN_IP14_5, FN_IP14_6, FN_IP14_7,
         FN_IP14_10_8, FN_IP14_13_11, FN_IP14_16_14, FN_IP14_19_17,
@@ -788,6 +789,7 @@ static const u16 pinmux_data[] = {
         PINMUX_DATA(USB1_PWEN_MARK, FN_USB1_PWEN),
         PINMUX_DATA(USB1_OVC_MARK, FN_USB1_OVC),
         PINMUX_DATA(DU0_DOTCLKIN_MARK, FN_DU0_DOTCLKIN),
+        PINMUX_DATA(SD1_CLK_MARK, FN_SD1_CLK),
 
         /* IPSR0 */
         PINMUX_IPSR_DATA(IP0_0, D0),
@@ -3825,7 +3827,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                 GP_6_11_FN, FN_IP13_25,
                 GP_6_10_FN, FN_IP13_24_23,
                 GP_6_9_FN, FN_IP13_22,
-                0, 0,
+                GP_6_8_FN, FN_SD1_CLK,
                 GP_6_7_FN, FN_IP13_21_19,
                 GP_6_6_FN, FN_IP13_18_16,
                 GP_6_5_FN, FN_IP13_15,
diff --git a/drivers/pinctrl/sirf/pinctrl-sirf.c b/drivers/pinctrl/sirf/pinctrl-sirf.c
index a0d6152701cd..617a4916b50f 100644
--- a/drivers/pinctrl/sirf/pinctrl-sirf.c
+++ b/drivers/pinctrl/sirf/pinctrl-sirf.c
@@ -598,7 +598,7 @@ static unsigned int sirfsoc_gpio_irq_startup(struct irq_data *d)
 {
         struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
 
-        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq))
+        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE))
                 dev_err(bank->chip.gc.dev,
                         "unable to lock HW IRQ %lu for IRQ\n",
                         d->hwirq);
@@ -611,7 +611,7 @@ static void sirfsoc_gpio_irq_shutdown(struct irq_data *d)
         struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
 
         sirfsoc_gpio_irq_mask(d);
-        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq);
+        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE);
 }
 
 static struct irq_chip sirfsoc_irq_chip = {
diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
index 8a843a04c224..a40b9c34e9ff 100644
--- a/drivers/pwm/pwm-lp3943.c
+++ b/drivers/pwm/pwm-lp3943.c
@@ -52,8 +52,10 @@ lp3943_pwm_request_map(struct lp3943_pwm *lp3943_pwm, int hwpwm)
                 offset = pwm_map->output[i];
 
                 /* Return an error if the pin is already assigned */
-                if (test_and_set_bit(offset, &lp3943->pin_used))
+                if (test_and_set_bit(offset, &lp3943->pin_used)) {
+                        kfree(pwm_map);
                         return ERR_PTR(-EBUSY);
+                }
         }
 
         return pwm_map;
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index b4b0d83f9ef6..7061ac0ad428 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -678,6 +678,7 @@ struct tsi721_bdma_chan {
         struct list_head        free_list;
         dma_cookie_t            completed_cookie;
         struct tasklet_struct   tasklet;
+        bool                    active;
 };
 
 #endif /* CONFIG_RAPIDIO_DMA_ENGINE */
diff --git a/drivers/rapidio/devices/tsi721_dma.c b/drivers/rapidio/devices/tsi721_dma.c
index 502663f5f7c6..91245f5dbe81 100644
--- a/drivers/rapidio/devices/tsi721_dma.c
+++ b/drivers/rapidio/devices/tsi721_dma.c
@@ -206,8 +206,8 @@ void tsi721_bdma_handler(struct tsi721_bdma_chan *bdma_chan)
 {
         /* Disable BDMA channel interrupts */
         iowrite32(0, bdma_chan->regs + TSI721_DMAC_INTE);
-
-        tasklet_schedule(&bdma_chan->tasklet);
+        if (bdma_chan->active)
+                tasklet_schedule(&bdma_chan->tasklet);
 }
 
 #ifdef CONFIG_PCI_MSI
@@ -562,7 +562,7 @@ static int tsi721_alloc_chan_resources(struct dma_chan *dchan)
         }
 #endif /* CONFIG_PCI_MSI */
 
-        tasklet_enable(&bdma_chan->tasklet);
+        bdma_chan->active = true;
         tsi721_bdma_interrupt_enable(bdma_chan, 1);
 
         return bdma_chan->bd_num - 1;
@@ -576,9 +576,7 @@ err_out:
 static void tsi721_free_chan_resources(struct dma_chan *dchan)
 {
         struct tsi721_bdma_chan *bdma_chan = to_tsi721_chan(dchan);
-#ifdef CONFIG_PCI_MSI
         struct tsi721_device *priv = to_tsi721(dchan->device);
-#endif
         LIST_HEAD(list);
 
         dev_dbg(dchan->device->dev, "%s: Entry\n", __func__);
@@ -589,14 +587,25 @@ static void tsi721_free_chan_resources(struct dma_chan *dchan)
         BUG_ON(!list_empty(&bdma_chan->active_list));
         BUG_ON(!list_empty(&bdma_chan->queue));
 
-        tasklet_disable(&bdma_chan->tasklet);
+        tsi721_bdma_interrupt_enable(bdma_chan, 0);
+        bdma_chan->active = false;
+
+#ifdef CONFIG_PCI_MSI
+        if (priv->flags & TSI721_USING_MSIX) {
+                synchronize_irq(priv->msix[TSI721_VECT_DMA0_DONE +
+                                           bdma_chan->id].vector);
+                synchronize_irq(priv->msix[TSI721_VECT_DMA0_INT +
+                                           bdma_chan->id].vector);
+        } else
+#endif
+        synchronize_irq(priv->pdev->irq);
+
+        tasklet_kill(&bdma_chan->tasklet);
 
         spin_lock_bh(&bdma_chan->lock);
         list_splice_init(&bdma_chan->free_list, &list);
         spin_unlock_bh(&bdma_chan->lock);
 
-        tsi721_bdma_interrupt_enable(bdma_chan, 0);
-
 #ifdef CONFIG_PCI_MSI
         if (priv->flags & TSI721_USING_MSIX) {
                 free_irq(priv->msix[TSI721_VECT_DMA0_DONE +
@@ -790,6 +799,7 @@ int tsi721_register_dma(struct tsi721_device *priv)
                 bdma_chan->dchan.cookie = 1;
                 bdma_chan->dchan.chan_id = i;
                 bdma_chan->id = i;
+                bdma_chan->active = false;
 
                 spin_lock_init(&bdma_chan->lock);
 
@@ -799,7 +809,6 @@ int tsi721_register_dma(struct tsi721_device *priv)
 
                 tasklet_init(&bdma_chan->tasklet, tsi721_dma_tasklet,
                              (unsigned long)bdma_chan);
-                tasklet_disable(&bdma_chan->tasklet);
                 list_add_tail(&bdma_chan->dchan.device_node,
                               &mport->dma.channels);
         }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 16a309e5c024..afca1bc24f26 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -953,6 +953,8 @@ static int machine_constraints_current(struct regulator_dev *rdev,
         return 0;
 }
 
+static int _regulator_do_enable(struct regulator_dev *rdev);
+
 /**
  * set_machine_constraints - sets regulator constraints
  * @rdev: regulator source
@@ -1013,10 +1015,9 @@ static int set_machine_constraints(struct regulator_dev *rdev,
         /* If the constraints say the regulator should be on at this point
          * and we have control then make sure it is enabled.
          */
-        if ((rdev->constraints->always_on || rdev->constraints->boot_on) &&
-            ops->enable) {
-                ret = ops->enable(rdev);
-                if (ret < 0) {
+        if (rdev->constraints->always_on || rdev->constraints->boot_on) {
+                ret = _regulator_do_enable(rdev);
+                if (ret < 0 && ret != -EINVAL) {
                         rdev_err(rdev, "failed to enable\n");
                         goto out;
                 }
@@ -1359,7 +1360,7 @@ static struct regulator *_regulator_get(struct device *dev, const char *id,
                 goto found;
         /* Don't log an error when called from regulator_get_optional() */
         } else if (!have_full_constraints() || exclusive) {
-                dev_err(dev, "dummy supplies not allowed\n");
+                dev_warn(dev, "dummy supplies not allowed\n");
         }
 
         mutex_unlock(&regulator_list_mutex);
@@ -1907,8 +1908,6 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
 
         trace_regulator_disable_complete(rdev_get_name(rdev));
 
-        _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
-                             NULL);
         return 0;
 }
 
@@ -1932,6 +1931,8 @@ static int _regulator_disable(struct regulator_dev *rdev)
                                 rdev_err(rdev, "failed to disable\n");
                                 return ret;
                         }
+                        _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
+                                        NULL);
                 }
 
                 rdev->use_count = 0;
@@ -1984,20 +1985,16 @@ static int _regulator_force_disable(struct regulator_dev *rdev)
 {
         int ret = 0;
 
-        /* force disable */
-        if (rdev->desc->ops->disable) {
-                /* ah well, who wants to live forever... */
-                ret = rdev->desc->ops->disable(rdev);
-                if (ret < 0) {
-                        rdev_err(rdev, "failed to force disable\n");
-                        return ret;
-                }
-                /* notify other consumers that power has been forced off */
-                _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
-                        REGULATOR_EVENT_DISABLE, NULL);
+        ret = _regulator_do_disable(rdev);
+        if (ret < 0) {
+                rdev_err(rdev, "failed to force disable\n");
+                return ret;
         }
 
-        return ret;
+        _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
+                        REGULATOR_EVENT_DISABLE, NULL);
+
+        return 0;
 }
 
 /**
@@ -3630,23 +3627,18 @@ int regulator_suspend_finish(void)
 
         mutex_lock(&regulator_list_mutex);
         list_for_each_entry(rdev, &regulator_list, list) {
-                struct regulator_ops *ops = rdev->desc->ops;
-
                 mutex_lock(&rdev->mutex);
-                if ((rdev->use_count > 0  || rdev->constraints->always_on) &&
-                                ops->enable) {
-                        error = ops->enable(rdev);
+                if (rdev->use_count > 0  || rdev->constraints->always_on) {
+                        error = _regulator_do_enable(rdev);
                         if (error)
                                 ret = error;
                 } else {
                         if (!have_full_constraints())
                                 goto unlock;
-                        if (!ops->disable)
-                                goto unlock;
                         if (!_regulator_is_enabled(rdev))
                                 goto unlock;
 
-                        error = ops->disable(rdev);
+                        error = _regulator_do_disable(rdev);
                         if (error)
                                 ret = error;
                 }
@@ -3820,7 +3812,7 @@ static int __init regulator_init_complete(void)
                 ops = rdev->desc->ops;
                 c = rdev->constraints;
 
-                if (!ops->disable || (c && c->always_on))
+                if (c && c->always_on)
                         continue;
 
                 mutex_lock(&rdev->mutex);
@@ -3841,7 +3833,7 @@ static int __init regulator_init_complete(void)
                         /* We log since this may kill the system if it
                          * goes wrong. */
                         rdev_info(rdev, "disabling\n");
-                        ret = ops->disable(rdev);
+                        ret = _regulator_do_disable(rdev);
                         if (ret != 0)
                                 rdev_err(rdev, "couldn't disable: %d\n", ret);
                 } else {
diff --git a/drivers/regulator/da9063-regulator.c b/drivers/regulator/da9063-regulator.c
index 56727eb745df..91e99a2c8dc1 100644
--- a/drivers/regulator/da9063-regulator.c
+++ b/drivers/regulator/da9063-regulator.c
@@ -1,3 +1,4 @@
+
 /*
  * Regulator driver for DA9063 PMIC series
  *
@@ -60,7 +61,8 @@ struct da9063_regulator_info {
         .desc.ops = &da9063_ldo_ops, \
         .desc.min_uV = (min_mV) * 1000, \
         .desc.uV_step = (step_mV) * 1000, \
-        .desc.n_voltages = (((max_mV) - (min_mV))/(step_mV) + 1), \
+        .desc.n_voltages = (((max_mV) - (min_mV))/(step_mV) + 1 \
+                + (DA9063_V##regl_name##_BIAS)), \
         .desc.enable_reg = DA9063_REG_##regl_name##_CONT, \
         .desc.enable_mask = DA9063_LDO_EN, \
         .desc.vsel_reg = DA9063_REG_V##regl_name##_A, \
diff --git a/drivers/regulator/max14577.c b/drivers/regulator/max14577.c
index 186df8785a91..e0619526708c 100644
--- a/drivers/regulator/max14577.c
+++ b/drivers/regulator/max14577.c
@@ -166,9 +166,10 @@ static int max14577_regulator_dt_parse_pdata(struct platform_device *pdev)
 
         ret = of_regulator_match(&pdev->dev, np, max14577_regulator_matches,
                         MAX14577_REG_MAX);
-        if (ret < 0) {
+        if (ret < 0)
                 dev_err(&pdev->dev, "Error parsing regulator init data: %d\n", ret);
-        }
+        else
+                ret = 0;
 
         of_node_put(np);
 
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index d7164bb75d3e..d958dfa05125 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -535,7 +535,7 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
                 return -ENODEV;
         }
 
-        regulators_np = of_find_node_by_name(pmic_np, "regulators");
+        regulators_np = of_get_child_by_name(pmic_np, "regulators");
         if (!regulators_np) {
                 dev_err(iodev->dev, "could not find regulators sub-node\n");
                 return -EINVAL;
@@ -591,6 +591,8 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
                 rmode++;
         }
 
+        of_node_put(regulators_np);
+
         if (of_get_property(pmic_np, "s5m8767,pmic-buck2-uses-gpio-dvs", NULL)) {
                 pdata->buck2_gpiodvs = true;
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 7afd373b9595..c4cde9c08f1f 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -580,10 +580,12 @@ static int s3c_rtc_suspend(struct device *dev)
 
         clk_enable(rtc_clk);
         /* save TICNT for anyone using periodic interrupts */
-        ticnt_save = readb(s3c_rtc_base + S3C2410_TICNT);
         if (s3c_rtc_cpu_type == TYPE_S3C64XX) {
                 ticnt_en_save = readw(s3c_rtc_base + S3C2410_RTCCON);
                 ticnt_en_save &= S3C64XX_RTCCON_TICEN;
+                ticnt_save = readl(s3c_rtc_base + S3C2410_TICNT);
+        } else {
+                ticnt_save = readb(s3c_rtc_base + S3C2410_TICNT);
         }
         s3c_rtc_enable(pdev, 0);
 
@@ -605,10 +607,15 @@ static int s3c_rtc_resume(struct device *dev)
 
         clk_enable(rtc_clk);
         s3c_rtc_enable(pdev, 1);
-        writeb(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
-        if (s3c_rtc_cpu_type == TYPE_S3C64XX && ticnt_en_save) {
-                tmp = readw(s3c_rtc_base + S3C2410_RTCCON);
-                writew(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
+        if (s3c_rtc_cpu_type == TYPE_S3C64XX) {
+                writel(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
+                if (ticnt_en_save) {
+                        tmp = readw(s3c_rtc_base + S3C2410_RTCCON);
+                        writew(tmp | ticnt_en_save,
+                                        s3c_rtc_base + S3C2410_RTCCON);
+                }
+        } else {
+                writeb(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
         }
 
         if (device_may_wakeup(dev) && wake_en) {
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index f6b9188c5af5..9f0ea6cb6922 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -610,6 +610,7 @@ void chsc_chp_online(struct chp_id chpid)
                 css_wait_for_slow_path();
                 for_each_subchannel_staged(__s390_process_res_acc, NULL,
                                            &link);
+                css_schedule_reprobe();
         }
 }
 
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index dc542e0a3055..0bc91e46395a 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -311,7 +311,7 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
         } __packed * msg = ap_msg->message;
 
         int rcblen = CEIL4(xcRB->request_control_blk_length);
-        int replylen;
+        int replylen, req_sumlen, resp_sumlen;
         char *req_data = ap_msg->message + sizeof(struct type6_hdr) + rcblen;
         char *function_code;
 
@@ -321,12 +321,34 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
                 xcRB->request_data_length;
         if (ap_msg->length > MSGTYPE06_MAX_MSG_SIZE)
                 return -EINVAL;
+
+        /* Overflow check
+           sum must be greater (or equal) than the largest operand */
+        req_sumlen = CEIL4(xcRB->request_control_blk_length) +
+                        xcRB->request_data_length;
+        if ((CEIL4(xcRB->request_control_blk_length) <=
+                                                xcRB->request_data_length) ?
+                (req_sumlen < xcRB->request_data_length) :
+                (req_sumlen < CEIL4(xcRB->request_control_blk_length))) {
+                return -EINVAL;
+        }
+
         replylen = sizeof(struct type86_fmt2_msg) +
                 CEIL4(xcRB->reply_control_blk_length) +
                 xcRB->reply_data_length;
         if (replylen > MSGTYPE06_MAX_MSG_SIZE)
                 return -EINVAL;
 
+        /* Overflow check
+           sum must be greater (or equal) than the largest operand */
+        resp_sumlen = CEIL4(xcRB->reply_control_blk_length) +
+                        xcRB->reply_data_length;
+        if ((CEIL4(xcRB->reply_control_blk_length) <= xcRB->reply_data_length) ?
+                (resp_sumlen < xcRB->reply_data_length) :
+                (resp_sumlen < CEIL4(xcRB->reply_control_blk_length))) {
+                return -EINVAL;
+        }
+
         /* prepare type6 header */
         msg->hdr = static_type6_hdrX;
         memcpy(msg->hdr.agent_id , &(xcRB->agent_ID), sizeof(xcRB->agent_ID));
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index c3a83df07894..795ed61a5496 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1660,7 +1660,6 @@ int qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
                                 QDIO_FLAG_CLEANUP_USING_CLEAR);
                 if (rc)
                         QETH_CARD_TEXT_(card, 3, "1err%d", rc);
-                qdio_free(CARD_DDEV(card));
                 atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
                 break;
         case QETH_QDIO_CLEANING:
@@ -2605,6 +2604,7 @@ static int qeth_mpc_initialize(struct qeth_card *card)
         return 0;
 out_qdio:
         qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
+        qdio_free(CARD_DDEV(card));
         return rc;
 }
 
@@ -4906,9 +4906,11 @@ retry:
         if (retries < 3)
                 QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
                         dev_name(&card->gdev->dev));
+        rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         rc = ccw_device_set_online(CARD_RDEV(card));
         if (rc)
                 goto retriable;
@@ -4918,7 +4920,6 @@ retry:
         rc = ccw_device_set_online(CARD_DDEV(card));
         if (rc)
                 goto retriable;
-        rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
 retriable:
         if (rc == -ERESTARTSYS) {
                 QETH_DBF_TEXT(SETUP, 2, "break1");
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 0710550093ce..908d82529ee9 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1091,6 +1091,7 @@ out_remove:
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_RECOVER)
                 card->state = CARD_STATE_RECOVER;
         else
@@ -1132,6 +1133,7 @@ static int __qeth_l2_set_offline(struct ccwgroup_device *cgdev,
                 rc = (rc2) ? rc2 : rc3;
         if (rc)
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_UP)
                 card->state = CARD_STATE_RECOVER;
         /* let user_space know that device is offline */
@@ -1194,6 +1196,7 @@ static void qeth_l2_shutdown(struct ccwgroup_device *gdev)
                 qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM);
         qeth_qdio_clear_card(card, 0);
         qeth_clear_qdio_buffers(card);
+        qdio_free(CARD_DDEV(card));
 }
 
 static int qeth_l2_pm_suspend(struct ccwgroup_device *gdev)
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 0f430424c3b8..3524d34ff694 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3447,6 +3447,7 @@ out_remove:
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_RECOVER)
                 card->state = CARD_STATE_RECOVER;
         else
@@ -3493,6 +3494,7 @@ static int __qeth_l3_set_offline(struct ccwgroup_device *cgdev,
                 rc = (rc2) ? rc2 : rc3;
         if (rc)
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_UP)
                 card->state = CARD_STATE_RECOVER;
         /* let user_space know that device is offline */
@@ -3545,6 +3547,7 @@ static void qeth_l3_shutdown(struct ccwgroup_device *gdev)
                 qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM);
         qeth_qdio_clear_card(card, 0);
         qeth_clear_qdio_buffers(card);
+        qdio_free(CARD_DDEV(card));
 }
 
 static int qeth_l3_pm_suspend(struct ccwgroup_device *gdev)
diff --git a/drivers/sbus/char/jsflash.c b/drivers/sbus/char/jsflash.c
index 6b4678a7900a..4ccb5d869389 100644
--- a/drivers/sbus/char/jsflash.c
+++ b/drivers/sbus/char/jsflash.c
@@ -507,7 +507,6 @@ static int jsflash_init(void)
         }
 
         /* Let us be really paranoid for modifications to probing code. */
-        /* extern enum sparc_cpu sparc_cpu_model; */ /* in <asm/system.h> */
         if (sparc_cpu_model != sun4m) {
                 /* We must be on sun4m because we use MMU Bypass ASI. */
                 return -ENXIO;
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 2eb97d7e8d12..0cb73074c199 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -790,17 +790,32 @@ static inline int test_tgt_sess_count(struct qla_tgt *tgt)
 }
 
 /* Called by tcm_qla2xxx configfs code */
-void qlt_stop_phase1(struct qla_tgt *tgt)
+int qlt_stop_phase1(struct qla_tgt *tgt)
 {
         struct scsi_qla_host *vha = tgt->vha;
         struct qla_hw_data *ha = tgt->ha;
         unsigned long flags;
 
+        mutex_lock(&qla_tgt_mutex);
+        if (!vha->fc_vport) {
+                struct Scsi_Host *sh = vha->host;
+                struct fc_host_attrs *fc_host = shost_to_fc_host(sh);
+                bool npiv_vports;
+
+                spin_lock_irqsave(sh->host_lock, flags);
+                npiv_vports = (fc_host->npiv_vports_inuse);
+                spin_unlock_irqrestore(sh->host_lock, flags);
+
+                if (npiv_vports) {
+                        mutex_unlock(&qla_tgt_mutex);
+                        return -EPERM;
+                }
+        }
         if (tgt->tgt_stop || tgt->tgt_stopped) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf04e,
                     "Already in tgt->tgt_stop or tgt_stopped state\n");
-                dump_stack();
-                return;
+                mutex_unlock(&qla_tgt_mutex);
+                return -EPERM;
         }
 
         ql_dbg(ql_dbg_tgt, vha, 0xe003, "Stopping target for host %ld(%p)\n",
@@ -815,6 +830,7 @@ void qlt_stop_phase1(struct qla_tgt *tgt)
         qlt_clear_tgt_db(tgt, true);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         mutex_unlock(&vha->vha_tgt.tgt_mutex);
+        mutex_unlock(&qla_tgt_mutex);
 
         flush_delayed_work(&tgt->sess_del_work);
 
@@ -841,6 +857,7 @@ void qlt_stop_phase1(struct qla_tgt *tgt)
 
         /* Wait for sessions to clear out (just in case) */
         wait_event(tgt->waitQ, test_tgt_sess_count(tgt));
+        return 0;
 }
 EXPORT_SYMBOL(qlt_stop_phase1);
 
@@ -3185,7 +3202,8 @@ restart:
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf02c,
                     "SRR cmd %p (se_cmd %p, tag %d, op %x), "
                     "sg_cnt=%d, offset=%d", cmd, &cmd->se_cmd, cmd->tag,
-                    se_cmd->t_task_cdb[0], cmd->sg_cnt, cmd->offset);
+                    se_cmd->t_task_cdb ? se_cmd->t_task_cdb[0] : 0,
+                    cmd->sg_cnt, cmd->offset);
 
                 qlt_handle_srr(vha, sctio, imm);
 
@@ -4181,6 +4199,9 @@ int qlt_add_target(struct qla_hw_data *ha, struct scsi_qla_host *base_vha)
         tgt->datasegs_per_cmd = QLA_TGT_DATASEGS_PER_CMD_24XX;
         tgt->datasegs_per_cont = QLA_TGT_DATASEGS_PER_CONT_24XX;
 
+        if (base_vha->fc_vport)
+                return 0;
+
         mutex_lock(&qla_tgt_mutex);
         list_add_tail(&tgt->tgt_list_entry, &qla_tgt_glist);
         mutex_unlock(&qla_tgt_mutex);
@@ -4194,6 +4215,10 @@ int qlt_remove_target(struct qla_hw_data *ha, struct scsi_qla_host *vha)
         if (!vha->vha_tgt.qla_tgt)
                 return 0;
 
+        if (vha->fc_vport) {
+                qlt_release(vha->vha_tgt.qla_tgt);
+                return 0;
+        }
         mutex_lock(&qla_tgt_mutex);
         list_del(&vha->vha_tgt.qla_tgt->tgt_list_entry);
         mutex_unlock(&qla_tgt_mutex);
@@ -4265,6 +4290,12 @@ int qlt_lport_register(void *target_lport_ptr, u64 phys_wwpn,
                         spin_unlock_irqrestore(&ha->hardware_lock, flags);
                         continue;
                 }
+                if (tgt->tgt_stop) {
+                        pr_debug("MODE_TARGET in shutdown on qla2xxx(%d)\n",
+                                 host->host_no);
+                        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                        continue;
+                }
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
                 if (!scsi_host_get(host)) {
@@ -4279,12 +4310,11 @@ int qlt_lport_register(void *target_lport_ptr, u64 phys_wwpn,
                         scsi_host_put(host);
                         continue;
                 }
-                mutex_unlock(&qla_tgt_mutex);
-
                 rc = (*callback)(vha, target_lport_ptr, npiv_wwpn, npiv_wwnn);
                 if (rc != 0)
                         scsi_host_put(host);
 
+                mutex_unlock(&qla_tgt_mutex);
                 return rc;
         }
         mutex_unlock(&qla_tgt_mutex);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 66e755cdde57..ce33d8c26406 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -1001,7 +1001,7 @@ extern void qlt_modify_vp_config(struct scsi_qla_host *,
 extern void qlt_probe_one_stage1(struct scsi_qla_host *, struct qla_hw_data *);
 extern int qlt_mem_alloc(struct qla_hw_data *);
 extern void qlt_mem_free(struct qla_hw_data *);
-extern void qlt_stop_phase1(struct qla_tgt *);
+extern int qlt_stop_phase1(struct qla_tgt *);
 extern void qlt_stop_phase2(struct qla_tgt *);
 extern irqreturn_t qla83xx_msix_atio_q(int, void *);
 extern void qlt_83xx_iospace_config(struct qla_hw_data *);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 75a141bbe74d..788c4fe2b0c9 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -182,20 +182,6 @@ static int tcm_qla2xxx_npiv_parse_wwn(
         return 0;
 }
 
-static ssize_t tcm_qla2xxx_npiv_format_wwn(char *buf, size_t len,
-                                        u64 wwpn, u64 wwnn)
-{
-        u8 b[8], b2[8];
-
-        put_unaligned_be64(wwpn, b);
-        put_unaligned_be64(wwnn, b2);
-        return snprintf(buf, len,
-                "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x,"
-                "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x",
-                b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7],
-                b2[0], b2[1], b2[2], b2[3], b2[4], b2[5], b2[6], b2[7]);
-}
-
 static char *tcm_qla2xxx_npiv_get_fabric_name(void)
 {
         return "qla2xxx_npiv";
@@ -227,15 +213,6 @@ static char *tcm_qla2xxx_get_fabric_wwn(struct se_portal_group *se_tpg)
         return lport->lport_naa_name;
 }
 
-static char *tcm_qla2xxx_npiv_get_fabric_wwn(struct se_portal_group *se_tpg)
-{
-        struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
-                                struct tcm_qla2xxx_tpg, se_tpg);
-        struct tcm_qla2xxx_lport *lport = tpg->lport;
-
-        return &lport->lport_npiv_name[0];
-}
-
 static u16 tcm_qla2xxx_get_tag(struct se_portal_group *se_tpg)
 {
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
@@ -941,15 +918,41 @@ static ssize_t tcm_qla2xxx_tpg_show_enable(
                         atomic_read(&tpg->lport_tpg_enabled));
 }
 
+static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+{
+        struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+                                struct tcm_qla2xxx_tpg, tpg_base_work);
+        struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+        struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+
+        if (!configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                  &se_tpg->tpg_group.cg_item)) {
+                atomic_set(&base_tpg->lport_tpg_enabled, 1);
+                qlt_enable_vha(base_vha);
+        }
+        complete(&base_tpg->tpg_base_comp);
+}
+
+static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+{
+        struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+                                struct tcm_qla2xxx_tpg, tpg_base_work);
+        struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+        struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+
+        if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+                atomic_set(&base_tpg->lport_tpg_enabled, 0);
+                configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                       &se_tpg->tpg_group.cg_item);
+        }
+        complete(&base_tpg->tpg_base_comp);
+}
+
 static ssize_t tcm_qla2xxx_tpg_store_enable(
         struct se_portal_group *se_tpg,
         const char *page,
         size_t count)
 {
-        struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
-        struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
-                        struct tcm_qla2xxx_lport, lport_wwn);
-        struct scsi_qla_host *vha = lport->qla_vha;
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
                         struct tcm_qla2xxx_tpg, se_tpg);
         unsigned long op;
@@ -964,19 +967,28 @@ static ssize_t tcm_qla2xxx_tpg_store_enable(
                 pr_err("Illegal value for tpg_enable: %lu\n", op);
                 return -EINVAL;
         }
-
         if (op) {
-                atomic_set(&tpg->lport_tpg_enabled, 1);
-                qlt_enable_vha(vha);
+                if (atomic_read(&tpg->lport_tpg_enabled))
+                        return -EEXIST;
+
+                INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
         } else {
-                if (!vha->vha_tgt.qla_tgt) {
-                        pr_err("struct qla_hw_data *vha->vha_tgt.qla_tgt is NULL\n");
-                        return -ENODEV;
-                }
-                atomic_set(&tpg->lport_tpg_enabled, 0);
-                qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+                if (!atomic_read(&tpg->lport_tpg_enabled))
+                        return count;
+
+                INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
         }
+        init_completion(&tpg->tpg_base_comp);
+        schedule_work(&tpg->tpg_base_work);
+        wait_for_completion(&tpg->tpg_base_comp);
 
+        if (op) {
+                if (!atomic_read(&tpg->lport_tpg_enabled))
+                        return -ENODEV;
+        } else {
+                if (atomic_read(&tpg->lport_tpg_enabled))
+                        return -EPERM;
+        }
         return count;
 }
 
@@ -1053,11 +1065,64 @@ static void tcm_qla2xxx_drop_tpg(struct se_portal_group *se_tpg)
         /*
          * Clear local TPG=1 pointer for non NPIV mode.
          */
-                lport->tpg_1 = NULL;
-
+        lport->tpg_1 = NULL;
         kfree(tpg);
 }
 
+static ssize_t tcm_qla2xxx_npiv_tpg_show_enable(
+        struct se_portal_group *se_tpg,
+        char *page)
+{
+        return tcm_qla2xxx_tpg_show_enable(se_tpg, page);
+}
+
+static ssize_t tcm_qla2xxx_npiv_tpg_store_enable(
+        struct se_portal_group *se_tpg,
+        const char *page,
+        size_t count)
+{
+        struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
+        struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
+                        struct tcm_qla2xxx_lport, lport_wwn);
+        struct scsi_qla_host *vha = lport->qla_vha;
+        struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+                        struct tcm_qla2xxx_tpg, se_tpg);
+        unsigned long op;
+        int rc;
+
+        rc = kstrtoul(page, 0, &op);
+        if (rc < 0) {
+                pr_err("kstrtoul() returned %d\n", rc);
+                return -EINVAL;
+        }
+        if ((op != 1) && (op != 0)) {
+                pr_err("Illegal value for tpg_enable: %lu\n", op);
+                return -EINVAL;
+        }
+        if (op) {
+                if (atomic_read(&tpg->lport_tpg_enabled))
+                        return -EEXIST;
+
+                atomic_set(&tpg->lport_tpg_enabled, 1);
+                qlt_enable_vha(vha);
+        } else {
+                if (!atomic_read(&tpg->lport_tpg_enabled))
+                        return count;
+
+                atomic_set(&tpg->lport_tpg_enabled, 0);
+                qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+        }
+
+        return count;
+}
+
+TF_TPG_BASE_ATTR(tcm_qla2xxx_npiv, enable, S_IRUGO | S_IWUSR);
+
+static struct configfs_attribute *tcm_qla2xxx_npiv_tpg_attrs[] = {
+        &tcm_qla2xxx_npiv_tpg_enable.attr,
+        NULL,
+};
+
 static struct se_portal_group *tcm_qla2xxx_npiv_make_tpg(
         struct se_wwn *wwn,
         struct config_group *group,
@@ -1650,6 +1715,9 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
         struct scsi_qla_host *npiv_vha;
         struct tcm_qla2xxx_lport *lport =
                         (struct tcm_qla2xxx_lport *)target_lport_ptr;
+        struct tcm_qla2xxx_lport *base_lport =
+                        (struct tcm_qla2xxx_lport *)base_vha->vha_tgt.target_lport_ptr;
+        struct tcm_qla2xxx_tpg *base_tpg;
         struct fc_vport_identifiers vport_id;
 
         if (!qla_tgt_mode_enabled(base_vha)) {
@@ -1657,6 +1725,13 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
                 return -EPERM;
         }
 
+        if (!base_lport || !base_lport->tpg_1 ||
+            !atomic_read(&base_lport->tpg_1->lport_tpg_enabled)) {
+                pr_err("qla2xxx base_lport or tpg_1 not available\n");
+                return -EPERM;
+        }
+        base_tpg = base_lport->tpg_1;
+
         memset(&vport_id, 0, sizeof(vport_id));
         vport_id.port_name = npiv_wwpn;
         vport_id.node_name = npiv_wwnn;
@@ -1675,7 +1750,6 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
         npiv_vha = (struct scsi_qla_host *)vport->dd_data;
         npiv_vha->vha_tgt.target_lport_ptr = target_lport_ptr;
         lport->qla_vha = npiv_vha;
-
         scsi_host_get(npiv_vha->host);
         return 0;
 }
@@ -1714,8 +1788,6 @@ static struct se_wwn *tcm_qla2xxx_npiv_make_lport(
         }
         lport->lport_npiv_wwpn = npiv_wwpn;
         lport->lport_npiv_wwnn = npiv_wwnn;
-        tcm_qla2xxx_npiv_format_wwn(&lport->lport_npiv_name[0],
-                        TCM_QLA2XXX_NAMELEN, npiv_wwpn, npiv_wwnn);
         sprintf(lport->lport_naa_name, "naa.%016llx", (unsigned long long) npiv_wwpn);
 
         ret = tcm_qla2xxx_init_lport(lport);
@@ -1824,7 +1896,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_ops = {
 static struct target_core_fabric_ops tcm_qla2xxx_npiv_ops = {
         .get_fabric_name                = tcm_qla2xxx_npiv_get_fabric_name,
         .get_fabric_proto_ident         = tcm_qla2xxx_get_fabric_proto_ident,
-        .tpg_get_wwn                    = tcm_qla2xxx_npiv_get_fabric_wwn,
+        .tpg_get_wwn                    = tcm_qla2xxx_get_fabric_wwn,
         .tpg_get_tag                    = tcm_qla2xxx_get_tag,
         .tpg_get_default_depth          = tcm_qla2xxx_get_default_depth,
         .tpg_get_pr_transport_id        = tcm_qla2xxx_get_pr_transport_id,
@@ -1935,7 +2007,7 @@ static int tcm_qla2xxx_register_configfs(void)
          */
         npiv_fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = tcm_qla2xxx_wwn_attrs;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs =
-            tcm_qla2xxx_tpg_attrs;
+            tcm_qla2xxx_npiv_tpg_attrs;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
index 275d8b9a7a34..33aaac8c7d59 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
@@ -4,8 +4,6 @@
 #define TCM_QLA2XXX_VERSION     "v0.1"
 /* length of ASCII WWPNs including pad */
 #define TCM_QLA2XXX_NAMELEN     32
-/* lenth of ASCII NPIV 'WWPN+WWNN' including pad */
-#define TCM_QLA2XXX_NPIV_NAMELEN 66
 
 #include "qla_target.h"
 
@@ -43,6 +41,9 @@ struct tcm_qla2xxx_tpg {
         struct tcm_qla2xxx_tpg_attrib tpg_attrib;
         /* Returned by tcm_qla2xxx_make_tpg() */
         struct se_portal_group se_tpg;
+        /* Items for dealing with configfs_depend_item */
+        struct completion tpg_base_comp;
+        struct work_struct tpg_base_work;
 };
 
 struct tcm_qla2xxx_fc_loopid {
@@ -62,8 +63,6 @@ struct tcm_qla2xxx_lport {
         char lport_name[TCM_QLA2XXX_NAMELEN];
         /* ASCII formatted naa WWPN for VPD page 83 etc */
         char lport_naa_name[TCM_QLA2XXX_NAMELEN];
-        /* ASCII formatted WWPN+WWNN for NPIV FC Target Lport */
-        char lport_npiv_name[TCM_QLA2XXX_NPIV_NAMELEN];
         /* map for fc_port pointers in 24-bit FC Port ID space */
         struct btree_head32 lport_fcport_map;
         /* vmalloc-ed memory for fc_port pointers for 16-bit FC loop ID */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 7bd7f0d5f050..62ec84b42e31 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1684,7 +1684,7 @@ u64 scsi_calculate_bounce_limit(struct Scsi_Host *shost)
 
         host_dev = scsi_get_device(shost);
         if (host_dev && host_dev->dma_mask)
-                bounce_limit = dma_max_pfn(host_dev) << PAGE_SHIFT;
+                bounce_limit = (u64)dma_max_pfn(host_dev) << PAGE_SHIFT;
 
         return bounce_limit;
 }
diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
index 31534b51715a..c3b2fb9b6713 100644
--- a/drivers/spi/spi-ath79.c
+++ b/drivers/spi/spi-ath79.c
@@ -132,9 +132,9 @@ static int ath79_spi_setup_cs(struct spi_device *spi)
 
                 flags = GPIOF_DIR_OUT;
                 if (spi->mode & SPI_CS_HIGH)
-                        flags |= GPIOF_INIT_HIGH;
-                else
                         flags |= GPIOF_INIT_LOW;
+                else
+                        flags |= GPIOF_INIT_HIGH;
 
                 status = gpio_request_one(cdata->gpio, flags,
                                           dev_name(&spi->dev));
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index b0842f751016..5d7b07f08326 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1455,6 +1455,14 @@ static int atmel_spi_suspend(struct device *dev)
 {
         struct spi_master       *master = dev_get_drvdata(dev);
         struct atmel_spi        *as = spi_master_get_devdata(master);
+        int ret;
+
+        /* Stop the queue running */
+        ret = spi_master_suspend(master);
+        if (ret) {
+                dev_warn(dev, "cannot suspend master\n");
+                return ret;
+        }
 
         clk_disable_unprepare(as->clk);
         return 0;
@@ -1464,9 +1472,16 @@ static int atmel_spi_resume(struct device *dev)
 {
         struct spi_master       *master = dev_get_drvdata(dev);
         struct atmel_spi        *as = spi_master_get_devdata(master);
+        int ret;
 
         clk_prepare_enable(as->clk);
-        return 0;
+
+        /* Start the queue running */
+        ret = spi_master_resume(master);
+        if (ret)
+                dev_err(dev, "problem starting queue (%d)\n", ret);
+
+        return ret;
 }
 
 static SIMPLE_DEV_PM_OPS(atmel_spi_pm_ops, atmel_spi_suspend, atmel_spi_resume);
diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
index cabed8f9119e..28ae470397a9 100644
--- a/drivers/spi/spi-coldfire-qspi.c
+++ b/drivers/spi/spi-coldfire-qspi.c
@@ -514,7 +514,8 @@ static int mcfqspi_resume(struct device *dev)
 #ifdef CONFIG_PM_RUNTIME
 static int mcfqspi_runtime_suspend(struct device *dev)
 {
-        struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
 
         clk_disable(mcfqspi->clk);
 
@@ -523,7 +524,8 @@ static int mcfqspi_runtime_suspend(struct device *dev)
 
 static int mcfqspi_runtime_resume(struct device *dev)
 {
-        struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
 
         clk_enable(mcfqspi->clk);
 
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index ec79f726672a..a25392065d9b 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -420,7 +420,6 @@ static int dspi_suspend(struct device *dev)
 
 static int dspi_resume(struct device *dev)
 {
-
         struct spi_master *master = dev_get_drvdata(dev);
         struct fsl_dspi *dspi = spi_master_get_devdata(master);
 
@@ -504,7 +503,7 @@ static int dspi_probe(struct platform_device *pdev)
         clk_prepare_enable(dspi->clk);
 
         init_waitqueue_head(&dspi->waitq);
-        platform_set_drvdata(pdev, dspi);
+        platform_set_drvdata(pdev, master);
 
         ret = spi_bitbang_start(&dspi->bitbang);
         if (ret != 0) {
@@ -525,7 +524,8 @@ out_master_put:
 
 static int dspi_remove(struct platform_device *pdev)
 {
-        struct fsl_dspi *dspi = platform_get_drvdata(pdev);
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct fsl_dspi *dspi = spi_master_get_devdata(master);
 
         /* Disconnect from the SPI framework */
         spi_bitbang_stop(&dspi->bitbang);
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index a5474ef9d2a0..47f15d97e7fa 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -948,8 +948,8 @@ static int spi_imx_remove(struct platform_device *pdev)
         spi_bitbang_stop(&spi_imx->bitbang);
 
         writel(0, spi_imx->base + MXC_CSPICTRL);
-        clk_disable_unprepare(spi_imx->clk_ipg);
-        clk_disable_unprepare(spi_imx->clk_per);
+        clk_unprepare(spi_imx->clk_ipg);
+        clk_unprepare(spi_imx->clk_per);
         spi_master_put(master);
 
         return 0;
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 2e7f38c7a961..88eb57e858b3 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -915,7 +915,7 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
         /* Set Tx DMA */
         param = &dma->param_tx;
         param->dma_dev = &dma_dev->dev;
-        param->chan_id = data->master->bus_num * 2; /* Tx = 0, 2 */
+        param->chan_id = data->ch * 2; /* Tx = 0, 2 */;
         param->tx_reg = data->io_base_addr + PCH_SPDWR;
         param->width = width;
         chan = dma_request_channel(mask, pch_spi_filter, param);
@@ -930,7 +930,7 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
         /* Set Rx DMA */
         param = &dma->param_rx;
         param->dma_dev = &dma_dev->dev;
-        param->chan_id = data->master->bus_num * 2 + 1; /* Rx = Tx + 1 */
+        param->chan_id = data->ch * 2 + 1; /* Rx = Tx + 1 */;
         param->rx_reg = data->io_base_addr + PCH_SPDRR;
         param->width = width;
         chan = dma_request_channel(mask, pch_spi_filter, param);
@@ -1452,6 +1452,11 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
 
         pch_spi_set_master_mode(master);
 
+        if (use_dma) {
+                dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
+                pch_alloc_dma_buf(board_dat, data);
+        }
+
         ret = spi_register_master(master);
         if (ret != 0) {
                 dev_err(&plat_dev->dev,
@@ -1459,14 +1464,10 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
                 goto err_spi_register_master;
         }
 
-        if (use_dma) {
-                dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
-                pch_alloc_dma_buf(board_dat, data);
-        }
-
         return 0;
 
 err_spi_register_master:
+        pch_free_dma_buf(board_dat, data);
         free_irq(board_dat->pdev->irq, data);
 err_request_irq:
         pch_spi_free_resources(board_dat, data);
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index eaec1dab7fe4..1432d956769c 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -2904,7 +2904,7 @@ static int binder_node_release(struct binder_node *node, int refs)
                 refs++;
 
                 if (!ref->death)
-                        goto out;
+                        continue;
 
                 death++;
 
@@ -2917,7 +2917,6 @@ static int binder_node_release(struct binder_node *node, int refs)
                         BUG();
         }
 
-out:
         binder_debug(BINDER_DEBUG_DEAD_BINDER,
                      "node %d now dead, refs %d, death %d\n",
                      node->debug_id, refs, death);
diff --git a/drivers/staging/bcm/Bcmnet.c b/drivers/staging/bcm/Bcmnet.c
index 8dfdd2732bdc..95a2358267ba 100644
--- a/drivers/staging/bcm/Bcmnet.c
+++ b/drivers/staging/bcm/Bcmnet.c
@@ -40,7 +40,7 @@ static INT bcm_close(struct net_device *dev)
 }
 
 static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb,
-                            void *accel_priv)
+                            void *accel_priv, select_queue_fallback_t fallback)
 {
         return ClassifyPacket(netdev_priv(dev), skb);
 }
diff --git a/drivers/staging/cxt1e1/linux.c b/drivers/staging/cxt1e1/linux.c
index 4a08e16e42f7..79206cb3fb94 100644
--- a/drivers/staging/cxt1e1/linux.c
+++ b/drivers/staging/cxt1e1/linux.c
@@ -866,6 +866,8 @@ c4_ioctl (struct net_device *ndev, struct ifreq *ifr, int cmd)
             _IOC_SIZE (iocmd));
 #endif
     iolen = _IOC_SIZE (iocmd);
+    if (iolen > sizeof(arg))
+        return -EFAULT;
     data = ifr->ifr_data + sizeof (iocmd);
     if (copy_from_user (&arg, data, iolen))
         return -EFAULT;
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 7fc66a6a6e36..514844efac75 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -757,6 +757,7 @@ static void mxs_lradc_finish_touch_event(struct mxs_lradc *lradc, bool valid)
         }
 
         /* if it is released, wait for the next touch via IRQ */
+        lradc->cur_plate = LRADC_TOUCH;
         mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, LRADC_CTRL1);
         mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
diff --git a/drivers/staging/netlogic/xlr_net.c b/drivers/staging/netlogic/xlr_net.c
index d8ea25486a33..31b269a5fff7 100644
--- a/drivers/staging/netlogic/xlr_net.c
+++ b/drivers/staging/netlogic/xlr_net.c
@@ -307,7 +307,7 @@ static netdev_tx_t xlr_net_start_xmit(struct sk_buff *skb,
 }
 
 static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb,
-                                void *accel_priv)
+                                void *accel_priv, select_queue_fallback_t fallback)
 {
         return (u16)smp_processor_id();
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/os_intfs.c b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
index 68f98fa114d2..7c9ee58f47bb 100644
--- a/drivers/staging/rtl8188eu/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
@@ -653,7 +653,7 @@ static unsigned int rtw_classify8021d(struct sk_buff *skb)
 }
 
 static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
-                            void *accel_priv)
+                            void *accel_priv, select_queue_fallback_t fallback)
 {
         struct adapter  *padapter = rtw_netdev_priv(dev);
         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index a70dcef1419e..2f40ff5901d6 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -55,6 +55,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         /****** 8188EUS ********/
         {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
+        {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
         {}      /* Terminating entry */
 };
 
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 7f1a7ce4b771..b83ec378d04f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -785,7 +785,7 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
         spin_unlock_bh(&conn->cmd_lock);
 
         list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 iscsit_free_cmd(cmd, false);
         }
 }
@@ -3708,7 +3708,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state
                 break;
         case ISTATE_REMOVE:
                 spin_lock_bh(&conn->cmd_lock);
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_free_cmd(cmd, false);
@@ -4151,7 +4151,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
         spin_lock_bh(&conn->cmd_lock);
         list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_increment_maxcmdsn(cmd, sess);
@@ -4196,6 +4196,10 @@ int iscsit_close_connection(
         iscsit_stop_timers_for_cmds(conn);
         iscsit_stop_nopin_response_timer(conn);
         iscsit_stop_nopin_timer(conn);
+
+        if (conn->conn_transport->iscsit_wait_conn)
+                conn->conn_transport->iscsit_wait_conn(conn);
+
         iscsit_free_queue_reqs_for_conn(conn);
 
         /*
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index 33be1fb1df32..4ca8fd2a70db 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -138,7 +138,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                 list_for_each_entry_safe(cmd, cmd_tmp,
                                 &cr->conn_recovery_cmd_list, i_conn_node) {
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
                         iscsit_free_cmd(cmd, true);
@@ -160,7 +160,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                 list_for_each_entry_safe(cmd, cmd_tmp,
                                 &cr->conn_recovery_cmd_list, i_conn_node) {
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
                         iscsit_free_cmd(cmd, true);
@@ -216,7 +216,7 @@ int iscsit_remove_cmd_from_connection_recovery(
         }
         cr = cmd->cr;
 
-        list_del(&cmd->i_conn_node);
+        list_del_init(&cmd->i_conn_node);
         return --cr->cmd_count;
 }
 
@@ -297,7 +297,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN))
                         continue;
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
 
                 spin_unlock_bh(&conn->cmd_lock);
                 iscsit_free_cmd(cmd, true);
@@ -335,7 +335,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
         /*
          * Only perform connection recovery on ISCSI_OP_SCSI_CMD or
          * ISCSI_OP_NOOP_OUT opcodes.  For all other opcodes call
-         * list_del(&cmd->i_conn_node); to release the command to the
+         * list_del_init(&cmd->i_conn_node); to release the command to the
          * session pool and remove it from the connection's list.
          *
          * Also stop the DataOUT timer, which will be restarted after
@@ -351,7 +351,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                                 " CID: %hu\n", cmd->iscsi_opcode,
                                 cmd->init_task_tag, cmd->cmd_sn, conn->cid);
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
@@ -371,7 +371,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                  */
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd &&
                      iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
@@ -393,7 +393,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
 
                 cmd->sess = conn->sess;
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_free_all_datain_reqs(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 39761837608d..44a5471de00f 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -137,7 +137,7 @@ struct iscsi_portal_group *iscsit_get_tpg_from_np(
         list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) {
 
                 spin_lock(&tpg->tpg_state_lock);
-                if (tpg->tpg_state == TPG_STATE_FREE) {
+                if (tpg->tpg_state != TPG_STATE_ACTIVE) {
                         spin_unlock(&tpg->tpg_state_lock);
                         continue;
                 }
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index a4489444ffbc..77e6531fb0a1 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1074,31 +1074,36 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
         struct scatterlist *psg;
         void *paddr, *addr;
         unsigned int i, len, left;
-        unsigned int offset = 0;
+        unsigned int offset = sg_off;
 
         left = sectors * dev->prot_length;
 
         for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
-
-                len = min(psg->length, left);
-                if (offset >= sg->length) {
-                        sg = sg_next(sg);
-                        offset = 0;
-                        sg_off = sg->offset;
-                }
+                unsigned int psg_len, copied = 0;
 
                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
-                addr = kmap_atomic(sg_page(sg)) + sg_off;
+                psg_len = min(left, psg->length);
+                while (psg_len) {
+                        len = min(psg_len, sg->length - offset);
+                        addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
 
-                if (read)
-                        memcpy(paddr, addr, len);
-                else
-                        memcpy(addr, paddr, len);
+                        if (read)
+                                memcpy(paddr + copied, addr, len);
+                        else
+                                memcpy(addr, paddr + copied, len);
 
-                left -= len;
-                offset += len;
+                        left -= len;
+                        offset += len;
+                        copied += len;
+                        psg_len -= len;
+
+                        if (offset >= sg->length) {
+                                sg = sg_next(sg);
+                                offset = 0;
+                        }
+                        kunmap_atomic(addr);
+                }
                 kunmap_atomic(paddr);
-                kunmap_atomic(addr);
         }
 }
 
@@ -1163,7 +1168,7 @@ sbc_dif_verify_read(struct se_cmd *cmd, sector_t start, unsigned int sectors,
 {
         struct se_device *dev = cmd->se_dev;
         struct se_dif_v1_tuple *sdt;
-        struct scatterlist *dsg;
+        struct scatterlist *dsg, *psg = sg;
         sector_t sector = start;
         void *daddr, *paddr;
         int i, j, offset = sg_off;
@@ -1171,14 +1176,14 @@ sbc_dif_verify_read(struct se_cmd *cmd, sector_t start, unsigned int sectors,
 
         for_each_sg(cmd->t_data_sg, dsg, cmd->t_data_nents, i) {
                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
-                paddr = kmap_atomic(sg_page(sg)) + sg->offset;
+                paddr = kmap_atomic(sg_page(psg)) + sg->offset;
 
                 for (j = 0; j < dsg->length; j += dev->dev_attrib.block_size) {
 
-                        if (offset >= sg->length) {
+                        if (offset >= psg->length) {
                                 kunmap_atomic(paddr);
-                                sg = sg_next(sg);
-                                paddr = kmap_atomic(sg_page(sg)) + sg->offset;
+                                psg = sg_next(psg);
+                                paddr = kmap_atomic(sg_page(psg)) + psg->offset;
                                 offset = 0;
                         }
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 24b4f65d8777..2956250b7225 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1601,6 +1601,9 @@ void transport_generic_request_failure(struct se_cmd *cmd,
         case TCM_CHECK_CONDITION_ABORT_CMD:
         case TCM_CHECK_CONDITION_UNIT_ATTENTION:
         case TCM_CHECK_CONDITION_NOT_READY:
+        case TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED:
+        case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
+        case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
                 break;
         case TCM_OUT_OF_RESOURCES:
                 sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 35c066489a19..5f88d767671e 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -136,6 +136,7 @@ config SPEAR_THERMAL
 config RCAR_THERMAL
         tristate "Renesas R-Car thermal driver"
         depends on ARCH_SHMOBILE || COMPILE_TEST
+        depends on HAS_IOMEM
         help
           Enable this to plug the R-Car thermal sensor driver into the Linux
           thermal framework.
@@ -210,8 +211,16 @@ config ACPI_INT3403_THERMAL
         tristate "ACPI INT3403 thermal driver"
         depends on X86 && ACPI
         help
-          This driver uses ACPI INT3403 device objects. If present, it will
-          register each INT3403 thermal sensor as a thermal zone.
+          Newer laptops and tablets that use ACPI may have thermal sensors
+          outside the core CPU/SOC for thermal safety reasons. These
+          temperature sensors are also exposed for the OS to use via the so
+          called INT3403 ACPI object. This driver will, on devices that have
+          such sensors, expose the temperature information from these sensors
+          to userspace via the normal thermal framework. This means that a wide
+          range of applications and GUI widgets can show this information to
+          the user or use this information for making decisions. For example,
+          the Intel Thermal Daemon can use this information to allow the user
+          to select his laptop to run without turning on the fans.
 
 menu "Texas Instruments thermal drivers"
 source "drivers/thermal/ti-soc-thermal/Kconfig"
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 338a88bf6662..71b0ec0c370d 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -56,10 +56,15 @@ static LIST_HEAD(thermal_governor_list);
 static DEFINE_MUTEX(thermal_list_lock);
 static DEFINE_MUTEX(thermal_governor_lock);
 
+static struct thermal_governor *def_governor;
+
 static struct thermal_governor *__find_governor(const char *name)
 {
         struct thermal_governor *pos;
 
+        if (!name || !name[0])
+                return def_governor;
+
         list_for_each_entry(pos, &thermal_governor_list, governor_list)
                 if (!strnicmp(name, pos->name, THERMAL_NAME_LENGTH))
                         return pos;
@@ -82,17 +87,23 @@ int thermal_register_governor(struct thermal_governor *governor)
         if (__find_governor(governor->name) == NULL) {
                 err = 0;
                 list_add(&governor->governor_list, &thermal_governor_list);
+                if (!def_governor && !strncmp(governor->name,
+                        DEFAULT_THERMAL_GOVERNOR, THERMAL_NAME_LENGTH))
+                        def_governor = governor;
         }
 
         mutex_lock(&thermal_list_lock);
 
         list_for_each_entry(pos, &thermal_tz_list, node) {
+                /*
+                 * only thermal zones with specified tz->tzp->governor_name
+                 * may run with tz->govenor unset
+                 */
                 if (pos->governor)
                         continue;
-                if (pos->tzp)
-                        name = pos->tzp->governor_name;
-                else
-                        name = DEFAULT_THERMAL_GOVERNOR;
+
+                name = pos->tzp->governor_name;
+
                 if (!strnicmp(name, governor->name, THERMAL_NAME_LENGTH))
                         pos->governor = governor;
         }
@@ -342,8 +353,8 @@ static void monitor_thermal_zone(struct thermal_zone_device *tz)
 static void handle_non_critical_trips(struct thermal_zone_device *tz,
                         int trip, enum thermal_trip_type trip_type)
 {
-        if (tz->governor)
-                tz->governor->throttle(tz, trip);
+        tz->governor ? tz->governor->throttle(tz, trip) :
+                       def_governor->throttle(tz, trip);
 }
 
 static void handle_critical_trips(struct thermal_zone_device *tz,
@@ -1107,7 +1118,7 @@ __thermal_cooling_device_register(struct device_node *np,
         INIT_LIST_HEAD(&cdev->thermal_instances);
         cdev->np = np;
         cdev->ops = ops;
-        cdev->updated = true;
+        cdev->updated = false;
         cdev->device.class = &thermal_class;
         cdev->devdata = devdata;
         dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
@@ -1533,7 +1544,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
         if (tz->tzp)
                 tz->governor = __find_governor(tz->tzp->governor_name);
         else
-                tz->governor = __find_governor(DEFAULT_THERMAL_GOVERNOR);
+                tz->governor = def_governor;
 
         mutex_unlock(&thermal_governor_lock);
 
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index 972e1c73722a..081fd7e6a9f0 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -68,6 +68,10 @@ struct phy_dev_entry {
         struct thermal_zone_device *tzone;
 };
 
+static const struct thermal_zone_params pkg_temp_tz_params = {
+        .no_hwmon       = true,
+};
+
 /* List maintaining number of package instances */
 static LIST_HEAD(phy_dev_list);
 static DEFINE_MUTEX(phy_dev_list_mutex);
@@ -394,7 +398,6 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
         int err;
         u32 tj_max;
         struct phy_dev_entry *phy_dev_entry;
-        char buffer[30];
         int thres_count;
         u32 eax, ebx, ecx, edx;
         u8 *temp;
@@ -440,13 +443,11 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
         phy_dev_entry->first_cpu = cpu;
         phy_dev_entry->tj_max = tj_max;
         phy_dev_entry->ref_cnt = 1;
-        snprintf(buffer, sizeof(buffer), "pkg-temp-%d\n",
-                                        phy_dev_entry->phys_proc_id);
-        phy_dev_entry->tzone = thermal_zone_device_register(buffer,
+        phy_dev_entry->tzone = thermal_zone_device_register("x86_pkg_temp",
                         thres_count,
                         (thres_count == MAX_NUMBER_OF_TRIPS) ?
                                 0x03 : 0x01,
-                        phy_dev_entry, &tzone_ops, NULL, 0, 0);
+                        phy_dev_entry, &tzone_ops, &pkg_temp_tz_params, 0, 0);
         if (IS_ERR(phy_dev_entry->tzone)) {
                 err = PTR_ERR(phy_dev_entry->tzone);
                 goto err_ret_free;
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index bd2715a9d8e5..c74a00ad7add 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1267,17 +1267,16 @@ static void pty_line_name(struct tty_driver *driver, int index, char *p)
  *      @p: output buffer of at least 7 bytes
  *
  *      Generate a name from a driver reference and write it to the output
- *      buffer. Return the number of bytes written.
+ *      buffer.
  *
  *      Locking: None
  */
-static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
+static void tty_line_name(struct tty_driver *driver, int index, char *p)
 {
         if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
-                return sprintf(p, "%s", driver->name);
+                strcpy(p, driver->name);
         else
-                return sprintf(p, "%s%d", driver->name,
-                               index + driver->name_base);
+                sprintf(p, "%s%d", driver->name, index + driver->name_base);
 }
 
 /**
@@ -3546,19 +3545,9 @@ static ssize_t show_cons_active(struct device *dev,
                 if (i >= ARRAY_SIZE(cs))
                         break;
         }
-        while (i--) {
-                struct tty_driver *driver;
-                const char *name = cs[i]->name;
-                int index = cs[i]->index;
-
-                driver = cs[i]->device(cs[i], &index);
-                if (driver) {
-                        count += tty_line_name(driver, index, buf + count);
-                        count += sprintf(buf + count, "%c", i ? ' ':'\n');
-                } else
-                        count += sprintf(buf + count, "%s%d%c",
-                                         name, index, i ? ' ':'\n');
-        }
+        while (i--)
+                count += sprintf(buf + count, "%s%d%c",
+                                 cs[i]->name, cs[i]->index, i ? ' ':'\n');
         console_unlock();
 
         return count;
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 80de2f88ed2c..4ab2cb62dfce 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -105,7 +105,7 @@ static int hw_ep_flush(struct ci_hdrc *ci, int num, int dir)
 
         do {
                 /* flush any pending transfer */
-                hw_write(ci, OP_ENDPTFLUSH, BIT(n), BIT(n));
+                hw_write(ci, OP_ENDPTFLUSH, ~0, BIT(n));
                 while (hw_read(ci, OP_ENDPTFLUSH, BIT(n)))
                         cpu_relax();
         } while (hw_read(ci, OP_ENDPTSTAT, BIT(n)));
@@ -205,7 +205,7 @@ static int hw_ep_prime(struct ci_hdrc *ci, int num, int dir, int is_ctrl)
         if (is_ctrl && dir == RX && hw_read(ci, OP_ENDPTSETUPSTAT, BIT(num)))
                 return -EAGAIN;
 
-        hw_write(ci, OP_ENDPTPRIME, BIT(n), BIT(n));
+        hw_write(ci, OP_ENDPTPRIME, ~0, BIT(n));
 
         while (hw_read(ci, OP_ENDPTPRIME, BIT(n)))
                 cpu_relax();
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 8d72f0c65937..062967c90b2a 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -717,6 +717,10 @@ int usb_get_configuration(struct usb_device *dev)
                         result = -ENOMEM;
                         goto err;
                 }
+
+                if (dev->quirks & USB_QUIRK_DELAY_INIT)
+                        msleep(100);
+
                 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
                     bigbuffer, length);
                 if (result < 0) {
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 8f37063c0a49..739ee8e8bdfd 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -47,6 +47,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Logitech HD Pro Webcams C920 and C930e */
+        { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Logitech Quickcam Fusion */
         { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/gadget/bcm63xx_udc.c b/drivers/usb/gadget/bcm63xx_udc.c
index 888fbb43b338..e969eb809a85 100644
--- a/drivers/usb/gadget/bcm63xx_udc.c
+++ b/drivers/usb/gadget/bcm63xx_udc.c
@@ -360,24 +360,30 @@ static inline void usb_dma_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
         bcm_writel(val, udc->iudma_regs + off);
 }
 
-static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off)
+static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off, int chan)
 {
-        return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
+        return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
-static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
+static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
+                                        int chan)
 {
-        bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
+        bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
-static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off)
+static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off, int chan)
 {
-        return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
+        return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
-static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
+static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
+                                        int chan)
 {
-        bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
+        bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
+                        (ENETDMA_CHAN_WIDTH * chan));
 }
 
 static inline void set_clocks(struct bcm63xx_udc *udc, bool is_enabled)
@@ -638,7 +644,7 @@ static void iudma_write(struct bcm63xx_udc *udc, struct iudma_ch *iudma,
         } while (!last_bd);
 
         usb_dmac_writel(udc, ENETDMAC_CHANCFG_EN_MASK,
-                        ENETDMAC_CHANCFG_REG(iudma->ch_idx));
+                        ENETDMAC_CHANCFG_REG, iudma->ch_idx);
 }
 
 /**
@@ -694,9 +700,9 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma)
                 bcm63xx_fifo_reset_ep(udc, max(0, iudma->ep_num));
 
         /* stop DMA, then wait for the hardware to wrap up */
-        usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG(ch_idx));
+        usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG, ch_idx);
 
-        while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)) &
+        while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx) &
                                    ENETDMAC_CHANCFG_EN_MASK) {
                 udelay(1);
 
@@ -713,10 +719,10 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma)
                         dev_warn(udc->dev, "forcibly halting IUDMA channel %d\n",
                                  ch_idx);
                         usb_dmac_writel(udc, ENETDMAC_CHANCFG_BUFHALT_MASK,
-                                        ENETDMAC_CHANCFG_REG(ch_idx));
+                                        ENETDMAC_CHANCFG_REG, ch_idx);
                 }
         }
-        usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG(ch_idx));
+        usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG, ch_idx);
 
         /* don't leave "live" HW-owned entries for the next guy to step on */
         for (d = iudma->bd_ring; d <= iudma->end_bd; d++)
@@ -728,11 +734,11 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma)
 
         /* set up IRQs, UBUS burst size, and BD base for this channel */
         usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
-                        ENETDMAC_IRMASK_REG(ch_idx));
-        usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG(ch_idx));
+                        ENETDMAC_IRMASK_REG, ch_idx);
+        usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG, ch_idx);
 
-        usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG(ch_idx));
-        usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG(ch_idx));
+        usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG, ch_idx);
+        usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG, ch_idx);
 }
 
 /**
@@ -2035,7 +2041,7 @@ static irqreturn_t bcm63xx_udc_data_isr(int irq, void *dev_id)
         spin_lock(&udc->lock);
 
         usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
-                        ENETDMAC_IR_REG(iudma->ch_idx));
+                        ENETDMAC_IR_REG, iudma->ch_idx);
         bep = iudma->bep;
         rc = iudma_read(udc, iudma);
 
@@ -2175,18 +2181,18 @@ static int bcm63xx_iudma_dbg_show(struct seq_file *s, void *p)
                 seq_printf(s, " [ep%d]:\n",
                            max_t(int, iudma_defaults[ch_idx].ep_num, 0));
                 seq_printf(s, "  cfg: %08x; irqstat: %08x; irqmask: %08x; maxburst: %08x\n",
-                           usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)),
-                           usb_dmac_readl(udc, ENETDMAC_IR_REG(ch_idx)),
-                           usb_dmac_readl(udc, ENETDMAC_IRMASK_REG(ch_idx)),
-                           usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG(ch_idx)));
+                           usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx),
+                           usb_dmac_readl(udc, ENETDMAC_IR_REG, ch_idx),
+                           usb_dmac_readl(udc, ENETDMAC_IRMASK_REG, ch_idx),
+                           usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG, ch_idx));
 
-                sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG(ch_idx));
-                sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG(ch_idx));
+                sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG, ch_idx);
+                sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG, ch_idx);
                 seq_printf(s, "  base: %08x; index: %04x_%04x; desc: %04x_%04x %08x\n",
-                           usb_dmas_readl(udc, ENETDMAS_RSTART_REG(ch_idx)),
+                           usb_dmas_readl(udc, ENETDMAS_RSTART_REG, ch_idx),
                            sram2 >> 16, sram2 & 0xffff,
                            sram3 >> 16, sram3 & 0xffff,
-                           usb_dmas_readl(udc, ENETDMAS_SRAM4_REG(ch_idx)));
+                           usb_dmas_readl(udc, ENETDMAS_SRAM4_REG, ch_idx));
                 seq_printf(s, "  desc: %d/%d used", iudma->n_bds_used,
                            iudma->n_bds);
 
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 306a2b52125c..2b4334394076 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -585,7 +585,6 @@ static ssize_t ffs_epfile_io(struct file *file,
                              char __user *buf, size_t len, int read)
 {
         struct ffs_epfile *epfile = file->private_data;
-        struct usb_gadget *gadget = epfile->ffs->gadget;
         struct ffs_ep *ep;
         char *data = NULL;
         ssize_t ret, data_len;
@@ -622,6 +621,12 @@ static ssize_t ffs_epfile_io(struct file *file,
         /* Allocate & copy */
         if (!halt) {
                 /*
+                 * if we _do_ wait above, the epfile->ffs->gadget might be NULL
+                 * before the waiting completes, so do not assign to 'gadget' earlier
+                 */
+                struct usb_gadget *gadget = epfile->ffs->gadget;
+
+                /*
                  * Controller may require buffer size to be aligned to
                  * maxpacketsize of an out endpoint.
                  */
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index bf7a56b6d48a..69b76efd11e9 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -1157,7 +1157,7 @@ static int __init printer_bind_config(struct usb_configuration *c)
 
         usb_gadget_set_selfpowered(gadget);
 
-        if (gadget->is_otg) {
+        if (gadget_is_otg(gadget)) {
                 otg_descriptor.bmAttributes |= USB_OTG_HNP;
                 printer_cfg_driver.descriptors = otg_desc;
                 printer_cfg_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index f04b2c3154de..dd9678f85c58 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1629,7 +1629,7 @@ static void s3c2410_udc_reinit(struct s3c2410_udc *dev)
                 ep->ep.desc = NULL;
                 ep->halted = 0;
                 INIT_LIST_HEAD(&ep->queue);
-                usb_ep_set_maxpacket_limit(&ep->ep, &ep->ep.maxpacket);
+                usb_ep_set_maxpacket_limit(&ep->ep, ep->ep.maxpacket);
         }
 }
 
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 471142725ffe..81cda09b47e3 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -685,8 +685,15 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
         struct ehci_hcd         *ehci = hcd_to_ehci (hcd);
         u32                     status, masked_status, pcd_status = 0, cmd;
         int                     bh;
+        unsigned long           flags;
 
-        spin_lock (&ehci->lock);
+        /*
+         * For threadirqs option we use spin_lock_irqsave() variant to prevent
+         * deadlock with ehci hrtimer callback, because hrtimer callbacks run
+         * in interrupt context even when threadirqs is specified. We can go
+         * back to spin_lock() variant when hrtimer callbacks become threaded.
+         */
+        spin_lock_irqsave(&ehci->lock, flags);
 
         status = ehci_readl(ehci, &ehci->regs->status);
 
@@ -704,7 +711,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 
         /* Shared IRQ? */
         if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
-                spin_unlock(&ehci->lock);
+                spin_unlock_irqrestore(&ehci->lock, flags);
                 return IRQ_NONE;
         }
 
@@ -815,7 +822,7 @@ dead:
 
         if (bh)
                 ehci_work (ehci);
-        spin_unlock (&ehci->lock);
+        spin_unlock_irqrestore(&ehci->lock, flags);
         if (pcd_status)
                 usb_hcd_poll_rh_status(hcd);
         return IRQ_HANDLED;
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 47b858fc50b2..7ae0c4d51741 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -238,6 +238,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
         int                     port;
         int                     mask;
         int                     changed;
+        bool                    fs_idle_delay;
 
         ehci_dbg(ehci, "suspend root hub\n");
 
@@ -272,6 +273,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
         ehci->bus_suspended = 0;
         ehci->owned_ports = 0;
         changed = 0;
+        fs_idle_delay = false;
         port = HCS_N_PORTS(ehci->hcs_params);
         while (port--) {
                 u32 __iomem     *reg = &ehci->regs->port_status [port];
@@ -300,16 +302,32 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                 }
 
                 if (t1 != t2) {
+                        /*
+                         * On some controllers, Wake-On-Disconnect will
+                         * generate false wakeup signals until the bus
+                         * switches over to full-speed idle.  For their
+                         * sake, add a delay if we need one.
+                         */
+                        if ((t2 & PORT_WKDISC_E) &&
+                                        ehci_port_speed(ehci, t2) ==
+                                                USB_PORT_STAT_HIGH_SPEED)
+                                fs_idle_delay = true;
                         ehci_writel(ehci, t2, reg);
                         changed = 1;
                 }
         }
+        spin_unlock_irq(&ehci->lock);
+
+        if ((changed && ehci->has_tdi_phy_lpm) || fs_idle_delay) {
+                /*
+                 * Wait for HCD to enter low-power mode or for the bus
+                 * to switch to full-speed idle.
+                 */
+                usleep_range(5000, 5500);
+        }
 
         if (changed && ehci->has_tdi_phy_lpm) {
-                spin_unlock_irq(&ehci->lock);
-                msleep(5);      /* 5 ms for HCD to enter low-power mode */
                 spin_lock_irq(&ehci->lock);
-
                 port = HCS_N_PORTS(ehci->hcs_params);
                 while (port--) {
                         u32 __iomem     *hostpc_reg = &ehci->regs->hostpc[port];
@@ -322,8 +340,8 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                                         port, (t3 & HOSTPC_PHCD) ?
                                         "succeeded" : "failed");
                 }
+                spin_unlock_irq(&ehci->lock);
         }
-        spin_unlock_irq(&ehci->lock);
 
         /* Apparently some devices need a >= 1-uframe delay here */
         if (ehci->bus_suspended)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6fe577d46fa2..924a6ccdb622 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4733,6 +4733,9 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
         /* Accept arbitrarily long scatter-gather lists */
         hcd->self.sg_tablesize = ~0;
 
+        /* support to build packet from discontinuous buffers */
+        hcd->self.no_sg_constraint = 1;
+
         /* XHCI controllers don't stop the ep queue on short packets :| */
         hcd->self.no_stop_on_short = 1;
 
@@ -4757,14 +4760,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
                 /* xHCI private pointer was set in xhci_pci_probe for the second
                  * registered roothub.
                  */
-                xhci = hcd_to_xhci(hcd);
-                /*
-                 * Support arbitrarily aligned sg-list entries on hosts without
-                 * TD fragment rules (which are currently unsupported).
-                 */
-                if (xhci->hci_version < 0x100)
-                        hcd->self.no_sg_constraint = 1;
-
                 return 0;
         }
 
@@ -4793,9 +4788,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
         if (xhci->hci_version > 0x96)
                 xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
 
-        if (xhci->hci_version < 0x100)
-                hcd->self.no_sg_constraint = 1;
-
         /* Make sure the HC is halted. */
         retval = xhci_halt(xhci);
         if (retval)
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fc192ad9cc6a..239ad0b1ceb6 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -477,8 +477,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                 musb->port1_status |=
                                                 (USB_PORT_STAT_C_SUSPEND << 16)
                                                 | MUSB_PORT_STAT_RESUME;
+                                musb->rh_timer = jiffies
+                                                 + msecs_to_jiffies(20);
                                 schedule_delayed_work(
-                                        &musb->finish_resume_work, 20);
+                                        &musb->finish_resume_work,
+                                        msecs_to_jiffies(20));
 
                                 musb->xceiv->state = OTG_STATE_A_HOST;
                                 musb->is_active = 1;
@@ -2157,11 +2160,19 @@ static void musb_restore_context(struct musb *musb)
         void __iomem *musb_base = musb->mregs;
         void __iomem *ep_target_regs;
         void __iomem *epio;
+        u8 power;
 
         musb_writew(musb_base, MUSB_FRAME, musb->context.frame);
         musb_writeb(musb_base, MUSB_TESTMODE, musb->context.testmode);
         musb_write_ulpi_buscontrol(musb->mregs, musb->context.busctl);
-        musb_writeb(musb_base, MUSB_POWER, musb->context.power);
+
+        /* Don't affect SUSPENDM/RESUME bits in POWER reg */
+        power = musb_readb(musb_base, MUSB_POWER);
+        power &= MUSB_POWER_SUSPENDM | MUSB_POWER_RESUME;
+        musb->context.power &= ~(MUSB_POWER_SUSPENDM | MUSB_POWER_RESUME);
+        power |= musb->context.power;
+        musb_writeb(musb_base, MUSB_POWER, power);
+
         musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe);
         musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe);
         musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index ed455724017b..abb38c3833ef 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1183,6 +1183,9 @@ irqreturn_t musb_h_ep0_irq(struct musb *musb)
                                 csr = MUSB_CSR0_H_STATUSPKT
                                         | MUSB_CSR0_TXPKTRDY;
 
+                        /* disable ping token in status phase */
+                        csr |= MUSB_CSR0_H_DIS_PING;
+
                         /* flag status stage */
                         musb->ep0_stage = MUSB_EP0_STATUS;
 
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index eb634433ef09..e2d2d8c9891b 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -135,7 +135,8 @@ void musb_port_suspend(struct musb *musb, bool do_suspend)
 
                 /* later, GetPortStatus will stop RESUME signaling */
                 musb->port1_status |= MUSB_PORT_STAT_RESUME;
-                schedule_delayed_work(&musb->finish_resume_work, 20);
+                schedule_delayed_work(&musb->finish_resume_work,
+                                      msecs_to_jiffies(20));
         }
 }
 
@@ -158,7 +159,6 @@ void musb_port_reset(struct musb *musb, bool do_reset)
          */
         power = musb_readb(mbase, MUSB_POWER);
         if (do_reset) {
-
                 /*
                  * If RESUME is set, we must make sure it stays minimum 20 ms.
                  * Then we must clear RESUME and wait a bit to let musb start
@@ -167,11 +167,22 @@ void musb_port_reset(struct musb *musb, bool do_reset)
                  * detected".
                  */
                 if (power &  MUSB_POWER_RESUME) {
-                        while (time_before(jiffies, musb->rh_timer))
-                                msleep(1);
+                        long remain = (unsigned long) musb->rh_timer - jiffies;
+
+                        if (musb->rh_timer > 0 && remain > 0) {
+                                /* take into account the minimum delay after resume */
+                                schedule_delayed_work(
+                                        &musb->deassert_reset_work, remain);
+                                return;
+                        }
+
                         musb_writeb(mbase, MUSB_POWER,
-                                power & ~MUSB_POWER_RESUME);
-                        msleep(1);
+                                    power & ~MUSB_POWER_RESUME);
+
+                        /* Give the core 1 ms to clear MUSB_POWER_RESUME */
+                        schedule_delayed_work(&musb->deassert_reset_work,
+                                              msecs_to_jiffies(1));
+                        return;
                 }
 
                 power &= 0xf0;
@@ -180,7 +191,8 @@ void musb_port_reset(struct musb *musb, bool do_reset)
 
                 musb->port1_status |= USB_PORT_STAT_RESET;
                 musb->port1_status &= ~USB_PORT_STAT_ENABLE;
-                schedule_delayed_work(&musb->deassert_reset_work, 50);
+                schedule_delayed_work(&musb->deassert_reset_work,
+                                      msecs_to_jiffies(50));
         } else {
                 dev_dbg(musb->controller, "root port reset stopped\n");
                 musb_writeb(mbase, MUSB_POWER,
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 2a408cdaf7b2..8aa59a2c5eb2 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -659,7 +659,6 @@ static int omap2430_runtime_suspend(struct device *dev)
                                 OTG_INTERFSEL);
 
                 omap2430_low_level_exit(musb);
-                phy_power_off(musb->phy);
         }
 
         return 0;
@@ -674,7 +673,6 @@ static int omap2430_runtime_resume(struct device *dev)
                 omap2430_low_level_init(musb);
                 musb_writel(musb->mregs, OTG_INTERFSEL,
                                 musb->context.otg_interfsel);
-                phy_power_on(musb->phy);
         }
 
         return 0;
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 8546c8dccd51..d204f745ed05 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -159,32 +159,6 @@ put_3p3:
         return rc;
 }
 
-#ifdef CONFIG_PM_SLEEP
-#define USB_PHY_SUSP_DIG_VOL  500000
-static int msm_hsusb_config_vddcx(int high)
-{
-        int max_vol = USB_PHY_VDD_DIG_VOL_MAX;
-        int min_vol;
-        int ret;
-
-        if (high)
-                min_vol = USB_PHY_VDD_DIG_VOL_MIN;
-        else
-                min_vol = USB_PHY_SUSP_DIG_VOL;
-
-        ret = regulator_set_voltage(hsusb_vddcx, min_vol, max_vol);
-        if (ret) {
-                pr_err("%s: unable to set the voltage for regulator "
-                        "HSUSB_VDDCX\n", __func__);
-                return ret;
-        }
-
-        pr_debug("%s: min_vol:%d max_vol:%d\n", __func__, min_vol, max_vol);
-
-        return ret;
-}
-#endif
-
 static int msm_hsusb_ldo_set_mode(int on)
 {
         int ret = 0;
@@ -440,7 +414,32 @@ static int msm_otg_reset(struct usb_phy *phy)
 #define PHY_SUSPEND_TIMEOUT_USEC        (500 * 1000)
 #define PHY_RESUME_TIMEOUT_USEC (100 * 1000)
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
+
+#define USB_PHY_SUSP_DIG_VOL  500000
+static int msm_hsusb_config_vddcx(int high)
+{
+        int max_vol = USB_PHY_VDD_DIG_VOL_MAX;
+        int min_vol;
+        int ret;
+
+        if (high)
+                min_vol = USB_PHY_VDD_DIG_VOL_MIN;
+        else
+                min_vol = USB_PHY_SUSP_DIG_VOL;
+
+        ret = regulator_set_voltage(hsusb_vddcx, min_vol, max_vol);
+        if (ret) {
+                pr_err("%s: unable to set the voltage for regulator "
+                        "HSUSB_VDDCX\n", __func__);
+                return ret;
+        }
+
+        pr_debug("%s: min_vol:%d max_vol:%d\n", __func__, min_vol, max_vol);
+
+        return ret;
+}
+
 static int msm_otg_suspend(struct msm_otg *motg)
 {
         struct usb_phy *phy = &motg->phy;
@@ -1733,22 +1732,18 @@ static int msm_otg_pm_resume(struct device *dev)
 }
 #endif
 
-#ifdef CONFIG_PM
 static const struct dev_pm_ops msm_otg_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(msm_otg_pm_suspend, msm_otg_pm_resume)
         SET_RUNTIME_PM_OPS(msm_otg_runtime_suspend, msm_otg_runtime_resume,
                                 msm_otg_runtime_idle)
 };
-#endif
 
 static struct platform_driver msm_otg_driver = {
         .remove = msm_otg_remove,
         .driver = {
                 .name = DRIVER_NAME,
                 .owner = THIS_MODULE,
-#ifdef CONFIG_PM
                 .pm = &msm_otg_dev_pm_ops,
-#endif
         },
 };
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ee1f00f03c43..44ab12986805 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -907,6 +907,8 @@ static const struct usb_device_id id_table_combined[] = {
         /* Crucible Devices */
         { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
+        /* Cressi Devices */
+        { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1e2d369df86e..e599fbfcde5f 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1320,3 +1320,9 @@
  * Manufacturer: Smart GSM Team
  */
 #define FTDI_Z3X_PID            0x0011
+
+/*
+ * Product: Cressi PC Interface
+ * Manufacturer: Cressi
+ */
+#define FTDI_CRESSI_PID         0x87d0
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 216d20affba8..68fc9fe65936 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1526,7 +1526,8 @@ static const struct usb_device_id option_ids[] = {
         /* Cinterion */
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
-        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
         { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
                 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 4fb7a8f83c8a..54af4e933695 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -186,12 +186,12 @@ static bool is_invalid_reserved_pfn(unsigned long pfn)
         if (pfn_valid(pfn)) {
                 bool reserved;
                 struct page *tail = pfn_to_page(pfn);
-                struct page *head = compound_trans_head(tail);
+                struct page *head = compound_head(tail);
                 reserved = !!(PageReserved(head));
                 if (head != tail) {
                         /*
                          * "head" is not a dangling pointer
-                         * (compound_trans_head takes care of that)
+                         * (compound_head takes care of that)
                          * but the hugepage may have been split
                          * from under us (and we may not hold a
                          * reference count on the head page so it can
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 9a68409580d5..a0fa5de210cf 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -70,7 +70,12 @@ enum {
 };
 
 struct vhost_net_ubuf_ref {
-        struct kref kref;
+        /* refcount follows semantics similar to kref:
+         *  0: object is released
+         *  1: no outstanding ubufs
+         * >1: outstanding ubufs
+         */
+        atomic_t refcount;
         wait_queue_head_t wait;
         struct vhost_virtqueue *vq;
 };
@@ -116,14 +121,6 @@ static void vhost_net_enable_zcopy(int vq)
         vhost_net_zcopy_mask |= 0x1 << vq;
 }
 
-static void vhost_net_zerocopy_done_signal(struct kref *kref)
-{
-        struct vhost_net_ubuf_ref *ubufs;
-
-        ubufs = container_of(kref, struct vhost_net_ubuf_ref, kref);
-        wake_up(&ubufs->wait);
-}
-
 static struct vhost_net_ubuf_ref *
 vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy)
 {
@@ -134,21 +131,24 @@ vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy)
         ubufs = kmalloc(sizeof(*ubufs), GFP_KERNEL);
         if (!ubufs)
                 return ERR_PTR(-ENOMEM);
-        kref_init(&ubufs->kref);
+        atomic_set(&ubufs->refcount, 1);
         init_waitqueue_head(&ubufs->wait);
         ubufs->vq = vq;
         return ubufs;
 }
 
-static void vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)
+static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)
 {
-        kref_put(&ubufs->kref, vhost_net_zerocopy_done_signal);
+        int r = atomic_sub_return(1, &ubufs->refcount);
+        if (unlikely(!r))
+                wake_up(&ubufs->wait);
+        return r;
 }
 
 static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
 {
-        kref_put(&ubufs->kref, vhost_net_zerocopy_done_signal);
-        wait_event(ubufs->wait, !atomic_read(&ubufs->kref.refcount));
+        vhost_net_ubuf_put(ubufs);
+        wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
 }
 
 static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
@@ -306,23 +306,26 @@ static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success)
 {
         struct vhost_net_ubuf_ref *ubufs = ubuf->ctx;
         struct vhost_virtqueue *vq = ubufs->vq;
-        int cnt = atomic_read(&ubufs->kref.refcount);
+        int cnt;
+
+        rcu_read_lock_bh();
 
         /* set len to mark this desc buffers done DMA */
         vq->heads[ubuf->desc].len = success ?
                 VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN;
-        vhost_net_ubuf_put(ubufs);
+        cnt = vhost_net_ubuf_put(ubufs);
 
         /*
          * Trigger polling thread if guest stopped submitting new buffers:
-         * in this case, the refcount after decrement will eventually reach 1
-         * so here it is 2.
+         * in this case, the refcount after decrement will eventually reach 1.
          * We also trigger polling periodically after each 16 packets
          * (the value 16 here is more or less arbitrary, it's tuned to trigger
          * less than 10% of times).
          */
-        if (cnt <= 2 || !(cnt % 16))
+        if (cnt <= 1 || !(cnt % 16))
                 vhost_poll_queue(&vq->poll);
+
+        rcu_read_unlock_bh();
 }
 
 /* Expects to be always run from workqueue - which acts as
@@ -420,7 +423,7 @@ static void handle_tx(struct vhost_net *net)
                         msg.msg_control = ubuf;
                         msg.msg_controllen = sizeof(ubuf);
                         ubufs = nvq->ubufs;
-                        kref_get(&ubufs->kref);
+                        atomic_inc(&ubufs->refcount);
                         nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV;
                 } else {
                         msg.msg_control = NULL;
@@ -780,7 +783,7 @@ static void vhost_net_flush(struct vhost_net *n)
                 vhost_net_ubuf_put_and_wait(n->vqs[VHOST_NET_VQ_TX].ubufs);
                 mutex_lock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
                 n->tx_flush = false;
-                kref_init(&n->vqs[VHOST_NET_VQ_TX].ubufs->kref);
+                atomic_set(&n->vqs[VHOST_NET_VQ_TX].ubufs->refcount, 1);
                 mutex_unlock(&n->vqs[VHOST_NET_VQ_TX].vq.mutex);
         }
 }
@@ -800,6 +803,8 @@ static int vhost_net_release(struct inode *inode, struct file *f)
                 fput(tx_sock->file);
         if (rx_sock)
                 fput(rx_sock->file);
+        /* Make sure no callbacks are outstanding */
+        synchronize_rcu_bh();
         /* We do an extra flush before freeing memory,
          * since jobs can re-queue themselves. */
         vhost_net_flush(n);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 0a025b8e2a12..e48d4a672580 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1001,6 +1001,12 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                         break;
                 }
 
+                /* virtio-scsi spec requires byte 0 of the lun to be 1 */
+                if (unlikely(v_req.lun[0] != 1)) {
+                        vhost_scsi_send_bad_target(vs, vq, head, out);
+                        continue;
+                }
+
                 /* Extract the tpgt */
                 target = v_req.lun[1];
                 tpg = ACCESS_ONCE(vs_tpg[target]);
diff --git a/drivers/watchdog/w83697hf_wdt.c b/drivers/watchdog/w83697hf_wdt.c
index aaf2995d37f4..68b45fc9ba6a 100644
--- a/drivers/watchdog/w83697hf_wdt.c
+++ b/drivers/watchdog/w83697hf_wdt.c
@@ -402,7 +402,7 @@ static int __init wdt_init(void)
 
         if (!found) {
                 pr_err("No W83697HF/HG could be found\n");
-                ret = -EIO;
+                ret = -ENODEV;
                 goto out;
         }
 
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 0129b78a6908..4f70f383132c 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -458,11 +458,10 @@ static int bio_integrity_verify(struct bio *bio)
         struct blk_integrity_exchg bix;
         struct bio_vec *bv;
         sector_t sector = bio->bi_integrity->bip_iter.bi_sector;
-        unsigned int sectors, total, ret;
+        unsigned int sectors, ret = 0;
         void *prot_buf = bio->bi_integrity->bip_buf;
         int i;
 
-        ret = total = 0;
         bix.disk_name = bio->bi_bdev->bd_disk->disk_name;
         bix.sector_size = bi->sector_size;
 
@@ -484,8 +483,6 @@ static int bio_integrity_verify(struct bio *bio)
                 sectors = bv->bv_len / bi->sector_size;
                 sector += sectors;
                 prot_buf += sectors * bi->tuple_size;
-                total += sectors * bi->tuple_size;
-                BUG_ON(total > bio->bi_integrity->bip_iter.bi_size);
 
                 kunmap_atomic(kaddr);
         }
diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c
index 4c2d452c4bfc..21887d63dad5 100644
--- a/fs/ceph/acl.c
+++ b/fs/ceph/acl.c
@@ -54,11 +54,6 @@ static inline struct posix_acl *ceph_get_cached_acl(struct inode *inode,
         return acl;
 }
 
-void ceph_forget_all_cached_acls(struct inode *inode)
-{
-        forget_all_cached_acls(inode);
-}
-
 struct posix_acl *ceph_get_acl(struct inode *inode, int type)
 {
         int size;
@@ -160,11 +155,7 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type)
                         goto out_dput;
         }
 
-        if (value)
-                ret = __ceph_setxattr(dentry, name, value, size, 0);
-        else
-                ret = __ceph_removexattr(dentry, name);
-
+        ret = __ceph_setxattr(dentry, name, value, size, 0);
         if (ret) {
                 if (new_mode != old_mode) {
                         newattrs.ia_mode = old_mode;
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 6da4df84ba30..45eda6d7a40c 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -100,6 +100,14 @@ static unsigned fpos_off(loff_t p)
         return p & 0xffffffff;
 }
 
+static int fpos_cmp(loff_t l, loff_t r)
+{
+        int v = ceph_frag_compare(fpos_frag(l), fpos_frag(r));
+        if (v)
+                return v;
+        return (int)(fpos_off(l) - fpos_off(r));
+}
+
 /*
  * When possible, we try to satisfy a readdir by peeking at the
  * dcache.  We make this work by carefully ordering dentries on
@@ -156,7 +164,7 @@ more:
                 if (!d_unhashed(dentry) && dentry->d_inode &&
                     ceph_snap(dentry->d_inode) != CEPH_SNAPDIR &&
                     ceph_ino(dentry->d_inode) != CEPH_INO_CEPH &&
-                    ctx->pos <= di->offset)
+                    fpos_cmp(ctx->pos, di->offset) <= 0)
                         break;
                 dout(" skipping %p %.*s at %llu (%llu)%s%s\n", dentry,
                      dentry->d_name.len, dentry->d_name.name, di->offset,
@@ -695,9 +703,8 @@ static int ceph_mknod(struct inode *dir, struct dentry *dentry,
         ceph_mdsc_put_request(req);
 
         if (!err)
-                err = ceph_init_acl(dentry, dentry->d_inode, dir);
-
-        if (err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                 d_drop(dentry);
         return err;
 }
@@ -735,7 +742,9 @@ static int ceph_symlink(struct inode *dir, struct dentry *dentry,
         if (!err && !req->r_reply_info.head->is_dentry)
                 err = ceph_handle_notrace_create(dir, dentry);
         ceph_mdsc_put_request(req);
-        if (err)
+        if (!err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                 d_drop(dentry);
         return err;
 }
@@ -776,7 +785,9 @@ static int ceph_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
                 err = ceph_handle_notrace_create(dir, dentry);
         ceph_mdsc_put_request(req);
 out:
-        if (err < 0)
+        if (!err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                 d_drop(dentry);
         return err;
 }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index dfd2ce3419f8..09c7afe32e49 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -286,6 +286,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
         } else {
                 dout("atomic_open finish_open on dn %p\n", dn);
                 if (req->r_op == CEPH_MDS_OP_CREATE && req->r_reply_info.has_create_ino) {
+                        ceph_init_acl(dentry, dentry->d_inode, dir);
                         *opened |= FILE_CREATED;
                 }
                 err = finish_open(file, dentry, ceph_open, opened);
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 2df963f1cf5a..10a4ccbf38da 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -144,7 +144,11 @@ enum {
         Opt_ino32,
         Opt_noino32,
         Opt_fscache,
-        Opt_nofscache
+        Opt_nofscache,
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        Opt_acl,
+#endif
+        Opt_noacl
 };
 
 static match_table_t fsopt_tokens = {
@@ -172,6 +176,10 @@ static match_table_t fsopt_tokens = {
         {Opt_noino32, "noino32"},
         {Opt_fscache, "fsc"},
         {Opt_nofscache, "nofsc"},
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        {Opt_acl, "acl"},
+#endif
+        {Opt_noacl, "noacl"},
         {-1, NULL}
 };
 
@@ -271,6 +279,14 @@ static int parse_fsopt_token(char *c, void *private)
         case Opt_nofscache:
                 fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
                 break;
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        case Opt_acl:
+                fsopt->sb_flags |= MS_POSIXACL;
+                break;
+#endif
+        case Opt_noacl:
+                fsopt->sb_flags &= ~MS_POSIXACL;
+                break;
         default:
                 BUG_ON(token);
         }
@@ -438,6 +454,13 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
         else
                 seq_puts(m, ",nofsc");
 
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        if (fsopt->sb_flags & MS_POSIXACL)
+                seq_puts(m, ",acl");
+        else
+                seq_puts(m, ",noacl");
+#endif
+
         if (fsopt->wsize)
                 seq_printf(m, ",wsize=%d", fsopt->wsize);
         if (fsopt->rsize != CEPH_RSIZE_DEFAULT)
@@ -819,9 +842,6 @@ static int ceph_set_super(struct super_block *s, void *data)
 
         s->s_flags = fsc->mount_options->sb_flags;
         s->s_maxbytes = 1ULL << 40;  /* temp value until we get mdsmap */
-#ifdef CONFIG_CEPH_FS_POSIX_ACL
-        s->s_flags |= MS_POSIXACL;
-#endif
 
         s->s_xattr = ceph_xattr_handlers;
         s->s_fs_info = fsc;
@@ -911,6 +931,10 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
         struct ceph_options *opt = NULL;
 
         dout("ceph_mount\n");
+
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        flags |= MS_POSIXACL;
+#endif
         err = parse_mount_options(&fsopt, &opt, flags, data, dev_name, &path);
         if (err < 0) {
                 res = ERR_PTR(err);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 19793b56d0a7..d8801a95b685 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -13,6 +13,7 @@
 #include <linux/wait.h>
 #include <linux/writeback.h>
 #include <linux/slab.h>
+#include <linux/posix_acl.h>
 
 #include <linux/ceph/libceph.h>
 
@@ -743,7 +744,11 @@ extern const struct xattr_handler *ceph_xattr_handlers[];
 struct posix_acl *ceph_get_acl(struct inode *, int);
 int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type);
 int ceph_init_acl(struct dentry *, struct inode *, struct inode *);
-void ceph_forget_all_cached_acls(struct inode *inode);
+
+static inline void ceph_forget_all_cached_acls(struct inode *inode)
+{
+       forget_all_cached_acls(inode);
+}
 
 #else
 
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 898b6565ad3e..a55ec37378c6 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -12,6 +12,9 @@
 #define XATTR_CEPH_PREFIX "ceph."
 #define XATTR_CEPH_PREFIX_LEN (sizeof (XATTR_CEPH_PREFIX) - 1)
 
+static int __remove_xattr(struct ceph_inode_info *ci,
+                          struct ceph_inode_xattr *xattr);
+
 /*
  * List of handlers for synthetic system.* attributes. Other
  * attributes are handled directly.
@@ -319,8 +322,7 @@ static struct ceph_vxattr *ceph_match_vxattr(struct inode *inode,
 static int __set_xattr(struct ceph_inode_info *ci,
                            const char *name, int name_len,
                            const char *val, int val_len,
-                           int dirty,
-                           int should_free_name, int should_free_val,
+                           int flags, int update_xattr,
                            struct ceph_inode_xattr **newxattr)
 {
         struct rb_node **p;
@@ -349,12 +351,31 @@ static int __set_xattr(struct ceph_inode_info *ci,
                 xattr = NULL;
         }
 
+        if (update_xattr) {
+                int err = 0;
+                if (xattr && (flags & XATTR_CREATE))
+                        err = -EEXIST;
+                else if (!xattr && (flags & XATTR_REPLACE))
+                        err = -ENODATA;
+                if (err) {
+                        kfree(name);
+                        kfree(val);
+                        return err;
+                }
+                if (update_xattr < 0) {
+                        if (xattr)
+                                __remove_xattr(ci, xattr);
+                        kfree(name);
+                        return 0;
+                }
+        }
+
         if (!xattr) {
                 new = 1;
                 xattr = *newxattr;
                 xattr->name = name;
                 xattr->name_len = name_len;
-                xattr->should_free_name = should_free_name;
+                xattr->should_free_name = update_xattr;
 
                 ci->i_xattrs.count++;
                 dout("__set_xattr count=%d\n", ci->i_xattrs.count);
@@ -364,7 +385,7 @@ static int __set_xattr(struct ceph_inode_info *ci,
                 if (xattr->should_free_val)
                         kfree((void *)xattr->val);
 
-                if (should_free_name) {
+                if (update_xattr) {
                         kfree((void *)name);
                         name = xattr->name;
                 }
@@ -379,8 +400,8 @@ static int __set_xattr(struct ceph_inode_info *ci,
                 xattr->val = "";
 
         xattr->val_len = val_len;
-        xattr->dirty = dirty;
-        xattr->should_free_val = (val && should_free_val);
+        xattr->dirty = update_xattr;
+        xattr->should_free_val = (val && update_xattr);
 
         if (new) {
                 rb_link_node(&xattr->node, parent, p);
@@ -442,7 +463,7 @@ static int __remove_xattr(struct ceph_inode_info *ci,
                           struct ceph_inode_xattr *xattr)
 {
         if (!xattr)
-                return -EOPNOTSUPP;
+                return -ENODATA;
 
         rb_erase(&xattr->node, &ci->i_xattrs.index);
 
@@ -588,7 +609,7 @@ start:
                         p += len;
 
                         err = __set_xattr(ci, name, namelen, val, len,
-                                          0, 0, 0, &xattrs[numattr]);
+                                          0, 0, &xattrs[numattr]);
 
                         if (err < 0)
                                 goto bad;
@@ -850,6 +871,9 @@ static int ceph_sync_setxattr(struct dentry *dentry, const char *name,
 
         dout("setxattr value=%.*s\n", (int)size, value);
 
+        if (!value)
+                flags |= CEPH_XATTR_REMOVE;
+
         /* do request */
         req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_SETXATTR,
                                        USE_AUTH_MDS);
@@ -892,7 +916,7 @@ int __ceph_setxattr(struct dentry *dentry, const char *name,
         struct ceph_inode_info *ci = ceph_inode(inode);
         int issued;
         int err;
-        int dirty;
+        int dirty = 0;
         int name_len = strlen(name);
         int val_len = size;
         char *newname = NULL;
@@ -953,12 +977,14 @@ retry:
                 goto retry;
         }
 
-        err = __set_xattr(ci, newname, name_len, newval,
-                          val_len, 1, 1, 1, &xattr);
+        err = __set_xattr(ci, newname, name_len, newval, val_len,
+                          flags, value ? 1 : -1, &xattr);
 
-        dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
-        ci->i_xattrs.dirty = true;
-        inode->i_ctime = CURRENT_TIME;
+        if (!err) {
+                dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
+                ci->i_xattrs.dirty = true;
+                inode->i_ctime = CURRENT_TIME;
+        }
 
         spin_unlock(&ci->i_ceph_lock);
         if (dirty)
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index c819b0bd491a..7ff866dbb89e 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -865,8 +865,8 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
         return rc;
 }
 
-static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
-                __u16 fid, u32 *pacllen)
+struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
+                const struct cifs_fid *cifsfid, u32 *pacllen)
 {
         struct cifs_ntsd *pntsd = NULL;
         unsigned int xid;
@@ -877,7 +877,8 @@ static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
                 return ERR_CAST(tlink);
 
         xid = get_xid();
-        rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), fid, &pntsd, pacllen);
+        rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), cifsfid->netfid, &pntsd,
+                                pacllen);
         free_xid(xid);
 
         cifs_put_tlink(tlink);
@@ -946,7 +947,7 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
         if (!open_file)
                 return get_cifs_acl_by_path(cifs_sb, path, pacllen);
 
-        pntsd = get_cifs_acl_by_fid(cifs_sb, open_file->fid.netfid, pacllen);
+        pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen);
         cifsFileInfo_put(open_file);
         return pntsd;
 }
@@ -1006,19 +1007,31 @@ out:
 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
 int
 cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
-                  struct inode *inode, const char *path, const __u16 *pfid)
+                  struct inode *inode, const char *path,
+                  const struct cifs_fid *pfid)
 {
         struct cifs_ntsd *pntsd = NULL;
         u32 acllen = 0;
         int rc = 0;
+        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
+        struct cifs_tcon *tcon;
 
         cifs_dbg(NOISY, "converting ACL to mode for %s\n", path);
 
-        if (pfid)
-                pntsd = get_cifs_acl_by_fid(cifs_sb, *pfid, &acllen);
-        else
-                pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
+        if (IS_ERR(tlink))
+                return PTR_ERR(tlink);
+        tcon = tlink_tcon(tlink);
 
+        if (pfid && (tcon->ses->server->ops->get_acl_by_fid))
+                pntsd = tcon->ses->server->ops->get_acl_by_fid(cifs_sb, pfid,
+                                                          &acllen);
+        else if (tcon->ses->server->ops->get_acl)
+                pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
+                                                        &acllen);
+        else {
+                cifs_put_tlink(tlink);
+                return -EOPNOTSUPP;
+        }
         /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
         if (IS_ERR(pntsd)) {
                 rc = PTR_ERR(pntsd);
@@ -1030,6 +1043,8 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
                         cifs_dbg(VFS, "parse sec desc failed rc = %d\n", rc);
         }
 
+        cifs_put_tlink(tlink);
+
         return rc;
 }
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 86dc28c7aa5c..cf32f0393369 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -398,6 +398,8 @@ struct smb_version_operations {
                         const struct nls_table *, int);
         struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *,
                         const char *, u32 *);
+        struct cifs_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *,
+                        const struct cifs_fid *, u32 *);
         int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
                         int);
 };
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index d00e09dfc452..acc4ee8ed075 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -151,7 +151,7 @@ extern struct inode *cifs_iget(struct super_block *sb,
 
 extern int cifs_get_inode_info(struct inode **inode, const char *full_path,
                                FILE_ALL_INFO *data, struct super_block *sb,
-                               int xid, const __u16 *fid);
+                               int xid, const struct cifs_fid *fid);
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                         const unsigned char *search_path,
                         struct super_block *sb, unsigned int xid);
@@ -162,11 +162,13 @@ extern int cifs_rename_pending_delete(const char *full_path,
                                       const unsigned int xid);
 extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb,
                               struct cifs_fattr *fattr, struct inode *inode,
-                              const char *path, const __u16 *pfid);
+                              const char *path, const struct cifs_fid *pfid);
 extern int id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64,
                                         kuid_t, kgid_t);
 extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *,
                                         const char *, u32 *);
+extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *,
+                                                const struct cifs_fid *, u32 *);
 extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
                                 const char *, int);
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index d3a6796caa5a..3db0c5fd9a11 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -378,7 +378,7 @@ cifs_create_get_file_info:
                                               xid);
         else {
                 rc = cifs_get_inode_info(&newinode, full_path, buf, inode->i_sb,
-                                         xid, &fid->netfid);
+                                         xid, fid);
                 if (newinode) {
                         if (server->ops->set_lease_key)
                                 server->ops->set_lease_key(newinode, fid);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 755584684f6c..53c15074bb36 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -244,7 +244,7 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
                                               xid);
         else
                 rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
-                                         xid, &fid->netfid);
+                                         xid, fid);
 
 out:
         kfree(buf);
@@ -2389,7 +2389,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                  unsigned long nr_segs, loff_t *poffset)
 {
         unsigned long nr_pages, i;
-        size_t copied, len, cur_len;
+        size_t bytes, copied, len, cur_len;
         ssize_t total_written = 0;
         loff_t offset;
         struct iov_iter it;
@@ -2444,14 +2444,45 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
 
                 save_len = cur_len;
                 for (i = 0; i < nr_pages; i++) {
-                        copied = min_t(const size_t, cur_len, PAGE_SIZE);
+                        bytes = min_t(const size_t, cur_len, PAGE_SIZE);
                         copied = iov_iter_copy_from_user(wdata->pages[i], &it,
-                                                         0, copied);
+                                                         0, bytes);
                         cur_len -= copied;
                         iov_iter_advance(&it, copied);
+                        /*
+                         * If we didn't copy as much as we expected, then that
+                         * may mean we trod into an unmapped area. Stop copying
+                         * at that point. On the next pass through the big
+                         * loop, we'll likely end up getting a zero-length
+                         * write and bailing out of it.
+                         */
+                        if (copied < bytes)
+                                break;
                 }
                 cur_len = save_len - cur_len;
 
+                /*
+                 * If we have no data to send, then that probably means that
+                 * the copy above failed altogether. That's most likely because
+                 * the address in the iovec was bogus. Set the rc to -EFAULT,
+                 * free anything we allocated and bail out.
+                 */
+                if (!cur_len) {
+                        for (i = 0; i < nr_pages; i++)
+                                put_page(wdata->pages[i]);
+                        kfree(wdata);
+                        rc = -EFAULT;
+                        break;
+                }
+
+                /*
+                 * i + 1 now represents the number of pages we actually used in
+                 * the copy phase above. Bring nr_pages down to that, and free
+                 * any pages that we didn't use.
+                 */
+                for ( ; nr_pages > i + 1; nr_pages--)
+                        put_page(wdata->pages[nr_pages - 1]);
+
                 wdata->sync_mode = WB_SYNC_ALL;
                 wdata->nr_pages = nr_pages;
                 wdata->offset = (__u64)offset;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index be58b8fcdb3c..aadc2b68678b 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -677,7 +677,7 @@ cgfi_exit:
 int
 cifs_get_inode_info(struct inode **inode, const char *full_path,
                     FILE_ALL_INFO *data, struct super_block *sb, int xid,
-                    const __u16 *fid)
+                    const struct cifs_fid *fid)
 {
         bool validinum = false;
         __u16 srchflgs;
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index bfd66d84831e..526fb89f9230 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1073,6 +1073,7 @@ struct smb_version_operations smb1_operations = {
 #endif /* CIFS_XATTR */
 #ifdef CONFIG_CIFS_ACL
         .get_acl = get_cifs_acl,
+        .get_acl_by_fid = get_cifs_acl_by_fid,
         .set_acl = set_cifs_acl,
 #endif /* CIFS_ACL */
 };
diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h
index c38350851b08..bc0bb9c34f72 100644
--- a/fs/cifs/smb2glob.h
+++ b/fs/cifs/smb2glob.h
@@ -57,4 +57,7 @@
 #define SMB2_CMACAES_SIZE (16)
 #define SMB3_SIGNKEY_SIZE (16)
 
+/* Maximum buffer size value we can send with 1 credit */
+#define SMB2_MAX_BUFFER_SIZE 65536
+
 #endif  /* _SMB2_GLOB_H */
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 757da3e54d3d..192f51a12cf1 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -182,11 +182,8 @@ smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         /* start with specified wsize, or default */
         wsize = volume_info->wsize ? volume_info->wsize : CIFS_DEFAULT_IOSIZE;
         wsize = min_t(unsigned int, wsize, server->max_write);
-        /*
-         * limit write size to 2 ** 16, because we don't support multicredit
-         * requests now.
-         */
-        wsize = min_t(unsigned int, wsize, 2 << 15);
+        /* set it to the maximum buffer size value we can send with 1 credit */
+        wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE);
 
         return wsize;
 }
@@ -200,11 +197,8 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         /* start with specified rsize, or default */
         rsize = volume_info->rsize ? volume_info->rsize : CIFS_DEFAULT_IOSIZE;
         rsize = min_t(unsigned int, rsize, server->max_read);
-        /*
-         * limit write size to 2 ** 16, because we don't support multicredit
-         * requests now.
-         */
-        rsize = min_t(unsigned int, rsize, 2 << 15);
+        /* set it to the maximum buffer size value we can send with 1 credit */
+        rsize = min_t(unsigned int, rsize, SMB2_MAX_BUFFER_SIZE);
 
         return rsize;
 }
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index a3f7a9c3cc69..860344701067 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -413,7 +413,9 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
 
         /* SMB2 only has an extended negflavor */
         server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
-        server->maxBuf = le32_to_cpu(rsp->MaxTransactSize);
+        /* set it to the maximum buffer size value we can send with 1 credit */
+        server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
+                               SMB2_MAX_BUFFER_SIZE);
         server->max_read = le32_to_cpu(rsp->MaxReadSize);
         server->max_write = le32_to_cpu(rsp->MaxWriteSize);
         /* BB Do we need to validate the SecurityMode? */
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index ece55565b9cd..d3a534fdc5ff 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -771,6 +771,8 @@ do {									       \
         if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime))                      \
                 (einode)->xtime.tv_sec =                                       \
                         (signed)le32_to_cpu((raw_inode)->xtime);               \
+        else                                                                   \
+                (einode)->xtime.tv_sec = 0;                                    \
         if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime ## _extra))            \
                 ext4_decode_extra_time(&(einode)->xtime,                       \
                                        raw_inode->xtime ## _extra);            \
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 10cff4736b11..74bc2d549c58 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3906,6 +3906,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                 } else
                         err = ret;
                 map->m_flags |= EXT4_MAP_MAPPED;
+                map->m_pblk = newblock;
                 if (allocated > map->m_len)
                         allocated = map->m_len;
                 map->m_len = allocated;
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 6bea80614d77..a2a837f00407 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -140,7 +140,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
         handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
         if (IS_ERR(handle)) {
                 err = -EINVAL;
-                goto swap_boot_out;
+                goto journal_err_out;
         }
 
         /* Protect extent tree against block allocations via delalloc */
@@ -198,6 +198,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
 
         ext4_double_up_write_data_sem(inode, inode_bl);
 
+journal_err_out:
         ext4_inode_resume_unlocked_dio(inode);
         ext4_inode_resume_unlocked_dio(inode_bl);
 
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index c5adbb318a90..f3b84cd9de56 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -243,6 +243,7 @@ static int ext4_alloc_group_tables(struct super_block *sb,
         ext4_group_t group;
         ext4_group_t last_group;
         unsigned overhead;
+        __u16 uninit_mask = (flexbg_size > 1) ? ~EXT4_BG_BLOCK_UNINIT : ~0;
 
         BUG_ON(flex_gd->count == 0 || group_data == NULL);
 
@@ -266,7 +267,7 @@ next_group:
         src_group++;
         for (; src_group <= last_group; src_group++) {
                 overhead = ext4_group_overhead_blocks(sb, src_group);
-                if (overhead != 0)
+                if (overhead == 0)
                         last_blk += group_data[src_group - group].blocks_count;
                 else
                         break;
@@ -280,8 +281,7 @@ next_group:
                 group = ext4_get_group_number(sb, start_blk - 1);
                 group -= group_data[0].group;
                 group_data[group].free_blocks_count--;
-                if (flexbg_size > 1)
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
+                flex_gd->bg_flags[group] &= uninit_mask;
         }
 
         /* Allocate inode bitmaps */
@@ -292,22 +292,30 @@ next_group:
                 group = ext4_get_group_number(sb, start_blk - 1);
                 group -= group_data[0].group;
                 group_data[group].free_blocks_count--;
-                if (flexbg_size > 1)
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
+                flex_gd->bg_flags[group] &= uninit_mask;
         }
 
         /* Allocate inode tables */
         for (; it_index < flex_gd->count; it_index++) {
-                if (start_blk + EXT4_SB(sb)->s_itb_per_group > last_blk)
+                unsigned int itb = EXT4_SB(sb)->s_itb_per_group;
+                ext4_fsblk_t next_group_start;
+
+                if (start_blk + itb > last_blk)
                         goto next_group;
                 group_data[it_index].inode_table = start_blk;
-                group = ext4_get_group_number(sb, start_blk - 1);
+                group = ext4_get_group_number(sb, start_blk);
+                next_group_start = ext4_group_first_block_no(sb, group + 1);
                 group -= group_data[0].group;
-                group_data[group].free_blocks_count -=
-                                        EXT4_SB(sb)->s_itb_per_group;
-                if (flexbg_size > 1)
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
 
+                if (start_blk + itb > next_group_start) {
+                        flex_gd->bg_flags[group + 1] &= uninit_mask;
+                        overhead = start_blk + itb - next_group_start;
+                        group_data[group + 1].free_blocks_count -= overhead;
+                        itb -= overhead;
+                }
+
+                group_data[group].free_blocks_count -= itb;
+                flex_gd->bg_flags[group] &= uninit_mask;
                 start_blk += EXT4_SB(sb)->s_itb_per_group;
         }
 
@@ -401,7 +409,7 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle,
                 start = ext4_group_first_block_no(sb, group);
                 group -= flex_gd->groups[0].group;
 
-                count2 = sb->s_blocksize * 8 - (block - start);
+                count2 = EXT4_BLOCKS_PER_GROUP(sb) - (block - start);
                 if (count2 > count)
                         count2 = count;
 
@@ -620,7 +628,7 @@ handle_ib:
                         if (err)
                                 goto out;
                         count = group_table_count[j];
-                        start = group_data[i].block_bitmap;
+                        start = (&group_data[i].block_bitmap)[j];
                         block = start;
                 }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1f7784de05b6..710fed2377d4 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3695,16 +3695,22 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         for (i = 0; i < 4; i++)
                 sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);
         sbi->s_def_hash_version = es->s_def_hash_version;
-        i = le32_to_cpu(es->s_flags);
-        if (i & EXT2_FLAGS_UNSIGNED_HASH)
-                sbi->s_hash_unsigned = 3;
-        else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) {
+        if (EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
+                i = le32_to_cpu(es->s_flags);
+                if (i & EXT2_FLAGS_UNSIGNED_HASH)
+                        sbi->s_hash_unsigned = 3;
+                else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) {
 #ifdef __CHAR_UNSIGNED__
-                es->s_flags |= cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH);
-                sbi->s_hash_unsigned = 3;
+                        if (!(sb->s_flags & MS_RDONLY))
+                                es->s_flags |=
+                                        cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH);
+                        sbi->s_hash_unsigned = 3;
 #else
-                es->s_flags |= cpu_to_le32(EXT2_FLAGS_SIGNED_HASH);
+                        if (!(sb->s_flags & MS_RDONLY))
+                                es->s_flags |=
+                                        cpu_to_le32(EXT2_FLAGS_SIGNED_HASH);
 #endif
+                }
         }
 
         /* Handle clustersize */
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e0259a163f98..d754e3cf99a8 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -40,18 +40,13 @@
 struct wb_writeback_work {
         long nr_pages;
         struct super_block *sb;
-        /*
-         * Write only inodes dirtied before this time. Don't forget to set
-         * older_than_this_is_set when you set this.
-         */
-        unsigned long older_than_this;
+        unsigned long *older_than_this;
         enum writeback_sync_modes sync_mode;
         unsigned int tagged_writepages:1;
         unsigned int for_kupdate:1;
         unsigned int range_cyclic:1;
         unsigned int for_background:1;
         unsigned int for_sync:1;        /* sync(2) WB_SYNC_ALL writeback */
-        unsigned int older_than_this_is_set:1;
         enum wb_reason reason;          /* why was writeback initiated? */
 
         struct list_head list;          /* pending work list */
@@ -252,10 +247,10 @@ static int move_expired_inodes(struct list_head *delaying_queue,
         int do_sb_sort = 0;
         int moved = 0;
 
-        WARN_ON_ONCE(!work->older_than_this_is_set);
         while (!list_empty(delaying_queue)) {
                 inode = wb_inode(delaying_queue->prev);
-                if (inode_dirtied_after(inode, work->older_than_this))
+                if (work->older_than_this &&
+                    inode_dirtied_after(inode, *work->older_than_this))
                         break;
                 list_move(&inode->i_wb_list, &tmp);
                 moved++;
@@ -742,8 +737,6 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
                 .sync_mode      = WB_SYNC_NONE,
                 .range_cyclic   = 1,
                 .reason         = reason,
-                .older_than_this = jiffies,
-                .older_than_this_is_set = 1,
         };
 
         spin_lock(&wb->list_lock);
@@ -802,13 +795,12 @@ static long wb_writeback(struct bdi_writeback *wb,
 {
         unsigned long wb_start = jiffies;
         long nr_pages = work->nr_pages;
+        unsigned long oldest_jif;
         struct inode *inode;
         long progress;
 
-        if (!work->older_than_this_is_set) {
-                work->older_than_this = jiffies;
-                work->older_than_this_is_set = 1;
-        }
+        oldest_jif = jiffies;
+        work->older_than_this = &oldest_jif;
 
         spin_lock(&wb->list_lock);
         for (;;) {
@@ -842,10 +834,10 @@ static long wb_writeback(struct bdi_writeback *wb,
                  * safe.
                  */
                 if (work->for_kupdate) {
-                        work->older_than_this = jiffies -
+                        oldest_jif = jiffies -
                                 msecs_to_jiffies(dirty_expire_interval * 10);
                 } else if (work->for_background)
-                        work->older_than_this = jiffies;
+                        oldest_jif = jiffies;
 
                 trace_writeback_start(wb->bdi, work);
                 if (list_empty(&wb->b_io))
@@ -1357,21 +1349,18 @@ EXPORT_SYMBOL(try_to_writeback_inodes_sb);
 
 /**
  * sync_inodes_sb       -       sync sb inode pages
- * @sb:                 the superblock
- * @older_than_this:    timestamp
+ * @sb: the superblock
  *
  * This function writes and waits on any dirty inode belonging to this
- * superblock that has been dirtied before given timestamp.
+ * super_block.
  */
-void sync_inodes_sb(struct super_block *sb, unsigned long older_than_this)
+void sync_inodes_sb(struct super_block *sb)
 {
         DECLARE_COMPLETION_ONSTACK(done);
         struct wb_writeback_work work = {
                 .sb             = sb,
                 .sync_mode      = WB_SYNC_ALL,
                 .nr_pages       = LONG_MAX,
-                .older_than_this = older_than_this,
-                .older_than_this_is_set = 1,
                 .range_cyclic   = 0,
                 .done           = &done,
                 .reason         = WB_REASON_SYNC,
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index e1959efad64f..b5ebc2d7d80d 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -50,6 +50,8 @@ void fscache_objlist_add(struct fscache_object *obj)
         struct fscache_object *xobj;
         struct rb_node **p = &fscache_object_list.rb_node, *parent = NULL;
 
+        ASSERT(RB_EMPTY_NODE(&obj->objlist_link));
+
         write_lock(&fscache_object_list_lock);
 
         while (*p) {
@@ -75,6 +77,9 @@ void fscache_objlist_add(struct fscache_object *obj)
  */
 void fscache_objlist_remove(struct fscache_object *obj)
 {
+        if (RB_EMPTY_NODE(&obj->objlist_link))
+                return;
+
         write_lock(&fscache_object_list_lock);
 
         BUG_ON(RB_EMPTY_ROOT(&fscache_object_list));
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 53d35c504240..d3b4539f1651 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -314,6 +314,9 @@ void fscache_object_init(struct fscache_object *object,
         object->cache = cache;
         object->cookie = cookie;
         object->parent = NULL;
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        RB_CLEAR_NODE(&object->objlist_link);
+#endif
 
         object->oob_event_mask = 0;
         for (t = object->oob_table; t->events; t++)
diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index 968eab5bc1f5..68537e8b7a09 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -75,7 +75,7 @@ int hfsplus_parse_options_remount(char *input, int *force)
         int token;
 
         if (!input)
-                return 0;
+                return 1;
 
         while ((p = strsep(&input, ",")) != NULL) {
                 if (!*p)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8360674c85bc..60bb365f54a5 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
          * similarly constrained call sites
          */
         ret = start_this_handle(journal, handle, GFP_NOFS);
-        if (ret < 0)
+        if (ret < 0) {
                 jbd2_journal_free_reserved(handle);
+                return ret;
+        }
         handle->h_type = type;
         handle->h_line_no = line_no;
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(jbd2_journal_start_reserved);
 
diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
index e973b85d6afd..5a8ea16eedbc 100644
--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -86,6 +86,8 @@ static int __jfs_set_acl(tid_t tid, struct inode *inode, int type,
                 rc = posix_acl_equiv_mode(acl, &inode->i_mode);
                 if (rc < 0)
                         return rc;
+                inode->i_ctime = CURRENT_TIME;
+                mark_inode_dirty(inode);
                 if (rc == 0)
                         acl = NULL;
                 break;
diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
index 0d6ce895a9ee..0f4152defe7b 100644
--- a/fs/kernfs/mount.c
+++ b/fs/kernfs/mount.c
@@ -94,6 +94,7 @@ const void *kernfs_super_ns(struct super_block *sb)
  * @fs_type: file_system_type of the fs being mounted
  * @flags: mount flags specified for the mount
  * @root: kernfs_root of the hierarchy being mounted
+ * @new_sb_created: tell the caller if we allocated a new superblock
  * @ns: optional namespace tag of the mount
  *
  * This is to be called from each kernfs user's file_system_type->mount()
@@ -104,7 +105,8 @@ const void *kernfs_super_ns(struct super_block *sb)
  * The return value can be passed to the vfs layer verbatim.
  */
 struct dentry *kernfs_mount_ns(struct file_system_type *fs_type, int flags,
-                               struct kernfs_root *root, const void *ns)
+                               struct kernfs_root *root, bool *new_sb_created,
+                               const void *ns)
 {
         struct super_block *sb;
         struct kernfs_super_info *info;
@@ -122,6 +124,10 @@ struct dentry *kernfs_mount_ns(struct file_system_type *fs_type, int flags,
                 kfree(info);
         if (IS_ERR(sb))
                 return ERR_CAST(sb);
+
+        if (new_sb_created)
+                *new_sb_created = !sb->s_root;
+
         if (!sb->s_root) {
                 error = kernfs_fill_super(sb);
                 if (error) {
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index ef792f29f831..5d8ccecf5f5c 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -659,16 +659,19 @@ int nfs_async_inode_return_delegation(struct inode *inode,
 
         rcu_read_lock();
         delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (delegation == NULL)
+                goto out_enoent;
 
-        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) {
-                rcu_read_unlock();
-                return -ENOENT;
-        }
+        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid))
+                goto out_enoent;
         nfs_mark_return_delegation(server, delegation);
         rcu_read_unlock();
 
         nfs_delegation_run_state_manager(clp);
         return 0;
+out_enoent:
+        rcu_read_unlock();
+        return -ENOENT;
 }
 
 static struct inode *
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 28a0a3cbd3b7..360114ae8b82 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -164,17 +164,16 @@ static void nfs_zap_caches_locked(struct inode *inode)
         if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) {
                 nfs_fscache_invalidate(inode);
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                        | NFS_INO_INVALID_LABEL
                                         | NFS_INO_INVALID_DATA
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
                                         | NFS_INO_REVAL_PAGECACHE;
         } else
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                        | NFS_INO_INVALID_LABEL
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
                                         | NFS_INO_REVAL_PAGECACHE;
+        nfs_zap_label_cache_locked(nfsi);
 }
 
 void nfs_zap_caches(struct inode *inode)
@@ -266,6 +265,13 @@ nfs_init_locked(struct inode *inode, void *opaque)
 }
 
 #ifdef CONFIG_NFS_V4_SECURITY_LABEL
+static void nfs_clear_label_invalid(struct inode *inode)
+{
+        spin_lock(&inode->i_lock);
+        NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_LABEL;
+        spin_unlock(&inode->i_lock);
+}
+
 void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                         struct nfs4_label *label)
 {
@@ -283,6 +289,7 @@ void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                         __func__,
                                         (char *)label->label,
                                         label->len, error);
+                nfs_clear_label_invalid(inode);
         }
 }
 
@@ -1648,7 +1655,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 inode->i_blocks = fattr->du.nfs2.blocks;
 
         /* Update attrtimeo value if we're out of the unstable period */
-        if (invalid & (NFS_INO_INVALID_ATTR|NFS_INO_INVALID_LABEL)) {
+        if (invalid & NFS_INO_INVALID_ATTR) {
                 nfs_inc_stats(inode, NFSIOS_ATTRINVALIDATE);
                 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
                 nfsi->attrtimeo_timestamp = now;
@@ -1661,7 +1668,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 }
         }
         invalid &= ~NFS_INO_INVALID_ATTR;
-        invalid &= ~NFS_INO_INVALID_LABEL;
         /* Don't invalidate the data if we were to blame */
         if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
                                 || S_ISLNK(inode->i_mode)))
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 8b5cc04a8611..b46cf5a67329 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -176,7 +176,8 @@ extern struct nfs_server *nfs4_create_server(
 extern struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *,
                                                       struct nfs_fh *);
 extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
-                                        struct sockaddr *sap, size_t salen);
+                                        struct sockaddr *sap, size_t salen,
+                                        struct net *net);
 extern void nfs_free_server(struct nfs_server *server);
 extern struct nfs_server *nfs_clone_server(struct nfs_server *,
                                            struct nfs_fh *,
@@ -279,9 +280,18 @@ static inline void nfs4_label_free(struct nfs4_label *label)
         }
         return;
 }
+
+static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
+{
+        if (nfs_server_capable(&nfsi->vfs_inode, NFS_CAP_SECURITY_LABEL))
+                nfsi->cache_validity |= NFS_INO_INVALID_LABEL;
+}
 #else
 static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
 static inline void nfs4_label_free(void *label) {}
+static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
+{
+}
 #endif /* CONFIG_NFS_V4_SECURITY_LABEL */
 
 /* proc.c */
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index aa9bc973f36a..a462ef0fb5d6 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -18,6 +18,7 @@
 #include <linux/lockd/bind.h>
 #include <linux/nfs_mount.h>
 #include <linux/freezer.h>
+#include <linux/xattr.h>
 
 #include "iostat.h"
 #include "internal.h"
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 860ad26a5590..0e46d3d1b6cc 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1135,6 +1135,7 @@ static int nfs_probe_destination(struct nfs_server *server)
  * @hostname: new end-point's hostname
  * @sap: new end-point's socket address
  * @salen: size of "sap"
+ * @net: net namespace
  *
  * The nfs_server must be quiescent before this function is invoked.
  * Either its session is drained (NFSv4.1+), or its transport is
@@ -1143,13 +1144,13 @@ static int nfs_probe_destination(struct nfs_server *server)
  * Returns zero on success, or a negative errno value.
  */
 int nfs4_update_server(struct nfs_server *server, const char *hostname,
-                       struct sockaddr *sap, size_t salen)
+                       struct sockaddr *sap, size_t salen, struct net *net)
 {
         struct nfs_client *clp = server->nfs_client;
         struct rpc_clnt *clnt = server->client;
         struct xprt_create xargs = {
                 .ident          = clp->cl_proto,
-                .net            = &init_net,
+                .net            = net,
                 .dstaddr        = sap,
                 .addrlen        = salen,
                 .servername     = hostname,
@@ -1189,7 +1190,7 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
         error = nfs4_set_client(server, hostname, sap, salen, buf,
                                 clp->cl_rpcclient->cl_auth->au_flavor,
                                 clp->cl_proto, clnt->cl_timeout,
-                                clp->cl_minorversion, clp->cl_net);
+                                clp->cl_minorversion, net);
         nfs_put_client(clp);
         if (error != 0) {
                 nfs_server_insert_lists(server);
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 12c8132ad408..b9a35c05b60f 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -324,8 +324,9 @@ static void filelayout_read_prepare(struct rpc_task *task, void *data)
                         &rdata->res.seq_res,
                         task))
                 return;
-        nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
-                        rdata->args.lock_context, FMODE_READ);
+        if (nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
+                        rdata->args.lock_context, FMODE_READ) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 
 static void filelayout_read_call_done(struct rpc_task *task, void *data)
@@ -435,8 +436,9 @@ static void filelayout_write_prepare(struct rpc_task *task, void *data)
                         &wdata->res.seq_res,
                         task))
                 return;
-        nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
-                        wdata->args.lock_context, FMODE_WRITE);
+        if (nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
+                        wdata->args.lock_context, FMODE_WRITE) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 
 static void filelayout_write_call_done(struct rpc_task *task, void *data)
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 4e7f05d3e9db..3d5dbf80d46a 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -121,9 +121,8 @@ static int nfs4_validate_fspath(struct dentry *dentry,
 }
 
 static size_t nfs_parse_server_name(char *string, size_t len,
-                struct sockaddr *sa, size_t salen, struct nfs_server *server)
+                struct sockaddr *sa, size_t salen, struct net *net)
 {
-        struct net *net = rpc_net_ns(server->client);
         ssize_t ret;
 
         ret = rpc_pton(net, string, len, sa, salen);
@@ -223,6 +222,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                                      const struct nfs4_fs_location *location)
 {
         const size_t addr_bufsize = sizeof(struct sockaddr_storage);
+        struct net *net = rpc_net_ns(NFS_SB(mountdata->sb)->client);
         struct vfsmount *mnt = ERR_PTR(-ENOENT);
         char *mnt_path;
         unsigned int maxbuflen;
@@ -248,8 +248,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                         continue;
 
                 mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
-                                mountdata->addr, addr_bufsize,
-                                NFS_SB(mountdata->sb));
+                                mountdata->addr, addr_bufsize, net);
                 if (mountdata->addrlen == 0)
                         continue;
 
@@ -419,6 +418,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                 const struct nfs4_fs_location *location)
 {
         const size_t addr_bufsize = sizeof(struct sockaddr_storage);
+        struct net *net = rpc_net_ns(server->client);
         struct sockaddr *sap;
         unsigned int s;
         size_t salen;
@@ -440,7 +440,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                         continue;
 
                 salen = nfs_parse_server_name(buf->data, buf->len,
-                                                sap, addr_bufsize, server);
+                                                sap, addr_bufsize, net);
                 if (salen == 0)
                         continue;
                 rpc_set_port(sap, NFS_PORT);
@@ -450,7 +450,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                 if (hostname == NULL)
                         break;
 
-                error = nfs4_update_server(server, hostname, sap, salen);
+                error = nfs4_update_server(server, hostname, sap, salen, net);
                 kfree(hostname);
                 if (error == 0)
                         break;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 2da6a698b8f7..450bfedbe2f4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2398,13 +2398,16 @@ static int _nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
 
         if (nfs4_copy_delegation_stateid(&arg.stateid, inode, fmode)) {
                 /* Use that stateid */
-        } else if (truncate && state != NULL && nfs4_valid_open_stateid(state)) {
+        } else if (truncate && state != NULL) {
                 struct nfs_lockowner lockowner = {
                         .l_owner = current->files,
                         .l_pid = current->tgid,
                 };
-                nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
-                                &lockowner);
+                if (!nfs4_valid_open_stateid(state))
+                        return -EBADF;
+                if (nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
+                                &lockowner) == -EIO)
+                        return -EBADF;
         } else
                 nfs4_stateid_copy(&arg.stateid, &zero_stateid);
 
@@ -4011,8 +4014,9 @@ static bool nfs4_stateid_is_current(nfs4_stateid *stateid,
 {
         nfs4_stateid current_stateid;
 
-        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode))
-                return false;
+        /* If the current stateid represents a lost lock, then exit */
+        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode) == -EIO)
+                return true;
         return nfs4_stateid_match(stateid, &current_stateid);
 }
 
@@ -5828,8 +5832,7 @@ struct nfs_release_lockowner_data {
         struct nfs4_lock_state *lsp;
         struct nfs_server *server;
         struct nfs_release_lockowner_args args;
-        struct nfs4_sequence_args seq_args;
-        struct nfs4_sequence_res seq_res;
+        struct nfs_release_lockowner_res res;
         unsigned long timestamp;
 };
 
@@ -5837,7 +5840,7 @@ static void nfs4_release_lockowner_prepare(struct rpc_task *task, void *calldata
 {
         struct nfs_release_lockowner_data *data = calldata;
         nfs40_setup_sequence(data->server,
-                                &data->seq_args, &data->seq_res, task);
+                                &data->args.seq_args, &data->res.seq_res, task);
         data->timestamp = jiffies;
 }
 
@@ -5846,7 +5849,7 @@ static void nfs4_release_lockowner_done(struct rpc_task *task, void *calldata)
         struct nfs_release_lockowner_data *data = calldata;
         struct nfs_server *server = data->server;
 
-        nfs40_sequence_done(task, &data->seq_res);
+        nfs40_sequence_done(task, &data->res.seq_res);
 
         switch (task->tk_status) {
         case 0:
@@ -5887,7 +5890,6 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
         data = kmalloc(sizeof(*data), GFP_NOFS);
         if (!data)
                 return -ENOMEM;
-        nfs4_init_sequence(&data->seq_args, &data->seq_res, 0);
         data->lsp = lsp;
         data->server = server;
         data->args.lock_owner.clientid = server->nfs_client->cl_clientid;
@@ -5895,6 +5897,8 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
         data->args.lock_owner.s_dev = server->s_dev;
 
         msg.rpc_argp = &data->args;
+        msg.rpc_resp = &data->res;
+        nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 0);
         rpc_call_async(server->client, &msg, 0, &nfs4_release_lockowner_ops, data);
         return 0;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e5be72518bd7..0deb32105ccf 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -974,9 +974,6 @@ static int nfs4_copy_lock_stateid(nfs4_stateid *dst,
         else if (lsp != NULL && test_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags) != 0) {
                 nfs4_stateid_copy(dst, &lsp->ls_stateid);
                 ret = 0;
-                smp_rmb();
-                if (!list_empty(&lsp->ls_seqid.list))
-                        ret = -EWOULDBLOCK;
         }
         spin_unlock(&state->state_lock);
         nfs4_put_lock_state(lsp);
@@ -984,10 +981,9 @@ out:
         return ret;
 }
 
-static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
+static void nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
 {
         const nfs4_stateid *src;
-        int ret;
         int seq;
 
         do {
@@ -996,12 +992,7 @@ static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
                 if (test_bit(NFS_OPEN_STATE, &state->flags))
                         src = &state->open_stateid;
                 nfs4_stateid_copy(dst, src);
-                ret = 0;
-                smp_rmb();
-                if (!list_empty(&state->owner->so_seqid.list))
-                        ret = -EWOULDBLOCK;
         } while (read_seqretry(&state->seqlock, seq));
-        return ret;
 }
 
 /*
@@ -1015,15 +1006,19 @@ int nfs4_select_rw_stateid(nfs4_stateid *dst, struct nfs4_state *state,
         if (ret == -EIO)
                 /* A lost lock - don't even consider delegations */
                 goto out;
-        if (nfs4_copy_delegation_stateid(dst, state->inode, fmode))
+        /* returns true if delegation stateid found and copied */
+        if (nfs4_copy_delegation_stateid(dst, state->inode, fmode)) {
+                ret = 0;
                 goto out;
+        }
         if (ret != -ENOENT)
                 /* nfs4_copy_delegation_stateid() didn't over-write
                  * dst, so it still has the lock stateid which we now
                  * choose to use.
                  */
                 goto out;
-        ret = nfs4_copy_open_stateid(dst, state);
+        nfs4_copy_open_stateid(dst, state);
+        ret = 0;
 out:
         if (nfs_server_capable(state->inode, NFS_CAP_STATEID_NFSV41))
                 dst->seqid = 0;
diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index 0b9ff4395e6a..abc8cbcfe90e 100644
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -86,7 +86,7 @@ static int dnotify_handle_event(struct fsnotify_group *group,
                                 struct fsnotify_mark *inode_mark,
                                 struct fsnotify_mark *vfsmount_mark,
                                 u32 mask, void *data, int data_type,
-                                const unsigned char *file_name)
+                                const unsigned char *file_name, u32 cookie)
 {
         struct dnotify_mark *dn_mark;
         struct dnotify_struct *dn;
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 0e792f5e3147..dc638f786d5c 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -147,7 +147,7 @@ static int fanotify_handle_event(struct fsnotify_group *group,
                                  struct fsnotify_mark *inode_mark,
                                  struct fsnotify_mark *fanotify_mark,
                                  u32 mask, void *data, int data_type,
-                                 const unsigned char *file_name)
+                                 const unsigned char *file_name, u32 cookie)
 {
         int ret = 0;
         struct fanotify_event_info *event;
@@ -192,10 +192,12 @@ static int fanotify_handle_event(struct fsnotify_group *group,
 
         ret = fsnotify_add_notify_event(group, fsn_event, fanotify_merge);
         if (ret) {
-                BUG_ON(mask & FAN_ALL_PERM_EVENTS);
+                /* Permission events shouldn't be merged */
+                BUG_ON(ret == 1 && mask & FAN_ALL_PERM_EVENTS);
                 /* Our event wasn't used in the end. Free it. */
                 fsnotify_destroy_event(group, fsn_event);
-                ret = 0;
+
+                return 0;
         }
 
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index b6175fa11bf8..287a22c04149 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -698,6 +698,7 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
         struct fsnotify_group *group;
         int f_flags, fd;
         struct user_struct *user;
+        struct fanotify_event_info *oevent;
 
         pr_debug("%s: flags=%d event_f_flags=%d\n",
                 __func__, flags, event_f_flags);
@@ -730,8 +731,20 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
         group->fanotify_data.user = user;
         atomic_inc(&user->fanotify_listeners);
 
+        oevent = kmem_cache_alloc(fanotify_event_cachep, GFP_KERNEL);
+        if (unlikely(!oevent)) {
+                fd = -ENOMEM;
+                goto out_destroy_group;
+        }
+        group->overflow_event = &oevent->fse;
+        fsnotify_init_event(group->overflow_event, NULL, FS_Q_OVERFLOW);
+        oevent->tgid = get_pid(task_tgid(current));
+        oevent->path.mnt = NULL;
+        oevent->path.dentry = NULL;
+
         group->fanotify_data.f_flags = event_f_flags;
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
+        oevent->response = 0;
         mutex_init(&group->fanotify_data.access_mutex);
         init_waitqueue_head(&group->fanotify_data.access_waitq);
         INIT_LIST_HEAD(&group->fanotify_data.access_list);
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 1d4e1ea2f37c..9d3e9c50066a 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -179,7 +179,7 @@ static int send_to_group(struct inode *to_tell,
 
         return group->ops->handle_event(group, to_tell, inode_mark,
                                         vfsmount_mark, mask, data, data_is,
-                                        file_name);
+                                        file_name, cookie);
 }
 
 /*
diff --git a/fs/notify/group.c b/fs/notify/group.c
index ee674fe2cec7..ad1995980456 100644
--- a/fs/notify/group.c
+++ b/fs/notify/group.c
@@ -55,6 +55,13 @@ void fsnotify_destroy_group(struct fsnotify_group *group)
         /* clear the notification queue of all events */
         fsnotify_flush_notify(group);
 
+        /*
+         * Destroy overflow event (we cannot use fsnotify_destroy_event() as
+         * that deliberately ignores overflow events.
+         */
+        if (group->overflow_event)
+                group->ops->free_event(group->overflow_event);
+
         fsnotify_put_group(group);
 }
 
@@ -99,7 +106,6 @@ struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *ops)
         INIT_LIST_HEAD(&group->marks_list);
 
         group->ops = ops;
-        fsnotify_init_event(&group->overflow_event, NULL, FS_Q_OVERFLOW);
 
         return group;
 }
diff --git a/fs/notify/inotify/inotify.h b/fs/notify/inotify/inotify.h
index 485eef3f4407..ed855ef6f077 100644
--- a/fs/notify/inotify/inotify.h
+++ b/fs/notify/inotify/inotify.h
@@ -27,6 +27,6 @@ extern int inotify_handle_event(struct fsnotify_group *group,
                                 struct fsnotify_mark *inode_mark,
                                 struct fsnotify_mark *vfsmount_mark,
                                 u32 mask, void *data, int data_type,
-                                const unsigned char *file_name);
+                                const unsigned char *file_name, u32 cookie);
 
 extern const struct fsnotify_ops inotify_fsnotify_ops;
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index d5ee56348bb8..43ab1e1a07a2 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -67,7 +67,7 @@ int inotify_handle_event(struct fsnotify_group *group,
                          struct fsnotify_mark *inode_mark,
                          struct fsnotify_mark *vfsmount_mark,
                          u32 mask, void *data, int data_type,
-                         const unsigned char *file_name)
+                         const unsigned char *file_name, u32 cookie)
 {
         struct inotify_inode_mark *i_mark;
         struct inotify_event_info *event;
@@ -103,6 +103,7 @@ int inotify_handle_event(struct fsnotify_group *group,
         fsn_event = &event->fse;
         fsnotify_init_event(fsn_event, inode, mask);
         event->wd = i_mark->wd;
+        event->sync_cookie = cookie;
         event->name_len = len;
         if (len)
                 strcpy(event->name, file_name);
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 497395c8274b..78a2ca3966c3 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -495,7 +495,7 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark *fsn_mark,
 
         /* Queue ignore event for the watch */
         inotify_handle_event(group, NULL, fsn_mark, NULL, FS_IN_IGNORED,
-                             NULL, FSNOTIFY_EVENT_NONE, NULL);
+                             NULL, FSNOTIFY_EVENT_NONE, NULL, 0);
 
         i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
         /* remove this mark from the idr */
@@ -633,11 +633,23 @@ static int inotify_update_watch(struct fsnotify_group *group, struct inode *inod
 static struct fsnotify_group *inotify_new_group(unsigned int max_events)
 {
         struct fsnotify_group *group;
+        struct inotify_event_info *oevent;
 
         group = fsnotify_alloc_group(&inotify_fsnotify_ops);
         if (IS_ERR(group))
                 return group;
 
+        oevent = kmalloc(sizeof(struct inotify_event_info), GFP_KERNEL);
+        if (unlikely(!oevent)) {
+                fsnotify_destroy_group(group);
+                return ERR_PTR(-ENOMEM);
+        }
+        group->overflow_event = &oevent->fse;
+        fsnotify_init_event(group->overflow_event, NULL, FS_Q_OVERFLOW);
+        oevent->wd = -1;
+        oevent->sync_cookie = 0;
+        oevent->name_len = 0;
+
         group->max_events = max_events;
 
         spin_lock_init(&group->inotify_data.idr_lock);
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 18b3c4427dca..1e58402171a5 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -80,7 +80,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group,
 /*
  * Add an event to the group notification queue.  The group can later pull this
  * event off the queue to deal with.  The function returns 0 if the event was
- * added to the queue, 1 if the event was merged with some other queued event.
+ * added to the queue, 1 if the event was merged with some other queued event,
+ * 2 if the queue of events has overflown.
  */
 int fsnotify_add_notify_event(struct fsnotify_group *group,
                               struct fsnotify_event *event,
@@ -95,10 +96,14 @@ int fsnotify_add_notify_event(struct fsnotify_group *group,
         mutex_lock(&group->notification_mutex);
 
         if (group->q_len >= group->max_events) {
+                ret = 2;
                 /* Queue overflow event only if it isn't already queued */
-                if (list_empty(&group->overflow_event.list))
-                        event = &group->overflow_event;
-                ret = 1;
+                if (!list_empty(&group->overflow_event->list)) {
+                        mutex_unlock(&group->notification_mutex);
+                        return ret;
+                }
+                event = group->overflow_event;
+                goto queue;
         }
 
         if (!list_empty(list) && merge) {
@@ -109,6 +114,7 @@ int fsnotify_add_notify_event(struct fsnotify_group *group,
                 }
         }
 
+queue:
         group->q_len++;
         list_add_tail(&event->list, list);
         mutex_unlock(&group->notification_mutex);
@@ -132,7 +138,11 @@ struct fsnotify_event *fsnotify_remove_notify_event(struct fsnotify_group *group
 
         event = list_first_entry(&group->notification_list,
                                  struct fsnotify_event, list);
-        list_del(&event->list);
+        /*
+         * We need to init list head for the case of overflow event so that
+         * check in fsnotify_add_notify_events() works
+         */
+        list_del_init(&event->list);
         group->q_len--;
 
         return event;
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index aaa50611ec66..d7b5108789e2 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -717,6 +717,12 @@ static int ocfs2_release_dquot(struct dquot *dquot)
          */
         if (status < 0)
                 mlog_errno(status);
+        /*
+         * Clear dq_off so that we search for the structure in quota file next
+         * time we acquire it. The structure might be deleted and reallocated
+         * elsewhere by another node while our dquot structure is on freelist.
+         */
+        dquot->dq_off = 0;
         clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
 out_trans:
         ocfs2_commit_trans(osb, handle);
@@ -756,16 +762,17 @@ static int ocfs2_acquire_dquot(struct dquot *dquot)
         status = ocfs2_lock_global_qf(info, 1);
         if (status < 0)
                 goto out;
-        if (!test_bit(DQ_READ_B, &dquot->dq_flags)) {
-                status = ocfs2_qinfo_lock(info, 0);
-                if (status < 0)
-                        goto out_dq;
-                status = qtree_read_dquot(&info->dqi_gi, dquot);
-                ocfs2_qinfo_unlock(info, 0);
-                if (status < 0)
-                        goto out_dq;
-        }
-        set_bit(DQ_READ_B, &dquot->dq_flags);
+        status = ocfs2_qinfo_lock(info, 0);
+        if (status < 0)
+                goto out_dq;
+        /*
+         * We always want to read dquot structure from disk because we don't
+         * know what happened with it while it was on freelist.
+         */
+        status = qtree_read_dquot(&info->dqi_gi, dquot);
+        ocfs2_qinfo_unlock(info, 0);
+        if (status < 0)
+                goto out_dq;
 
         OCFS2_DQUOT(dquot)->dq_use_count++;
         OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace;
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 2e4344be3b96..2001862bf2b1 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -1303,10 +1303,6 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot)
         ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh);
 
 out:
-        /* Clear the read bit so that next time someone uses this
-         * dquot he reads fresh info from disk and allocates local
-         * dquot structure */
-        clear_bit(DQ_READ_B, &dquot->dq_flags);
         return status;
 }
 
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 02174a610315..e647c55275d9 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -121,9 +121,8 @@ u64 stable_page_flags(struct page *page)
          * just checks PG_head/PG_tail, so we need to check PageLRU/PageAnon
          * to make sure a given page is a thp, not a non-huge compound page.
          */
-        else if (PageTransCompound(page) &&
-                 (PageLRU(compound_trans_head(page)) ||
-                  PageAnon(compound_trans_head(page))))
+        else if (PageTransCompound(page) && (PageLRU(compound_head(page)) ||
+                                             PageAnon(compound_head(page))))
                 u |= 1 << KPF_THP;
 
         /*
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 831d49a4111f..cfc8dcc16043 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -581,9 +581,17 @@ int dquot_scan_active(struct super_block *sb,
                 dqstats_inc(DQST_LOOKUPS);
                 dqput(old_dquot);
                 old_dquot = dquot;
-                ret = fn(dquot, priv);
-                if (ret < 0)
-                        goto out;
+                /*
+                 * ->release_dquot() can be racing with us. Our reference
+                 * protects us from new calls to it so just wait for any
+                 * outstanding call and recheck the DQ_ACTIVE_B after that.
+                 */
+                wait_on_dquot(dquot);
+                if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+                        ret = fn(dquot, priv);
+                        if (ret < 0)
+                                goto out;
+                }
                 spin_lock(&dq_list_lock);
                 /* We are safe to continue now because our dquot could not
                  * be moved out of the inuse list while we hold the reference */
diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
index 2b7882b508db..9a3c68cf6026 100644
--- a/fs/reiserfs/do_balan.c
+++ b/fs/reiserfs/do_balan.c
@@ -324,23 +324,17 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                         switch (flag) {
                         case M_INSERT:  /* insert item into L[0] */
 
-                                if (item_pos == tb->lnum[0] - 1
-                                    && tb->lbytes != -1) {
+                                if (item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
                                         /* part of new item falls into L[0] */
                                         int new_item_len;
                                         int version;
 
-                                        ret_val =
-                                            leaf_shift_left(tb, tb->lnum[0] - 1,
-                                                            -1);
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0] - 1, -1);
 
                                         /* Calculate item length to insert to S[0] */
-                                        new_item_len =
-                                            ih_item_len(ih) - tb->lbytes;
+                                        new_item_len = ih_item_len(ih) - tb->lbytes;
                                         /* Calculate and check item length to insert to L[0] */
-                                        put_ih_item_len(ih,
-                                                        ih_item_len(ih) -
-                                                        new_item_len);
+                                        put_ih_item_len(ih, ih_item_len(ih) - new_item_len);
 
                                         RFALSE(ih_item_len(ih) <= 0,
                                                "PAP-12080: there is nothing to insert into L[0]: ih_item_len=%d",
@@ -349,30 +343,18 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         /* Insert new item into L[0] */
                                         buffer_info_init_left(tb, &bi);
                                         leaf_insert_into_buf(&bi,
-                                                             n + item_pos -
-                                                             ret_val, ih, body,
-                                                             zeros_num >
-                                                             ih_item_len(ih) ?
-                                                             ih_item_len(ih) :
-                                                             zeros_num);
+                                                        n + item_pos - ret_val, ih, body,
+                                                        zeros_num > ih_item_len(ih) ? ih_item_len(ih) : zeros_num);
 
                                         version = ih_version(ih);
 
                                         /* Calculate key component, item length and body to insert into S[0] */
-                                        set_le_ih_k_offset(ih,
-                                                           le_ih_k_offset(ih) +
-                                                           (tb->
-                                                            lbytes <<
-                                                            (is_indirect_le_ih
-                                                             (ih) ? tb->tb_sb->
-                                                             s_blocksize_bits -
-                                                             UNFM_P_SHIFT :
-                                                             0)));
+                                        set_le_ih_k_offset(ih, le_ih_k_offset(ih) +
+                                                        (tb-> lbytes << (is_indirect_le_ih(ih) ? tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT : 0)));
 
                                         put_ih_item_len(ih, new_item_len);
                                         if (tb->lbytes > zeros_num) {
-                                                body +=
-                                                    (tb->lbytes - zeros_num);
+                                                body += (tb->lbytes - zeros_num);
                                                 zeros_num = 0;
                                         } else
                                                 zeros_num -= tb->lbytes;
@@ -383,15 +365,10 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                 } else {
                                         /* new item in whole falls into L[0] */
                                         /* Shift lnum[0]-1 items to L[0] */
-                                        ret_val =
-                                            leaf_shift_left(tb, tb->lnum[0] - 1,
-                                                            tb->lbytes);
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0] - 1, tb->lbytes);
                                         /* Insert new item into L[0] */
                                         buffer_info_init_left(tb, &bi);
-                                        leaf_insert_into_buf(&bi,
-                                                             n + item_pos -
-                                                             ret_val, ih, body,
-                                                             zeros_num);
+                                        leaf_insert_into_buf(&bi, n + item_pos - ret_val, ih, body, zeros_num);
                                         tb->insert_size[0] = 0;
                                         zeros_num = 0;
                                 }
@@ -399,264 +376,117 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                         case M_PASTE:   /* append item in L[0] */
 
-                                if (item_pos == tb->lnum[0] - 1
-                                    && tb->lbytes != -1) {
+                                if (item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
                                         /* we must shift the part of the appended item */
-                                        if (is_direntry_le_ih
-                                            (B_N_PITEM_HEAD(tbS0, item_pos))) {
+                                        if (is_direntry_le_ih(B_N_PITEM_HEAD(tbS0, item_pos))) {
 
                                                 RFALSE(zeros_num,
                                                        "PAP-12090: invalid parameter in case of a directory");
                                                 /* directory item */
                                                 if (tb->lbytes > pos_in_item) {
                                                         /* new directory entry falls into L[0] */
-                                                        struct item_head
-                                                            *pasted;
-                                                        int l_pos_in_item =
-                                                            pos_in_item;
+                                                        struct item_head *pasted;
+                                                        int l_pos_in_item = pos_in_item;
 
                                                         /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 entries from given directory item */
-                                                        ret_val =
-                                                            leaf_shift_left(tb,
-                                                                            tb->
-                                                                            lnum
-                                                                            [0],
-                                                                            tb->
-                                                                            lbytes
-                                                                            -
-                                                                            1);
-                                                        if (ret_val
-                                                            && !item_pos) {
-                                                                pasted =
-                                                                    B_N_PITEM_HEAD
-                                                                    (tb->L[0],
-                                                                     B_NR_ITEMS
-                                                                     (tb->
-                                                                      L[0]) -
-                                                                     1);
-                                                                l_pos_in_item +=
-                                                                    I_ENTRY_COUNT
-                                                                    (pasted) -
-                                                                    (tb->
-                                                                     lbytes -
-                                                                     1);
+                                                        ret_val = leaf_shift_left(tb, tb->lnum[0], tb->lbytes-1);
+                                                        if (ret_val && !item_pos) {
+                                                                pasted = B_N_PITEM_HEAD(tb->L[0], B_NR_ITEMS(tb->L[0]) - 1);
+                                                                l_pos_in_item += I_ENTRY_COUNT(pasted) - (tb->lbytes -1);
                                                         }
 
                                                         /* Append given directory entry to directory item */
                                                         buffer_info_init_left(tb, &bi);
-                                                        leaf_paste_in_buffer
-                                                            (&bi,
-                                                             n + item_pos -
-                                                             ret_val,
-                                                             l_pos_in_item,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
+                                                        leaf_paste_in_buffer(&bi, n + item_pos - ret_val, l_pos_in_item, tb->insert_size[0], body, zeros_num);
 
                                                         /* previous string prepared space for pasting new entry, following string pastes this entry */
 
                                                         /* when we have merge directory item, pos_in_item has been changed too */
 
                                                         /* paste new directory entry. 1 is entry number */
-                                                        leaf_paste_entries(&bi,
-                                                                           n +
-                                                                           item_pos
-                                                                           -
-                                                                           ret_val,
-                                                                           l_pos_in_item,
-                                                                           1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
+                                                        leaf_paste_entries(&bi, n + item_pos - ret_val, l_pos_in_item,
+                                                                           1, (struct reiserfs_de_head *) body,
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
                                                         tb->insert_size[0] = 0;
                                                 } else {
                                                         /* new directory item doesn't fall into L[0] */
                                                         /* Shift lnum[0]-1 items in whole. Shift lbytes directory entries from directory item number lnum[0] */
-                                                        leaf_shift_left(tb,
-                                                                        tb->
-                                                                        lnum[0],
-                                                                        tb->
-                                                                        lbytes);
+                                                        leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
                                                 }
                                                 /* Calculate new position to append in item body */
                                                 pos_in_item -= tb->lbytes;
                                         } else {
                                                 /* regular object */
-                                                RFALSE(tb->lbytes <= 0,
-                                                       "PAP-12095: there is nothing to shift to L[0]. lbytes=%d",
-                                                       tb->lbytes);
-                                                RFALSE(pos_in_item !=
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
+                                                RFALSE(tb->lbytes <= 0, "PAP-12095: there is nothing to shift to L[0]. lbytes=%d", tb->lbytes);
+                                                RFALSE(pos_in_item != ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)),
                                                        "PAP-12100: incorrect position to paste: item_len=%d, pos_in_item=%d",
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
-                                                       pos_in_item);
+                                                       ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)),pos_in_item);
 
                                                 if (tb->lbytes >= pos_in_item) {
                                                         /* appended item will be in L[0] in whole */
                                                         int l_n;
 
                                                         /* this bytes number must be appended to the last item of L[h] */
-                                                        l_n =
-                                                            tb->lbytes -
-                                                            pos_in_item;
+                                                        l_n = tb->lbytes - pos_in_item;
 
                                                         /* Calculate new insert_size[0] */
-                                                        tb->insert_size[0] -=
-                                                            l_n;
+                                                        tb->insert_size[0] -= l_n;
 
-                                                        RFALSE(tb->
-                                                               insert_size[0] <=
-                                                               0,
+                                                        RFALSE(tb->insert_size[0] <= 0,
                                                                "PAP-12105: there is nothing to paste into L[0]. insert_size=%d",
-                                                               tb->
-                                                               insert_size[0]);
-                                                        ret_val =
-                                                            leaf_shift_left(tb,
-                                                                            tb->
-                                                                            lnum
-                                                                            [0],
-                                                                            ih_item_len
-                                                                            (B_N_PITEM_HEAD
-                                                                             (tbS0,
-                                                                              item_pos)));
+                                                               tb->insert_size[0]);
+                                                        ret_val = leaf_shift_left(tb, tb->lnum[0], ih_item_len
+                                                                            (B_N_PITEM_HEAD(tbS0, item_pos)));
                                                         /* Append to body of item in L[0] */
                                                         buffer_info_init_left(tb, &bi);
                                                         leaf_paste_in_buffer
-                                                            (&bi,
-                                                             n + item_pos -
-                                                             ret_val,
-                                                             ih_item_len
-                                                             (B_N_PITEM_HEAD
-                                                              (tb->L[0],
-                                                               n + item_pos -
-                                                               ret_val)), l_n,
-                                                             body,
-                                                             zeros_num >
-                                                             l_n ? l_n :
-                                                             zeros_num);
+                                                            (&bi, n + item_pos - ret_val, ih_item_len
+                                                             (B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val)),
+                                                             l_n, body,
+                                                             zeros_num > l_n ? l_n : zeros_num);
                                                         /* 0-th item in S0 can be only of DIRECT type when l_n != 0 */
                                                         {
                                                                 int version;
-                                                                int temp_l =
-                                                                    l_n;
-
-                                                                RFALSE
-                                                                    (ih_item_len
-                                                                     (B_N_PITEM_HEAD
-                                                                      (tbS0,
-                                                                       0)),
+                                                                int temp_l = l_n;
+
+                                                                RFALSE(ih_item_len(B_N_PITEM_HEAD(tbS0, 0)),
                                                                      "PAP-12106: item length must be 0");
-                                                                RFALSE
-                                                                    (comp_short_le_keys
-                                                                     (B_N_PKEY
-                                                                      (tbS0, 0),
-                                                                      B_N_PKEY
-                                                                      (tb->L[0],
-                                                                       n +
-                                                                       item_pos
-                                                                       -
-                                                                       ret_val)),
+                                                                RFALSE(comp_short_le_keys(B_N_PKEY(tbS0, 0), B_N_PKEY
+                                                                      (tb->L[0], n + item_pos - ret_val)),
                                                                      "PAP-12107: items must be of the same file");
                                                                 if (is_indirect_le_ih(B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val))) {
-                                                                        temp_l =
-                                                                            l_n
-                                                                            <<
-                                                                            (tb->
-                                                                             tb_sb->
-                                                                             s_blocksize_bits
-                                                                             -
-                                                                             UNFM_P_SHIFT);
+                                                                        temp_l = l_n << (tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT);
                                                                 }
                                                                 /* update key of first item in S0 */
-                                                                version =
-                                                                    ih_version
-                                                                    (B_N_PITEM_HEAD
-                                                                     (tbS0, 0));
-                                                                set_le_key_k_offset
-                                                                    (version,
-                                                                     B_N_PKEY
-                                                                     (tbS0, 0),
-                                                                     le_key_k_offset
-                                                                     (version,
-                                                                      B_N_PKEY
-                                                                      (tbS0,
-                                                                       0)) +
-                                                                     temp_l);
+                                                                version = ih_version(B_N_PITEM_HEAD(tbS0, 0));
+                                                                set_le_key_k_offset(version, B_N_PKEY(tbS0, 0),
+                                                                     le_key_k_offset(version,B_N_PKEY(tbS0, 0)) + temp_l);
                                                                 /* update left delimiting key */
-                                                                set_le_key_k_offset
-                                                                    (version,
-                                                                     B_N_PDELIM_KEY
-                                                                     (tb->
-                                                                      CFL[0],
-                                                                      tb->
-                                                                      lkey[0]),
-                                                                     le_key_k_offset
-                                                                     (version,
-                                                                      B_N_PDELIM_KEY
-                                                                      (tb->
-                                                                       CFL[0],
-                                                                       tb->
-                                                                       lkey[0]))
-                                                                     + temp_l);
+                                                                set_le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0]),
+                                                                     le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0])) + temp_l);
                                                         }
 
                                                         /* Calculate new body, position in item and insert_size[0] */
                                                         if (l_n > zeros_num) {
-                                                                body +=
-                                                                    (l_n -
-                                                                     zeros_num);
+                                                                body += (l_n - zeros_num);
                                                                 zeros_num = 0;
                                                         } else
-                                                                zeros_num -=
-                                                                    l_n;
+                                                                zeros_num -= l_n;
                                                         pos_in_item = 0;
 
-                                                        RFALSE
-                                                            (comp_short_le_keys
-                                                             (B_N_PKEY(tbS0, 0),
-                                                              B_N_PKEY(tb->L[0],
-                                                                       B_NR_ITEMS
-                                                                       (tb->
-                                                                        L[0]) -
-                                                                       1))
-                                                             ||
-                                                             !op_is_left_mergeable
-                                                             (B_N_PKEY(tbS0, 0),
-                                                              tbS0->b_size)
-                                                             ||
-                                                             !op_is_left_mergeable
-                                                             (B_N_PDELIM_KEY
-                                                              (tb->CFL[0],
-                                                               tb->lkey[0]),
-                                                              tbS0->b_size),
+                                                        RFALSE(comp_short_le_keys(B_N_PKEY(tbS0, 0), B_N_PKEY(tb->L[0], B_NR_ITEMS(tb->L[0]) - 1))
+                                                             || !op_is_left_mergeable(B_N_PKEY(tbS0, 0), tbS0->b_size)
+                                                             || !op_is_left_mergeable(B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0]), tbS0->b_size),
                                                              "PAP-12120: item must be merge-able with left neighboring item");
                                                 } else {        /* only part of the appended item will be in L[0] */
 
                                                         /* Calculate position in item for append in S[0] */
-                                                        pos_in_item -=
-                                                            tb->lbytes;
+                                                        pos_in_item -= tb->lbytes;
 
-                                                        RFALSE(pos_in_item <= 0,
-                                                               "PAP-12125: no place for paste. pos_in_item=%d",
-                                                               pos_in_item);
+                                                        RFALSE(pos_in_item <= 0, "PAP-12125: no place for paste. pos_in_item=%d", pos_in_item);
 
                                                         /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 byte from item number lnum[0] */
-                                                        leaf_shift_left(tb,
-                                                                        tb->
-                                                                        lnum[0],
-                                                                        tb->
-                                                                        lbytes);
+                                                        leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
                                                 }
                                         }
                                 } else {        /* appended item will be in L[0] in whole */
@@ -665,52 +495,30 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         if (!item_pos && op_is_left_mergeable(B_N_PKEY(tbS0, 0), tbS0->b_size)) {       /* if we paste into first item of S[0] and it is left mergable */
                                                 /* then increment pos_in_item by the size of the last item in L[0] */
-                                                pasted =
-                                                    B_N_PITEM_HEAD(tb->L[0],
-                                                                   n - 1);
+                                                pasted = B_N_PITEM_HEAD(tb->L[0], n - 1);
                                                 if (is_direntry_le_ih(pasted))
-                                                        pos_in_item +=
-                                                            ih_entry_count
-                                                            (pasted);
+                                                        pos_in_item += ih_entry_count(pasted);
                                                 else
-                                                        pos_in_item +=
-                                                            ih_item_len(pasted);
+                                                        pos_in_item += ih_item_len(pasted);
                                         }
 
                                         /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 byte from item number lnum[0] */
-                                        ret_val =
-                                            leaf_shift_left(tb, tb->lnum[0],
-                                                            tb->lbytes);
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
                                         /* Append to body of item in L[0] */
                                         buffer_info_init_left(tb, &bi);
-                                        leaf_paste_in_buffer(&bi,
-                                                             n + item_pos -
-                                                             ret_val,
+                                        leaf_paste_in_buffer(&bi, n + item_pos - ret_val,
                                                              pos_in_item,
                                                              tb->insert_size[0],
                                                              body, zeros_num);
 
                                         /* if appended item is directory, paste entry */
-                                        pasted =
-                                            B_N_PITEM_HEAD(tb->L[0],
-                                                           n + item_pos -
-                                                           ret_val);
+                                        pasted = B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val);
                                         if (is_direntry_le_ih(pasted))
-                                                leaf_paste_entries(&bi,
-                                                                   n +
-                                                                   item_pos -
-                                                                   ret_val,
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
+                                                leaf_paste_entries(&bi, n + item_pos - ret_val,
+                                                                   pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *) body,
+                                                                   body + DEH_SIZE,
+                                                                   tb->insert_size[0]);
                                         /* if appended item is indirect item, put unformatted node into un list */
                                         if (is_indirect_le_ih(pasted))
                                                 set_ih_free_space(pasted, 0);
@@ -722,13 +530,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                 reiserfs_panic(tb->tb_sb, "PAP-12130",
                                                "lnum > 0: unexpected mode: "
                                                " %s(%d)",
-                                               (flag ==
-                                                M_DELETE) ? "DELETE" : ((flag ==
-                                                                         M_CUT)
-                                                                        ? "CUT"
-                                                                        :
-                                                                        "UNKNOWN"),
-                                               flag);
+                                               (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
                         }
                 } else {
                         /* new item doesn't fall into L[0] */
@@ -748,14 +550,12 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                 case M_INSERT:  /* insert item */
                         if (n - tb->rnum[0] < item_pos) {       /* new item or its part falls to R[0] */
                                 if (item_pos == n - tb->rnum[0] + 1 && tb->rbytes != -1) {      /* part of new item falls into R[0] */
-                                        loff_t old_key_comp, old_len,
-                                            r_zeros_number;
+                                        loff_t old_key_comp, old_len, r_zeros_number;
                                         const char *r_body;
                                         int version;
                                         loff_t offset;
 
-                                        leaf_shift_right(tb, tb->rnum[0] - 1,
-                                                         -1);
+                                        leaf_shift_right(tb, tb->rnum[0] - 1, -1);
 
                                         version = ih_version(ih);
                                         /* Remember key component and item length */
@@ -763,29 +563,17 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         old_len = ih_item_len(ih);
 
                                         /* Calculate key component and item length to insert into R[0] */
-                                        offset =
-                                            le_ih_k_offset(ih) +
-                                            ((old_len -
-                                              tb->
-                                              rbytes) << (is_indirect_le_ih(ih)
-                                                          ? tb->tb_sb->
-                                                          s_blocksize_bits -
-                                                          UNFM_P_SHIFT : 0));
+                                        offset = le_ih_k_offset(ih) + ((old_len - tb->rbytes) << (is_indirect_le_ih(ih) ? tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT : 0));
                                         set_le_ih_k_offset(ih, offset);
                                         put_ih_item_len(ih, tb->rbytes);
                                         /* Insert part of the item into R[0] */
                                         buffer_info_init_right(tb, &bi);
                                         if ((old_len - tb->rbytes) > zeros_num) {
                                                 r_zeros_number = 0;
-                                                r_body =
-                                                    body + (old_len -
-                                                            tb->rbytes) -
-                                                    zeros_num;
+                                                r_body = body + (old_len - tb->rbytes) - zeros_num;
                                         } else {
                                                 r_body = body;
-                                                r_zeros_number =
-                                                    zeros_num - (old_len -
-                                                                 tb->rbytes);
+                                                r_zeros_number = zeros_num - (old_len - tb->rbytes);
                                                 zeros_num -= r_zeros_number;
                                         }
 
@@ -798,25 +586,18 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         /* Calculate key component and item length to insert into S[0] */
                                         set_le_ih_k_offset(ih, old_key_comp);
-                                        put_ih_item_len(ih,
-                                                        old_len - tb->rbytes);
+                                        put_ih_item_len(ih, old_len - tb->rbytes);
 
                                         tb->insert_size[0] -= tb->rbytes;
 
                                 } else {        /* whole new item falls into R[0] */
 
                                         /* Shift rnum[0]-1 items to R[0] */
-                                        ret_val =
-                                            leaf_shift_right(tb,
-                                                             tb->rnum[0] - 1,
-                                                             tb->rbytes);
+                                        ret_val = leaf_shift_right(tb, tb->rnum[0] - 1, tb->rbytes);
                                         /* Insert new item into R[0] */
                                         buffer_info_init_right(tb, &bi);
-                                        leaf_insert_into_buf(&bi,
-                                                             item_pos - n +
-                                                             tb->rnum[0] - 1,
-                                                             ih, body,
-                                                             zeros_num);
+                                        leaf_insert_into_buf(&bi, item_pos - n + tb->rnum[0] - 1,
+                                                             ih, body, zeros_num);
 
                                         if (item_pos - n + tb->rnum[0] - 1 == 0) {
                                                 replace_key(tb, tb->CFR[0],
@@ -841,200 +622,97 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                                 RFALSE(zeros_num,
                                                        "PAP-12145: invalid parameter in case of a directory");
-                                                entry_count =
-                                                    I_ENTRY_COUNT(B_N_PITEM_HEAD
-                                                                  (tbS0,
-                                                                   item_pos));
+                                                entry_count = I_ENTRY_COUNT(B_N_PITEM_HEAD
+                                                                  (tbS0, item_pos));
                                                 if (entry_count - tb->rbytes <
                                                     pos_in_item)
                                                         /* new directory entry falls into R[0] */
                                                 {
                                                         int paste_entry_position;
 
-                                                        RFALSE(tb->rbytes - 1 >=
-                                                               entry_count
-                                                               || !tb->
-                                                               insert_size[0],
+                                                        RFALSE(tb->rbytes - 1 >= entry_count || !tb-> insert_size[0],
                                                                "PAP-12150: no enough of entries to shift to R[0]: rbytes=%d, entry_count=%d",
-                                                               tb->rbytes,
-                                                               entry_count);
+                                                               tb->rbytes, entry_count);
                                                         /* Shift rnum[0]-1 items in whole. Shift rbytes-1 directory entries from directory item number rnum[0] */
-                                                        leaf_shift_right(tb,
-                                                                         tb->
-                                                                         rnum
-                                                                         [0],
-                                                                         tb->
-                                                                         rbytes
-                                                                         - 1);
+                                                        leaf_shift_right(tb, tb->rnum[0], tb->rbytes - 1);
                                                         /* Paste given directory entry to directory item */
-                                                        paste_entry_position =
-                                                            pos_in_item -
-                                                            entry_count +
-                                                            tb->rbytes - 1;
+                                                        paste_entry_position = pos_in_item - entry_count + tb->rbytes - 1;
                                                         buffer_info_init_right(tb, &bi);
-                                                        leaf_paste_in_buffer
-                                                            (&bi, 0,
-                                                             paste_entry_position,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
+                                                        leaf_paste_in_buffer(&bi, 0, paste_entry_position, tb->insert_size[0], body, zeros_num);
                                                         /* paste entry */
-                                                        leaf_paste_entries(&bi,
-                                                                           0,
-                                                                           paste_entry_position,
-                                                                           1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
-
-                                                        if (paste_entry_position
-                                                            == 0) {
+                                                        leaf_paste_entries(&bi, 0, paste_entry_position, 1,
+                                                                           (struct reiserfs_de_head *) body,
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
+
+                                                        if (paste_entry_position == 0) {
                                                                 /* change delimiting keys */
-                                                                replace_key(tb,
-                                                                            tb->
-                                                                            CFR
-                                                                            [0],
-                                                                            tb->
-                                                                            rkey
-                                                                            [0],
-                                                                            tb->
-                                                                            R
-                                                                            [0],
-                                                                            0);
+                                                                replace_key(tb, tb->CFR[0], tb->rkey[0], tb->R[0],0);
                                                         }
 
                                                         tb->insert_size[0] = 0;
                                                         pos_in_item++;
                                                 } else {        /* new directory entry doesn't fall into R[0] */
 
-                                                        leaf_shift_right(tb,
-                                                                         tb->
-                                                                         rnum
-                                                                         [0],
-                                                                         tb->
-                                                                         rbytes);
+                                                        leaf_shift_right(tb, tb->rnum[0], tb->rbytes);
                                                 }
                                         } else {        /* regular object */
 
-                                                int n_shift, n_rem,
-                                                    r_zeros_number;
+                                                int n_shift, n_rem, r_zeros_number;
                                                 const char *r_body;
 
                                                 /* Calculate number of bytes which must be shifted from appended item */
-                                                if ((n_shift =
-                                                     tb->rbytes -
-                                                     tb->insert_size[0]) < 0)
+                                                if ((n_shift = tb->rbytes - tb->insert_size[0]) < 0)
                                                         n_shift = 0;
 
-                                                RFALSE(pos_in_item !=
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
+                                                RFALSE(pos_in_item != ih_item_len
+                                                       (B_N_PITEM_HEAD(tbS0, item_pos)),
                                                        "PAP-12155: invalid position to paste. ih_item_len=%d, pos_in_item=%d",
-                                                       pos_in_item,
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)));
-
-                                                leaf_shift_right(tb,
-                                                                 tb->rnum[0],
-                                                                 n_shift);
+                                                       pos_in_item, ih_item_len
+                                                       (B_N_PITEM_HEAD(tbS0, item_pos)));
+
+                                                leaf_shift_right(tb, tb->rnum[0], n_shift);
                                                 /* Calculate number of bytes which must remain in body after appending to R[0] */
-                                                if ((n_rem =
-                                                     tb->insert_size[0] -
-                                                     tb->rbytes) < 0)
+                                                if ((n_rem = tb->insert_size[0] - tb->rbytes) < 0)
                                                         n_rem = 0;
 
                                                 {
                                                         int version;
-                                                        unsigned long temp_rem =
-                                                            n_rem;
-
-                                                        version =
-                                                            ih_version
-                                                            (B_N_PITEM_HEAD
-                                                             (tb->R[0], 0));
-                                                        if (is_indirect_le_key
-                                                            (version,
-                                                             B_N_PKEY(tb->R[0],
-                                                                      0))) {
-                                                                temp_rem =
-                                                                    n_rem <<
-                                                                    (tb->tb_sb->
-                                                                     s_blocksize_bits
-                                                                     -
-                                                                     UNFM_P_SHIFT);
+                                                        unsigned long temp_rem = n_rem;
+
+                                                        version = ih_version(B_N_PITEM_HEAD(tb->R[0], 0));
+                                                        if (is_indirect_le_key(version, B_N_PKEY(tb->R[0], 0))) {
+                                                                temp_rem = n_rem << (tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT);
                                                         }
-                                                        set_le_key_k_offset
-                                                            (version,
-                                                             B_N_PKEY(tb->R[0],
-                                                                      0),
-                                                             le_key_k_offset
-                                                             (version,
-                                                              B_N_PKEY(tb->R[0],
-                                                                       0)) +
-                                                             temp_rem);
-                                                        set_le_key_k_offset
-                                                            (version,
-                                                             B_N_PDELIM_KEY(tb->
-                                                                            CFR
-                                                                            [0],
-                                                                            tb->
-                                                                            rkey
-                                                                            [0]),
-                                                             le_key_k_offset
-                                                             (version,
-                                                              B_N_PDELIM_KEY
-                                                              (tb->CFR[0],
-                                                               tb->rkey[0])) +
-                                                             temp_rem);
+                                                        set_le_key_k_offset(version, B_N_PKEY(tb->R[0], 0),
+                                                             le_key_k_offset(version, B_N_PKEY(tb->R[0], 0)) + temp_rem);
+                                                        set_le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFR[0], tb->rkey[0]),
+                                                             le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFR[0], tb->rkey[0])) + temp_rem);
                                                 }
 /*                k_offset (B_N_PKEY(tb->R[0],0)) += n_rem;
                   k_offset (B_N_PDELIM_KEY(tb->CFR[0],tb->rkey[0])) += n_rem;*/
-                                                do_balance_mark_internal_dirty
-                                                    (tb, tb->CFR[0], 0);
+                                                do_balance_mark_internal_dirty(tb, tb->CFR[0], 0);
 
                                                 /* Append part of body into R[0] */
                                                 buffer_info_init_right(tb, &bi);
                                                 if (n_rem > zeros_num) {
                                                         r_zeros_number = 0;
-                                                        r_body =
-                                                            body + n_rem -
-                                                            zeros_num;
+                                                        r_body = body + n_rem - zeros_num;
                                                 } else {
                                                         r_body = body;
-                                                        r_zeros_number =
-                                                            zeros_num - n_rem;
-                                                        zeros_num -=
-                                                            r_zeros_number;
+                                                        r_zeros_number = zeros_num - n_rem;
+                                                        zeros_num -= r_zeros_number;
                                                 }
 
-                                                leaf_paste_in_buffer(&bi, 0,
-                                                                     n_shift,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0] -
-                                                                     n_rem,
-                                                                     r_body,
-                                                                     r_zeros_number);
-
-                                                if (is_indirect_le_ih
-                                                    (B_N_PITEM_HEAD
-                                                     (tb->R[0], 0))) {
+                                                leaf_paste_in_buffer(&bi, 0, n_shift,
+                                                                     tb->insert_size[0] - n_rem,
+                                                                     r_body, r_zeros_number);
+
+                                                if (is_indirect_le_ih(B_N_PITEM_HEAD(tb->R[0], 0))) {
 #if 0
                                                         RFALSE(n_rem,
                                                                "PAP-12160: paste more than one unformatted node pointer");
 #endif
-                                                        set_ih_free_space
-                                                            (B_N_PITEM_HEAD
-                                                             (tb->R[0], 0), 0);
+                                                        set_ih_free_space(B_N_PITEM_HEAD(tb->R[0], 0), 0);
                                                 }
                                                 tb->insert_size[0] = n_rem;
                                                 if (!n_rem)
@@ -1044,58 +722,28 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         struct item_head *pasted;
 
-                                        ret_val =
-                                            leaf_shift_right(tb, tb->rnum[0],
-                                                             tb->rbytes);
+                                        ret_val = leaf_shift_right(tb, tb->rnum[0], tb->rbytes);
                                         /* append item in R[0] */
                                         if (pos_in_item >= 0) {
                                                 buffer_info_init_right(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
-                                                                     item_pos -
-                                                                     n +
-                                                                     tb->
-                                                                     rnum[0],
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
-                                                                     zeros_num);
+                                                leaf_paste_in_buffer(&bi, item_pos - n + tb->rnum[0], pos_in_item,
+                                                                     tb->insert_size[0], body, zeros_num);
                                         }
 
                                         /* paste new entry, if item is directory item */
-                                        pasted =
-                                            B_N_PITEM_HEAD(tb->R[0],
-                                                           item_pos - n +
-                                                           tb->rnum[0]);
-                                        if (is_direntry_le_ih(pasted)
-                                            && pos_in_item >= 0) {
-                                                leaf_paste_entries(&bi,
-                                                                   item_pos -
-                                                                   n +
-                                                                   tb->rnum[0],
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
+                                        pasted = B_N_PITEM_HEAD(tb->R[0], item_pos - n + tb->rnum[0]);
+                                        if (is_direntry_le_ih(pasted) && pos_in_item >= 0) {
+                                                leaf_paste_entries(&bi, item_pos - n + tb->rnum[0],
+                                                                   pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *) body,
+                                                                   body + DEH_SIZE, tb->insert_size[0]);
                                                 if (!pos_in_item) {
 
-                                                        RFALSE(item_pos - n +
-                                                               tb->rnum[0],
+                                                        RFALSE(item_pos - n + tb->rnum[0],
                                                                "PAP-12165: directory item must be first item of node when pasting is in 0th position");
 
                                                         /* update delimiting keys */
-                                                        replace_key(tb,
-                                                                    tb->CFR[0],
-                                                                    tb->rkey[0],
-                                                                    tb->R[0],
-                                                                    0);
+                                                        replace_key(tb, tb->CFR[0], tb->rkey[0], tb->R[0], 0);
                                                 }
                                         }
 
@@ -1111,22 +759,16 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                 default:        /* cases d and t */
                         reiserfs_panic(tb->tb_sb, "PAP-12175",
                                        "rnum > 0: unexpected mode: %s(%d)",
-                                       (flag ==
-                                        M_DELETE) ? "DELETE" : ((flag ==
-                                                                 M_CUT) ? "CUT"
-                                                                : "UNKNOWN"),
-                                       flag);
+                                       (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
                 }
 
         }
 
         /* tb->rnum[0] > 0 */
         RFALSE(tb->blknum[0] > 3,
-               "PAP-12180: blknum can not be %d. It must be <= 3",
-               tb->blknum[0]);
+               "PAP-12180: blknum can not be %d. It must be <= 3", tb->blknum[0]);
         RFALSE(tb->blknum[0] < 0,
-               "PAP-12185: blknum can not be %d. It must be >= 0",
-               tb->blknum[0]);
+               "PAP-12185: blknum can not be %d. It must be >= 0", tb->blknum[0]);
 
         /* if while adding to a node we discover that it is possible to split
            it in two, and merge the left part into the left neighbor and the
@@ -1177,8 +819,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                         if (n - snum[i] < item_pos) {   /* new item or it's part falls to first new node S_new[i] */
                                 if (item_pos == n - snum[i] + 1 && sbytes[i] != -1) {   /* part of new item falls into S_new[i] */
-                                        int old_key_comp, old_len,
-                                            r_zeros_number;
+                                        int old_key_comp, old_len, r_zeros_number;
                                         const char *r_body;
                                         int version;
 
@@ -1192,15 +833,8 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         old_len = ih_item_len(ih);
 
                                         /* Calculate key component and item length to insert into S_new[i] */
-                                        set_le_ih_k_offset(ih,
-                                                           le_ih_k_offset(ih) +
-                                                           ((old_len -
-                                                             sbytes[i]) <<
-                                                            (is_indirect_le_ih
-                                                             (ih) ? tb->tb_sb->
-                                                             s_blocksize_bits -
-                                                             UNFM_P_SHIFT :
-                                                             0)));
+                                        set_le_ih_k_offset(ih, le_ih_k_offset(ih) +
+                                                           ((old_len - sbytes[i]) << (is_indirect_le_ih(ih) ? tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT : 0)));
 
                                         put_ih_item_len(ih, sbytes[i]);
 
@@ -1209,39 +843,29 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                         if ((old_len - sbytes[i]) > zeros_num) {
                                                 r_zeros_number = 0;
-                                                r_body =
-                                                    body + (old_len -
-                                                            sbytes[i]) -
-                                                    zeros_num;
+                                                r_body = body + (old_len - sbytes[i]) - zeros_num;
                                         } else {
                                                 r_body = body;
-                                                r_zeros_number =
-                                                    zeros_num - (old_len -
-                                                                 sbytes[i]);
+                                                r_zeros_number = zeros_num - (old_len - sbytes[i]);
                                                 zeros_num -= r_zeros_number;
                                         }
 
-                                        leaf_insert_into_buf(&bi, 0, ih, r_body,
-                                                             r_zeros_number);
+                                        leaf_insert_into_buf(&bi, 0, ih, r_body, r_zeros_number);
 
                                         /* Calculate key component and item length to insert into S[i] */
                                         set_le_ih_k_offset(ih, old_key_comp);
-                                        put_ih_item_len(ih,
-                                                        old_len - sbytes[i]);
+                                        put_ih_item_len(ih, old_len - sbytes[i]);
                                         tb->insert_size[0] -= sbytes[i];
                                 } else {        /* whole new item falls into S_new[i] */
 
                                         /* Shift snum[0] - 1 items to S_new[i] (sbytes[i] of split item) */
                                         leaf_move_items(LEAF_FROM_S_TO_SNEW, tb,
-                                                        snum[i] - 1, sbytes[i],
-                                                        S_new[i]);
+                                                        snum[i] - 1, sbytes[i], S_new[i]);
 
                                         /* Insert new item into S_new[i] */
                                         buffer_info_init_bh(tb, &bi, S_new[i]);
-                                        leaf_insert_into_buf(&bi,
-                                                             item_pos - n +
-                                                             snum[i] - 1, ih,
-                                                             body, zeros_num);
+                                        leaf_insert_into_buf(&bi, item_pos - n + snum[i] - 1,
+                                                             ih, body, zeros_num);
 
                                         zeros_num = tb->insert_size[0] = 0;
                                 }
@@ -1268,150 +892,73 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
 
                                                 int entry_count;
 
-                                                entry_count =
-                                                    ih_entry_count(aux_ih);
+                                                entry_count = ih_entry_count(aux_ih);
 
-                                                if (entry_count - sbytes[i] <
-                                                    pos_in_item
-                                                    && pos_in_item <=
-                                                    entry_count) {
+                                                if (entry_count - sbytes[i] < pos_in_item && pos_in_item <= entry_count) {
                                                         /* new directory entry falls into S_new[i] */
 
-                                                        RFALSE(!tb->
-                                                               insert_size[0],
-                                                               "PAP-12215: insert_size is already 0");
-                                                        RFALSE(sbytes[i] - 1 >=
-                                                               entry_count,
+                                                        RFALSE(!tb->insert_size[0], "PAP-12215: insert_size is already 0");
+                                                        RFALSE(sbytes[i] - 1 >= entry_count,
                                                                "PAP-12220: there are no so much entries (%d), only %d",
-                                                               sbytes[i] - 1,
-                                                               entry_count);
+                                                               sbytes[i] - 1, entry_count);
 
                                                         /* Shift snum[i]-1 items in whole. Shift sbytes[i] directory entries from directory item number snum[i] */
-                                                        leaf_move_items
-                                                            (LEAF_FROM_S_TO_SNEW,
-                                                             tb, snum[i],
-                                                             sbytes[i] - 1,
-                                                             S_new[i]);
+                                                        leaf_move_items(LEAF_FROM_S_TO_SNEW, tb, snum[i], sbytes[i] - 1, S_new[i]);
                                                         /* Paste given directory entry to directory item */
                                                         buffer_info_init_bh(tb, &bi, S_new[i]);
-                                                        leaf_paste_in_buffer
-                                                            (&bi, 0,
-                                                             pos_in_item -
-                                                             entry_count +
-                                                             sbytes[i] - 1,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
+                                                        leaf_paste_in_buffer(&bi, 0, pos_in_item - entry_count + sbytes[i] - 1,
+                                                             tb->insert_size[0], body, zeros_num);
                                                         /* paste new directory entry */
-                                                        leaf_paste_entries(&bi,
-                                                                           0,
-                                                                           pos_in_item
-                                                                           -
-                                                                           entry_count
-                                                                           +
-                                                                           sbytes
-                                                                           [i] -
-                                                                           1, 1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
+                                                        leaf_paste_entries(&bi, 0, pos_in_item - entry_count + sbytes[i] - 1, 1,
+                                                                           (struct reiserfs_de_head *) body,
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
                                                         tb->insert_size[0] = 0;
                                                         pos_in_item++;
                                                 } else {        /* new directory entry doesn't fall into S_new[i] */
-                                                        leaf_move_items
-                                                            (LEAF_FROM_S_TO_SNEW,
-                                                             tb, snum[i],
-                                                             sbytes[i],
-                                                             S_new[i]);
+                                                        leaf_move_items(LEAF_FROM_S_TO_SNEW,tb, snum[i], sbytes[i], S_new[i]);
                                                 }
                                         } else {        /* regular object */
 
-                                                int n_shift, n_rem,
-                                                    r_zeros_number;
+                                                int n_shift, n_rem, r_zeros_number;
                                                 const char *r_body;
 
-                                                RFALSE(pos_in_item !=
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos))
-                                                       || tb->insert_size[0] <=
-                                                       0,
+                                                RFALSE(pos_in_item != ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)) || tb->insert_size[0] <= 0,
                                                        "PAP-12225: item too short or insert_size <= 0");
 
                                                 /* Calculate number of bytes which must be shifted from appended item */
-                                                n_shift =
-                                                    sbytes[i] -
-                                                    tb->insert_size[0];
+                                                n_shift = sbytes[i] - tb->insert_size[0];
                                                 if (n_shift < 0)
                                                         n_shift = 0;
-                                                leaf_move_items
-                                                    (LEAF_FROM_S_TO_SNEW, tb,
-                                                     snum[i], n_shift,
-                                                     S_new[i]);
+                                                leaf_move_items(LEAF_FROM_S_TO_SNEW, tb, snum[i], n_shift, S_new[i]);
 
                                                 /* Calculate number of bytes which must remain in body after append to S_new[i] */
-                                                n_rem =
-                                                    tb->insert_size[0] -
-                                                    sbytes[i];
+                                                n_rem = tb->insert_size[0] - sbytes[i];
                                                 if (n_rem < 0)
                                                         n_rem = 0;
                                                 /* Append part of body into S_new[0] */
                                                 buffer_info_init_bh(tb, &bi, S_new[i]);
                                                 if (n_rem > zeros_num) {
                                                         r_zeros_number = 0;
-                                                        r_body =
-                                                            body + n_rem -
-                                                            zeros_num;
+                                                        r_body = body + n_rem - zeros_num;
                                                 } else {
                                                         r_body = body;
-                                                        r_zeros_number =
-                                                            zeros_num - n_rem;
-                                                        zeros_num -=
-                                                            r_zeros_number;
+                                                        r_zeros_number = zeros_num - n_rem;
+                                                        zeros_num -= r_zeros_number;
                                                 }
 
-                                                leaf_paste_in_buffer(&bi, 0,
-                                                                     n_shift,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0] -
-                                                                     n_rem,
-                                                                     r_body,
-                                                                     r_zeros_number);
+                                                leaf_paste_in_buffer(&bi, 0, n_shift,
+                                                                     tb->insert_size[0] - n_rem,
+                                                                     r_body, r_zeros_number);
                                                 {
                                                         struct item_head *tmp;
 
-                                                        tmp =
-                                                            B_N_PITEM_HEAD(S_new
-                                                                           [i],
-                                                                           0);
+                                                        tmp = B_N_PITEM_HEAD(S_new[i], 0);
                                                         if (is_indirect_le_ih
                                                             (tmp)) {
-                                                                set_ih_free_space
-                                                                    (tmp, 0);
-                                                                set_le_ih_k_offset
-                                                                    (tmp,
-                                                                     le_ih_k_offset
-                                                                     (tmp) +
-                                                                     (n_rem <<
-                                                                      (tb->
-                                                                       tb_sb->
-                                                                       s_blocksize_bits
-                                                                       -
-                                                                       UNFM_P_SHIFT)));
+                                                                set_ih_free_space(tmp, 0);
+                                                                set_le_ih_k_offset(tmp, le_ih_k_offset(tmp) + (n_rem << (tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT)));
                                                         } else {
-                                                                set_le_ih_k_offset
-                                                                    (tmp,
-                                                                     le_ih_k_offset
-                                                                     (tmp) +
-                                                                     n_rem);
+                                                                set_le_ih_k_offset(tmp, le_ih_k_offset(tmp) + n_rem);
                                                         }
                                                 }
 
@@ -1426,8 +973,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         struct item_head *pasted;
 
 #ifdef CONFIG_REISERFS_CHECK
-                                        struct item_head *ih_check =
-                                            B_N_PITEM_HEAD(tbS0, item_pos);
+                                        struct item_head *ih_check = B_N_PITEM_HEAD(tbS0, item_pos);
 
                                         if (!is_direntry_le_ih(ih_check)
                                             && (pos_in_item != ih_item_len(ih_check)
@@ -1439,8 +985,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                              "to ih_item_len");
 #endif                          /* CONFIG_REISERFS_CHECK */
 
-                                        leaf_mi =
-                                            leaf_move_items(LEAF_FROM_S_TO_SNEW,
+                                        leaf_mi = leaf_move_items(LEAF_FROM_S_TO_SNEW,
                                                             tb, snum[i],
                                                             sbytes[i],
                                                             S_new[i]);
@@ -1452,30 +997,19 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         /* paste into item */
                                         buffer_info_init_bh(tb, &bi, S_new[i]);
                                         leaf_paste_in_buffer(&bi,
-                                                             item_pos - n +
-                                                             snum[i],
+                                                             item_pos - n + snum[i],
                                                              pos_in_item,
                                                              tb->insert_size[0],
                                                              body, zeros_num);
 
-                                        pasted =
-                                            B_N_PITEM_HEAD(S_new[i],
-                                                           item_pos - n +
-                                                           snum[i]);
+                                        pasted = B_N_PITEM_HEAD(S_new[i], item_pos - n + snum[i]);
                                         if (is_direntry_le_ih(pasted)) {
                                                 leaf_paste_entries(&bi,
-                                                                   item_pos -
-                                                                   n + snum[i],
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
+                                                                   item_pos - n + snum[i],
+                                                                   pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *)body,
+                                                                   body + DEH_SIZE,
+                                                                   tb->insert_size[0]
                                                     );
                                         }
 
@@ -1495,11 +1029,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                 default:        /* cases d and t */
                         reiserfs_panic(tb->tb_sb, "PAP-12245",
                                        "blknum > 2: unexpected mode: %s(%d)",
-                                       (flag ==
-                                        M_DELETE) ? "DELETE" : ((flag ==
-                                                                 M_CUT) ? "CUT"
-                                                                : "UNKNOWN"),
-                                       flag);
+                                       (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
                 }
 
                 memcpy(insert_key + i, B_N_PKEY(S_new[i], 0), KEY_SIZE);
@@ -1524,9 +1054,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                         /* If we insert the first key change the delimiting key */
                         if (item_pos == 0) {
                                 if (tb->CFL[0]) /* can be 0 in reiserfsck */
-                                        replace_key(tb, tb->CFL[0], tb->lkey[0],
-                                                    tbS0, 0);
-
+                                        replace_key(tb, tb->CFL[0], tb->lkey[0], tbS0, 0);
                         }
                         break;
 
@@ -1536,53 +1064,27 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                 pasted = B_N_PITEM_HEAD(tbS0, item_pos);
                                 /* when directory, may be new entry already pasted */
                                 if (is_direntry_le_ih(pasted)) {
-                                        if (pos_in_item >= 0 &&
-                                            pos_in_item <=
-                                            ih_entry_count(pasted)) {
+                                        if (pos_in_item >= 0 && pos_in_item <= ih_entry_count(pasted)) {
 
                                                 RFALSE(!tb->insert_size[0],
                                                        "PAP-12260: insert_size is 0 already");
 
                                                 /* prepare space */
                                                 buffer_info_init_tbS0(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
-                                                                     item_pos,
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
+                                                leaf_paste_in_buffer(&bi, item_pos, pos_in_item,
+                                                                     tb->insert_size[0], body,
                                                                      zeros_num);
 
                                                 /* paste entry */
-                                                leaf_paste_entries(&bi,
-                                                                   item_pos,
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
+                                                leaf_paste_entries(&bi, item_pos, pos_in_item, 1,
+                                                                   (struct reiserfs_de_head *)body,
+                                                                   body + DEH_SIZE,
+                                                                   tb->insert_size[0]);
                                                 if (!item_pos && !pos_in_item) {
-                                                        RFALSE(!tb->CFL[0]
-                                                               || !tb->L[0],
+                                                        RFALSE(!tb->CFL[0] || !tb->L[0],
                                                                "PAP-12270: CFL[0]/L[0] must be specified");
-                                                        if (tb->CFL[0]) {
-                                                                replace_key(tb,
-                                                                            tb->
-                                                                            CFL
-                                                                            [0],
-                                                                            tb->
-                                                                            lkey
-                                                                            [0],
-                                                                            tbS0,
-                                                                            0);
-
-                                                        }
+                                                        if (tb->CFL[0])
+                                                                replace_key(tb, tb->CFL[0], tb->lkey[0], tbS0, 0);
                                                 }
                                                 tb->insert_size[0] = 0;
                                         }
@@ -1593,13 +1095,8 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                        "PAP-12275: insert size must not be %d",
                                                        tb->insert_size[0]);
                                                 buffer_info_init_tbS0(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
-                                                                     item_pos,
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
-                                                                     zeros_num);
+                                                leaf_paste_in_buffer(&bi, item_pos, pos_in_item,
+                                                                     tb->insert_size[0], body, zeros_num);
 
                                                 if (is_indirect_le_ih(pasted)) {
 #if 0
@@ -1611,8 +1108,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                                tb->
                                                                insert_size[0]);
 #endif
-                                                        set_ih_free_space
-                                                            (pasted, 0);
+                                                        set_ih_free_space(pasted, 0);
                                                 }
                                                 tb->insert_size[0] = 0;
                                         }
@@ -1620,8 +1116,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                         else {
                                                 if (tb->insert_size[0]) {
                                                         print_cur_tb("12285");
-                                                        reiserfs_panic(tb->
-                                                                       tb_sb,
+                                                        reiserfs_panic(tb->tb_sb,
                                                             "PAP-12285",
                                                             "insert_size "
                                                             "must be 0 "
diff --git a/fs/sync.c b/fs/sync.c
index e8ba024a055b..b28d1dd10e8b 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -27,11 +27,10 @@
  * wait == 1 case since in that case write_inode() functions do
  * sync_dirty_buffer() and thus effectively write one block at a time.
  */
-static int __sync_filesystem(struct super_block *sb, int wait,
-                             unsigned long start)
+static int __sync_filesystem(struct super_block *sb, int wait)
 {
         if (wait)
-                sync_inodes_sb(sb, start);
+                sync_inodes_sb(sb);
         else
                 writeback_inodes_sb(sb, WB_REASON_SYNC);
 
@@ -48,7 +47,6 @@ static int __sync_filesystem(struct super_block *sb, int wait,
 int sync_filesystem(struct super_block *sb)
 {
         int ret;
-        unsigned long start = jiffies;
 
         /*
          * We need to be protected against the filesystem going from
@@ -62,17 +60,17 @@ int sync_filesystem(struct super_block *sb)
         if (sb->s_flags & MS_RDONLY)
                 return 0;
 
-        ret = __sync_filesystem(sb, 0, start);
+        ret = __sync_filesystem(sb, 0);
         if (ret < 0)
                 return ret;
-        return __sync_filesystem(sb, 1, start);
+        return __sync_filesystem(sb, 1);
 }
 EXPORT_SYMBOL_GPL(sync_filesystem);
 
 static void sync_inodes_one_sb(struct super_block *sb, void *arg)
 {
         if (!(sb->s_flags & MS_RDONLY))
-                sync_inodes_sb(sb, *((unsigned long *)arg));
+                sync_inodes_sb(sb);
 }
 
 static void sync_fs_one_sb(struct super_block *sb, void *arg)
@@ -104,10 +102,9 @@ static void fdatawait_one_bdev(struct block_device *bdev, void *arg)
 SYSCALL_DEFINE0(sync)
 {
         int nowait = 0, wait = 1;
-        unsigned long start = jiffies;
 
         wakeup_flusher_threads(0, WB_REASON_SYNC);
-        iterate_supers(sync_inodes_one_sb, &start);
+        iterate_supers(sync_inodes_one_sb, NULL);
         iterate_supers(sync_fs_one_sb, &nowait);
         iterate_supers(sync_fs_one_sb, &wait);
         iterate_bdevs(fdatawrite_one_bdev, NULL);
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 6211230814fd..3eaf5c6622eb 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -27,6 +27,7 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
 {
         struct dentry *root;
         void *ns;
+        bool new_sb;
 
         if (!(flags & MS_KERNMOUNT)) {
                 if (!capable(CAP_SYS_ADMIN) && !fs_fully_visible(fs_type))
@@ -37,8 +38,8 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
         }
 
         ns = kobj_ns_grab_current(KOBJ_NS_TYPE_NET);
-        root = kernfs_mount_ns(fs_type, flags, sysfs_root, ns);
-        if (IS_ERR(root))
+        root = kernfs_mount_ns(fs_type, flags, sysfs_root, &new_sb, ns);
+        if (IS_ERR(root) || !new_sb)
                 kobj_ns_drop(KOBJ_NS_TYPE_NET, ns);
         return root;
 }
diff --git a/fs/udf/file.c b/fs/udf/file.c
index c02a27a19c6d..1037637957c7 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -144,6 +144,7 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         size_t count = iocb->ki_nbytes;
         struct udf_inode_info *iinfo = UDF_I(inode);
 
+        mutex_lock(&inode->i_mutex);
         down_write(&iinfo->i_data_sem);
         if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
                 if (file->f_flags & O_APPEND)
@@ -156,6 +157,7 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                                                 pos + count)) {
                         err = udf_expand_file_adinicb(inode);
                         if (err) {
+                                mutex_unlock(&inode->i_mutex);
                                 udf_debug("udf_expand_adinicb: err=%d\n", err);
                                 return err;
                         }
@@ -169,9 +171,17 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         } else
                 up_write(&iinfo->i_data_sem);
 
-        retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
-        if (retval > 0)
+        retval = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
+        mutex_unlock(&inode->i_mutex);
+
+        if (retval > 0) {
+                ssize_t err;
+
                 mark_inode_dirty(inode);
+                err = generic_write_sync(file, iocb->ki_pos - retval, retval);
+                if (err < 0)
+                        retval = err;
+        }
 
         return retval;
 }
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 062b7925bca0..982ce05c87ed 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -265,6 +265,7 @@ int udf_expand_file_adinicb(struct inode *inode)
                 .nr_to_write = 1,
         };
 
+        WARN_ON_ONCE(!mutex_is_locked(&inode->i_mutex));
         if (!iinfo->i_lenAlloc) {
                 if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_SHORT_AD))
                         iinfo->i_alloc_type = ICBTAG_FLAG_AD_SHORT;
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index f35d5c953ff9..9ddfb8190ca1 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -705,7 +705,6 @@ xfs_setattr_size(
 {
         struct xfs_mount        *mp = ip->i_mount;
         struct inode            *inode = VFS_I(ip);
-        int                     mask = iattr->ia_valid;
         xfs_off_t               oldsize, newsize;
         struct xfs_trans        *tp;
         int                     error;
@@ -726,8 +725,8 @@ xfs_setattr_size(
 
         ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
         ASSERT(S_ISREG(ip->i_d.di_mode));
-        ASSERT((mask & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
-                        ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
+        ASSERT((iattr->ia_valid & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
+                ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
 
         oldsize = inode->i_size;
         newsize = iattr->ia_size;
@@ -736,7 +735,7 @@ xfs_setattr_size(
          * Short circuit the truncate case for zero length files.
          */
         if (newsize == 0 && oldsize == 0 && ip->i_d.di_nextents == 0) {
-                if (!(mask & (ATTR_CTIME|ATTR_MTIME)))
+                if (!(iattr->ia_valid & (ATTR_CTIME|ATTR_MTIME)))
                         return 0;
 
                 /*
@@ -824,10 +823,11 @@ xfs_setattr_size(
          * these flags set.  For all other operations the VFS set these flags
          * explicitly if it wants a timestamp update.
          */
-        if (newsize != oldsize && (!(mask & (ATTR_CTIME | ATTR_MTIME)))) {
+        if (newsize != oldsize &&
+            !(iattr->ia_valid & (ATTR_CTIME | ATTR_MTIME))) {
                 iattr->ia_ctime = iattr->ia_mtime =
                         current_fs_time(inode->i_sb);
-                mask |= ATTR_CTIME | ATTR_MTIME;
+                iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME;
         }
 
         /*
@@ -863,9 +863,9 @@ xfs_setattr_size(
                 xfs_inode_clear_eofblocks_tag(ip);
         }
 
-        if (mask & ATTR_MODE)
+        if (iattr->ia_valid & ATTR_MODE)
                 xfs_setattr_mode(ip, iattr);
-        if (mask & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
+        if (iattr->ia_valid & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
                 xfs_setattr_time(ip, iattr);
 
         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index cdebd832c3db..4ef6fdbced78 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -205,16 +205,25 @@ xlog_cil_insert_format_items(
                 /*
                  * We 64-bit align the length of each iovec so that the start
                  * of the next one is naturally aligned.  We'll need to
-                 * account for that slack space here.
+                 * account for that slack space here. Then round nbytes up
+                 * to 64-bit alignment so that the initial buffer alignment is
+                 * easy to calculate and verify.
                  */
                 nbytes += niovecs * sizeof(uint64_t);
+                nbytes = round_up(nbytes, sizeof(uint64_t));
 
                 /* grab the old item if it exists for reservation accounting */
                 old_lv = lip->li_lv;
 
-                /* calc buffer size */
-                buf_size = sizeof(struct xfs_log_vec) + nbytes +
-                                niovecs * sizeof(struct xfs_log_iovec);
+                /*
+                 * The data buffer needs to start 64-bit aligned, so round up
+                 * that space to ensure we can align it appropriately and not
+                 * overrun the buffer.
+                 */
+                buf_size = nbytes +
+                           round_up((sizeof(struct xfs_log_vec) +
+                                     niovecs * sizeof(struct xfs_log_iovec)),
+                                    sizeof(uint64_t));
 
                 /* compare to existing item size */
                 if (lip->li_lv && buf_size <= lip->li_lv->lv_size) {
@@ -251,6 +260,8 @@ xlog_cil_insert_format_items(
                 /* The allocated data region lies beyond the iovec region */
                 lv->lv_buf_len = 0;
                 lv->lv_buf = (char *)lv + buf_size - nbytes;
+                ASSERT(IS_ALIGNED((unsigned long)lv->lv_buf, sizeof(uint64_t)));
+
                 lip->li_ops->iop_format(lip, lv);
 insert:
                 ASSERT(lv->lv_buf_len <= nbytes);
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 02df7b408a26..f96c05669a9e 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -282,22 +282,29 @@ xfs_readsb(
         struct xfs_sb   *sbp = &mp->m_sb;
         int             error;
         int             loud = !(flags & XFS_MFSI_QUIET);
+        const struct xfs_buf_ops *buf_ops;
 
         ASSERT(mp->m_sb_bp == NULL);
         ASSERT(mp->m_ddev_targp != NULL);
 
         /*
+         * For the initial read, we must guess at the sector
+         * size based on the block device.  It's enough to
+         * get the sb_sectsize out of the superblock and
+         * then reread with the proper length.
+         * We don't verify it yet, because it may not be complete.
+         */
+        sector_size = xfs_getsize_buftarg(mp->m_ddev_targp);
+        buf_ops = NULL;
+
+        /*
          * Allocate a (locked) buffer to hold the superblock.
          * This will be kept around at all times to optimize
          * access to the superblock.
          */
-        sector_size = xfs_getsize_buftarg(mp->m_ddev_targp);
-
 reread:
         bp = xfs_buf_read_uncached(mp->m_ddev_targp, XFS_SB_DADDR,
-                                   BTOBB(sector_size), 0,
-                                   loud ? &xfs_sb_buf_ops
-                                        : &xfs_sb_quiet_buf_ops);
+                                   BTOBB(sector_size), 0, buf_ops);
         if (!bp) {
                 if (loud)
                         xfs_warn(mp, "SB buffer read failed");
@@ -328,12 +335,13 @@ reread:
         }
 
         /*
-         * If device sector size is smaller than the superblock size,
-         * re-read the superblock so the buffer is correctly sized.
+         * Re-read the superblock so the buffer is correctly sized,
+         * and properly verified.
          */
-        if (sector_size < sbp->sb_sectsize) {
+        if (buf_ops == NULL) {
                 xfs_buf_relse(bp);
                 sector_size = sbp->sb_sectsize;
+                buf_ops = loud ? &xfs_sb_buf_ops : &xfs_sb_quiet_buf_ops;
                 goto reread;
         }
 
diff --git a/fs/xfs/xfs_sb.c b/fs/xfs/xfs_sb.c
index b7c9aea77f8f..1e116794bb66 100644
--- a/fs/xfs/xfs_sb.c
+++ b/fs/xfs/xfs_sb.c
@@ -295,8 +295,7 @@ xfs_mount_validate_sb(
             sbp->sb_dblocks == 0                                        ||
             sbp->sb_dblocks > XFS_MAX_DBLOCKS(sbp)                      ||
             sbp->sb_dblocks < XFS_MIN_DBLOCKS(sbp))) {
-                XFS_CORRUPTION_ERROR("SB sanity check failed",
-                                XFS_ERRLEVEL_LOW, mp, sbp);
+                xfs_notice(mp, "SB sanity check failed");
                 return XFS_ERROR(EFSCORRUPTED);
         }
 
@@ -611,10 +610,10 @@ xfs_sb_read_verify(
                                                 XFS_SB_VERSION_5) ||
              dsb->sb_crc != 0)) {
 
-                if (!xfs_verify_cksum(bp->b_addr, be16_to_cpu(dsb->sb_sectsize),
+                if (!xfs_verify_cksum(bp->b_addr, BBTOB(bp->b_length),
                                       offsetof(struct xfs_sb, sb_crc))) {
                         /* Only fail bad secondaries on a known V5 filesystem */
-                        if (bp->b_bn != XFS_SB_DADDR &&
+                        if (bp->b_bn == XFS_SB_DADDR ||
                             xfs_sb_version_hascrc(&mp->m_sb)) {
                                 error = EFSCORRUPTED;
                                 goto out_error;
@@ -625,7 +624,7 @@ xfs_sb_read_verify(
 
 out_error:
         if (error) {
-                if (error != EWRONGFS)
+                if (error == EFSCORRUPTED)
                         XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW,
                                              mp, bp->b_addr);
                 xfs_buf_ioerror(bp, error);
@@ -644,7 +643,6 @@ xfs_sb_quiet_read_verify(
 {
         struct xfs_dsb  *dsb = XFS_BUF_TO_SBP(bp);
 
-
         if (dsb->sb_magicnum == cpu_to_be32(XFS_SB_MAGIC)) {
                 /* XFS filesystem, verify noisily! */
                 xfs_sb_read_verify(bp);
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index f317488263dd..d971f4932b5d 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -913,7 +913,7 @@ xfs_flush_inodes(
         struct super_block      *sb = mp->m_super;
 
         if (down_read_trylock(&sb->s_umount)) {
-                sync_inodes_sb(sb, jiffies);
+                sync_inodes_sb(sb);
                 up_read(&sb->s_umount);
         }
 }
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 8e4f41d9af4d..34c7bdc06014 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -701,6 +701,18 @@ static inline pte_t pte_mknuma(pte_t pte)
 }
 #endif
 
+#ifndef ptep_set_numa
+static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pte_t *ptep)
+{
+        pte_t ptent = *ptep;
+
+        ptent = pte_mknuma(ptent);
+        set_pte_at(mm, addr, ptep, ptent);
+        return;
+}
+#endif
+
 #ifndef pmd_mknuma
 static inline pmd_t pmd_mknuma(pmd_t pmd)
 {
@@ -708,6 +720,18 @@ static inline pmd_t pmd_mknuma(pmd_t pmd)
         return pmd_clear_flags(pmd, _PAGE_PRESENT);
 }
 #endif
+
+#ifndef pmdp_set_numa
+static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pmd_t *pmdp)
+{
+        pmd_t pmd = *pmdp;
+
+        pmd = pmd_mknuma(pmd);
+        set_pmd_at(mm, addr, pmdp, pmd);
+        return;
+}
+#endif
 #else
 extern int pte_numa(pte_t pte);
 extern int pmd_numa(pmd_t pmd);
@@ -715,6 +739,8 @@ extern pte_t pte_mknonnuma(pte_t pte);
 extern pmd_t pmd_mknonnuma(pmd_t pmd);
 extern pte_t pte_mknuma(pte_t pte);
 extern pmd_t pmd_mknuma(pmd_t pmd);
+extern void ptep_set_numa(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
+extern void pmdp_set_numa(struct mm_struct *mm, unsigned long addr, pmd_t *pmdp);
 #endif /* CONFIG_ARCH_USES_NUMA_PROT_NONE */
 #else
 static inline int pmd_numa(pmd_t pmd)
@@ -742,10 +768,23 @@ static inline pte_t pte_mknuma(pte_t pte)
         return pte;
 }
 
+static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pte_t *ptep)
+{
+        return;
+}
+
+
 static inline pmd_t pmd_mknuma(pmd_t pmd)
 {
         return pmd;
 }
+
+static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
+                                 pmd_t *pmdp)
+{
+        return ;
+}
 #endif /* CONFIG_NUMA_BALANCING */
 
 #endif /* CONFIG_MMU */
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 71727b6210ae..8f3dee097579 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -907,6 +907,9 @@ struct drm_mode_config {
 
         /* whether async page flip is supported or not */
         bool async_page_flip;
+
+        /* cursor size */
+        uint32_t cursor_width, cursor_height;
 };
 
 #define obj_to_crtc(x) container_of(x, struct drm_crtc, base)
diff --git a/include/drm/ttm/ttm_page_alloc.h b/include/drm/ttm/ttm_page_alloc.h
index d1f61bfe0ebe..49a828425fa2 100644
--- a/include/drm/ttm/ttm_page_alloc.h
+++ b/include/drm/ttm/ttm_page_alloc.h
@@ -29,6 +29,8 @@
 #include <drm/ttm/ttm_bo_driver.h>
 #include <drm/ttm/ttm_memory.h>
 
+struct device;
+
 /**
  * Initialize pool allocator.
  */
diff --git a/include/dt-bindings/clock/tegra124-car.h b/include/dt-bindings/clock/tegra124-car.h
index a1116a3b54ef..8c1603b10665 100644
--- a/include/dt-bindings/clock/tegra124-car.h
+++ b/include/dt-bindings/clock/tegra124-car.h
@@ -36,10 +36,10 @@
 #define TEGRA124_CLK_PWM 17
 #define TEGRA124_CLK_I2S2 18
 /* 20 (register bit affects vi and vi_sensor) */
-#define TEGRA124_CLK_GR_2D 21
+/* 21 */
 #define TEGRA124_CLK_USBD 22
 #define TEGRA124_CLK_ISP 23
-#define TEGRA124_CLK_GR_3D 24
+/* 26 */
 /* 25 */
 #define TEGRA124_CLK_DISP2 26
 #define TEGRA124_CLK_DISP1 27
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index 18ba8a627f46..2ff2e8d982be 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -121,8 +121,7 @@ void blk_mq_init_commands(struct request_queue *, void (*init)(void *data, struc
 
 void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule);
 
-void blk_mq_insert_request(struct request_queue *, struct request *,
-                bool, bool);
+void blk_mq_insert_request(struct request *, bool, bool, bool);
 void blk_mq_run_queues(struct request_queue *q, bool async);
 void blk_mq_free_request(struct request *rq);
 bool blk_mq_can_queue(struct blk_mq_hw_ctx *);
@@ -134,7 +133,13 @@ struct blk_mq_hw_ctx *blk_mq_map_queue(struct request_queue *, const int ctx_ind
 struct blk_mq_hw_ctx *blk_mq_alloc_single_hw_queue(struct blk_mq_reg *, unsigned int);
 void blk_mq_free_single_hw_queue(struct blk_mq_hw_ctx *, unsigned int);
 
-void blk_mq_end_io(struct request *rq, int error);
+bool blk_mq_end_io_partial(struct request *rq, int error,
+                unsigned int nr_bytes);
+static inline void blk_mq_end_io(struct request *rq, int error)
+{
+        bool done = !blk_mq_end_io_partial(rq, error, blk_rq_bytes(rq));
+        BUG_ON(!done);
+}
 
 void blk_mq_complete_request(struct request *rq);
 
diff --git a/include/linux/ceph/ceph_fs.h b/include/linux/ceph/ceph_fs.h
index 2623cffc73a1..25bfb0eff772 100644
--- a/include/linux/ceph/ceph_fs.h
+++ b/include/linux/ceph/ceph_fs.h
@@ -373,8 +373,9 @@ extern const char *ceph_mds_op_name(int op);
 /*
  * Ceph setxattr request flags.
  */
-#define CEPH_XATTR_CREATE  1
-#define CEPH_XATTR_REPLACE 2
+#define CEPH_XATTR_CREATE  (1 << 0)
+#define CEPH_XATTR_REPLACE (1 << 1)
+#define CEPH_XATTR_REMOVE  (1 << 31)
 
 union ceph_mds_request_args {
         struct {
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 5c097596104b..9450f025fe0c 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -166,6 +166,8 @@ struct cgroup {
          *
          * The ID of the root cgroup is always 0, and a new cgroup
          * will be assigned with a smallest available ID.
+         *
+         * Allocating/Removing ID must be protected by cgroup_mutex.
          */
         int id;
 
diff --git a/include/linux/clk/ti.h b/include/linux/clk/ti.h
index 092b64168d7f..4a21a872dbbd 100644
--- a/include/linux/clk/ti.h
+++ b/include/linux/clk/ti.h
@@ -245,6 +245,10 @@ long omap2_dpll_round_rate(struct clk_hw *hw, unsigned long target_rate,
 void omap2_init_clk_clkdm(struct clk_hw *clk);
 unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
                                     unsigned long parent_rate);
+int omap3_clkoutx2_set_rate(struct clk_hw *hw, unsigned long rate,
+                                        unsigned long parent_rate);
+long omap3_clkoutx2_round_rate(struct clk_hw *hw, unsigned long rate,
+                unsigned long *prate);
 int omap2_clkops_enable_clkdm(struct clk_hw *hw);
 void omap2_clkops_disable_clkdm(struct clk_hw *hw);
 int omap2_clk_disable_autoidle_all(void);
diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h
index dfac5ed31120..f886985a28b2 100644
--- a/include/linux/dma-buf.h
+++ b/include/linux/dma-buf.h
@@ -171,7 +171,7 @@ struct dma_buf *dma_buf_export_named(void *priv, const struct dma_buf_ops *ops,
                                size_t size, int flags, const char *);
 
 #define dma_buf_export(priv, ops, size, flags)  \
-        dma_buf_export_named(priv, ops, size, flags, __FILE__)
+        dma_buf_export_named(priv, ops, size, flags, KBUILD_MODNAME)
 
 int dma_buf_fd(struct dma_buf *dmabuf, int flags);
 struct dma_buf *dma_buf_get(int fd);
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 5d7782e42b8f..c3683bdf28fe 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -200,6 +200,7 @@ struct fw_device {
         unsigned irmc:1;
         unsigned bc_implemented:2;
 
+        work_func_t workfn;
         struct delayed_work work;
         struct fw_attribute_group attribute_group;
 };
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 3d286ff49ab0..64cf3ef50696 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -99,7 +99,7 @@ struct fsnotify_ops {
                             struct fsnotify_mark *inode_mark,
                             struct fsnotify_mark *vfsmount_mark,
                             u32 mask, void *data, int data_type,
-                            const unsigned char *file_name);
+                            const unsigned char *file_name, u32 cookie);
         void (*free_group_priv)(struct fsnotify_group *group);
         void (*freeing_mark)(struct fsnotify_mark *mark, struct fsnotify_group *group);
         void (*free_event)(struct fsnotify_event *event);
@@ -160,7 +160,7 @@ struct fsnotify_group {
 
         struct fasync_struct *fsn_fa;    /* async notification */
 
-        struct fsnotify_event overflow_event;   /* Event we queue when the
+        struct fsnotify_event *overflow_event;  /* Event we queue when the
                                                  * notification list is too
                                                  * full */
 
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index db512014e061..b826239bdce0 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -157,46 +157,6 @@ static inline int hpage_nr_pages(struct page *page)
                 return HPAGE_PMD_NR;
         return 1;
 }
-/*
- * compound_trans_head() should be used instead of compound_head(),
- * whenever the "page" passed as parameter could be the tail of a
- * transparent hugepage that could be undergoing a
- * __split_huge_page_refcount(). The page structure layout often
- * changes across releases and it makes extensive use of unions. So if
- * the page structure layout will change in a way that
- * page->first_page gets clobbered by __split_huge_page_refcount, the
- * implementation making use of smp_rmb() will be required.
- *
- * Currently we define compound_trans_head as compound_head, because
- * page->private is in the same union with page->first_page, and
- * page->private isn't clobbered. However this also means we're
- * currently leaving dirt into the page->private field of anonymous
- * pages resulting from a THP split, instead of setting page->private
- * to zero like for every other page that has PG_private not set. But
- * anonymous pages don't use page->private so this is not a problem.
- */
-#if 0
-/* This will be needed if page->private will be clobbered in split_huge_page */
-static inline struct page *compound_trans_head(struct page *page)
-{
-        if (PageTail(page)) {
-                struct page *head;
-                head = page->first_page;
-                smp_rmb();
-                /*
-                 * head may be a dangling pointer.
-                 * __split_huge_page_refcount clears PageTail before
-                 * overwriting first_page, so if PageTail is still
-                 * there it means the head pointer isn't dangling.
-                 */
-                if (PageTail(page))
-                        return head;
-        }
-        return page;
-}
-#else
-#define compound_trans_head(page) compound_head(page)
-#endif
 
 extern int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                 unsigned long addr, pmd_t pmd, pmd_t *pmdp);
@@ -226,7 +186,6 @@ static inline int split_huge_page(struct page *page)
         do { } while (0)
 #define split_huge_page_pmd_mm(__mm, __address, __pmd)  \
         do { } while (0)
-#define compound_trans_head(page) compound_head(page)
 static inline int hugepage_madvise(struct vm_area_struct *vma,
                                    unsigned long *vm_flags, int advice)
 {
diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
index e7831d203737..35e7eca4e33b 100644
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -118,9 +118,7 @@ extern int mq_init_ns(struct ipc_namespace *ns);
  *     the new maximum will handle anyone else.  I may have to revisit this
  *     in the future.
  */
-#define MIN_QUEUESMAX                   1
 #define DFLT_QUEUESMAX                256
-#define HARD_QUEUESMAX               1024
 #define MIN_MSGMAX                      1
 #define DFLT_MSG                       10U
 #define DFLT_MSGMAX                    10
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 7dc10036eff5..e675971bdc3f 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -303,6 +303,10 @@ static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
  * @irq_pm_shutdown:    function called from core code on shutdown once per chip
  * @irq_calc_mask:      Optional function to set irq_data.mask for special cases
  * @irq_print_chip:     optional to print special chip info in show_interrupts
+ * @irq_request_resources:      optional to request resources before calling
+ *                              any other callback related to this irq
+ * @irq_release_resources:      optional to release resources acquired with
+ *                              irq_request_resources
  * @flags:              chip specific flags
  */
 struct irq_chip {
@@ -336,6 +340,8 @@ struct irq_chip {
         void            (*irq_calc_mask)(struct irq_data *data);
 
         void            (*irq_print_chip)(struct irq_data *data, struct seq_file *p);
+        int             (*irq_request_resources)(struct irq_data *data);
+        void            (*irq_release_resources)(struct irq_data *data);
 
         unsigned long   flags;
 };
diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h
index 5be9f0228a3b..d267623c28cf 100644
--- a/include/linux/kernfs.h
+++ b/include/linux/kernfs.h
@@ -249,7 +249,8 @@ void kernfs_notify(struct kernfs_node *kn);
 
 const void *kernfs_super_ns(struct super_block *sb);
 struct dentry *kernfs_mount_ns(struct file_system_type *fs_type, int flags,
-                               struct kernfs_root *root, const void *ns);
+                               struct kernfs_root *root, bool *new_sb_created,
+                               const void *ns);
 void kernfs_kill_sb(struct super_block *sb);
 
 void kernfs_init(void);
@@ -317,7 +318,7 @@ static inline const void *kernfs_super_ns(struct super_block *sb)
 
 static inline struct dentry *
 kernfs_mount_ns(struct file_system_type *fs_type, int flags,
-                struct kernfs_root *root, const void *ns)
+                struct kernfs_root *root, bool *new_sb_created, const void *ns)
 { return ERR_PTR(-ENOSYS); }
 
 static inline void kernfs_kill_sb(struct super_block *sb) { }
@@ -368,9 +369,9 @@ static inline int kernfs_remove_by_name(struct kernfs_node *parent,
 
 static inline struct dentry *
 kernfs_mount(struct file_system_type *fs_type, int flags,
-             struct kernfs_root *root)
+             struct kernfs_root *root, bool *new_sb_created)
 {
-        return kernfs_mount_ns(fs_type, flags, root, NULL);
+        return kernfs_mount_ns(fs_type, flags, root, new_sb_created, NULL);
 }
 
 #endif  /* __LINUX_KERNFS_H */
diff --git a/include/linux/mfd/max8997-private.h b/include/linux/mfd/max8997-private.h
index ad1ae7f345ad..78c76cd4d37b 100644
--- a/include/linux/mfd/max8997-private.h
+++ b/include/linux/mfd/max8997-private.h
@@ -387,7 +387,7 @@ struct max8997_dev {
         struct i2c_client *muic; /* slave addr 0x4a */
         struct mutex iolock;
 
-        int type;
+        unsigned long type;
         struct platform_device *battery; /* battery control (not fuel gauge) */
 
         int irq;
diff --git a/include/linux/mfd/max8998-private.h b/include/linux/mfd/max8998-private.h
index 4ecb24b4b863..d68ada502ff3 100644
--- a/include/linux/mfd/max8998-private.h
+++ b/include/linux/mfd/max8998-private.h
@@ -163,7 +163,7 @@ struct max8998_dev {
         int ono;
         u8 irq_masks_cur[MAX8998_NUM_IRQ_REGS];
         u8 irq_masks_cache[MAX8998_NUM_IRQ_REGS];
-        int type;
+        unsigned long type;
         bool wakeup;
 };
 
diff --git a/include/linux/mfd/tps65217.h b/include/linux/mfd/tps65217.h
index a5a7f0130e96..54b5458ec084 100644
--- a/include/linux/mfd/tps65217.h
+++ b/include/linux/mfd/tps65217.h
@@ -252,7 +252,7 @@ struct tps65217_board {
 struct tps65217 {
         struct device *dev;
         struct tps65217_board *pdata;
-        unsigned int id;
+        unsigned long id;
         struct regulator_desc desc[TPS65217_NUM_REGULATOR];
         struct regulator_dev *rdev[TPS65217_NUM_REGULATOR];
         struct regmap *regmap;
@@ -263,7 +263,7 @@ static inline struct tps65217 *dev_to_tps65217(struct device *dev)
         return dev_get_drvdata(dev);
 }
 
-static inline int tps65217_chip_id(struct tps65217 *tps65217)
+static inline unsigned long tps65217_chip_id(struct tps65217 *tps65217)
 {
         return tps65217->id;
 }
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f28f46eade6a..c1b7414c7bef 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -175,7 +175,7 @@ extern unsigned int kobjsize(const void *objp);
  * Special vmas that are non-mergable, non-mlock()able.
  * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
  */
-#define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_PFNMAP)
+#define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_PFNMAP | VM_MIXEDMAP)
 
 /*
  * mapping from the currently active vm_flags protection bits (the
@@ -399,8 +399,18 @@ static inline void compound_unlock_irqrestore(struct page *page,
 
 static inline struct page *compound_head(struct page *page)
 {
-        if (unlikely(PageTail(page)))
-                return page->first_page;
+        if (unlikely(PageTail(page))) {
+                struct page *head = page->first_page;
+
+                /*
+                 * page->first_page may be a dangling pointer to an old
+                 * compound page, so recheck that it is still a tail
+                 * page before returning.
+                 */
+                smp_rmb();
+                if (likely(PageTail(page)))
+                        return head;
+        }
         return page;
 }
 
@@ -757,7 +767,7 @@ static inline bool __cpupid_match_pid(pid_t task_pid, int cpupid)
 #ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS
 static inline int page_cpupid_xchg_last(struct page *page, int cpupid)
 {
-        return xchg(&page->_last_cpupid, cpupid);
+        return xchg(&page->_last_cpupid, cpupid & LAST_CPUPID_MASK);
 }
 
 static inline int page_cpupid_last(struct page *page)
@@ -766,7 +776,7 @@ static inline int page_cpupid_last(struct page *page)
 }
 static inline void page_cpupid_reset_last(struct page *page)
 {
-        page->_last_cpupid = -1;
+        page->_last_cpupid = -1 & LAST_CPUPID_MASK;
 }
 #else
 static inline int page_cpupid_last(struct page *page)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 440a02ee6f92..e8eeebd49a98 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -752,6 +752,9 @@ struct netdev_phys_port_id {
         unsigned char id_len;
 };
 
+typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
+                                       struct sk_buff *skb);
+
 /*
  * This structure defines the management hooks for network devices.
  * The following hooks can be defined; unless noted otherwise, they are
@@ -783,7 +786,7 @@ struct netdev_phys_port_id {
  *      Required can not be NULL.
  *
  * u16 (*ndo_select_queue)(struct net_device *dev, struct sk_buff *skb,
- *                         void *accel_priv);
+ *                         void *accel_priv, select_queue_fallback_t fallback);
  *      Called to decide which queue to when device supports multiple
  *      transmit queues.
  *
@@ -1005,7 +1008,8 @@ struct net_device_ops {
                                                    struct net_device *dev);
         u16                     (*ndo_select_queue)(struct net_device *dev,
                                                     struct sk_buff *skb,
-                                                    void *accel_priv);
+                                                    void *accel_priv,
+                                                    select_queue_fallback_t fallback);
         void                    (*ndo_change_rx_flags)(struct net_device *dev,
                                                        int flags);
         void                    (*ndo_set_rx_mode)(struct net_device *dev);
@@ -1551,7 +1555,6 @@ static inline void netdev_for_each_tx_queue(struct net_device *dev,
 struct netdev_queue *netdev_pick_tx(struct net_device *dev,
                                     struct sk_buff *skb,
                                     void *accel_priv);
-u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb);
 
 /*
  * Net namespace inlines
@@ -2276,6 +2279,26 @@ static inline void netdev_reset_queue(struct net_device *dev_queue)
 }
 
 /**
+ *      netdev_cap_txqueue - check if selected tx queue exceeds device queues
+ *      @dev: network device
+ *      @queue_index: given tx queue index
+ *
+ *      Returns 0 if given tx queue index >= number of device tx queues,
+ *      otherwise returns the originally passed tx queue index.
+ */
+static inline u16 netdev_cap_txqueue(struct net_device *dev, u16 queue_index)
+{
+        if (unlikely(queue_index >= dev->real_num_tx_queues)) {
+                net_warn_ratelimited("%s selects TX queue %d, but real number of TX queues is %d\n",
+                                     dev->name, queue_index,
+                                     dev->real_num_tx_queues);
+                return 0;
+        }
+
+        return queue_index;
+}
+
+/**
  *      netif_running - test if up
  *      @dev: network device
  *
@@ -3068,7 +3091,12 @@ void netdev_change_features(struct net_device *dev);
 void netif_stacked_transfer_operstate(const struct net_device *rootdev,
                                         struct net_device *dev);
 
-netdev_features_t netif_skb_features(struct sk_buff *skb);
+netdev_features_t netif_skb_dev_features(struct sk_buff *skb,
+                                         const struct net_device *dev);
+static inline netdev_features_t netif_skb_features(struct sk_buff *skb)
+{
+        return netif_skb_dev_features(skb, skb->dev);
+}
 
 static inline bool net_gso_ok(netdev_features_t features, int gso_type)
 {
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index b2fb167b2e6d..5624e4e2763c 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -467,9 +467,14 @@ struct nfs_lockt_res {
 };
 
 struct nfs_release_lockowner_args {
+        struct nfs4_sequence_args       seq_args;
         struct nfs_lowner       lock_owner;
 };
 
+struct nfs_release_lockowner_res {
+        struct nfs4_sequence_res        seq_res;
+};
+
 struct nfs4_delegreturnargs {
         struct nfs4_sequence_args       seq_args;
         const struct nfs_fh *fhandle;
diff --git a/include/linux/pci.h b/include/linux/pci.h
index fb57c892b214..33aa2caf0f0c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1169,8 +1169,23 @@ void msi_remove_pci_irq_vectors(struct pci_dev *dev);
 void pci_restore_msi_state(struct pci_dev *dev);
 int pci_msi_enabled(void);
 int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec);
+static inline int pci_enable_msi_exact(struct pci_dev *dev, int nvec)
+{
+        int rc = pci_enable_msi_range(dev, nvec, nvec);
+        if (rc < 0)
+                return rc;
+        return 0;
+}
 int pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries,
                           int minvec, int maxvec);
+static inline int pci_enable_msix_exact(struct pci_dev *dev,
+                                        struct msix_entry *entries, int nvec)
+{
+        int rc = pci_enable_msix_range(dev, entries, nvec, nvec);
+        if (rc < 0)
+                return rc;
+        return 0;
+}
 #else
 static inline int pci_msi_vec_count(struct pci_dev *dev) { return -ENOSYS; }
 static inline int pci_enable_msi_block(struct pci_dev *dev, int nvec)
@@ -1189,9 +1204,14 @@ static inline int pci_msi_enabled(void) { return 0; }
 static inline int pci_enable_msi_range(struct pci_dev *dev, int minvec,
                                        int maxvec)
 { return -ENOSYS; }
+static inline int pci_enable_msi_exact(struct pci_dev *dev, int nvec)
+{ return -ENOSYS; }
 static inline int pci_enable_msix_range(struct pci_dev *dev,
                       struct msix_entry *entries, int minvec, int maxvec)
 { return -ENOSYS; }
+static inline int pci_enable_msix_exact(struct pci_dev *dev,
+                      struct msix_entry *entries, int nvec)
+{ return -ENOSYS; }
 #endif
 
 #ifdef CONFIG_PCIEPORTBUS
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index f589c9af8cbf..5e1e6f2d98c2 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2725,7 +2725,7 @@ static inline void nf_reset(struct sk_buff *skb)
 
 static inline void nf_reset_trace(struct sk_buff *skb)
 {
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)
         skb->nf_trace = 0;
 #endif
 }
@@ -2742,6 +2742,9 @@ static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src)
         dst->nf_bridge  = src->nf_bridge;
         nf_bridge_get(src->nf_bridge);
 #endif
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)
+        dst->nf_trace = src->nf_trace;
+#endif
 }
 
 static inline void nf_copy(struct sk_buff *dst, const struct sk_buff *src)
@@ -2916,5 +2919,22 @@ static inline bool skb_head_is_locked(const struct sk_buff *skb)
 {
         return !skb->head_frag || skb_cloned(skb);
 }
+
+/**
+ * skb_gso_network_seglen - Return length of individual segments of a gso packet
+ *
+ * @skb: GSO skb
+ *
+ * skb_gso_network_seglen is used to determine the real size of the
+ * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP).
+ *
+ * The MAC/L2 header is not accounted for.
+ */
+static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) -
+                               skb_network_header(skb);
+        return hdr_len + skb_gso_transport_seglen(skb);
+}
 #endif  /* __KERNEL__ */
 #endif  /* _LINUX_SKBUFF_H */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 40ed9e9a77e5..a747a77ea584 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -281,13 +281,15 @@ asmlinkage long sys_sched_setscheduler(pid_t pid, int policy,
 asmlinkage long sys_sched_setparam(pid_t pid,
                                         struct sched_param __user *param);
 asmlinkage long sys_sched_setattr(pid_t pid,
-                                        struct sched_attr __user *attr);
+                                        struct sched_attr __user *attr,
+                                        unsigned int flags);
 asmlinkage long sys_sched_getscheduler(pid_t pid);
 asmlinkage long sys_sched_getparam(pid_t pid,
                                         struct sched_param __user *param);
 asmlinkage long sys_sched_getattr(pid_t pid,
                                         struct sched_attr __user *attr,
-                                        unsigned int size);
+                                        unsigned int size,
+                                        unsigned int flags);
 asmlinkage long sys_sched_setaffinity(pid_t pid, unsigned int len,
                                         unsigned long __user *user_mask_ptr);
 asmlinkage long sys_sched_getaffinity(pid_t pid, unsigned int len,
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index accc497f8d72..7159a0a933df 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -60,6 +60,12 @@ struct tp_module {
         unsigned int num_tracepoints;
         struct tracepoint * const *tracepoints_ptrs;
 };
+bool trace_module_has_bad_taint(struct module *mod);
+#else
+static inline bool trace_module_has_bad_taint(struct module *mod)
+{
+        return false;
+}
 #endif /* CONFIG_MODULES */
 
 struct tracepoint_iter {
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 594521ba0d43..704f4f652d0a 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -419,10 +419,7 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active,
         static struct lock_class_key __key;                             \
         const char *__lock_name;                                        \
                                                                         \
-        if (__builtin_constant_p(fmt))                                  \
-                __lock_name = (fmt);                                    \
-        else                                                            \
-                __lock_name = #fmt;                                     \
+        __lock_name = #fmt#args;                                        \
                                                                         \
         __alloc_workqueue_key((fmt), (flags), (max_active),             \
                               &__key, __lock_name, ##args);             \
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index fc0e4320aa6d..021b8a319b9e 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -97,7 +97,7 @@ void writeback_inodes_sb_nr(struct super_block *, unsigned long nr,
 int try_to_writeback_inodes_sb(struct super_block *, enum wb_reason reason);
 int try_to_writeback_inodes_sb_nr(struct super_block *, unsigned long nr,
                                   enum wb_reason reason);
-void sync_inodes_sb(struct super_block *sb, unsigned long older_than_this);
+void sync_inodes_sb(struct super_block *);
 void wakeup_flusher_threads(long nr_pages, enum wb_reason reason);
 void inode_wait_for_writeback(struct inode *inode);
 
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 48ed75c21260..e77c10405d51 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -129,6 +129,7 @@ int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[],
 int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
                       struct ip_tunnel_parm *p);
 void ip_tunnel_setup(struct net_device *dev, int net_id);
+void ip_tunnel_dst_reset_all(struct ip_tunnel *t);
 
 /* Extract dsfield from inner protocol */
 static inline u8 ip_tunnel_get_dsfield(const struct iphdr *iph,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index d992ca3145fe..6ee76c804893 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1653,17 +1653,6 @@ struct sctp_association {
         /* This is the last advertised value of rwnd over a SACK chunk. */
         __u32 a_rwnd;
 
-        /* Number of bytes by which the rwnd has slopped.  The rwnd is allowed
-         * to slop over a maximum of the association's frag_point.
-         */
-        __u32 rwnd_over;
-
-        /* Keeps treack of rwnd pressure.  This happens when we have
-         * a window, but not recevie buffer (i.e small packets).  This one
-         * is releases slowly (1 PMTU at a time ).
-         */
-        __u32 rwnd_press;
-
         /* This is the sndbuf size in use for the association.
          * This corresponds to the sndbuf size for the association,
          * as specified in the sk->sndbuf.
@@ -1892,8 +1881,7 @@ void sctp_assoc_update(struct sctp_association *old,
 __u32 sctp_association_get_next_tsn(struct sctp_association *);
 
 void sctp_assoc_sync_pmtu(struct sock *, struct sctp_association *);
-void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
-void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
+void sctp_assoc_rwnd_update(struct sctp_association *, bool);
 void sctp_assoc_set_primary(struct sctp_association *,
                             struct sctp_transport *);
 void sctp_assoc_del_nonprimary_peers(struct sctp_association *,
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 56fc366da6d5..8c4dd63134d4 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1303,7 +1303,8 @@ struct tcp_fastopen_request {
         /* Fast Open cookie. Size 0 means a cookie request */
         struct tcp_fastopen_cookie      cookie;
         struct msghdr                   *data;  /* data in MSG_FASTOPEN */
-        u16                             copied; /* queued in tcp_connect() */
+        size_t                          size;
+        int                             copied; /* queued in tcp_connect() */
 };
 void tcp_free_fastopen_req(struct tcp_sock *tp);
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index afa5730fb3bd..fb5654a8ca3c 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1648,6 +1648,11 @@ static inline int xfrm_aevent_is_on(struct net *net)
 }
 #endif
 
+static inline int aead_len(struct xfrm_algo_aead *alg)
+{
+        return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
+}
+
 static inline int xfrm_alg_len(const struct xfrm_algo *alg)
 {
         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
@@ -1686,6 +1691,12 @@ static inline int xfrm_replay_clone(struct xfrm_state *x,
         return 0;
 }
 
+static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
+{
+        return kmemdup(orig, aead_len(orig), GFP_KERNEL);
+}
+
+
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {
         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
index 68d92e36facd..6e89ef6c11c1 100644
--- a/include/sound/soc-dapm.h
+++ b/include/sound/soc-dapm.h
@@ -449,14 +449,22 @@ void snd_soc_dapm_debugfs_init(struct snd_soc_dapm_context *dapm,
 /* dapm audio pin control and status */
 int snd_soc_dapm_enable_pin(struct snd_soc_dapm_context *dapm,
                             const char *pin);
+int snd_soc_dapm_enable_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                                     const char *pin);
 int snd_soc_dapm_disable_pin(struct snd_soc_dapm_context *dapm,
                              const char *pin);
+int snd_soc_dapm_disable_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                                      const char *pin);
 int snd_soc_dapm_nc_pin(struct snd_soc_dapm_context *dapm, const char *pin);
+int snd_soc_dapm_nc_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                                 const char *pin);
 int snd_soc_dapm_get_pin_status(struct snd_soc_dapm_context *dapm,
                                 const char *pin);
 int snd_soc_dapm_sync(struct snd_soc_dapm_context *dapm);
 int snd_soc_dapm_force_enable_pin(struct snd_soc_dapm_context *dapm,
                                   const char *pin);
+int snd_soc_dapm_force_enable_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                                           const char *pin);
 int snd_soc_dapm_ignore_suspend(struct snd_soc_dapm_context *dapm,
                                 const char *pin);
 void snd_soc_dapm_auto_nc_codec_pins(struct snd_soc_codec *codec);
diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h
index ae5a17111968..4483fadfa68d 100644
--- a/include/target/iscsi/iscsi_transport.h
+++ b/include/target/iscsi/iscsi_transport.h
@@ -12,6 +12,7 @@ struct iscsit_transport {
         int (*iscsit_setup_np)(struct iscsi_np *, struct __kernel_sockaddr_storage *);
         int (*iscsit_accept_np)(struct iscsi_np *, struct iscsi_conn *);
         void (*iscsit_free_np)(struct iscsi_np *);
+        void (*iscsit_wait_conn)(struct iscsi_conn *);
         void (*iscsit_free_conn)(struct iscsi_conn *);
         int (*iscsit_get_login_rx)(struct iscsi_conn *, struct iscsi_login *);
         int (*iscsit_put_login_tx)(struct iscsi_conn *, struct iscsi_login *, u32);
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index ddc179b7a105..1fef3e6e9436 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -83,7 +83,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
                 ),
 
         TP_fast_assign(
-                __entry->client_id = clnt->cl_clid;
+                __entry->client_id = clnt ? clnt->cl_clid : -1;
                 __entry->task_id = task->tk_pid;
                 __entry->action = action;
                 __entry->runstate = task->tk_runstate;
@@ -91,7 +91,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
                 __entry->flags = task->tk_flags;
                 ),
 
-        TP_printk("task:%u@%u flags=%4.4x state=%4.4lx status=%d action=%pf",
+        TP_printk("task:%u@%d flags=%4.4x state=%4.4lx status=%d action=%pf",
                 __entry->task_id, __entry->client_id,
                 __entry->flags,
                 __entry->runstate,
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index c7bbbe794e65..464ea82e10db 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -287,11 +287,11 @@ TRACE_EVENT(writeback_queue_io,
                 __field(int,            reason)
         ),
         TP_fast_assign(
-                unsigned long older_than_this = work->older_than_this;
+                unsigned long *older_than_this = work->older_than_this;
                 strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
-                __entry->older  = older_than_this;
+                __entry->older  = older_than_this ?  *older_than_this : 0;
                 __entry->age    = older_than_this ?
-                                  (jiffies - older_than_this) * 1000 / HZ : -1;
+                                  (jiffies - *older_than_this) * 1000 / HZ : -1;
                 __entry->moved  = moved;
                 __entry->reason = work->reason;
         ),
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index a20a9b4d3871..dde8041f40d2 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -692,9 +692,13 @@ __SC_COMP(__NR_process_vm_writev, sys_process_vm_writev, \
 __SYSCALL(__NR_kcmp, sys_kcmp)
 #define __NR_finit_module 273
 __SYSCALL(__NR_finit_module, sys_finit_module)
+#define __NR_sched_setattr 274
+__SYSCALL(__NR_sched_setattr, sys_sched_setattr)
+#define __NR_sched_getattr 275
+__SYSCALL(__NR_sched_getattr, sys_sched_getattr)
 
 #undef __NR_syscalls
-#define __NR_syscalls 274
+#define __NR_syscalls 276
 
 /*
  * All syscalls below here should go away really,
diff --git a/include/uapi/drm/drm.h b/include/uapi/drm/drm.h
index 3c9a833992e8..b06c8ed68707 100644
--- a/include/uapi/drm/drm.h
+++ b/include/uapi/drm/drm.h
@@ -619,6 +619,8 @@ struct drm_gem_open {
 #define  DRM_PRIME_CAP_EXPORT           0x2
 #define DRM_CAP_TIMESTAMP_MONOTONIC     0x6
 #define DRM_CAP_ASYNC_PAGE_FLIP         0x7
+#define DRM_CAP_CURSOR_WIDTH            0x8
+#define DRM_CAP_CURSOR_HEIGHT           0x9
 
 /** DRM_IOCTL_GET_CAP ioctl argument type */
 struct drm_get_cap {
diff --git a/include/uapi/drm/vmwgfx_drm.h b/include/uapi/drm/vmwgfx_drm.h
index 9971c560ed9a..87792a5fee3b 100644
--- a/include/uapi/drm/vmwgfx_drm.h
+++ b/include/uapi/drm/vmwgfx_drm.h
@@ -87,6 +87,7 @@
 #define DRM_VMW_PARAM_MAX_SURF_MEMORY  7
 #define DRM_VMW_PARAM_3D_CAPS_SIZE     8
 #define DRM_VMW_PARAM_MAX_MOB_MEMORY   9
+#define DRM_VMW_PARAM_MAX_MOB_SIZE     10
 
 /**
  * struct drm_vmw_getparam_arg
diff --git a/ipc/mq_sysctl.c b/ipc/mq_sysctl.c
index 383d638340b8..5bb8bfe67149 100644
--- a/ipc/mq_sysctl.c
+++ b/ipc/mq_sysctl.c
@@ -22,6 +22,16 @@ static void *get_mq(ctl_table *table)
         return which;
 }
 
+static int proc_mq_dointvec(ctl_table *table, int write,
+                            void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        struct ctl_table mq_table;
+        memcpy(&mq_table, table, sizeof(mq_table));
+        mq_table.data = get_mq(table);
+
+        return proc_dointvec(&mq_table, write, buffer, lenp, ppos);
+}
+
 static int proc_mq_dointvec_minmax(ctl_table *table, int write,
         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -33,12 +43,10 @@ static int proc_mq_dointvec_minmax(ctl_table *table, int write,
                                         lenp, ppos);
 }
 #else
+#define proc_mq_dointvec NULL
 #define proc_mq_dointvec_minmax NULL
 #endif
 
-static int msg_queues_limit_min = MIN_QUEUESMAX;
-static int msg_queues_limit_max = HARD_QUEUESMAX;
-
 static int msg_max_limit_min = MIN_MSGMAX;
 static int msg_max_limit_max = HARD_MSGMAX;
 
@@ -51,9 +59,7 @@ static ctl_table mq_sysctls[] = {
                 .data           = &init_ipc_ns.mq_queues_max,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_mq_dointvec_minmax,
-                .extra1         = &msg_queues_limit_min,
-                .extra2         = &msg_queues_limit_max,
+                .proc_handler   = proc_mq_dointvec,
         },
         {
                 .procname       = "msg_max",
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index ccf1f9fd263a..c3b31179122c 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -433,9 +433,9 @@ static int mqueue_create(struct inode *dir, struct dentry *dentry,
                 error = -EACCES;
                 goto out_unlock;
         }
-        if (ipc_ns->mq_queues_count >= HARD_QUEUESMAX ||
-            (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
-             !capable(CAP_SYS_RESOURCE))) {
+
+        if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
+            !capable(CAP_SYS_RESOURCE)) {
                 error = -ENOSPC;
                 goto out_unlock;
         }
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 67ccf0e7cca9..135944a7b28a 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -916,7 +916,7 @@ static int audit_tree_handle_event(struct fsnotify_group *group,
                                    struct fsnotify_mark *inode_mark,
                                    struct fsnotify_mark *vfsmount_mark,
                                    u32 mask, void *data, int data_type,
-                                   const unsigned char *file_name)
+                                   const unsigned char *file_name, u32 cookie)
 {
         return 0;
 }
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 2596fac5dcb4..70b4554d2fbe 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -471,7 +471,7 @@ static int audit_watch_handle_event(struct fsnotify_group *group,
                                     struct fsnotify_mark *inode_mark,
                                     struct fsnotify_mark *vfsmount_mark,
                                     u32 mask, void *data, int data_type,
-                                    const unsigned char *dname)
+                                    const unsigned char *dname, u32 cookie)
 {
         struct inode *inode;
         struct audit_parent *parent;
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index e2f46ba37f72..105f273b6f86 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -886,7 +886,9 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                  * per-subsystem and moved to css->id so that lookups are
                  * successful until the target css is released.
                  */
+                mutex_lock(&cgroup_mutex);
                 idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+                mutex_unlock(&cgroup_mutex);
                 cgrp->id = -1;
 
                 call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
@@ -1566,10 +1568,10 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                 mutex_lock(&cgroup_mutex);
                 mutex_lock(&cgroup_root_mutex);
 
-                root_cgrp->id = idr_alloc(&root->cgroup_idr, root_cgrp,
-                                           0, 1, GFP_KERNEL);
-                if (root_cgrp->id < 0)
+                ret = idr_alloc(&root->cgroup_idr, root_cgrp, 0, 1, GFP_KERNEL);
+                if (ret < 0)
                         goto unlock_drop;
+                root_cgrp->id = ret;
 
                 /* Check for name clashes with existing mounts */
                 ret = -EBUSY;
@@ -2763,10 +2765,7 @@ static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
          */
         update_before = cgroup_serial_nr_next;
 
-        mutex_unlock(&cgroup_mutex);
-
         /* add/rm files for all cgroups created before */
-        rcu_read_lock();
         css_for_each_descendant_pre(css, cgroup_css(root, ss)) {
                 struct cgroup *cgrp = css->cgroup;
 
@@ -2775,23 +2774,19 @@ static int cgroup_cfts_commit(struct cftype *cfts, bool is_add)
 
                 inode = cgrp->dentry->d_inode;
                 dget(cgrp->dentry);
-                rcu_read_unlock();
-
                 dput(prev);
                 prev = cgrp->dentry;
 
+                mutex_unlock(&cgroup_mutex);
                 mutex_lock(&inode->i_mutex);
                 mutex_lock(&cgroup_mutex);
                 if (cgrp->serial_nr < update_before && !cgroup_is_dead(cgrp))
                         ret = cgroup_addrm_files(cgrp, cfts, is_add);
-                mutex_unlock(&cgroup_mutex);
                 mutex_unlock(&inode->i_mutex);
-
-                rcu_read_lock();
                 if (ret)
                         break;
         }
-        rcu_read_unlock();
+        mutex_unlock(&cgroup_mutex);
         dput(prev);
         deactivate_super(sb);
         return ret;
@@ -2910,9 +2905,14 @@ static void cgroup_enable_task_cg_lists(void)
                  * We should check if the process is exiting, otherwise
                  * it will race with cgroup_exit() in that the list
                  * entry won't be deleted though the process has exited.
+                 * Do it while holding siglock so that we don't end up
+                 * racing against cgroup_exit().
                  */
+                spin_lock_irq(&p->sighand->siglock);
                 if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
                         list_add(&p->cg_list, &task_css_set(p)->tasks);
+                spin_unlock_irq(&p->sighand->siglock);
+
                 task_unlock(p);
         } while_each_thread(g, p);
         read_unlock(&tasklist_lock);
@@ -4158,7 +4158,7 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         struct cgroup *cgrp;
         struct cgroup_name *name;
         struct cgroupfs_root *root = parent->root;
-        int ssid, err = 0;
+        int ssid, err;
         struct cgroup_subsys *ss;
         struct super_block *sb = root->sb;
 
@@ -4168,19 +4168,13 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                 return -ENOMEM;
 
         name = cgroup_alloc_name(dentry);
-        if (!name)
+        if (!name) {
+                err = -ENOMEM;
                 goto err_free_cgrp;
+        }
         rcu_assign_pointer(cgrp->name, name);
 
         /*
-         * Temporarily set the pointer to NULL, so idr_find() won't return
-         * a half-baked cgroup.
-         */
-        cgrp->id = idr_alloc(&root->cgroup_idr, NULL, 1, 0, GFP_KERNEL);
-        if (cgrp->id < 0)
-                goto err_free_name;
-
-        /*
          * Only live parents can have children.  Note that the liveliness
          * check isn't strictly necessary because cgroup_mkdir() and
          * cgroup_rmdir() are fully synchronized by i_mutex; however, do it
@@ -4189,7 +4183,17 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         if (!cgroup_lock_live_group(parent)) {
                 err = -ENODEV;
-                goto err_free_id;
+                goto err_free_name;
+        }
+
+        /*
+         * Temporarily set the pointer to NULL, so idr_find() won't return
+         * a half-baked cgroup.
+         */
+        cgrp->id = idr_alloc(&root->cgroup_idr, NULL, 1, 0, GFP_KERNEL);
+        if (cgrp->id < 0) {
+                err = -ENOMEM;
+                goto err_unlock;
         }
 
         /* Grab a reference on the superblock so the hierarchy doesn't
@@ -4221,7 +4225,7 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         err = cgroup_create_file(dentry, S_IFDIR | mode, sb);
         if (err < 0)
-                goto err_unlock;
+                goto err_free_id;
         lockdep_assert_held(&dentry->d_inode->i_mutex);
 
         cgrp->serial_nr = cgroup_serial_nr_next++;
@@ -4257,12 +4261,12 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
 
         return 0;
 
-err_unlock:
-        mutex_unlock(&cgroup_mutex);
-        /* Release the reference count that we took on the superblock */
-        deactivate_super(sb);
 err_free_id:
         idr_remove(&root->cgroup_idr, cgrp->id);
+        /* Release the reference count that we took on the superblock */
+        deactivate_super(sb);
+err_unlock:
+        mutex_unlock(&cgroup_mutex);
 err_free_name:
         kfree(rcu_dereference_raw(cgrp->name));
 err_free_cgrp:
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 4410ac6a55f1..e6b1b66afe52 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -974,12 +974,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
  *    Temporarilly set tasks mems_allowed to target nodes of migration,
  *    so that the migration code can allocate pages on these nodes.
  *
- *    Call holding cpuset_mutex, so current's cpuset won't change
- *    during this call, as manage_mutex holds off any cpuset_attach()
- *    calls.  Therefore we don't need to take task_lock around the
- *    call to guarantee_online_mems(), as we know no one is changing
- *    our task's cpuset.
- *
  *    While the mm_struct we are migrating is typically from some
  *    other task, the task_struct mems_allowed that we are hacking
  *    is for our current task, which must allocate new pages for that
@@ -996,8 +990,10 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
 
         do_migrate_pages(mm, from, to, MPOL_MF_MOVE_ALL);
 
+        rcu_read_lock();
         mems_cs = effective_nodemask_cpuset(task_cs(tsk));
         guarantee_online_mems(mems_cs, &tsk->mems_allowed);
+        rcu_read_unlock();
 }
 
 /*
@@ -2486,9 +2482,9 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
 
         task_lock(current);
         cs = nearest_hardwall_ancestor(task_cs(current));
+        allowed = node_isset(node, cs->mems_allowed);
         task_unlock(current);
 
-        allowed = node_isset(node, cs->mems_allowed);
         mutex_unlock(&callback_mutex);
         return allowed;
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 56003c6edfd3..fa0b2d4ad83c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7856,14 +7856,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu)
 static void __perf_event_exit_context(void *__info)
 {
         struct perf_event_context *ctx = __info;
-        struct perf_event *event, *tmp;
+        struct perf_event *event;
 
         perf_pmu_rotate_stop(ctx->pmu);
 
-        list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry)
-                __perf_remove_from_context(event);
-        list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry)
+        rcu_read_lock();
+        list_for_each_entry_rcu(event, &ctx->event_list, event_entry)
                 __perf_remove_from_context(event);
+        rcu_read_unlock();
 }
 
 static void perf_event_exit_cpu_context(int cpu)
@@ -7887,11 +7887,11 @@ static void perf_event_exit_cpu(int cpu)
 {
         struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 
+        perf_event_exit_cpu_context(cpu);
+
         mutex_lock(&swhash->hlist_mutex);
         swevent_hlist_release(swhash);
         mutex_unlock(&swhash->hlist_mutex);
-
-        perf_event_exit_cpu_context(cpu);
 }
 #else
 static inline void perf_event_exit_cpu(int cpu) { }
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index cf68bb36fe58..f14033700c25 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -10,6 +10,7 @@
 #include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_irq.h>
 #include <linux/topology.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index ada0c548c36a..de1a8ed29b40 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -832,8 +832,7 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
 
 static void wake_threads_waitq(struct irq_desc *desc)
 {
-        if (atomic_dec_and_test(&desc->threads_active) &&
-            waitqueue_active(&desc->wait_for_threads))
+        if (atomic_dec_and_test(&desc->threads_active))
                 wake_up(&desc->wait_for_threads);
 }
 
@@ -954,6 +953,23 @@ static void irq_setup_forced_threading(struct irqaction *new)
         }
 }
 
+static int irq_request_resources(struct irq_desc *desc)
+{
+        struct irq_data *d = &desc->irq_data;
+        struct irq_chip *c = d->chip;
+
+        return c->irq_request_resources ? c->irq_request_resources(d) : 0;
+}
+
+static void irq_release_resources(struct irq_desc *desc)
+{
+        struct irq_data *d = &desc->irq_data;
+        struct irq_chip *c = d->chip;
+
+        if (c->irq_release_resources)
+                c->irq_release_resources(d);
+}
+
 /*
  * Internal function to register an irqaction - typically used to
  * allocate special interrupts that are part of the architecture.
@@ -1149,6 +1165,13 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
         }
 
         if (!shared) {
+                ret = irq_request_resources(desc);
+                if (ret) {
+                        pr_err("Failed to request resources for %s (irq %d) on irqchip %s\n",
+                               new->name, irq, desc->irq_data.chip->name);
+                        goto out_mask;
+                }
+
                 init_waitqueue_head(&desc->wait_for_threads);
 
                 /* Setup the type (level, edge polarity) if configured: */
@@ -1319,8 +1342,10 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
         *action_ptr = action->next;
 
         /* If this was the last handler, shut down the IRQ line: */
-        if (!desc->action)
+        if (!desc->action) {
                 irq_shutdown(desc);
+                irq_release_resources(desc);
+        }
 
 #ifdef CONFIG_SMP
         /* make sure affinity_hint is cleaned up */
diff --git a/kernel/power/console.c b/kernel/power/console.c
index eacb8bd8cab4..aba9c545a0e3 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -9,6 +9,7 @@
 #include <linux/kbd_kern.h>
 #include <linux/vt.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include "power.h"
 
 #define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index b1d255f04135..4dae9cbe9259 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1076,7 +1076,6 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 next_seq = log_next_seq;
 
                 len = 0;
-                prev = 0;
                 while (len >= 0 && seq < next_seq) {
                         struct printk_log *msg = log_from_idx(idx);
                         int textlen;
@@ -2788,7 +2787,6 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         next_idx = idx;
 
         l = 0;
-        prev = 0;
         while (seq < dumper->next_seq) {
                 struct printk_log *msg = log_from_idx(idx);
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b46131ef6aab..6edbef296ece 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1952,7 +1952,7 @@ static int dl_overflow(struct task_struct *p, int policy,
 {
 
         struct dl_bw *dl_b = dl_bw_of(task_cpu(p));
-        u64 period = attr->sched_period;
+        u64 period = attr->sched_period ?: attr->sched_deadline;
         u64 runtime = attr->sched_runtime;
         u64 new_bw = dl_policy(policy) ? to_ratio(period, runtime) : 0;
         int cpus, err = -1;
@@ -3661,13 +3661,14 @@ SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
  * @pid: the pid in question.
  * @uattr: structure containing the extended parameters.
  */
-SYSCALL_DEFINE2(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr)
+SYSCALL_DEFINE3(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr,
+                               unsigned int, flags)
 {
         struct sched_attr attr;
         struct task_struct *p;
         int retval;
 
-        if (!uattr || pid < 0)
+        if (!uattr || pid < 0 || flags)
                 return -EINVAL;
 
         if (sched_copy_attr(uattr, &attr))
@@ -3786,7 +3787,7 @@ static int sched_read_attr(struct sched_attr __user *uattr,
                 attr->size = usize;
         }
 
-        ret = copy_to_user(uattr, attr, usize);
+        ret = copy_to_user(uattr, attr, attr->size);
         if (ret)
                 return -EFAULT;
 
@@ -3804,8 +3805,8 @@ err_size:
  * @uattr: structure containing the extended parameters.
  * @size: sizeof(attr) for fwd/bwd comp.
  */
-SYSCALL_DEFINE3(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
-                unsigned int, size)
+SYSCALL_DEFINE4(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
+                unsigned int, size, unsigned int, flags)
 {
         struct sched_attr attr = {
                 .size = sizeof(struct sched_attr),
@@ -3814,7 +3815,7 @@ SYSCALL_DEFINE3(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
         int retval;
 
         if (!uattr || pid < 0 || size > PAGE_SIZE ||
-            size < SCHED_ATTR_SIZE_VER0)
+            size < SCHED_ATTR_SIZE_VER0 || flags)
                 return -EINVAL;
 
         rcu_read_lock();
@@ -7422,6 +7423,7 @@ static int sched_dl_global_constraints(void)
         u64 period = global_rt_period();
         u64 new_bw = to_ratio(period, runtime);
         int cpu, ret = 0;
+        unsigned long flags;
 
         /*
          * Here we want to check the bandwidth not being set to some
@@ -7435,10 +7437,10 @@ static int sched_dl_global_constraints(void)
         for_each_possible_cpu(cpu) {
                 struct dl_bw *dl_b = dl_bw_of(cpu);
 
-                raw_spin_lock(&dl_b->lock);
+                raw_spin_lock_irqsave(&dl_b->lock, flags);
                 if (new_bw < dl_b->total_bw)
                         ret = -EBUSY;
-                raw_spin_unlock(&dl_b->lock);
+                raw_spin_unlock_irqrestore(&dl_b->lock, flags);
 
                 if (ret)
                         break;
@@ -7451,6 +7453,7 @@ static void sched_dl_do_global(void)
 {
         u64 new_bw = -1;
         int cpu;
+        unsigned long flags;
 
         def_dl_bandwidth.dl_period = global_rt_period();
         def_dl_bandwidth.dl_runtime = global_rt_runtime();
@@ -7464,9 +7467,9 @@ static void sched_dl_do_global(void)
         for_each_possible_cpu(cpu) {
                 struct dl_bw *dl_b = dl_bw_of(cpu);
 
-                raw_spin_lock(&dl_b->lock);
+                raw_spin_lock_irqsave(&dl_b->lock, flags);
                 dl_b->bw = new_bw;
-                raw_spin_unlock(&dl_b->lock);
+                raw_spin_unlock_irqrestore(&dl_b->lock, flags);
         }
 }
 
@@ -7475,7 +7478,8 @@ static int sched_rt_global_validate(void)
         if (sysctl_sched_rt_period <= 0)
                 return -EINVAL;
 
-        if (sysctl_sched_rt_runtime > sysctl_sched_rt_period)
+        if ((sysctl_sched_rt_runtime != RUNTIME_INF) &&
+                (sysctl_sched_rt_runtime > sysctl_sched_rt_period))
                 return -EINVAL;
 
         return 0;
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index 045fc74e3f09..5b9bb42b2d47 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -70,7 +70,7 @@ static void cpudl_heapify(struct cpudl *cp, int idx)
 
 static void cpudl_change_key(struct cpudl *cp, int idx, u64 new_dl)
 {
-        WARN_ON(idx > num_present_cpus() || idx == IDX_INVALID);
+        WARN_ON(idx == IDX_INVALID || !cpu_present(idx));
 
         if (dl_time_before(new_dl, cp->elements[idx].dl)) {
                 cp->elements[idx].dl = new_dl;
@@ -117,7 +117,7 @@ int cpudl_find(struct cpudl *cp, struct task_struct *p,
         }
 
 out:
-        WARN_ON(best_cpu > num_present_cpus() && best_cpu != -1);
+        WARN_ON(best_cpu != -1 && !cpu_present(best_cpu));
 
         return best_cpu;
 }
@@ -137,7 +137,7 @@ void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid)
         int old_idx, new_cpu;
         unsigned long flags;
 
-        WARN_ON(cpu > num_present_cpus());
+        WARN_ON(!cpu_present(cpu));
 
         raw_spin_lock_irqsave(&cp->lock, flags);
         old_idx = cp->cpu_to_idx[cpu];
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 0dd5e0971a07..6e79b3faa4cd 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -121,7 +121,7 @@ static inline void dl_clear_overload(struct rq *rq)
 
 static void update_dl_migration(struct dl_rq *dl_rq)
 {
-        if (dl_rq->dl_nr_migratory && dl_rq->dl_nr_total > 1) {
+        if (dl_rq->dl_nr_migratory && dl_rq->dl_nr_running > 1) {
                 if (!dl_rq->overloaded) {
                         dl_set_overload(rq_of_dl_rq(dl_rq));
                         dl_rq->overloaded = 1;
@@ -135,9 +135,7 @@ static void update_dl_migration(struct dl_rq *dl_rq)
 static void inc_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 {
         struct task_struct *p = dl_task_of(dl_se);
-        dl_rq = &rq_of_dl_rq(dl_rq)->dl;
 
-        dl_rq->dl_nr_total++;
         if (p->nr_cpus_allowed > 1)
                 dl_rq->dl_nr_migratory++;
 
@@ -147,9 +145,7 @@ static void inc_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 static void dec_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 {
         struct task_struct *p = dl_task_of(dl_se);
-        dl_rq = &rq_of_dl_rq(dl_rq)->dl;
 
-        dl_rq->dl_nr_total--;
         if (p->nr_cpus_allowed > 1)
                 dl_rq->dl_nr_migratory--;
 
@@ -566,6 +562,8 @@ int dl_runtime_exceeded(struct rq *rq, struct sched_dl_entity *dl_se)
         return 1;
 }
 
+extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq);
+
 /*
  * Update the current task's runtime statistics (provided it is still
  * a -deadline task and has not been removed from the dl_rq).
@@ -629,11 +627,13 @@ static void update_curr_dl(struct rq *rq)
                 struct rt_rq *rt_rq = &rq->rt;
 
                 raw_spin_lock(&rt_rq->rt_runtime_lock);
-                rt_rq->rt_time += delta_exec;
                 /*
                  * We'll let actual RT tasks worry about the overflow here, we
-                 * have our own CBS to keep us inline -- see above.
+                 * have our own CBS to keep us inline; only account when RT
+                 * bandwidth is relevant.
                  */
+                if (sched_rt_bandwidth_account(rt_rq))
+                        rt_rq->rt_time += delta_exec;
                 raw_spin_unlock(&rt_rq->rt_runtime_lock);
         }
 }
@@ -717,6 +717,7 @@ void inc_dl_tasks(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 
         WARN_ON(!dl_prio(prio));
         dl_rq->dl_nr_running++;
+        inc_nr_running(rq_of_dl_rq(dl_rq));
 
         inc_dl_deadline(dl_rq, deadline);
         inc_dl_migration(dl_se, dl_rq);
@@ -730,6 +731,7 @@ void dec_dl_tasks(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
         WARN_ON(!dl_prio(prio));
         WARN_ON(!dl_rq->dl_nr_running);
         dl_rq->dl_nr_running--;
+        dec_nr_running(rq_of_dl_rq(dl_rq));
 
         dec_dl_deadline(dl_rq, dl_se->deadline);
         dec_dl_migration(dl_se, dl_rq);
@@ -836,8 +838,6 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
 
         if (!task_current(rq, p) && p->nr_cpus_allowed > 1)
                 enqueue_pushable_dl_task(rq, p);
-
-        inc_nr_running(rq);
 }
 
 static void __dequeue_task_dl(struct rq *rq, struct task_struct *p, int flags)
@@ -850,8 +850,6 @@ static void dequeue_task_dl(struct rq *rq, struct task_struct *p, int flags)
 {
         update_curr_dl(rq);
         __dequeue_task_dl(rq, p, flags);
-
-        dec_nr_running(rq);
 }
 
 /*
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 966cc2bfcb77..9b4c4f320130 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1757,6 +1757,8 @@ void task_numa_work(struct callback_head *work)
                         start = end;
                         if (pages <= 0)
                                 goto out;
+
+                        cond_resched();
                 } while (end != vma->vm_end);
         }
 
@@ -6999,15 +7001,15 @@ static void switched_from_fair(struct rq *rq, struct task_struct *p)
         struct cfs_rq *cfs_rq = cfs_rq_of(se);
 
         /*
-         * Ensure the task's vruntime is normalized, so that when its
+         * Ensure the task's vruntime is normalized, so that when it's
          * switched back to the fair class the enqueue_entity(.flags=0) will
          * do the right thing.
          *
-         * If it was on_rq, then the dequeue_entity(.flags=0) will already
-         * have normalized the vruntime, if it was !on_rq, then only when
+         * If it's on_rq, then the dequeue_entity(.flags=0) will already
+         * have normalized the vruntime, if it's !on_rq, then only when
          * the task is sleeping will it still have non-normalized vruntime.
          */
-        if (!se->on_rq && p->state != TASK_RUNNING) {
+        if (!p->on_rq && p->state != TASK_RUNNING) {
                 /*
                  * Fix up our vruntime so that the current sleep doesn't
                  * cause 'unlimited' sleep bonus.
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index a2740b775b45..1999021042c7 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -538,6 +538,14 @@ static inline struct rt_bandwidth *sched_rt_bandwidth(struct rt_rq *rt_rq)
 
 #endif /* CONFIG_RT_GROUP_SCHED */
 
+bool sched_rt_bandwidth_account(struct rt_rq *rt_rq)
+{
+        struct rt_bandwidth *rt_b = sched_rt_bandwidth(rt_rq);
+
+        return (hrtimer_active(&rt_b->rt_period_timer) ||
+                rt_rq->rt_time < rt_b->rt_runtime);
+}
+
 #ifdef CONFIG_SMP
 /*
  * We ran out of runtime, see if we can borrow some from our neighbours.
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index c2119fd20f8b..f964add50f38 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -462,7 +462,6 @@ struct dl_rq {
         } earliest_dl;
 
         unsigned long dl_nr_migratory;
-        unsigned long dl_nr_total;
         int overloaded;
 
         /*
diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c
index 0abb36464281..4d23dc4d8139 100644
--- a/kernel/time/sched_clock.c
+++ b/kernel/time/sched_clock.c
@@ -116,20 +116,42 @@ static enum hrtimer_restart sched_clock_poll(struct hrtimer *hrt)
 void __init sched_clock_register(u64 (*read)(void), int bits,
                                  unsigned long rate)
 {
+        u64 res, wrap, new_mask, new_epoch, cyc, ns;
+        u32 new_mult, new_shift;
+        ktime_t new_wrap_kt;
         unsigned long r;
-        u64 res, wrap;
         char r_unit;
 
         if (cd.rate > rate)
                 return;
 
         WARN_ON(!irqs_disabled());
-        read_sched_clock = read;
-        sched_clock_mask = CLOCKSOURCE_MASK(bits);
-        cd.rate = rate;
 
         /* calculate the mult/shift to convert counter ticks to ns. */
-        clocks_calc_mult_shift(&cd.mult, &cd.shift, rate, NSEC_PER_SEC, 3600);
+        clocks_calc_mult_shift(&new_mult, &new_shift, rate, NSEC_PER_SEC, 3600);
+
+        new_mask = CLOCKSOURCE_MASK(bits);
+
+        /* calculate how many ns until we wrap */
+        wrap = clocks_calc_max_nsecs(new_mult, new_shift, 0, new_mask);
+        new_wrap_kt = ns_to_ktime(wrap - (wrap >> 3));
+
+        /* update epoch for new counter and update epoch_ns from old counter*/
+        new_epoch = read();
+        cyc = read_sched_clock();
+        ns = cd.epoch_ns + cyc_to_ns((cyc - cd.epoch_cyc) & sched_clock_mask,
+                          cd.mult, cd.shift);
+
+        raw_write_seqcount_begin(&cd.seq);
+        read_sched_clock = read;
+        sched_clock_mask = new_mask;
+        cd.rate = rate;
+        cd.wrap_kt = new_wrap_kt;
+        cd.mult = new_mult;
+        cd.shift = new_shift;
+        cd.epoch_cyc = new_epoch;
+        cd.epoch_ns = ns;
+        raw_write_seqcount_end(&cd.seq);
 
         r = rate;
         if (r >= 4000000) {
@@ -141,22 +163,12 @@ void __init sched_clock_register(u64 (*read)(void), int bits,
         } else
                 r_unit = ' ';
 
-        /* calculate how many ns until we wrap */
-        wrap = clocks_calc_max_nsecs(cd.mult, cd.shift, 0, sched_clock_mask);
-        cd.wrap_kt = ns_to_ktime(wrap - (wrap >> 3));
-
         /* calculate the ns resolution of this counter */
-        res = cyc_to_ns(1ULL, cd.mult, cd.shift);
+        res = cyc_to_ns(1ULL, new_mult, new_shift);
+
         pr_info("sched_clock: %u bits at %lu%cHz, resolution %lluns, wraps every %lluns\n",
                 bits, r, r_unit, res, wrap);
 
-        update_sched_clock();
-
-        /*
-         * Ensure that sched_clock() starts off at 0ns
-         */
-        cd.epoch_ns = 0;
-
         /* Enable IRQ time accounting if we have a fast enough sched_clock */
         if (irqtime > 0 || (irqtime == -1 && rate >= 1000000))
                 enable_sched_clock_irqtime();
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index e71ffd4eccb5..f3989ceb5cd5 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1777,6 +1777,16 @@ static void trace_module_add_events(struct module *mod)
 {
         struct ftrace_event_call **call, **start, **end;
 
+        if (!mod->num_trace_events)
+                return;
+
+        /* Don't add infrastructure for mods without tracepoints */
+        if (trace_module_has_bad_taint(mod)) {
+                pr_err("%s: module has bad taint, not creating trace events\n",
+                       mod->name);
+                return;
+        }
+
         start = mod->trace_events;
         end = mod->trace_events + mod->num_trace_events;
 
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 29f26540e9c9..031cc5655a51 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -631,6 +631,11 @@ void tracepoint_iter_reset(struct tracepoint_iter *iter)
 EXPORT_SYMBOL_GPL(tracepoint_iter_reset);
 
 #ifdef CONFIG_MODULES
+bool trace_module_has_bad_taint(struct module *mod)
+{
+        return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP));
+}
+
 static int tracepoint_module_coming(struct module *mod)
 {
         struct tp_module *tp_mod, *iter;
@@ -641,7 +646,7 @@ static int tracepoint_module_coming(struct module *mod)
          * module headers (for forced load), to make sure we don't cause a crash.
          * Staging and out-of-tree GPL modules are fine.
          */
-        if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
+        if (trace_module_has_bad_taint(mod))
                 return 0;
         mutex_lock(&tracepoints_mutex);
         tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 240fb62cf394..dd06439b9c84 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -225,7 +225,7 @@ static u32 map_id_up(struct uid_gid_map *map, u32 id)
  *
  *      When there is no mapping defined for the user-namespace uid
  *      pair INVALID_UID is returned.  Callers are expected to test
- *      for and handle handle INVALID_UID being returned.  INVALID_UID
+ *      for and handle INVALID_UID being returned.  INVALID_UID
  *      may be tested for using uid_valid().
  */
 kuid_t make_kuid(struct user_namespace *ns, uid_t uid)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 82ef9f3b7473..193e977a10ea 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1851,6 +1851,12 @@ static void destroy_worker(struct worker *worker)
         if (worker->flags & WORKER_IDLE)
                 pool->nr_idle--;
 
+        /*
+         * Once WORKER_DIE is set, the kworker may destroy itself at any
+         * point.  Pin to ensure the task stays until we're done with it.
+         */
+        get_task_struct(worker->task);
+
         list_del_init(&worker->entry);
         worker->flags |= WORKER_DIE;
 
@@ -1859,6 +1865,7 @@ static void destroy_worker(struct worker *worker)
         spin_unlock_irq(&pool->lock);
 
         kthread_stop(worker->task);
+        put_task_struct(worker->task);
         kfree(worker);
 
         spin_lock_irq(&pool->lock);
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 2defd1308b04..98f2d7e91a91 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -424,111 +424,134 @@ void debug_dma_dump_mappings(struct device *dev)
 EXPORT_SYMBOL(debug_dma_dump_mappings);
 
 /*
- * For each page mapped (initial page in the case of
- * dma_alloc_coherent/dma_map_{single|page}, or each page in a
- * scatterlist) insert into this tree using the pfn as the key. At
+ * For each mapping (initial cacheline in the case of
+ * dma_alloc_coherent/dma_map_page, initial cacheline in each page of a
+ * scatterlist, or the cacheline specified in dma_map_single) insert
+ * into this tree using the cacheline as the key. At
  * dma_unmap_{single|sg|page} or dma_free_coherent delete the entry.  If
- * the pfn already exists at insertion time add a tag as a reference
+ * the entry already exists at insertion time add a tag as a reference
  * count for the overlapping mappings.  For now, the overlap tracking
- * just ensures that 'unmaps' balance 'maps' before marking the pfn
- * idle, but we should also be flagging overlaps as an API violation.
+ * just ensures that 'unmaps' balance 'maps' before marking the
+ * cacheline idle, but we should also be flagging overlaps as an API
+ * violation.
  *
  * Memory usage is mostly constrained by the maximum number of available
  * dma-debug entries in that we need a free dma_debug_entry before
- * inserting into the tree.  In the case of dma_map_{single|page} and
- * dma_alloc_coherent there is only one dma_debug_entry and one pfn to
- * track per event.  dma_map_sg(), on the other hand,
- * consumes a single dma_debug_entry, but inserts 'nents' entries into
- * the tree.
+ * inserting into the tree.  In the case of dma_map_page and
+ * dma_alloc_coherent there is only one dma_debug_entry and one
+ * dma_active_cacheline entry to track per event.  dma_map_sg(), on the
+ * other hand, consumes a single dma_debug_entry, but inserts 'nents'
+ * entries into the tree.
  *
  * At any time debug_dma_assert_idle() can be called to trigger a
- * warning if the given page is in the active set.
+ * warning if any cachelines in the given page are in the active set.
  */
-static RADIX_TREE(dma_active_pfn, GFP_NOWAIT);
+static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT);
 static DEFINE_SPINLOCK(radix_lock);
-#define ACTIVE_PFN_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
+#define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
+#define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
+#define CACHELINES_PER_PAGE (1 << CACHELINE_PER_PAGE_SHIFT)
 
-static int active_pfn_read_overlap(unsigned long pfn)
+static phys_addr_t to_cacheline_number(struct dma_debug_entry *entry)
+{
+        return (entry->pfn << CACHELINE_PER_PAGE_SHIFT) +
+                (entry->offset >> L1_CACHE_SHIFT);
+}
+
+static int active_cacheline_read_overlap(phys_addr_t cln)
 {
         int overlap = 0, i;
 
         for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
-                if (radix_tree_tag_get(&dma_active_pfn, pfn, i))
+                if (radix_tree_tag_get(&dma_active_cacheline, cln, i))
                         overlap |= 1 << i;
         return overlap;
 }
 
-static int active_pfn_set_overlap(unsigned long pfn, int overlap)
+static int active_cacheline_set_overlap(phys_addr_t cln, int overlap)
 {
         int i;
 
-        if (overlap > ACTIVE_PFN_MAX_OVERLAP || overlap < 0)
+        if (overlap > ACTIVE_CACHELINE_MAX_OVERLAP || overlap < 0)
                 return overlap;
 
         for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
                 if (overlap & 1 << i)
-                        radix_tree_tag_set(&dma_active_pfn, pfn, i);
+                        radix_tree_tag_set(&dma_active_cacheline, cln, i);
                 else
-                        radix_tree_tag_clear(&dma_active_pfn, pfn, i);
+                        radix_tree_tag_clear(&dma_active_cacheline, cln, i);
 
         return overlap;
 }
 
-static void active_pfn_inc_overlap(unsigned long pfn)
+static void active_cacheline_inc_overlap(phys_addr_t cln)
 {
-        int overlap = active_pfn_read_overlap(pfn);
+        int overlap = active_cacheline_read_overlap(cln);
 
-        overlap = active_pfn_set_overlap(pfn, ++overlap);
+        overlap = active_cacheline_set_overlap(cln, ++overlap);
 
         /* If we overflowed the overlap counter then we're potentially
          * leaking dma-mappings.  Otherwise, if maps and unmaps are
          * balanced then this overflow may cause false negatives in
-         * debug_dma_assert_idle() as the pfn may be marked idle
+         * debug_dma_assert_idle() as the cacheline may be marked idle
          * prematurely.
          */
-        WARN_ONCE(overlap > ACTIVE_PFN_MAX_OVERLAP,
-                  "DMA-API: exceeded %d overlapping mappings of pfn %lx\n",
-                  ACTIVE_PFN_MAX_OVERLAP, pfn);
+        WARN_ONCE(overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
+                  "DMA-API: exceeded %d overlapping mappings of cacheline %pa\n",
+                  ACTIVE_CACHELINE_MAX_OVERLAP, &cln);
 }
 
-static int active_pfn_dec_overlap(unsigned long pfn)
+static int active_cacheline_dec_overlap(phys_addr_t cln)
 {
-        int overlap = active_pfn_read_overlap(pfn);
+        int overlap = active_cacheline_read_overlap(cln);
 
-        return active_pfn_set_overlap(pfn, --overlap);
+        return active_cacheline_set_overlap(cln, --overlap);
 }
 
-static int active_pfn_insert(struct dma_debug_entry *entry)
+static int active_cacheline_insert(struct dma_debug_entry *entry)
 {
+        phys_addr_t cln = to_cacheline_number(entry);
         unsigned long flags;
         int rc;
 
+        /* If the device is not writing memory then we don't have any
+         * concerns about the cpu consuming stale data.  This mitigates
+         * legitimate usages of overlapping mappings.
+         */
+        if (entry->direction == DMA_TO_DEVICE)
+                return 0;
+
         spin_lock_irqsave(&radix_lock, flags);
-        rc = radix_tree_insert(&dma_active_pfn, entry->pfn, entry);
+        rc = radix_tree_insert(&dma_active_cacheline, cln, entry);
         if (rc == -EEXIST)
-                active_pfn_inc_overlap(entry->pfn);
+                active_cacheline_inc_overlap(cln);
         spin_unlock_irqrestore(&radix_lock, flags);
 
         return rc;
 }
 
-static void active_pfn_remove(struct dma_debug_entry *entry)
+static void active_cacheline_remove(struct dma_debug_entry *entry)
 {
+        phys_addr_t cln = to_cacheline_number(entry);
         unsigned long flags;
 
+        /* ...mirror the insert case */
+        if (entry->direction == DMA_TO_DEVICE)
+                return;
+
         spin_lock_irqsave(&radix_lock, flags);
         /* since we are counting overlaps the final put of the
-         * entry->pfn will occur when the overlap count is 0.
-         * active_pfn_dec_overlap() returns -1 in that case
+         * cacheline will occur when the overlap count is 0.
+         * active_cacheline_dec_overlap() returns -1 in that case
          */
-        if (active_pfn_dec_overlap(entry->pfn) < 0)
-                radix_tree_delete(&dma_active_pfn, entry->pfn);
+        if (active_cacheline_dec_overlap(cln) < 0)
+                radix_tree_delete(&dma_active_cacheline, cln);
         spin_unlock_irqrestore(&radix_lock, flags);
 }
 
 /**
  * debug_dma_assert_idle() - assert that a page is not undergoing dma
- * @page: page to lookup in the dma_active_pfn tree
+ * @page: page to lookup in the dma_active_cacheline tree
  *
  * Place a call to this routine in cases where the cpu touching the page
  * before the dma completes (page is dma_unmapped) will lead to data
@@ -536,22 +559,38 @@ static void active_pfn_remove(struct dma_debug_entry *entry)
  */
 void debug_dma_assert_idle(struct page *page)
 {
+        static struct dma_debug_entry *ents[CACHELINES_PER_PAGE];
+        struct dma_debug_entry *entry = NULL;
+        void **results = (void **) &ents;
+        unsigned int nents, i;
         unsigned long flags;
-        struct dma_debug_entry *entry;
+        phys_addr_t cln;
 
         if (!page)
                 return;
 
+        cln = (phys_addr_t) page_to_pfn(page) << CACHELINE_PER_PAGE_SHIFT;
         spin_lock_irqsave(&radix_lock, flags);
-        entry = radix_tree_lookup(&dma_active_pfn, page_to_pfn(page));
+        nents = radix_tree_gang_lookup(&dma_active_cacheline, results, cln,
+                                       CACHELINES_PER_PAGE);
+        for (i = 0; i < nents; i++) {
+                phys_addr_t ent_cln = to_cacheline_number(ents[i]);
+
+                if (ent_cln == cln) {
+                        entry = ents[i];
+                        break;
+                } else if (ent_cln >= cln + CACHELINES_PER_PAGE)
+                        break;
+        }
         spin_unlock_irqrestore(&radix_lock, flags);
 
         if (!entry)
                 return;
 
+        cln = to_cacheline_number(entry);
         err_printk(entry->dev, entry,
-                   "DMA-API: cpu touching an active dma mapped page "
-                   "[pfn=0x%lx]\n", entry->pfn);
+                   "DMA-API: cpu touching an active dma mapped cacheline [cln=%pa]\n",
+                   &cln);
 }
 
 /*
@@ -568,9 +607,9 @@ static void add_dma_entry(struct dma_debug_entry *entry)
         hash_bucket_add(bucket, entry);
         put_hash_bucket(bucket, &flags);
 
-        rc = active_pfn_insert(entry);
+        rc = active_cacheline_insert(entry);
         if (rc == -ENOMEM) {
-                pr_err("DMA-API: pfn tracking ENOMEM, dma-debug disabled\n");
+                pr_err("DMA-API: cacheline tracking ENOMEM, dma-debug disabled\n");
                 global_disable = true;
         }
 
@@ -631,7 +670,7 @@ static void dma_entry_free(struct dma_debug_entry *entry)
 {
         unsigned long flags;
 
-        active_pfn_remove(entry);
+        active_cacheline_remove(entry);
 
         /*
          * add to beginning of the list - this way the entries are
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 7811ed3b4e70..bd4a8dfdf0b8 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -1253,8 +1253,10 @@ unsigned long radix_tree_locate_item(struct radix_tree_root *root, void *item)
 
                 node = indirect_to_ptr(node);
                 max_index = radix_tree_maxindex(node->height);
-                if (cur_index > max_index)
+                if (cur_index > max_index) {
+                        rcu_read_unlock();
                         break;
+                }
 
                 cur_index = __locate(node, item, cur_index, &found_index);
                 rcu_read_unlock();
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 82166bf974e1..1546655a2d78 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1166,8 +1166,10 @@ alloc:
                 } else {
                         ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
                                         pmd, orig_pmd, page, haddr);
-                        if (ret & VM_FAULT_OOM)
+                        if (ret & VM_FAULT_OOM) {
                                 split_huge_page(page);
+                                ret |= VM_FAULT_FALLBACK;
+                        }
                         put_page(page);
                 }
                 count_vm_event(THP_FAULT_FALLBACK);
@@ -1179,9 +1181,10 @@ alloc:
                 if (page) {
                         split_huge_page(page);
                         put_page(page);
-                }
+                } else
+                        split_huge_page_pmd(vma, address, pmd);
+                ret |= VM_FAULT_FALLBACK;
                 count_vm_event(THP_FAULT_FALLBACK);
-                ret |= VM_FAULT_OOM;
                 goto out;
         }
 
@@ -1545,6 +1548,7 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                                 entry = pmd_mknonnuma(entry);
                         entry = pmd_modify(entry, newprot);
                         ret = HPAGE_PMD_NR;
+                        set_pmd_at(mm, addr, pmd, entry);
                         BUG_ON(pmd_write(entry));
                 } else {
                         struct page *page = pmd_page(*pmd);
@@ -1557,16 +1561,10 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                          */
                         if (!is_huge_zero_page(page) &&
                             !pmd_numa(*pmd)) {
-                                entry = *pmd;
-                                entry = pmd_mknuma(entry);
+                                pmdp_set_numa(mm, addr, pmd);
                                 ret = HPAGE_PMD_NR;
                         }
                 }
-
-                /* Set PMD if cleared earlier */
-                if (ret == HPAGE_PMD_NR)
-                        set_pmd_at(mm, addr, pmd, entry);
-
                 spin_unlock(ptl);
         }
 
@@ -1963,7 +1961,7 @@ out:
         return ret;
 }
 
-#define VM_NO_THP (VM_SPECIAL|VM_MIXEDMAP|VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
+#define VM_NO_THP (VM_SPECIAL | VM_HUGETLB | VM_SHARED | VM_MAYSHARE)
 
 int hugepage_madvise(struct vm_area_struct *vma,
                      unsigned long *vm_flags, int advice)
diff --git a/mm/ksm.c b/mm/ksm.c
index aa4c7c7250c1..68710e80994a 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -444,7 +444,7 @@ static void break_cow(struct rmap_item *rmap_item)
 static struct page *page_trans_compound_anon(struct page *page)
 {
         if (PageTransCompound(page)) {
-                struct page *head = compound_trans_head(page);
+                struct page *head = compound_head(page);
                 /*
                  * head may actually be splitted and freed from under
                  * us but it's ok here.
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 53385cd4e6f0..5b6b0039f725 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1127,8 +1127,8 @@ skip_node:
          * skipping css reference should be safe.
          */
         if (next_css) {
-                if ((next_css->flags & CSS_ONLINE) &&
-                                (next_css == &root->css || css_tryget(next_css)))
+                if ((next_css == &root->css) ||
+                    ((next_css->flags & CSS_ONLINE) && css_tryget(next_css)))
                         return mem_cgroup_from_css(next_css);
 
                 prev_css = next_css;
@@ -1687,7 +1687,7 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
          * protects memcg_name and makes sure that parallel ooms do not
          * interleave
          */
-        static DEFINE_SPINLOCK(oom_info_lock);
+        static DEFINE_MUTEX(oom_info_lock);
         struct cgroup *task_cgrp;
         struct cgroup *mem_cgrp;
         static char memcg_name[PATH_MAX];
@@ -1698,7 +1698,7 @@ void mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
         if (!p)
                 return;
 
-        spin_lock(&oom_info_lock);
+        mutex_lock(&oom_info_lock);
         rcu_read_lock();
 
         mem_cgrp = memcg->css.cgroup;
@@ -1767,7 +1767,7 @@ done:
 
                 pr_cont("\n");
         }
-        spin_unlock(&oom_info_lock);
+        mutex_unlock(&oom_info_lock);
 }
 
 /*
@@ -6595,6 +6595,7 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
         struct mem_cgroup_event *event, *tmp;
+        struct cgroup_subsys_state *iter;
 
         /*
          * Unregister events and notify userspace.
@@ -6611,7 +6612,14 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
         kmem_cgroup_css_offline(memcg);
 
         mem_cgroup_invalidate_reclaim_iterators(memcg);
-        mem_cgroup_reparent_charges(memcg);
+
+        /*
+         * This requires that offlining is serialized.  Right now that is
+         * guaranteed because css_killed_work_fn() holds the cgroup_mutex.
+         */
+        css_for_each_descendant_post(iter, css)
+                mem_cgroup_reparent_charges(mem_cgroup_from_css(iter));
+
         mem_cgroup_destroy_all_caches(memcg);
         vmpressure_cleanup(&memcg->vmpressure);
 }
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 2f2f34a4e77d..90002ea43638 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1651,7 +1651,7 @@ int soft_offline_page(struct page *page, int flags)
 {
         int ret;
         unsigned long pfn = page_to_pfn(page);
-        struct page *hpage = compound_trans_head(page);
+        struct page *hpage = compound_head(page);
 
         if (PageHWPoison(page)) {
                 pr_info("soft offline: %#lx page already poisoned\n", pfn);
diff --git a/mm/memory.c b/mm/memory.c
index be6a0c0d4ae0..22dfa617bddb 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3348,6 +3348,7 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                 if (ret & VM_FAULT_LOCKED)
                         unlock_page(vmf.page);
                 ret = VM_FAULT_HWPOISON;
+                page_cache_release(vmf.page);
                 goto uncharge_out;
         }
 
@@ -3703,7 +3704,6 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         if (unlikely(is_vm_hugetlb_page(vma)))
                 return hugetlb_fault(mm, vma, address, flags);
 
-retry:
         pgd = pgd_offset(mm, address);
         pud = pud_alloc(mm, pgd, address);
         if (!pud)
@@ -3741,20 +3741,13 @@ retry:
                         if (dirty && !pmd_write(orig_pmd)) {
                                 ret = do_huge_pmd_wp_page(mm, vma, address, pmd,
                                                           orig_pmd);
-                                /*
-                                 * If COW results in an oom, the huge pmd will
-                                 * have been split, so retry the fault on the
-                                 * pte for a smaller charge.
-                                 */
-                                if (unlikely(ret & VM_FAULT_OOM))
-                                        goto retry;
-                                return ret;
+                                if (!(ret & VM_FAULT_FALLBACK))
+                                        return ret;
                         } else {
                                 huge_pmd_set_accessed(mm, vma, address, pmd,
                                                       orig_pmd, dirty);
+                                return 0;
                         }
-
-                        return 0;
                 }
         }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 7332c1785744..769a67a15803 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -58,36 +58,27 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                                 if (pte_numa(ptent))
                                         ptent = pte_mknonnuma(ptent);
                                 ptent = pte_modify(ptent, newprot);
+                                /*
+                                 * Avoid taking write faults for pages we
+                                 * know to be dirty.
+                                 */
+                                if (dirty_accountable && pte_dirty(ptent))
+                                        ptent = pte_mkwrite(ptent);
+                                ptep_modify_prot_commit(mm, addr, pte, ptent);
                                 updated = true;
                         } else {
                                 struct page *page;
 
-                                ptent = *pte;
                                 page = vm_normal_page(vma, addr, oldpte);
                                 if (page && !PageKsm(page)) {
                                         if (!pte_numa(oldpte)) {
-                                                ptent = pte_mknuma(ptent);
-                                                set_pte_at(mm, addr, pte, ptent);
+                                                ptep_set_numa(mm, addr, pte);
                                                 updated = true;
                                         }
                                 }
                         }
-
-                        /*
-                         * Avoid taking write faults for pages we know to be
-                         * dirty.
-                         */
-                        if (dirty_accountable && pte_dirty(ptent)) {
-                                ptent = pte_mkwrite(ptent);
-                                updated = true;
-                        }
-
                         if (updated)
                                 pages++;
-
-                        /* Only !prot_numa always clears the pte */
-                        if (!prot_numa)
-                                ptep_modify_prot_commit(mm, addr, pte, ptent);
                 } else if (IS_ENABLED(CONFIG_MIGRATION) && !pte_file(oldpte)) {
                         swp_entry_t entry = pte_to_swp_entry(oldpte);
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e3758a09a009..3bac76ae4b30 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -369,9 +369,11 @@ void prep_compound_page(struct page *page, unsigned long order)
         __SetPageHead(page);
         for (i = 1; i < nr_pages; i++) {
                 struct page *p = page + i;
-                __SetPageTail(p);
                 set_page_count(p, 0);
                 p->first_page = page;
+                /* Make sure p->first_page is always valid for PageTail() */
+                smp_wmb();
+                __SetPageTail(p);
         }
 }
 
@@ -1236,6 +1238,15 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp)
         }
         local_irq_restore(flags);
 }
+static bool gfp_thisnode_allocation(gfp_t gfp_mask)
+{
+        return (gfp_mask & GFP_THISNODE) == GFP_THISNODE;
+}
+#else
+static bool gfp_thisnode_allocation(gfp_t gfp_mask)
+{
+        return false;
+}
 #endif
 
 /*
@@ -1572,7 +1583,13 @@ again:
                                           get_pageblock_migratetype(page));
         }
 
-        __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
+        /*
+         * NOTE: GFP_THISNODE allocations do not partake in the kswapd
+         * aging protocol, so they can't be fair.
+         */
+        if (!gfp_thisnode_allocation(gfp_flags))
+                __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
+
         __count_zone_vm_events(PGALLOC, zone, 1 << order);
         zone_statistics(preferred_zone, zone, gfp_flags);
         local_irq_restore(flags);
@@ -1944,8 +1961,12 @@ zonelist_scan:
                  * ultimately fall back to remote zones that do not
                  * partake in the fairness round-robin cycle of this
                  * zonelist.
+                 *
+                 * NOTE: GFP_THISNODE allocations do not partake in
+                 * the kswapd aging protocol, so they can't be fair.
                  */
-                if (alloc_flags & ALLOC_WMARK_LOW) {
+                if ((alloc_flags & ALLOC_WMARK_LOW) &&
+                    !gfp_thisnode_allocation(gfp_mask)) {
                         if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
                                 continue;
                         if (!zone_local(preferred_zone, zone))
@@ -2501,8 +2522,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
          * allowed per node queues are empty and that nodes are
          * over allocated.
          */
-        if (IS_ENABLED(CONFIG_NUMA) &&
-                        (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
+        if (gfp_thisnode_allocation(gfp_mask))
                 goto nopage;
 
 restart:
diff --git a/mm/swap.c b/mm/swap.c
index b31ba67d440a..0092097b3f4c 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -98,7 +98,7 @@ static void put_compound_page(struct page *page)
         }
 
         /* __split_huge_page_refcount can run under us */
-        page_head = compound_trans_head(page);
+        page_head = compound_head(page);
 
         /*
          * THP can not break up slab pages so avoid taking
@@ -253,7 +253,7 @@ bool __get_page_tail(struct page *page)
          */
         unsigned long flags;
         bool got;
-        struct page *page_head = compound_trans_head(page);
+        struct page *page_head = compound_head(page);
 
         /* Ref to put_compound_page() comment. */
         if (!__compound_tail_refcounted(page_head)) {
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 196970a4541f..d4042e75f7c7 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -19,6 +19,7 @@
 #include <linux/mm.h>
 #include <linux/vmstat.h>
 #include <linux/eventfd.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/printk.h>
 #include <linux/vmpressure.h>
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 512159bf607f..8323bced8e5b 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -241,19 +241,19 @@ batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const uint8_t *addr)
         size = bat_priv->num_ifaces * sizeof(uint8_t);
         orig_node->bat_iv.bcast_own_sum = kzalloc(size, GFP_ATOMIC);
         if (!orig_node->bat_iv.bcast_own_sum)
-                goto free_bcast_own;
+                goto free_orig_node;
 
         hash_added = batadv_hash_add(bat_priv->orig_hash, batadv_compare_orig,
                                      batadv_choose_orig, orig_node,
                                      &orig_node->hash_entry);
         if (hash_added != 0)
-                goto free_bcast_own;
+                goto free_orig_node;
 
         return orig_node;
 
-free_bcast_own:
-        kfree(orig_node->bat_iv.bcast_own);
 free_orig_node:
+        /* free twice, as batadv_orig_node_new sets refcount to 2 */
+        batadv_orig_node_free_ref(orig_node);
         batadv_orig_node_free_ref(orig_node);
 
         return NULL;
@@ -266,7 +266,7 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
                         struct batadv_orig_node *orig_neigh)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
-        struct batadv_neigh_node *neigh_node;
+        struct batadv_neigh_node *neigh_node, *tmp_neigh_node;
 
         neigh_node = batadv_neigh_node_new(hard_iface, neigh_addr, orig_node);
         if (!neigh_node)
@@ -281,14 +281,24 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
         neigh_node->orig_node = orig_neigh;
         neigh_node->if_incoming = hard_iface;
 
-        batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
-                   "Creating new neighbor %pM for orig_node %pM on interface %s\n",
-                   neigh_addr, orig_node->orig, hard_iface->net_dev->name);
-
         spin_lock_bh(&orig_node->neigh_list_lock);
-        hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
+        tmp_neigh_node = batadv_neigh_node_get(orig_node, hard_iface,
+                                               neigh_addr);
+        if (!tmp_neigh_node) {
+                hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
+        } else {
+                kfree(neigh_node);
+                batadv_hardif_free_ref(hard_iface);
+                neigh_node = tmp_neigh_node;
+        }
         spin_unlock_bh(&orig_node->neigh_list_lock);
 
+        if (!tmp_neigh_node)
+                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
+                           "Creating new neighbor %pM for orig_node %pM on interface %s\n",
+                           neigh_addr, orig_node->orig,
+                           hard_iface->net_dev->name);
+
 out:
         return neigh_node;
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 3d417d3641c6..b851cc580853 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -241,7 +241,7 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
 {
         struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         const struct batadv_hard_iface *hard_iface;
-        int min_mtu = ETH_DATA_LEN;
+        int min_mtu = INT_MAX;
 
         rcu_read_lock();
         list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
@@ -256,8 +256,6 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
         }
         rcu_read_unlock();
 
-        atomic_set(&bat_priv->packet_size_max, min_mtu);
-
         if (atomic_read(&bat_priv->fragmentation) == 0)
                 goto out;
 
@@ -268,13 +266,21 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
         min_mtu = min_t(int, min_mtu, BATADV_FRAG_MAX_FRAG_SIZE);
         min_mtu -= sizeof(struct batadv_frag_packet);
         min_mtu *= BATADV_FRAG_MAX_FRAGMENTS;
-        atomic_set(&bat_priv->packet_size_max, min_mtu);
-
-        /* with fragmentation enabled we can fragment external packets easily */
-        min_mtu = min_t(int, min_mtu, ETH_DATA_LEN);
 
 out:
-        return min_mtu - batadv_max_header_len();
+        /* report to the other components the maximum amount of bytes that
+         * batman-adv can send over the wire (without considering the payload
+         * overhead). For example, this value is used by TT to compute the
+         * maximum local table table size
+         */
+        atomic_set(&bat_priv->packet_size_max, min_mtu);
+
+        /* the real soft-interface MTU is computed by removing the payload
+         * overhead from the maximum amount of bytes that was just computed.
+         *
+         * However batman-adv does not support MTUs bigger than ETH_DATA_LEN
+         */
+        return min_t(int, min_mtu - batadv_max_header_len(), ETH_DATA_LEN);
 }
 
 /* adjusts the MTU if a new interface with a smaller MTU appeared. */
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 6df12a2e3605..853941629dc1 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -458,6 +458,42 @@ out:
 }
 
 /**
+ * batadv_neigh_node_get - retrieve a neighbour from the list
+ * @orig_node: originator which the neighbour belongs to
+ * @hard_iface: the interface where this neighbour is connected to
+ * @addr: the address of the neighbour
+ *
+ * Looks for and possibly returns a neighbour belonging to this originator list
+ * which is connected through the provided hard interface.
+ * Returns NULL if the neighbour is not found.
+ */
+struct batadv_neigh_node *
+batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
+                      const struct batadv_hard_iface *hard_iface,
+                      const uint8_t *addr)
+{
+        struct batadv_neigh_node *tmp_neigh_node, *res = NULL;
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(tmp_neigh_node, &orig_node->neigh_list, list) {
+                if (!batadv_compare_eth(tmp_neigh_node->addr, addr))
+                        continue;
+
+                if (tmp_neigh_node->if_incoming != hard_iface)
+                        continue;
+
+                if (!atomic_inc_not_zero(&tmp_neigh_node->refcount))
+                        continue;
+
+                res = tmp_neigh_node;
+                break;
+        }
+        rcu_read_unlock();
+
+        return res;
+}
+
+/**
  * batadv_orig_ifinfo_free_rcu - free the orig_ifinfo object
  * @rcu: rcu pointer of the orig_ifinfo object
  */
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 37be290f63f6..db3a9ed734cb 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -29,6 +29,10 @@ void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node);
 struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
                                               const uint8_t *addr);
 struct batadv_neigh_node *
+batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
+                      const struct batadv_hard_iface *hard_iface,
+                      const uint8_t *addr);
+struct batadv_neigh_node *
 batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,
                       const uint8_t *neigh_addr,
                       struct batadv_orig_node *orig_node);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 1ed9f7c9ecea..a953d5b196a3 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -688,7 +688,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         int is_old_ttvn;
 
         /* check if there is enough data before accessing it */
-        if (pskb_may_pull(skb, hdr_len + ETH_HLEN) < 0)
+        if (!pskb_may_pull(skb, hdr_len + ETH_HLEN))
                 return 0;
 
         /* create a copy of the skb (in case of for re-routing) to modify it. */
@@ -918,6 +918,8 @@ int batadv_recv_unicast_tvlv(struct sk_buff *skb,
 
         if (ret != NET_RX_SUCCESS)
                 ret = batadv_route_unicast_packet(skb, recv_if);
+        else
+                consume_skb(skb);
 
         return ret;
 }
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 579f5f00a385..843febd1e519 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -254,9 +254,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
                                    struct batadv_orig_node *orig_node,
                                    unsigned short vid)
 {
-        struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+        struct ethhdr *ethhdr;
         struct batadv_unicast_packet *unicast_packet;
-        int ret = NET_XMIT_DROP;
+        int ret = NET_XMIT_DROP, hdr_size;
 
         if (!orig_node)
                 goto out;
@@ -265,12 +265,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
         case BATADV_UNICAST:
                 if (!batadv_send_skb_prepare_unicast(skb, orig_node))
                         goto out;
+
+                hdr_size = sizeof(*unicast_packet);
                 break;
         case BATADV_UNICAST_4ADDR:
                 if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,
                                                            orig_node,
                                                            packet_subtype))
                         goto out;
+
+                hdr_size = sizeof(struct batadv_unicast_4addr_packet);
                 break;
         default:
                 /* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -279,6 +283,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
                 goto out;
         }
 
+        ethhdr = (struct ethhdr *)(skb->data + hdr_size);
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
 
         /* inform the destination node that we are still missing a correct route
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index b6071f675a3e..959dde721c46 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1975,6 +1975,7 @@ static uint32_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
         struct hlist_head *head;
         uint32_t i, crc_tmp, crc = 0;
         uint8_t flags;
+        __be16 tmp_vid;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -2011,8 +2012,11 @@ static uint32_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
                                                              orig_node))
                                 continue;
 
-                        crc_tmp = crc32c(0, &tt_common->vid,
-                                         sizeof(tt_common->vid));
+                        /* use network order to read the VID: this ensures that
+                         * every node reads the bytes in the same order.
+                         */
+                        tmp_vid = htons(tt_common->vid);
+                        crc_tmp = crc32c(0, &tmp_vid, sizeof(tmp_vid));
 
                         /* compute the CRC on flags that have to be kept in sync
                          * among nodes
@@ -2046,6 +2050,7 @@ static uint32_t batadv_tt_local_crc(struct batadv_priv *bat_priv,
         struct hlist_head *head;
         uint32_t i, crc_tmp, crc = 0;
         uint8_t flags;
+        __be16 tmp_vid;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -2064,8 +2069,11 @@ static uint32_t batadv_tt_local_crc(struct batadv_priv *bat_priv,
                         if (tt_common->flags & BATADV_TT_CLIENT_NEW)
                                 continue;
 
-                        crc_tmp = crc32c(0, &tt_common->vid,
-                                         sizeof(tt_common->vid));
+                        /* use network order to read the VID: this ensures that
+                         * every node reads the bytes in the same order.
+                         */
+                        tmp_vid = htons(tt_common->vid);
+                        crc_tmp = crc32c(0, &tmp_vid, sizeof(tmp_vid));
 
                         /* compute the CRC on flags that have to be kept in sync
                          * among nodes
@@ -2262,6 +2270,7 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
 {
         struct batadv_tvlv_tt_vlan_data *tt_vlan_tmp;
         struct batadv_orig_node_vlan *vlan;
+        uint32_t crc;
         int i;
 
         /* check if each received CRC matches the locally stored one */
@@ -2281,7 +2290,10 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
                 if (!vlan)
                         return false;
 
-                if (vlan->tt.crc != ntohl(tt_vlan_tmp->crc))
+                crc = vlan->tt.crc;
+                batadv_orig_node_vlan_free_ref(vlan);
+
+                if (crc != ntohl(tt_vlan_tmp->crc))
                         return false;
         }
 
@@ -3218,7 +3230,6 @@ static void batadv_tt_update_orig(struct batadv_priv *bat_priv,
 
                 spin_lock_bh(&orig_node->tt_lock);
 
-                tt_change = (struct batadv_tvlv_tt_change *)tt_buff;
                 batadv_tt_update_changes(bat_priv, orig_node, tt_num_changes,
                                          ttvn, tt_change);
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 292e619db896..d9fb93451442 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -430,6 +430,16 @@ static void hidp_del_timer(struct hidp_session *session)
                 del_timer(&session->timer);
 }
 
+static void hidp_process_report(struct hidp_session *session,
+                                int type, const u8 *data, int len, int intr)
+{
+        if (len > HID_MAX_BUFFER_SIZE)
+                len = HID_MAX_BUFFER_SIZE;
+
+        memcpy(session->input_buf, data, len);
+        hid_input_report(session->hid, type, session->input_buf, len, intr);
+}
+
 static void hidp_process_handshake(struct hidp_session *session,
                                         unsigned char param)
 {
@@ -502,7 +512,8 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
                         hidp_input_report(session, skb);
 
                 if (session->hid)
-                        hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
+                        hidp_process_report(session, HID_INPUT_REPORT,
+                                            skb->data, skb->len, 0);
                 break;
 
         case HIDP_DATA_RTYPE_OTHER:
@@ -584,7 +595,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
                         hidp_input_report(session, skb);
 
                 if (session->hid) {
-                        hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
+                        hidp_process_report(session, HID_INPUT_REPORT,
+                                            skb->data, skb->len, 1);
                         BT_DBG("report len %d", skb->len);
                 }
         } else {
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index ab5241400cf7..8798492a6e99 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -24,6 +24,7 @@
 #define __HIDP_H
 
 #include <linux/types.h>
+#include <linux/hid.h>
 #include <linux/kref.h>
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/l2cap.h>
@@ -179,6 +180,9 @@ struct hidp_session {
 
         /* Used in hidp_output_raw_report() */
         int output_report_success; /* boolean */
+
+        /* temporary input buffer */
+        u8 input_buf[HID_MAX_BUFFER_SIZE];
 };
 
 /* HIDP init defines */
diff --git a/net/can/raw.c b/net/can/raw.c
index 8be757cca2ec..081e81fd017f 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -121,13 +121,9 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
         if (!ro->recv_own_msgs && oskb->sk == sk)
                 return;
 
-        /* do not pass frames with DLC > 8 to a legacy socket */
-        if (!ro->fd_frames) {
-                struct canfd_frame *cfd = (struct canfd_frame *)oskb->data;
-
-                if (unlikely(cfd->len > CAN_MAX_DLEN))
-                        return;
-        }
+        /* do not pass non-CAN2.0 frames to a legacy socket */
+        if (!ro->fd_frames && oskb->len != CAN_MTU)
+                return;
 
         /* clone the given skb to be able to enqueue it into the rcv queue */
         skb = skb_clone(oskb, GFP_ATOMIC);
@@ -738,9 +734,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *msg, size_t size, int flags)
 {
         struct sock *sk = sock->sk;
-        struct raw_sock *ro = raw_sk(sk);
         struct sk_buff *skb;
-        int rxmtu;
         int err = 0;
         int noblock;
 
@@ -751,20 +745,10 @@ static int raw_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        /*
-         * when serving a legacy socket the DLC <= 8 is already checked inside
-         * raw_rcv(). Now check if we need to pass a canfd_frame to a legacy
-         * socket and cut the possible CANFD_MTU/CAN_MTU length to CAN_MTU
-         */
-        if (!ro->fd_frames)
-                rxmtu = CAN_MTU;
-        else
-                rxmtu = skb->len;
-
-        if (size < rxmtu)
+        if (size < skb->len)
                 msg->msg_flags |= MSG_TRUNC;
         else
-                size = rxmtu;
+                size = skb->len;
 
         err = memcpy_toiovec(msg->msg_iov, skb->data, size);
         if (err < 0) {
diff --git a/net/core/dev.c b/net/core/dev.c
index 4ad1b78c9c77..b1b0c8d4d7df 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2420,7 +2420,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault);
  * 2. No high memory really exists on this machine.
  */
 
-static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+static int illegal_highdma(const struct net_device *dev, struct sk_buff *skb)
 {
 #ifdef CONFIG_HIGHMEM
         int i;
@@ -2495,34 +2495,36 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features)
 }
 
 static netdev_features_t harmonize_features(struct sk_buff *skb,
-        netdev_features_t features)
+                                            const struct net_device *dev,
+                                            netdev_features_t features)
 {
         if (skb->ip_summed != CHECKSUM_NONE &&
             !can_checksum_protocol(features, skb_network_protocol(skb))) {
                 features &= ~NETIF_F_ALL_CSUM;
-        } else if (illegal_highdma(skb->dev, skb)) {
+        } else if (illegal_highdma(dev, skb)) {
                 features &= ~NETIF_F_SG;
         }
 
         return features;
 }
 
-netdev_features_t netif_skb_features(struct sk_buff *skb)
+netdev_features_t netif_skb_dev_features(struct sk_buff *skb,
+                                         const struct net_device *dev)
 {
         __be16 protocol = skb->protocol;
-        netdev_features_t features = skb->dev->features;
+        netdev_features_t features = dev->features;
 
-        if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
+        if (skb_shinfo(skb)->gso_segs > dev->gso_max_segs)
                 features &= ~NETIF_F_GSO_MASK;
 
         if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
                 struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
                 protocol = veh->h_vlan_encapsulated_proto;
         } else if (!vlan_tx_tag_present(skb)) {
-                return harmonize_features(skb, features);
+                return harmonize_features(skb, dev, features);
         }
 
-        features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
+        features &= (dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
                                                NETIF_F_HW_VLAN_STAG_TX);
 
         if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD))
@@ -2530,9 +2532,9 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
                                 NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_CTAG_TX |
                                 NETIF_F_HW_VLAN_STAG_TX;
 
-        return harmonize_features(skb, features);
+        return harmonize_features(skb, dev, features);
 }
-EXPORT_SYMBOL(netif_skb_features);
+EXPORT_SYMBOL(netif_skb_dev_features);
 
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                         struct netdev_queue *txq)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 87577d447554..e29e810663d7 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -323,17 +323,6 @@ u32 __skb_get_poff(const struct sk_buff *skb)
         return poff;
 }
 
-static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
-{
-        if (unlikely(queue_index >= dev->real_num_tx_queues)) {
-                net_warn_ratelimited("%s selects TX queue %d, but real number of TX queues is %d\n",
-                                     dev->name, queue_index,
-                                     dev->real_num_tx_queues);
-                return 0;
-        }
-        return queue_index;
-}
-
 static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
 {
 #ifdef CONFIG_XPS
@@ -372,7 +361,7 @@ static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
 #endif
 }
 
-u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
+static u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         int queue_index = sk_tx_queue_get(sk);
@@ -392,7 +381,6 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
 
         return queue_index;
 }
-EXPORT_SYMBOL(__netdev_pick_tx);
 
 struct netdev_queue *netdev_pick_tx(struct net_device *dev,
                                     struct sk_buff *skb,
@@ -403,13 +391,13 @@ struct netdev_queue *netdev_pick_tx(struct net_device *dev,
         if (dev->real_num_tx_queues != 1) {
                 const struct net_device_ops *ops = dev->netdev_ops;
                 if (ops->ndo_select_queue)
-                        queue_index = ops->ndo_select_queue(dev, skb,
-                                                            accel_priv);
+                        queue_index = ops->ndo_select_queue(dev, skb, accel_priv,
+                                                            __netdev_pick_tx);
                 else
                         queue_index = __netdev_pick_tx(dev, skb);
 
                 if (!accel_priv)
-                        queue_index = dev_cap_txqueue(dev, queue_index);
+                        queue_index = netdev_cap_txqueue(dev, queue_index);
         }
 
         skb_set_queue_mapping(skb, queue_index);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b9e9e0d38672..e16129019c66 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -766,9 +766,6 @@ static void neigh_periodic_work(struct work_struct *work)
         nht = rcu_dereference_protected(tbl->nht,
                                         lockdep_is_held(&tbl->lock));
 
-        if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
-                goto out;
-
         /*
          *      periodically recompute ReachableTime from random function
          */
@@ -781,6 +778,9 @@ static void neigh_periodic_work(struct work_struct *work)
                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
         }
 
+        if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
+                goto out;
+
         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
                 np = &nht->hash_buckets[i];
 
@@ -3046,7 +3046,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
         if (!t)
                 goto err;
 
-        for (i = 0; i < ARRAY_SIZE(t->neigh_vars); i++) {
+        for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
                 t->neigh_vars[i].data += (long) p;
                 t->neigh_vars[i].extra1 = dev;
                 t->neigh_vars[i].extra2 = p;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 048dc8d183aa..1a0dac2ef9ad 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1963,16 +1963,21 @@ replay:
 
                 dev->ifindex = ifm->ifi_index;
 
-                if (ops->newlink)
+                if (ops->newlink) {
                         err = ops->newlink(net, dev, tb, data);
-                else
+                        /* Drivers should call free_netdev() in ->destructor
+                         * and unregister it on failure so that device could be
+                         * finally freed in rtnl_unlock.
+                         */
+                        if (err < 0)
+                                goto out;
+                } else {
                         err = register_netdevice(dev);
-
-                if (err < 0) {
-                        free_netdev(dev);
-                        goto out;
+                        if (err < 0) {
+                                free_netdev(dev);
+                                goto out;
+                        }
                 }
-
                 err = rtnl_configure_link(dev, ifm);
                 if (err < 0)
                         unregister_netdevice(dev);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5976ef0846bd..5d6236d9fdce 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -707,9 +707,6 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->mark               = old->mark;
         new->skb_iif            = old->skb_iif;
         __nf_copy(new, old);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
-        new->nf_trace           = old->nf_trace;
-#endif
 #ifdef CONFIG_NET_SCHED
         new->tc_index           = old->tc_index;
 #ifdef CONFIG_NET_CLS_ACT
diff --git a/net/dccp/ccids/lib/tfrc.c b/net/dccp/ccids/lib/tfrc.c
index c073b81a1f3e..62b5828acde0 100644
--- a/net/dccp/ccids/lib/tfrc.c
+++ b/net/dccp/ccids/lib/tfrc.c
@@ -8,7 +8,7 @@
 #include "tfrc.h"
 
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
-static bool tfrc_debug;
+bool tfrc_debug;
 module_param(tfrc_debug, bool, 0644);
 MODULE_PARM_DESC(tfrc_debug, "Enable TFRC debug messages");
 #endif
diff --git a/net/dccp/ccids/lib/tfrc.h b/net/dccp/ccids/lib/tfrc.h
index a3d8f7c76ae0..40ee7d62b652 100644
--- a/net/dccp/ccids/lib/tfrc.h
+++ b/net/dccp/ccids/lib/tfrc.h
@@ -21,6 +21,7 @@
 #include "packet_history.h"
 
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
+extern bool tfrc_debug;
 #define tfrc_pr_debug(format, a...)     DCCP_PR_DEBUG(tfrc_debug, format, ##a)
 #else
 #define tfrc_pr_debug(format, a...)
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 327060c6c874..7ae0d7f6dbd0 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -297,7 +297,7 @@ static bool seq_nr_after(u16 a, u16 b)
 
 void hsr_register_frame_in(struct node_entry *node, enum hsr_dev_idx dev_idx)
 {
-        if ((dev_idx < 0) || (dev_idx >= HSR_MAX_DEV)) {
+        if ((dev_idx < 0) || (dev_idx >= HSR_MAX_SLAVE)) {
                 WARN_ONCE(1, "%s: Invalid dev_idx (%d)\n", __func__, dev_idx);
                 return;
         }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index ecd2c3f245ce..19ab78aca547 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1296,8 +1296,11 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 
         segs = ERR_PTR(-EPROTONOSUPPORT);
 
-        /* Note : following gso_segment() might change skb->encapsulation */
-        udpfrag = !skb->encapsulation && proto == IPPROTO_UDP;
+        if (skb->encapsulation &&
+            skb_shinfo(skb)->gso_type & (SKB_GSO_SIT|SKB_GSO_IPIP))
+                udpfrag = proto == IPPROTO_UDP && encap;
+        else
+                udpfrag = proto == IPPROTO_UDP && !skb->encapsulation;
 
         ops = rcu_dereference(inet_offloads[proto]);
         if (likely(ops && ops->callbacks.gso_segment))
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index e9f1217a8afd..f3869c186d97 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -39,6 +39,71 @@
 #include <net/route.h>
 #include <net/xfrm.h>
 
+static bool ip_may_fragment(const struct sk_buff *skb)
+{
+        return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+               !skb->local_df;
+}
+
+static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+{
+        if (skb->len <= mtu || skb->local_df)
+                return false;
+
+        if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+                return false;
+
+        return true;
+}
+
+static bool ip_gso_exceeds_dst_mtu(const struct sk_buff *skb)
+{
+        unsigned int mtu;
+
+        if (skb->local_df || !skb_is_gso(skb))
+                return false;
+
+        mtu = ip_dst_mtu_maybe_forward(skb_dst(skb), true);
+
+        /* if seglen > mtu, do software segmentation for IP fragmentation on
+         * output.  DF bit cannot be set since ip_forward would have sent
+         * icmp error.
+         */
+        return skb_gso_network_seglen(skb) > mtu;
+}
+
+/* called if GSO skb needs to be fragmented on forward */
+static int ip_forward_finish_gso(struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        netdev_features_t features;
+        struct sk_buff *segs;
+        int ret = 0;
+
+        features = netif_skb_dev_features(skb, dst->dev);
+        segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+        if (IS_ERR(segs)) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        consume_skb(skb);
+
+        do {
+                struct sk_buff *nskb = segs->next;
+                int err;
+
+                segs->next = NULL;
+                err = dst_output(segs);
+
+                if (err && ret == 0)
+                        ret = err;
+                segs = nskb;
+        } while (segs);
+
+        return ret;
+}
+
 static int ip_forward_finish(struct sk_buff *skb)
 {
         struct ip_options *opt  = &(IPCB(skb)->opt);
@@ -49,6 +114,9 @@ static int ip_forward_finish(struct sk_buff *skb)
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
 
+        if (ip_gso_exceeds_dst_mtu(skb))
+                return ip_forward_finish_gso(skb);
+
         return dst_output(skb);
 }
 
@@ -91,8 +159,7 @@ int ip_forward(struct sk_buff *skb)
 
         IPCB(skb)->flags |= IPSKB_FORWARDED;
         mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
-        if (unlikely(skb->len > mtu && !skb_is_gso(skb) &&
-                     (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
+        if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, mtu)) {
                 IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                           htonl(mtu));
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 8971780aec7c..73c6b63bba74 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -422,9 +422,6 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->tc_index = from->tc_index;
 #endif
         nf_copy(to, from);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
-        to->nf_trace = from->nf_trace;
-#endif
 #if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
         to->ipvs_property = from->ipvs_property;
 #endif
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 50228be5c17b..78a89e61925d 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -93,13 +93,14 @@ static void tunnel_dst_reset(struct ip_tunnel *t)
         tunnel_dst_set(t, NULL);
 }
 
-static void tunnel_dst_reset_all(struct ip_tunnel *t)
+void ip_tunnel_dst_reset_all(struct ip_tunnel *t)
 {
         int i;
 
         for_each_possible_cpu(i)
                 __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);
 }
+EXPORT_SYMBOL(ip_tunnel_dst_reset_all);
 
 static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
 {
@@ -119,52 +120,6 @@ static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
         return (struct rtable *)dst;
 }
 
-/* Often modified stats are per cpu, other are shared (netdev->stats) */
-struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
-                                                struct rtnl_link_stats64 *tot)
-{
-        int i;
-
-        for_each_possible_cpu(i) {
-                const struct pcpu_sw_netstats *tstats =
-                                                   per_cpu_ptr(dev->tstats, i);
-                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
-                unsigned int start;
-
-                do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
-                        rx_packets = tstats->rx_packets;
-                        tx_packets = tstats->tx_packets;
-                        rx_bytes = tstats->rx_bytes;
-                        tx_bytes = tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
-
-                tot->rx_packets += rx_packets;
-                tot->tx_packets += tx_packets;
-                tot->rx_bytes   += rx_bytes;
-                tot->tx_bytes   += tx_bytes;
-        }
-
-        tot->multicast = dev->stats.multicast;
-
-        tot->rx_crc_errors = dev->stats.rx_crc_errors;
-        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
-        tot->rx_length_errors = dev->stats.rx_length_errors;
-        tot->rx_frame_errors = dev->stats.rx_frame_errors;
-        tot->rx_errors = dev->stats.rx_errors;
-
-        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
-        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
-        tot->tx_dropped = dev->stats.tx_dropped;
-        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
-        tot->tx_errors = dev->stats.tx_errors;
-
-        tot->collisions  = dev->stats.collisions;
-
-        return tot;
-}
-EXPORT_SYMBOL_GPL(ip_tunnel_get_stats64);
-
 static bool ip_tunnel_key_match(const struct ip_tunnel_parm *p,
                                 __be16 flags, __be32 key)
 {
@@ -759,7 +714,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn,
                 if (set_mtu)
                         dev->mtu = mtu;
         }
-        tunnel_dst_reset_all(t);
+        ip_tunnel_dst_reset_all(t);
         netdev_state_change(dev);
 }
 
@@ -1088,7 +1043,7 @@ void ip_tunnel_uninit(struct net_device *dev)
         if (itn->fb_tunnel_dev != dev)
                 ip_tunnel_del(netdev_priv(dev));
 
-        tunnel_dst_reset_all(tunnel);
+        ip_tunnel_dst_reset_all(tunnel);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_uninit);
 
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 6156f4ef5e91..6f847dd56dbc 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -108,7 +108,6 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
         nf_reset(skb);
         secpath_reset(skb);
         skb_clear_hash_if_not_l4(skb);
-        skb_dst_drop(skb);
         skb->vlan_tci = 0;
         skb_set_queue_mapping(skb, 0);
         skb->pkt_type = PACKET_HOST;
@@ -148,3 +147,49 @@ error:
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(iptunnel_handle_offloads);
+
+/* Often modified stats are per cpu, other are shared (netdev->stats) */
+struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *tot)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                const struct pcpu_sw_netstats *tstats =
+                                                   per_cpu_ptr(dev->tstats, i);
+                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
+                unsigned int start;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        rx_packets = tstats->rx_packets;
+                        tx_packets = tstats->tx_packets;
+                        rx_bytes = tstats->rx_bytes;
+                        tx_bytes = tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+
+                tot->rx_packets += rx_packets;
+                tot->tx_packets += tx_packets;
+                tot->rx_bytes   += rx_bytes;
+                tot->tx_bytes   += tx_bytes;
+        }
+
+        tot->multicast = dev->stats.multicast;
+
+        tot->rx_crc_errors = dev->stats.rx_crc_errors;
+        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
+        tot->rx_length_errors = dev->stats.rx_length_errors;
+        tot->rx_frame_errors = dev->stats.rx_frame_errors;
+        tot->rx_errors = dev->stats.rx_errors;
+
+        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
+        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
+        tot->tx_dropped = dev->stats.tx_dropped;
+        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
+        tot->tx_errors = dev->stats.tx_errors;
+
+        tot->collisions  = dev->stats.collisions;
+
+        return tot;
+}
+EXPORT_SYMBOL_GPL(ip_tunnel_get_stats64);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index efa1138fa523..b3e86ea7b71b 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -273,7 +273,7 @@ static int __init ic_open_devs(void)
 
                 msleep(1);
 
-                if time_before(jiffies, next_msg)
+                if (time_before(jiffies, next_msg))
                         continue;
 
                 elapsed = jiffies_to_msecs(jiffies - start);
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index d551e31b416e..7c676671329d 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1198,8 +1198,8 @@ static int snmp_translate(struct nf_conn *ct,
                 map.to = NOCT1(&ct->tuplehash[!dir].tuple.dst.u3.ip);
         } else {
                 /* DNAT replies */
-                map.from = NOCT1(&ct->tuplehash[dir].tuple.src.u3.ip);
-                map.to = NOCT1(&ct->tuplehash[!dir].tuple.dst.u3.ip);
+                map.from = NOCT1(&ct->tuplehash[!dir].tuple.src.u3.ip);
+                map.to = NOCT1(&ct->tuplehash[dir].tuple.dst.u3.ip);
         }
 
         if (map.from == map.to)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 25071b48921c..4c011ec69ed4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1597,6 +1597,7 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->rt_gateway = 0;
         rth->rt_uses_gateway = 0;
         INIT_LIST_HEAD(&rth->rt_uncached);
+        RT_CACHE_STAT_INC(in_slow_tot);
 
         rth->dst.input = ip_forward;
         rth->dst.output = ip_output;
@@ -1695,10 +1696,11 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         fl4.daddr = daddr;
         fl4.saddr = saddr;
         err = fib_lookup(net, &fl4, &res);
-        if (err != 0)
+        if (err != 0) {
+                if (!IN_DEV_FORWARD(in_dev))
+                        err = -EHOSTUNREACH;
                 goto no_route;
-
-        RT_CACHE_STAT_INC(in_slow_tot);
+        }
 
         if (res.type == RTN_BROADCAST)
                 goto brd_input;
@@ -1712,8 +1714,10 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 goto local_input;
         }
 
-        if (!IN_DEV_FORWARD(in_dev))
+        if (!IN_DEV_FORWARD(in_dev)) {
+                err = -EHOSTUNREACH;
                 goto no_route;
+        }
         if (res.type != RTN_UNICAST)
                 goto martian_destination;
 
@@ -1768,6 +1772,7 @@ local_input:
         rth->rt_gateway = 0;
         rth->rt_uses_gateway = 0;
         INIT_LIST_HEAD(&rth->rt_uncached);
+        RT_CACHE_STAT_INC(in_slow_tot);
         if (res.type == RTN_UNREACHABLE) {
                 rth->dst.input= ip_error;
                 rth->dst.error= -err;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9f3a2db9109e..97c8f5620c43 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1044,7 +1044,8 @@ void tcp_free_fastopen_req(struct tcp_sock *tp)
         }
 }
 
-static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)
+static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
+                                int *copied, size_t size)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int err, flags;
@@ -1059,11 +1060,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)
         if (unlikely(tp->fastopen_req == NULL))
                 return -ENOBUFS;
         tp->fastopen_req->data = msg;
+        tp->fastopen_req->size = size;
 
         flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
         err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
                                     msg->msg_namelen, flags);
-        *size = tp->fastopen_req->copied;
+        *copied = tp->fastopen_req->copied;
         tcp_free_fastopen_req(tp);
         return err;
 }
@@ -1083,7 +1085,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         flags = msg->msg_flags;
         if (flags & MSG_FASTOPEN) {
-                err = tcp_sendmsg_fastopen(sk, msg, &copied_syn);
+                err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
                 if (err == -EINPROGRESS && copied_syn > 0)
                         goto out;
                 else if (err)
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index ad37bf18ae4b..2388275adb9b 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -290,8 +290,7 @@ bool tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
         left = tp->snd_cwnd - in_flight;
         if (sk_can_gso(sk) &&
             left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
-            left * tp->mss_cache < sk->sk_gso_max_size &&
-            left < sk->sk_gso_max_segs)
+            left < tp->xmit_size_goal_segs)
                 return true;
         return left <= tcp_max_tso_deferred_mss(tp);
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 227cba79fa6b..eeaac399420d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1945,8 +1945,9 @@ void tcp_enter_loss(struct sock *sk, int how)
                 if (skb == tcp_send_head(sk))
                         break;
 
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_RETRANS)
+                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
                         tp->undo_marker = 0;
+
                 TCP_SKB_CB(skb)->sacked &= (~TCPCB_TAGBITS)|TCPCB_SACKED_ACKED;
                 if (!(TCP_SKB_CB(skb)->sacked&TCPCB_SACKED_ACKED) || how) {
                         TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_ACKED;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3be16727f058..f0eb4e337ec8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -864,8 +864,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
                 if (unlikely(skb->fclone == SKB_FCLONE_ORIG &&
                              fclone->fclone == SKB_FCLONE_CLONE))
-                        NET_INC_STATS_BH(sock_net(sk),
-                                         LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
+                        NET_INC_STATS(sock_net(sk),
+                                      LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
 
                 if (unlikely(skb_cloned(skb)))
                         skb = pskb_copy(skb, gfp_mask);
@@ -2337,6 +2337,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         unsigned int cur_mss;
+        int err;
 
         /* Inconslusive MTU probe */
         if (icsk->icsk_mtup.probe_size) {
@@ -2400,11 +2401,15 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                      skb_headroom(skb) >= 0xFFFF)) {
                 struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
                                                    GFP_ATOMIC);
-                return nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
-                              -ENOBUFS;
+                err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
+                             -ENOBUFS;
         } else {
-                return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
+                err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
         }
+
+        if (likely(!err))
+                TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
+        return err;
 }
 
 int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
@@ -2908,7 +2913,12 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
         space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
                 MAX_TCP_OPTION_SPACE;
 
-        syn_data = skb_copy_expand(syn, skb_headroom(syn), space,
+        space = min_t(size_t, space, fo->size);
+
+        /* limit to order-0 allocations */
+        space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
+
+        syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
                                    sk->sk_allocation);
         if (syn_data == NULL)
                 goto fallback;
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index d92e5586783e..438a73aa777c 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -138,6 +138,7 @@ config INET6_XFRM_MODE_ROUTEOPTIMIZATION
 config IPV6_VTI
 tristate "Virtual (secure) IPv6: tunneling"
         select IPV6_TUNNEL
+        select NET_IP_TUNNEL
         depends on INET6_XFRM_MODE_TUNNEL
         ---help---
         Tunneling means encapsulating data of one protocol type within
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ad235690684c..fdbfeca36d63 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2783,6 +2783,8 @@ static void addrconf_gre_config(struct net_device *dev)
         ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
         if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
                 addrconf_add_linklocal(idev, &addr);
+        else
+                addrconf_prefix_route(&addr, 64, dev, 0, 0);
 }
 #endif
 
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 140748debc4a..8af3eb57f438 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -212,7 +212,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                 found = (nexthdr == target);
 
                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
-                        if (target < 0)
+                        if (target < 0 || found)
                                 break;
                         return -ENOENT;
                 }
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 1e8683b135bb..59f95affceb0 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -89,7 +89,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         unsigned int unfrag_ip6hlen;
         u8 *prevhdr;
         int offset = 0;
-        bool tunnel;
+        bool encap, udpfrag;
         int nhoff;
 
         if (unlikely(skb_shinfo(skb)->gso_type &
@@ -110,8 +110,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
                 goto out;
 
-        tunnel = SKB_GSO_CB(skb)->encap_level > 0;
-        if (tunnel)
+        encap = SKB_GSO_CB(skb)->encap_level > 0;
+        if (encap)
                 features = skb->dev->hw_enc_features & netif_skb_features(skb);
         SKB_GSO_CB(skb)->encap_level += sizeof(*ipv6h);
 
@@ -121,6 +121,12 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
         proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
 
+        if (skb->encapsulation &&
+            skb_shinfo(skb)->gso_type & (SKB_GSO_SIT|SKB_GSO_IPIP))
+                udpfrag = proto == IPPROTO_UDP && encap;
+        else
+                udpfrag = proto == IPPROTO_UDP && !skb->encapsulation;
+
         ops = rcu_dereference(inet6_offloads[proto]);
         if (likely(ops && ops->callbacks.gso_segment)) {
                 skb_reset_transport_header(skb);
@@ -133,13 +139,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         for (skb = segs; skb; skb = skb->next) {
                 ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
                 ipv6h->payload_len = htons(skb->len - nhoff - sizeof(*ipv6h));
-                if (tunnel) {
-                        skb_reset_inner_headers(skb);
-                        skb->encapsulation = 1;
-                }
                 skb->network_header = (u8 *)ipv6h - skb->head;
 
-                if (!tunnel && proto == IPPROTO_UDP) {
+                if (udpfrag) {
                         unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
                         fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);
                         fptr->frag_off = htons(offset);
@@ -148,6 +150,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                         offset += (ntohs(ipv6h->payload_len) -
                                    sizeof(struct frag_hdr));
                 }
+                if (encap)
+                        skb_reset_inner_headers(skb);
         }
 
 out:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ef02b26ccf81..16f91a2e7888 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -342,6 +342,20 @@ static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
         return mtu;
 }
 
+static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
+{
+        if (skb->len <= mtu || skb->local_df)
+                return false;
+
+        if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
+                return true;
+
+        if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+                return false;
+
+        return true;
+}
+
 int ip6_forward(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
@@ -466,8 +480,7 @@ int ip6_forward(struct sk_buff *skb)
         if (mtu < IPV6_MIN_MTU)
                 mtu = IPV6_MIN_MTU;
 
-        if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
-            (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
+        if (ip6_pkt_too_big(skb, mtu)) {
                 /* Again, force OUTPUT device used as source address */
                 skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
@@ -517,9 +530,6 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->tc_index = from->tc_index;
 #endif
         nf_copy(to, from);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
-        to->nf_trace = from->nf_trace;
-#endif
         skb_copy_secmark(to, from);
 }
 
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index fb9beb78f00b..587bbdcb22b4 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -135,6 +135,7 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         fl6.flowi6_proto = IPPROTO_ICMPV6;
         fl6.saddr = np->saddr;
         fl6.daddr = *daddr;
+        fl6.flowi6_mark = sk->sk_mark;
         fl6.fl6_icmp_type = user_icmph.icmp6_type;
         fl6.fl6_icmp_code = user_icmph.icmp6_code;
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3dfbcf1dcb1c..b4d74c86586c 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -475,6 +475,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
                 ipip6_tunnel_unlink(sitn, tunnel);
                 ipip6_tunnel_del_prl(tunnel, NULL);
         }
+        ip_tunnel_dst_reset_all(tunnel);
         dev_put(dev);
 }
 
@@ -1082,6 +1083,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
                 t->parms.link = p->link;
                 ipip6_tunnel_bind_dev(t->dev);
         }
+        ip_tunnel_dst_reset_all(t);
         netdev_state_change(t->dev);
 }
 
@@ -1112,6 +1114,7 @@ static int ipip6_tunnel_update_6rd(struct ip_tunnel *t,
         t->ip6rd.relay_prefix = relay_prefix;
         t->ip6rd.prefixlen = ip6rd->prefixlen;
         t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;
+        ip_tunnel_dst_reset_all(t);
         netdev_state_change(t->dev);
         return 0;
 }
@@ -1271,6 +1274,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                         err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
                         break;
                 }
+                ip_tunnel_dst_reset_all(t);
                 netdev_state_change(dev);
                 break;
 
@@ -1326,6 +1330,9 @@ static const struct net_device_ops ipip6_netdev_ops = {
 
 static void ipip6_dev_free(struct net_device *dev)
 {
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+
+        free_percpu(tunnel->dst_cache);
         free_percpu(dev->tstats);
         free_netdev(dev);
 }
@@ -1375,6 +1382,12 @@ static int ipip6_tunnel_init(struct net_device *dev)
                 u64_stats_init(&ipip6_tunnel_stats->syncp);
         }
 
+        tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+        if (!tunnel->dst_cache) {
+                free_percpu(dev->tstats);
+                return -ENOMEM;
+        }
+
         return 0;
 }
 
@@ -1405,6 +1418,12 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
                 u64_stats_init(&ipip6_fb_stats->syncp);
         }
 
+        tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+        if (!tunnel->dst_cache) {
+                free_percpu(dev->tstats);
+                return -ENOMEM;
+        }
+
         dev_hold(dev);
         rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
         return 0;
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index e7359f9eaa8d..b261ee8b83fc 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -113,7 +113,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                 fptr->nexthdr = nexthdr;
                 fptr->reserved = 0;
-                ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
+                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
 
                 /* Fragment the skb. ipv6 header and the remaining fields of the
                  * fragment header are updated in ipv6_gso_segment()
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3701930c6649..5e44e3179e02 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1692,14 +1692,8 @@ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
 void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
 void ieee80211_add_pending_skb(struct ieee80211_local *local,
                                struct sk_buff *skb);
-void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
-                                   struct sk_buff_head *skbs,
-                                   void (*fn)(void *data), void *data);
-static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                                              struct sk_buff_head *skbs)
-{
-        ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
-}
+void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                struct sk_buff_head *skbs);
 void ieee80211_flush_queues(struct ieee80211_local *local,
                             struct ieee80211_sub_if_data *sdata);
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d6d1f1df9119..ce1c44370610 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1057,7 +1057,8 @@ static void ieee80211_uninit(struct net_device *dev)
 
 static u16 ieee80211_netdev_select_queue(struct net_device *dev,
                                          struct sk_buff *skb,
-                                         void *accel_priv)
+                                         void *accel_priv,
+                                         select_queue_fallback_t fallback)
 {
         return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
 }
@@ -1075,7 +1076,8 @@ static const struct net_device_ops ieee80211_dataif_ops = {
 
 static u16 ieee80211_monitor_select_queue(struct net_device *dev,
                                           struct sk_buff *skb,
-                                          void *accel_priv)
+                                          void *accel_priv,
+                                          select_queue_fallback_t fallback)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index fc1d82465b3c..245dce969b31 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -222,6 +222,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         switch (vht_oper->chan_width) {
         case IEEE80211_VHT_CHANWIDTH_USE_HT:
                 vht_chandef.width = chandef->width;
+                vht_chandef.center_freq1 = chandef->center_freq1;
                 break;
         case IEEE80211_VHT_CHANWIDTH_80MHZ:
                 vht_chandef.width = NL80211_CHAN_WIDTH_80;
@@ -271,6 +272,28 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         ret = 0;
 
 out:
+        /*
+         * When tracking the current AP, don't do any further checks if the
+         * new chandef is identical to the one we're currently using for the
+         * connection. This keeps us from playing ping-pong with regulatory,
+         * without it the following can happen (for example):
+         *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
+         *  - AP advertises regdom US
+         *  - CRDA loads regdom US with 80 MHz prohibited (old database)
+         *  - the code below detects an unsupported channel, downgrades, and
+         *    we disconnect from the AP in the caller
+         *  - disconnect causes CRDA to reload world regdomain and the game
+         *    starts anew.
+         * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
+         *
+         * It seems possible that there are still scenarios with CSA or real
+         * bandwidth changes where a this could happen, but those cases are
+         * less common and wouldn't completely prevent using the AP.
+         */
+        if (tracking &&
+            cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
+                return ret;
+
         /* don't print the message below for VHT mismatch if VHT is disabled */
         if (ret & IEEE80211_STA_DISABLE_VHT)
                 vht_chandef = *chandef;
@@ -3753,6 +3776,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
                 if (WARN_ON(!chanctx_conf)) {
                         rcu_read_unlock();
+                        sta_info_free(local, new_sta);
                         return -EINVAL;
                 }
                 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c24ca0d0f469..3e57f96c9666 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1128,6 +1128,13 @@ static void sta_ps_end(struct sta_info *sta)
                sta->sta.addr, sta->sta.aid);
 
         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
+                /*
+                 * Clear the flag only if the other one is still set
+                 * so that the TX path won't start TX'ing new frames
+                 * directly ... In the case that the driver flag isn't
+                 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
+                 */
+                clear_sta_flag(sta, WLAN_STA_PS_STA);
                 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
                        sta->sta.addr, sta->sta.aid);
                 return;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index decd30c1e290..a023b432143b 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -91,7 +91,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         return -ENOENT;
 }
 
-static void cleanup_single_sta(struct sta_info *sta)
+static void __cleanup_single_sta(struct sta_info *sta)
 {
         int ac, i;
         struct tid_ampdu_tx *tid_tx;
@@ -99,7 +99,8 @@ static void cleanup_single_sta(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         struct ps_data *ps;
 
-        if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
+            test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         ps = &sdata->bss->ps;
@@ -109,6 +110,7 @@ static void cleanup_single_sta(struct sta_info *sta)
                         return;
 
                 clear_sta_flag(sta, WLAN_STA_PS_STA);
+                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 
                 atomic_dec(&ps->num_sta_ps);
                 sta_info_recalc_tim(sta);
@@ -139,7 +141,14 @@ static void cleanup_single_sta(struct sta_info *sta)
                 ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
                 kfree(tid_tx);
         }
+}
 
+static void cleanup_single_sta(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        __cleanup_single_sta(sta);
         sta_info_free(local, sta);
 }
 
@@ -330,6 +339,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 
         spin_lock_init(&sta->lock);
+        spin_lock_init(&sta->ps_lock);
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
         mutex_init(&sta->ampdu_mlme.mtx);
@@ -487,21 +497,26 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
                 goto out_err;
         }
 
-        /* notify driver */
-        err = sta_info_insert_drv_state(local, sdata, sta);
-        if (err)
-                goto out_err;
-
         local->num_sta++;
         local->sta_generation++;
         smp_mb();
 
+        /* simplify things and don't accept BA sessions yet */
+        set_sta_flag(sta, WLAN_STA_BLOCK_BA);
+
         /* make the station visible */
         sta_info_hash_add(local, sta);
 
         list_add_rcu(&sta->list, &local->sta_list);
 
+        /* notify driver */
+        err = sta_info_insert_drv_state(local, sdata, sta);
+        if (err)
+                goto out_remove;
+
         set_sta_flag(sta, WLAN_STA_INSERTED);
+        /* accept BA sessions now */
+        clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
 
         ieee80211_recalc_min_chandef(sdata);
         ieee80211_sta_debugfs_add(sta);
@@ -522,6 +537,12 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
                 mesh_accept_plinks_update(sdata);
 
         return 0;
+ out_remove:
+        sta_info_hash_del(local, sta);
+        list_del_rcu(&sta->list);
+        local->num_sta--;
+        synchronize_net();
+        __cleanup_single_sta(sta);
  out_err:
         mutex_unlock(&local->sta_mtx);
         rcu_read_lock();
@@ -1071,10 +1092,14 @@ struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
 }
 EXPORT_SYMBOL(ieee80211_find_sta);
 
-static void clear_sta_ps_flags(void *_sta)
+/* powersave support code */
+void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 {
-        struct sta_info *sta = _sta;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff_head pending;
+        int filtered = 0, buffered = 0, ac;
+        unsigned long flags;
         struct ps_data *ps;
 
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
@@ -1085,20 +1110,6 @@ static void clear_sta_ps_flags(void *_sta)
         else
                 return;
 
-        clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
-        if (test_and_clear_sta_flag(sta, WLAN_STA_PS_STA))
-                atomic_dec(&ps->num_sta_ps);
-}
-
-/* powersave support code */
-void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
-{
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff_head pending;
-        int filtered = 0, buffered = 0, ac;
-        unsigned long flags;
-
         clear_sta_flag(sta, WLAN_STA_SP);
 
         BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
@@ -1109,6 +1120,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 
         skb_queue_head_init(&pending);
 
+        /* sync with ieee80211_tx_h_unicast_ps_buf */
+        spin_lock(&sta->ps_lock);
         /* Send all buffered frames to the station */
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 int count = skb_queue_len(&pending), tmp;
@@ -1127,7 +1140,12 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
                 buffered += tmp - count;
         }
 
-        ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
+        ieee80211_add_pending_skbs(local, &pending);
+        clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
+        clear_sta_flag(sta, WLAN_STA_PS_STA);
+        spin_unlock(&sta->ps_lock);
+
+        atomic_dec(&ps->num_sta_ps);
 
         /* This station just woke up and isn't aware of our SMPS state */
         if (!ieee80211_smps_is_restrictive(sta->known_smps_mode,
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index d77ff7090630..d3a6d8208f2f 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -267,6 +267,7 @@ struct ieee80211_tx_latency_stat {
  * @drv_unblock_wk: used for driver PS unblocking
  * @listen_interval: listen interval of this station, when we're acting as AP
  * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
+ * @ps_lock: used for powersave (when mac80211 is the AP) related locking
  * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
  *      when it leaves power saving state or polls
  * @tx_filtered: buffers (per AC) of frames we already tried to
@@ -356,10 +357,8 @@ struct sta_info {
         /* use the accessors defined below */
         unsigned long _flags;
 
-        /*
-         * STA powersave frame queues, no more than the internal
-         * locking required.
-         */
+        /* STA powersave lock and frame queues */
+        spinlock_t ps_lock;
         struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
         struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
         unsigned long driver_buffered_tids;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 97a02d3f7d87..4080c615636f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -478,6 +478,20 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                        sta->sta.addr, sta->sta.aid, ac);
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
                         purge_old_ps_buffers(tx->local);
+
+                /* sync with ieee80211_sta_ps_deliver_wakeup */
+                spin_lock(&sta->ps_lock);
+                /*
+                 * STA woke up the meantime and all the frames on ps_tx_buf have
+                 * been queued to pending queue. No reordering can happen, go
+                 * ahead and Tx the packet.
+                 */
+                if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
+                    !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
+                        spin_unlock(&sta->ps_lock);
+                        return TX_CONTINUE;
+                }
+
                 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
                         ps_dbg(tx->sdata,
@@ -492,6 +506,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
                 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
+                spin_unlock(&sta->ps_lock);
 
                 if (!timer_pending(&local->sta_cleanup))
                         mod_timer(&local->sta_cleanup,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 676dc0967f37..b8700d417a9c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -435,9 +435,8 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
-void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
-                                   struct sk_buff_head *skbs,
-                                   void (*fn)(void *data), void *data)
+void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                struct sk_buff_head *skbs)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct sk_buff *skb;
@@ -461,9 +460,6 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                 __skb_queue_tail(&local->pending[queue], skb);
         }
 
-        if (fn)
-                fn(data);
-
         for (i = 0; i < hw->queues; i++)
                 __ieee80211_wake_queue(hw, i,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
@@ -1741,6 +1737,26 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
         /*
+         * Reconfigure sched scan if it was interrupted by FW restart or
+         * suspend.
+         */
+        mutex_lock(&local->mtx);
+        sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
+                                                lockdep_is_held(&local->mtx));
+        if (sched_scan_sdata && local->sched_scan_req)
+                /*
+                 * Sched scan stopped, but we don't want to report it. Instead,
+                 * we're trying to reschedule.
+                 */
+                if (__ieee80211_request_sched_scan_start(sched_scan_sdata,
+                                                         local->sched_scan_req))
+                        sched_scan_stopped = true;
+        mutex_unlock(&local->mtx);
+
+        if (sched_scan_stopped)
+                cfg80211_sched_scan_stopped(local->hw.wiphy);
+
+        /*
          * If this is for hw restart things are still running.
          * We may want to change that later, however.
          */
@@ -1768,26 +1784,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         WARN_ON(1);
 #endif
 
-        /*
-         * Reconfigure sched scan if it was interrupted by FW restart or
-         * suspend.
-         */
-        mutex_lock(&local->mtx);
-        sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
-                                                lockdep_is_held(&local->mtx));
-        if (sched_scan_sdata && local->sched_scan_req)
-                /*
-                 * Sched scan stopped, but we don't want to report it. Instead,
-                 * we're trying to reschedule.
-                 */
-                if (__ieee80211_request_sched_scan_start(sched_scan_sdata,
-                                                         local->sched_scan_req))
-                        sched_scan_stopped = true;
-        mutex_unlock(&local->mtx);
-
-        if (sched_scan_stopped)
-                cfg80211_sched_scan_stopped(local->hw.wiphy);
-
         return 0;
 }
 
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 21211c60ca98..d51422c778de 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -154,6 +154,11 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                 return IEEE80211_AC_BE;
         }
 
+        if (skb->protocol == sdata->control_port_protocol) {
+                skb->priority = 7;
+                return ieee80211_downgrade_queue(sdata, skb);
+        }
+
         /* use the data classifier to determine what 802.1d tag the
          * data frame has */
         rcu_read_lock();
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bb322d0beb48..b9f0e0374322 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1310,27 +1310,22 @@ ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])
 }
 
 static int
-ctnetlink_change_nat(struct nf_conn *ct, const struct nlattr * const cda[])
+ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 #ifdef CONFIG_NF_NAT_NEEDED
         int ret;
 
-        if (cda[CTA_NAT_DST]) {
-                ret = ctnetlink_parse_nat_setup(ct,
-                                                NF_NAT_MANIP_DST,
-                                                cda[CTA_NAT_DST]);
-                if (ret < 0)
-                        return ret;
-        }
-        if (cda[CTA_NAT_SRC]) {
-                ret = ctnetlink_parse_nat_setup(ct,
-                                                NF_NAT_MANIP_SRC,
-                                                cda[CTA_NAT_SRC]);
-                if (ret < 0)
-                        return ret;
-        }
-        return 0;
+        ret = ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_DST,
+                                        cda[CTA_NAT_DST]);
+        if (ret < 0)
+                return ret;
+
+        ret = ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_SRC,
+                                        cda[CTA_NAT_SRC]);
+        return ret;
 #else
+        if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC])
+                return 0;
         return -EOPNOTSUPP;
 #endif
 }
@@ -1659,11 +1654,9 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                         goto err2;
         }
 
-        if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
-                err = ctnetlink_change_nat(ct, cda);
-                if (err < 0)
-                        goto err2;
-        }
+        err = ctnetlink_setup_nat(ct, cda);
+        if (err < 0)
+                goto err2;
 
         nf_ct_acct_ext_add(ct, GFP_ATOMIC);
         nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index d3f5cd6dd962..52ca952b802c 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -432,15 +432,15 @@ nf_nat_setup_info(struct nf_conn *ct,
 }
 EXPORT_SYMBOL(nf_nat_setup_info);
 
-unsigned int
-nf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
+static unsigned int
+__nf_nat_alloc_null_binding(struct nf_conn *ct, enum nf_nat_manip_type manip)
 {
         /* Force range to this IP; let proto decide mapping for
          * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
          * Use reply in case it's already been mangled (eg local packet).
          */
         union nf_inet_addr ip =
-                (HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
+                (manip == NF_NAT_MANIP_SRC ?
                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3 :
                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3);
         struct nf_nat_range range = {
@@ -448,7 +448,13 @@ nf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
                 .min_addr       = ip,
                 .max_addr       = ip,
         };
-        return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
+        return nf_nat_setup_info(ct, &range, manip);
+}
+
+unsigned int
+nf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
+{
+        return __nf_nat_alloc_null_binding(ct, HOOK2MANIP(hooknum));
 }
 EXPORT_SYMBOL_GPL(nf_nat_alloc_null_binding);
 
@@ -702,9 +708,9 @@ static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
 
 static int
 nfnetlink_parse_nat(const struct nlattr *nat,
-                    const struct nf_conn *ct, struct nf_nat_range *range)
+                    const struct nf_conn *ct, struct nf_nat_range *range,
+                    const struct nf_nat_l3proto *l3proto)
 {
-        const struct nf_nat_l3proto *l3proto;
         struct nlattr *tb[CTA_NAT_MAX+1];
         int err;
 
@@ -714,38 +720,46 @@ nfnetlink_parse_nat(const struct nlattr *nat,
         if (err < 0)
                 return err;
 
-        rcu_read_lock();
-        l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
-        if (l3proto == NULL) {
-                err = -EAGAIN;
-                goto out;
-        }
         err = l3proto->nlattr_to_range(tb, range);
         if (err < 0)
-                goto out;
+                return err;
 
         if (!tb[CTA_NAT_PROTO])
-                goto out;
+                return 0;
 
-        err = nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO], ct, range);
-out:
-        rcu_read_unlock();
-        return err;
+        return nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO], ct, range);
 }
 
+/* This function is called under rcu_read_lock() */
 static int
 nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
                           const struct nlattr *attr)
 {
         struct nf_nat_range range;
+        const struct nf_nat_l3proto *l3proto;
         int err;
 
-        err = nfnetlink_parse_nat(attr, ct, &range);
+        /* Should not happen, restricted to creating new conntracks
+         * via ctnetlink.
+         */
+        if (WARN_ON_ONCE(nf_nat_initialized(ct, manip)))
+                return -EEXIST;
+
+        /* Make sure that L3 NAT is there by when we call nf_nat_setup_info to
+         * attach the null binding, otherwise this may oops.
+         */
+        l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
+        if (l3proto == NULL)
+                return -EAGAIN;
+
+        /* No NAT information has been passed, allocate the null-binding */
+        if (attr == NULL)
+                return __nf_nat_alloc_null_binding(ct, manip);
+
+        err = nfnetlink_parse_nat(attr, ct, &range, l3proto);
         if (err < 0)
                 return err;
-        if (nf_nat_initialized(ct, manip))
-                return -EEXIST;
 
         return nf_nat_setup_info(ct, &range, manip);
 }
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index e8254ad2e5a9..425cf39af890 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -116,7 +116,7 @@ static void nft_meta_get_eval(const struct nft_expr *expr,
                                  skb->sk->sk_socket->file->f_cred->fsgid);
                 read_unlock_bh(&skb->sk->sk_callback_lock);
                 break;
-#ifdef CONFIG_NET_CLS_ROUTE
+#ifdef CONFIG_IP_ROUTE_CLASSID
         case NFT_META_RTCLASSID: {
                 const struct dst_entry *dst = skb_dst(skb);
 
@@ -199,7 +199,7 @@ static int nft_meta_init_validate_get(uint32_t key)
         case NFT_META_OIFTYPE:
         case NFT_META_SKUID:
         case NFT_META_SKGID:
-#ifdef CONFIG_NET_CLS_ROUTE
+#ifdef CONFIG_IP_ROUTE_CLASSID
         case NFT_META_RTCLASSID:
 #endif
 #ifdef CONFIG_NETWORK_SECMARK
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index a2aeb318678f..85daa84bfdfe 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -135,7 +135,8 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
         if (len == 0 || len > FIELD_SIZEOF(struct nft_data, data))
                 return ERR_PTR(-EINVAL);
 
-        if (len <= 4 && IS_ALIGNED(offset, len) && base != NFT_PAYLOAD_LL_HEADER)
+        if (len <= 4 && is_power_of_2(len) && IS_ALIGNED(offset, len) &&
+            base != NFT_PAYLOAD_LL_HEADER)
                 return &nft_payload_fast_ops;
         else
                 return &nft_payload_ops;
diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 8a310f239c93..b718a52a4654 100644
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -21,9 +21,9 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
 {
         switch (pkt->ops->pf) {
         case NFPROTO_IPV4:
-                nft_reject_ipv4_eval(expr, data, pkt);
+                return nft_reject_ipv4_eval(expr, data, pkt);
         case NFPROTO_IPV6:
-                nft_reject_ipv6_eval(expr, data, pkt);
+                return nft_reject_ipv6_eval(expr, data, pkt);
         }
 }
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index fdf51353cf78..04748ab649c2 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1489,8 +1489,8 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
         if (addr->sa_family != AF_NETLINK)
                 return -EINVAL;
 
-        /* Only superuser is allowed to send multicasts */
-        if (nladdr->nl_groups && !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
+        if ((nladdr->nl_groups || nladdr->nl_pid) &&
+            !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
                 return -EPERM;
 
         if (!nlk->portid)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 46bda010bf11..56db888b1cd5 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -301,7 +301,7 @@ static int nci_open_device(struct nci_dev *ndev)
         rc = __nci_request(ndev, nci_reset_req, 0,
                            msecs_to_jiffies(NCI_RESET_TIMEOUT));
 
-        if (ndev->ops->setup(ndev))
+        if (ndev->ops->setup)
                 ndev->ops->setup(ndev);
 
         if (!rc) {
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6a2bb37506c5..48a6a93db296 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -308,11 +308,27 @@ static bool packet_use_direct_xmit(const struct packet_sock *po)
         return po->xmit == packet_direct_xmit;
 }
 
-static u16 packet_pick_tx_queue(struct net_device *dev)
+static u16 __packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
 {
         return (u16) raw_smp_processor_id() % dev->real_num_tx_queues;
 }
 
+static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+        u16 queue_index;
+
+        if (ops->ndo_select_queue) {
+                queue_index = ops->ndo_select_queue(dev, skb, NULL,
+                                                    __packet_pick_tx_queue);
+                queue_index = netdev_cap_txqueue(dev, queue_index);
+        } else {
+                queue_index = __packet_pick_tx_queue(dev, skb);
+        }
+
+        skb_set_queue_mapping(skb, queue_index);
+}
+
 /* register_prot_hook must be invoked with the po->bind_lock held,
  * or from a context in which asynchronous accesses to the packet
  * socket is not possible (packet_create()).
@@ -2285,7 +2301,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                         }
                 }
 
-                skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
+                packet_pick_tx_queue(dev, skb);
+
                 skb->destructor = tpacket_destruct_skb;
                 __packet_set_status(po, ph, TP_STATUS_SENDING);
                 packet_inc_pending(&po->tx_ring);
@@ -2499,7 +2516,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         skb->dev = dev;
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
-        skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
+
+        packet_pick_tx_queue(dev, skb);
 
         if (po->has_vnet_hdr) {
                 if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
@@ -3786,7 +3804,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                  */
                         if (!tx_ring)
                                 init_prb_bdqc(po, rb, pg_vec, req_u, tx_ring);
-                                break;
+                        break;
                 default:
                         break;
                 }
diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
index a255d0200a59..fefeeb73f15f 100644
--- a/net/sched/sch_pie.c
+++ b/net/sched/sch_pie.c
@@ -15,6 +15,11 @@
  *
  * ECN support is added by Naeem Khademi <naeemk@ifi.uio.no>
  * University of Oslo, Norway.
+ *
+ * References:
+ * IETF draft submission: http://tools.ietf.org/html/draft-pan-aqm-pie-00
+ * IEEE  Conference on High Performance Switching and Routing 2013 :
+ * "PIE: A * Lightweight Control Scheme to Address the Bufferbloat Problem"
  */
 
 #include <linux/module.h>
@@ -36,7 +41,7 @@ struct pie_params {
         psched_time_t target;   /* user specified target delay in pschedtime */
         u32 tupdate;            /* timer frequency (in jiffies) */
         u32 limit;              /* number of packets that can be enqueued */
-        u32 alpha;              /* alpha and beta are between -4 and 4 */
+        u32 alpha;              /* alpha and beta are between 0 and 32 */
         u32 beta;               /* and are used for shift relative to 1 */
         bool ecn;               /* true if ecn is enabled */
         bool bytemode;          /* to scale drop early prob based on pkt size */
@@ -326,10 +331,16 @@ static void calculate_probability(struct Qdisc *sch)
         if (qdelay == 0 && qlen != 0)
                 update_prob = false;
 
-        /* Add ranges for alpha and beta, more aggressive for high dropping
-         * mode and gentle steps for light dropping mode
-         * In light dropping mode, take gentle steps; in medium dropping mode,
-         * take medium steps; in high dropping mode, take big steps.
+        /* In the algorithm, alpha and beta are between 0 and 2 with typical
+         * value for alpha as 0.125. In this implementation, we use values 0-32
+         * passed from user space to represent this. Also, alpha and beta have
+         * unit of HZ and need to be scaled before they can used to update
+         * probability. alpha/beta are updated locally below by 1) scaling them
+         * appropriately 2) scaling down by 16 to come to 0-2 range.
+         * Please see paper for details.
+         *
+         * We scale alpha and beta differently depending on whether we are in
+         * light, medium or high dropping mode.
          */
         if (q->vars.prob < MAX_PROB / 100) {
                 alpha =
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 1cb413fead89..4f505a006896 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -334,18 +334,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                         qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate,
                                                       tb[TCA_TBF_PTAB]));
 
-        if (q->qdisc != &noop_qdisc) {
-                err = fifo_set_limit(q->qdisc, qopt->limit);
-                if (err)
-                        goto done;
-        } else if (qopt->limit > 0) {
-                child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit);
-                if (IS_ERR(child)) {
-                        err = PTR_ERR(child);
-                        goto done;
-                }
-        }
-
         buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U);
         mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U);
 
@@ -390,6 +378,18 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                 goto done;
         }
 
+        if (q->qdisc != &noop_qdisc) {
+                err = fifo_set_limit(q->qdisc, qopt->limit);
+                if (err)
+                        goto done;
+        } else if (qopt->limit > 0) {
+                child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit);
+                if (IS_ERR(child)) {
+                        err = PTR_ERR(child);
+                        goto done;
+                }
+        }
+
         sch_tree_lock(sch);
         if (child) {
                 qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 5ae609200674..ee13d28d39d1 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1239,78 +1239,107 @@ void sctp_assoc_update(struct sctp_association *asoc,
 }
 
 /* Update the retran path for sending a retransmitted packet.
- * Round-robin through the active transports, else round-robin
- * through the inactive transports as this is the next best thing
- * we can try.
+ * See also RFC4960, 6.4. Multi-Homed SCTP Endpoints:
+ *
+ *   When there is outbound data to send and the primary path
+ *   becomes inactive (e.g., due to failures), or where the
+ *   SCTP user explicitly requests to send data to an
+ *   inactive destination transport address, before reporting
+ *   an error to its ULP, the SCTP endpoint should try to send
+ *   the data to an alternate active destination transport
+ *   address if one exists.
+ *
+ *   When retransmitting data that timed out, if the endpoint
+ *   is multihomed, it should consider each source-destination
+ *   address pair in its retransmission selection policy.
+ *   When retransmitting timed-out data, the endpoint should
+ *   attempt to pick the most divergent source-destination
+ *   pair from the original source-destination pair to which
+ *   the packet was transmitted.
+ *
+ *   Note: Rules for picking the most divergent source-destination
+ *   pair are an implementation decision and are not specified
+ *   within this document.
+ *
+ * Our basic strategy is to round-robin transports in priorities
+ * according to sctp_state_prio_map[] e.g., if no such
+ * transport with state SCTP_ACTIVE exists, round-robin through
+ * SCTP_UNKNOWN, etc. You get the picture.
  */
-void sctp_assoc_update_retran_path(struct sctp_association *asoc)
+static const u8 sctp_trans_state_to_prio_map[] = {
+        [SCTP_ACTIVE]   = 3,    /* best case */
+        [SCTP_UNKNOWN]  = 2,
+        [SCTP_PF]       = 1,
+        [SCTP_INACTIVE] = 0,    /* worst case */
+};
+
+static u8 sctp_trans_score(const struct sctp_transport *trans)
 {
-        struct sctp_transport *t, *next;
-        struct list_head *head = &asoc->peer.transport_addr_list;
-        struct list_head *pos;
+        return sctp_trans_state_to_prio_map[trans->state];
+}
 
-        if (asoc->peer.transport_count == 1)
-                return;
+static struct sctp_transport *sctp_trans_elect_best(struct sctp_transport *curr,
+                                                    struct sctp_transport *best)
+{
+        if (best == NULL)
+                return curr;
 
-        /* Find the next transport in a round-robin fashion. */
-        t = asoc->peer.retran_path;
-        pos = &t->transports;
-        next = NULL;
+        return sctp_trans_score(curr) > sctp_trans_score(best) ? curr : best;
+}
 
-        while (1) {
-                /* Skip the head. */
-                if (pos->next == head)
-                        pos = head->next;
-                else
-                        pos = pos->next;
+void sctp_assoc_update_retran_path(struct sctp_association *asoc)
+{
+        struct sctp_transport *trans = asoc->peer.retran_path;
+        struct sctp_transport *trans_next = NULL;
 
-                t = list_entry(pos, struct sctp_transport, transports);
+        /* We're done as we only have the one and only path. */
+        if (asoc->peer.transport_count == 1)
+                return;
+        /* If active_path and retran_path are the same and active,
+         * then this is the only active path. Use it.
+         */
+        if (asoc->peer.active_path == asoc->peer.retran_path &&
+            asoc->peer.active_path->state == SCTP_ACTIVE)
+                return;
 
-                /* We have exhausted the list, but didn't find any
-                 * other active transports.  If so, use the next
-                 * transport.
-                 */
-                if (t == asoc->peer.retran_path) {
-                        t = next;
+        /* Iterate from retran_path's successor back to retran_path. */
+        for (trans = list_next_entry(trans, transports); 1;
+             trans = list_next_entry(trans, transports)) {
+                /* Manually skip the head element. */
+                if (&trans->transports == &asoc->peer.transport_addr_list)
+                        continue;
+                if (trans->state == SCTP_UNCONFIRMED)
+                        continue;
+                trans_next = sctp_trans_elect_best(trans, trans_next);
+                /* Active is good enough for immediate return. */
+                if (trans_next->state == SCTP_ACTIVE)
                         break;
-                }
-
-                /* Try to find an active transport. */
-
-                if ((t->state == SCTP_ACTIVE) ||
-                    (t->state == SCTP_UNKNOWN)) {
+                /* We've reached the end, time to update path. */
+                if (trans == asoc->peer.retran_path)
                         break;
-                } else {
-                        /* Keep track of the next transport in case
-                         * we don't find any active transport.
-                         */
-                        if (t->state != SCTP_UNCONFIRMED && !next)
-                                next = t;
-                }
         }
 
-        if (t)
-                asoc->peer.retran_path = t;
-        else
-                t = asoc->peer.retran_path;
+        if (trans_next != NULL)
+                asoc->peer.retran_path = trans_next;
 
-        pr_debug("%s: association:%p addr:%pISpc\n", __func__, asoc,
-                 &t->ipaddr.sa);
+        pr_debug("%s: association:%p updated new path to addr:%pISpc\n",
+                 __func__, asoc, &asoc->peer.retran_path->ipaddr.sa);
 }
 
-/* Choose the transport for sending retransmit packet.  */
-struct sctp_transport *sctp_assoc_choose_alter_transport(
-        struct sctp_association *asoc, struct sctp_transport *last_sent_to)
+struct sctp_transport *
+sctp_assoc_choose_alter_transport(struct sctp_association *asoc,
+                                  struct sctp_transport *last_sent_to)
 {
         /* If this is the first time packet is sent, use the active path,
          * else use the retran path. If the last packet was sent over the
          * retran path, update the retran path and use it.
          */
-        if (!last_sent_to)
+        if (last_sent_to == NULL) {
                 return asoc->peer.active_path;
-        else {
+        } else {
                 if (last_sent_to == asoc->peer.retran_path)
                         sctp_assoc_update_retran_path(asoc);
+
                 return asoc->peer.retran_path;
         }
 }
@@ -1367,44 +1396,35 @@ static inline bool sctp_peer_needs_update(struct sctp_association *asoc)
         return false;
 }
 
-/* Increase asoc's rwnd by len and send any window update SACK if needed. */
-void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
+/* Update asoc's rwnd for the approximated state in the buffer,
+ * and check whether SACK needs to be sent.
+ */
+void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
 {
+        int rx_count;
         struct sctp_chunk *sack;
         struct timer_list *timer;
 
-        if (asoc->rwnd_over) {
-                if (asoc->rwnd_over >= len) {
-                        asoc->rwnd_over -= len;
-                } else {
-                        asoc->rwnd += (len - asoc->rwnd_over);
-                        asoc->rwnd_over = 0;
-                }
-        } else {
-                asoc->rwnd += len;
-        }
+        if (asoc->ep->rcvbuf_policy)
+                rx_count = atomic_read(&asoc->rmem_alloc);
+        else
+                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
 
-        /* If we had window pressure, start recovering it
-         * once our rwnd had reached the accumulated pressure
-         * threshold.  The idea is to recover slowly, but up
-         * to the initial advertised window.
-         */
-        if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) {
-                int change = min(asoc->pathmtu, asoc->rwnd_press);
-                asoc->rwnd += change;
-                asoc->rwnd_press -= change;
-        }
+        if ((asoc->base.sk->sk_rcvbuf - rx_count) > 0)
+                asoc->rwnd = (asoc->base.sk->sk_rcvbuf - rx_count) >> 1;
+        else
+                asoc->rwnd = 0;
 
-        pr_debug("%s: asoc:%p rwnd increased by %d to (%u, %u) - %u\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
-                 asoc->a_rwnd);
+        pr_debug("%s: asoc:%p rwnd=%u, rx_count=%d, sk_rcvbuf=%d\n",
+                 __func__, asoc, asoc->rwnd, rx_count,
+                 asoc->base.sk->sk_rcvbuf);
 
         /* Send a window update SACK if the rwnd has increased by at least the
          * minimum of the association's PMTU and half of the receive buffer.
          * The algorithm used is similar to the one described in
          * Section 4.2.3.3 of RFC 1122.
          */
-        if (sctp_peer_needs_update(asoc)) {
+        if (update_peer && sctp_peer_needs_update(asoc)) {
                 asoc->a_rwnd = asoc->rwnd;
 
                 pr_debug("%s: sending window update SACK- asoc:%p rwnd:%u "
@@ -1426,45 +1446,6 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
         }
 }
 
-/* Decrease asoc's rwnd by len. */
-void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
-{
-        int rx_count;
-        int over = 0;
-
-        if (unlikely(!asoc->rwnd || asoc->rwnd_over))
-                pr_debug("%s: association:%p has asoc->rwnd:%u, "
-                         "asoc->rwnd_over:%u!\n", __func__, asoc,
-                         asoc->rwnd, asoc->rwnd_over);
-
-        if (asoc->ep->rcvbuf_policy)
-                rx_count = atomic_read(&asoc->rmem_alloc);
-        else
-                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
-
-        /* If we've reached or overflowed our receive buffer, announce
-         * a 0 rwnd if rwnd would still be positive.  Store the
-         * the potential pressure overflow so that the window can be restored
-         * back to original value.
-         */
-        if (rx_count >= asoc->base.sk->sk_rcvbuf)
-                over = 1;
-
-        if (asoc->rwnd >= len) {
-                asoc->rwnd -= len;
-                if (over) {
-                        asoc->rwnd_press += asoc->rwnd;
-                        asoc->rwnd = 0;
-                }
-        } else {
-                asoc->rwnd_over = len - asoc->rwnd;
-                asoc->rwnd = 0;
-        }
-
-        pr_debug("%s: asoc:%p rwnd decreased by %d to (%u, %u, %u)\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
-                 asoc->rwnd_press);
-}
 
 /* Build the bind address list for the association based on info from the
  * local endpoint and the remote peer.
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index bd859154000e..5d6883ff00c3 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -495,11 +495,12 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands,
         }
 
         /* If the transport error count is greater than the pf_retrans
-         * threshold, and less than pathmaxrtx, then mark this transport
-         * as Partially Failed, ee SCTP Quick Failover Draft, secon 5.1,
-         * point 1
+         * threshold, and less than pathmaxrtx, and if the current state
+         * is not SCTP_UNCONFIRMED, then mark this transport as Partially
+         * Failed, see SCTP Quick Failover Draft, section 5.1
          */
         if ((transport->state != SCTP_PF) &&
+           (transport->state != SCTP_UNCONFIRMED) &&
            (asoc->pf_retrans < transport->pathmaxrxt) &&
            (transport->error_count > asoc->pf_retrans)) {
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 483dcd71b3c5..ae65b6b5973a 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -758,6 +758,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                 struct sctp_chunk auth;
                 sctp_ierror_t ret;
 
+                /* Make sure that we and the peer are AUTH capable */
+                if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
+                        kfree_skb(chunk->auth_chunk);
+                        sctp_association_free(new_asoc);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+                }
+
                 /* set-up our fake chunk so that we can process it */
                 auth.skb = chunk->auth_chunk;
                 auth.asoc = chunk->asoc;
@@ -6176,7 +6183,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * PMTU.  In cases, such as loopback, this might be a rather
          * large spill over.
          */
-        if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
+        if ((!chunk->data_accepted) && (!asoc->rwnd ||
             (datalen > asoc->rwnd + asoc->frag_point))) {
 
                 /* If this is the next TSN, consider reneging to make
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e91d6e5df63..981aaf8b6ace 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -64,6 +64,7 @@
 #include <linux/crypto.h>
 #include <linux/slab.h>
 #include <linux/file.h>
+#include <linux/compat.h>
 
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -1368,11 +1369,19 @@ static int sctp_setsockopt_connectx(struct sock *sk,
 /*
  * New (hopefully final) interface for the API.
  * We use the sctp_getaddrs_old structure so that use-space library
- * can avoid any unnecessary allocations.   The only defferent part
+ * can avoid any unnecessary allocations. The only different part
  * is that we store the actual length of the address buffer into the
- * addrs_num structure member.  That way we can re-use the existing
+ * addrs_num structure member. That way we can re-use the existing
  * code.
  */
+#ifdef CONFIG_COMPAT
+struct compat_sctp_getaddrs_old {
+        sctp_assoc_t    assoc_id;
+        s32             addr_num;
+        compat_uptr_t   addrs;          /* struct sockaddr * */
+};
+#endif
+
 static int sctp_getsockopt_connectx3(struct sock *sk, int len,
                                      char __user *optval,
                                      int __user *optlen)
@@ -1381,16 +1390,30 @@ static int sctp_getsockopt_connectx3(struct sock *sk, int len,
         sctp_assoc_t assoc_id = 0;
         int err = 0;
 
-        if (len < sizeof(param))
-                return -EINVAL;
+#ifdef CONFIG_COMPAT
+        if (is_compat_task()) {
+                struct compat_sctp_getaddrs_old param32;
 
-        if (copy_from_user(&param, optval, sizeof(param)))
-                return -EFAULT;
+                if (len < sizeof(param32))
+                        return -EINVAL;
+                if (copy_from_user(&param32, optval, sizeof(param32)))
+                        return -EFAULT;
 
-        err = __sctp_setsockopt_connectx(sk,
-                        (struct sockaddr __user *)param.addrs,
-                        param.addr_num, &assoc_id);
+                param.assoc_id = param32.assoc_id;
+                param.addr_num = param32.addr_num;
+                param.addrs = compat_ptr(param32.addrs);
+        } else
+#endif
+        {
+                if (len < sizeof(param))
+                        return -EINVAL;
+                if (copy_from_user(&param, optval, sizeof(param)))
+                        return -EFAULT;
+        }
 
+        err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
+                                         param.addrs, param.addr_num,
+                                         &assoc_id);
         if (err == 0 || err == -EINPROGRESS) {
                 if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
                         return -EFAULT;
@@ -2092,12 +2115,6 @@ static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
                 sctp_skb_pull(skb, copied);
                 skb_queue_head(&sk->sk_receive_queue, skb);
 
-                /* When only partial message is copied to the user, increase
-                 * rwnd by that amount. If all the data in the skb is read,
-                 * rwnd is updated when the event is freed.
-                 */
-                if (!sctp_ulpevent_is_notification(event))
-                        sctp_assoc_rwnd_increase(event->asoc, copied);
                 goto out;
         } else if ((event->msg_flags & MSG_NOTIFICATION) ||
                    (event->msg_flags & MSG_EOR))
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 7135e617ab0f..35c8923b5554 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -151,6 +151,7 @@ static struct ctl_table sctp_net_table[] = {
         },
         {
                 .procname       = "cookie_hmac_alg",
+                .data           = &init_net.sctp.sctp_hmac_alg,
                 .maxlen         = 8,
                 .mode           = 0644,
                 .proc_handler   = proc_sctp_do_hmac_alg,
@@ -401,15 +402,18 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
 
 int sctp_sysctl_net_register(struct net *net)
 {
-        struct ctl_table *table;
-        int i;
+        struct ctl_table *table = sctp_net_table;
+
+        if (!net_eq(net, &init_net)) {
+                int i;
 
-        table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
-        if (!table)
-                return -ENOMEM;
+                table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
+                if (!table)
+                        return -ENOMEM;
 
-        for (i = 0; table[i].data; i++)
-                table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
+                for (i = 0; table[i].data; i++)
+                        table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
+        }
 
         net->sctp.sysctl_header = register_net_sysctl(net, "net/sctp", table);
         return 0;
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 85c64658bd0b..8d198ae03606 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -989,7 +989,7 @@ static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
         skb = sctp_event2skb(event);
         /* Set the owner and charge rwnd for bytes received.  */
         sctp_ulpevent_set_owner(event, asoc);
-        sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
+        sctp_assoc_rwnd_update(asoc, false);
 
         if (!skb->data_len)
                 return;
@@ -1011,6 +1011,7 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
         struct sk_buff *skb, *frag;
         unsigned int    len;
+        struct sctp_association *asoc;
 
         /* Current stack structures assume that the rcv buffer is
          * per socket.   For UDP style sockets this is not true as
@@ -1035,8 +1036,11 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
         }
 
 done:
-        sctp_assoc_rwnd_increase(event->asoc, len);
+        asoc = event->asoc;
+        sctp_association_hold(asoc);
         sctp_ulpevent_release_owner(event);
+        sctp_assoc_rwnd_update(asoc, true);
+        sctp_association_put(asoc);
 }
 
 static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 6c0513a7f992..36e431ee1c90 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -108,6 +108,7 @@ struct gss_auth {
 static DEFINE_SPINLOCK(pipe_version_lock);
 static struct rpc_wait_queue pipe_version_rpc_waitqueue;
 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
+static void gss_put_auth(struct gss_auth *gss_auth);
 
 static void gss_free_ctx(struct gss_cl_ctx *);
 static const struct rpc_pipe_ops gss_upcall_ops_v0;
@@ -320,6 +321,7 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
         if (gss_msg->ctx != NULL)
                 gss_put_ctx(gss_msg->ctx);
         rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
+        gss_put_auth(gss_msg->auth);
         kfree(gss_msg);
 }
 
@@ -498,9 +500,12 @@ gss_alloc_msg(struct gss_auth *gss_auth,
         default:
                 err = gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
                 if (err)
-                        goto err_free_msg;
+                        goto err_put_pipe_version;
         };
+        kref_get(&gss_auth->kref);
         return gss_msg;
+err_put_pipe_version:
+        put_pipe_version(gss_auth->net);
 err_free_msg:
         kfree(gss_msg);
 err:
@@ -991,6 +996,8 @@ gss_create_new(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
         gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
         if (gss_auth->service == 0)
                 goto err_put_mech;
+        if (!gssd_running(gss_auth->net))
+                goto err_put_mech;
         auth = &gss_auth->rpc_auth;
         auth->au_cslack = GSS_CRED_SLACK >> 2;
         auth->au_rslack = GSS_VERF_SLACK >> 2;
@@ -1062,6 +1069,12 @@ gss_free_callback(struct kref *kref)
 }
 
 static void
+gss_put_auth(struct gss_auth *gss_auth)
+{
+        kref_put(&gss_auth->kref, gss_free_callback);
+}
+
+static void
 gss_destroy(struct rpc_auth *auth)
 {
         struct gss_auth *gss_auth = container_of(auth,
@@ -1082,7 +1095,7 @@ gss_destroy(struct rpc_auth *auth)
         gss_auth->gss_pipe[1] = NULL;
         rpcauth_destroy_credcache(auth);
 
-        kref_put(&gss_auth->kref, gss_free_callback);
+        gss_put_auth(gss_auth);
 }
 
 /*
@@ -1253,7 +1266,7 @@ gss_destroy_nullcred(struct rpc_cred *cred)
         call_rcu(&cred->cr_rcu, gss_free_cred_callback);
         if (ctx)
                 gss_put_ctx(ctx);
-        kref_put(&gss_auth->kref, gss_free_callback);
+        gss_put_auth(gss_auth);
 }
 
 static void
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 890a29912d5a..e860d4f7ed2a 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -64,7 +64,6 @@ static void xprt_free_allocation(struct rpc_rqst *req)
         free_page((unsigned long)xbufp->head[0].iov_base);
         xbufp = &req->rq_snd_buf;
         free_page((unsigned long)xbufp->head[0].iov_base);
-        list_del(&req->rq_bc_pa_list);
         kfree(req);
 }
 
@@ -168,8 +167,10 @@ out_free:
         /*
          * Memory allocation failed, free the temporary list
          */
-        list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list)
+        list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list) {
+                list_del(&req->rq_bc_pa_list);
                 xprt_free_allocation(req);
+        }
 
         dprintk("RPC:       setup backchannel transport failed\n");
         return -ENOMEM;
@@ -198,6 +199,7 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs)
         xprt_dec_alloc_count(xprt, max_reqs);
         list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
                 dprintk("RPC:        req=%p\n", req);
+                list_del(&req->rq_bc_pa_list);
                 xprt_free_allocation(req);
                 if (--max_reqs == 0)
                         break;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 817a1e523969..0addefca8e77 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -510,6 +510,7 @@ static int xs_nospace(struct rpc_task *task)
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+        struct sock *sk = transport->inet;
         int ret = -EAGAIN;
 
         dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
@@ -527,7 +528,7 @@ static int xs_nospace(struct rpc_task *task)
                          * window size
                          */
                         set_bit(SOCK_NOSPACE, &transport->sock->flags);
-                        transport->inet->sk_write_pending++;
+                        sk->sk_write_pending++;
                         /* ...and wait for more buffer space */
                         xprt_wait_for_buffer_space(task, xs_nospace_callback);
                 }
@@ -537,6 +538,9 @@ static int xs_nospace(struct rpc_task *task)
         }
 
         spin_unlock_bh(&xprt->transport_lock);
+
+        /* Race breaker in case memory is freed before above code is called */
+        sk->sk_write_space(sk);
         return ret;
 }
 
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index a38c89969c68..574b86193b15 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -610,8 +610,13 @@ static struct notifier_block notifier = {
 
 int tipc_bearer_setup(void)
 {
+        int err;
+
+        err = register_netdevice_notifier(&notifier);
+        if (err)
+                return err;
         dev_add_pack(&tipc_packet_type);
-        return register_netdevice_notifier(&notifier);
+        return 0;
 }
 
 void tipc_bearer_cleanup(void)
diff --git a/net/tipc/config.c b/net/tipc/config.c
index c301a9a592d8..e74eef2e7490 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -181,7 +181,7 @@ static struct sk_buff *cfg_set_own_addr(void)
         if (tipc_own_addr)
                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                    " (cannot change node address once assigned)");
-        tipc_core_start_net(addr);
+        tipc_net_start(addr);
         return tipc_cfg_reply_none();
 }
 
diff --git a/net/tipc/core.c b/net/tipc/core.c
index f9e88d8b04ca..80c20647b3d2 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -77,37 +77,13 @@ struct sk_buff *tipc_buf_acquire(u32 size)
 }
 
 /**
- * tipc_core_stop_net - shut down TIPC networking sub-systems
- */
-static void tipc_core_stop_net(void)
-{
-        tipc_net_stop();
-        tipc_bearer_cleanup();
-}
-
-/**
- * start_net - start TIPC networking sub-systems
- */
-int tipc_core_start_net(unsigned long addr)
-{
-        int res;
-
-        tipc_net_start(addr);
-        res = tipc_bearer_setup();
-        if (res < 0)
-                goto err;
-        return res;
-
-err:
-        tipc_core_stop_net();
-        return res;
-}
-
-/**
  * tipc_core_stop - switch TIPC from SINGLE NODE to NOT RUNNING mode
  */
 static void tipc_core_stop(void)
 {
+        tipc_handler_stop();
+        tipc_net_stop();
+        tipc_bearer_cleanup();
         tipc_netlink_stop();
         tipc_cfg_stop();
         tipc_subscr_stop();
@@ -122,30 +98,65 @@ static void tipc_core_stop(void)
  */
 static int tipc_core_start(void)
 {
-        int res;
+        int err;
 
         get_random_bytes(&tipc_random, sizeof(tipc_random));
 
-        res = tipc_handler_start();
-        if (!res)
-                res = tipc_ref_table_init(tipc_max_ports, tipc_random);
-        if (!res)
-                res = tipc_nametbl_init();
-        if (!res)
-                res = tipc_netlink_start();
-        if (!res)
-                res = tipc_socket_init();
-        if (!res)
-                res = tipc_register_sysctl();
-        if (!res)
-                res = tipc_subscr_start();
-        if (!res)
-                res = tipc_cfg_init();
-        if (res) {
-                tipc_handler_stop();
-                tipc_core_stop();
-        }
-        return res;
+        err = tipc_handler_start();
+        if (err)
+                goto out_handler;
+
+        err = tipc_ref_table_init(tipc_max_ports, tipc_random);
+        if (err)
+                goto out_reftbl;
+
+        err = tipc_nametbl_init();
+        if (err)
+                goto out_nametbl;
+
+        err = tipc_netlink_start();
+        if (err)
+                goto out_netlink;
+
+        err = tipc_socket_init();
+        if (err)
+                goto out_socket;
+
+        err = tipc_register_sysctl();
+        if (err)
+                goto out_sysctl;
+
+        err = tipc_subscr_start();
+        if (err)
+                goto out_subscr;
+
+        err = tipc_cfg_init();
+        if (err)
+                goto out_cfg;
+
+        err = tipc_bearer_setup();
+        if (err)
+                goto out_bearer;
+
+        return 0;
+out_bearer:
+        tipc_cfg_stop();
+out_cfg:
+        tipc_subscr_stop();
+out_subscr:
+        tipc_unregister_sysctl();
+out_sysctl:
+        tipc_socket_stop();
+out_socket:
+        tipc_netlink_stop();
+out_netlink:
+        tipc_nametbl_stop();
+out_nametbl:
+        tipc_ref_table_stop();
+out_reftbl:
+        tipc_handler_stop();
+out_handler:
+        return err;
 }
 
 static int __init tipc_init(void)
@@ -174,8 +185,6 @@ static int __init tipc_init(void)
 
 static void __exit tipc_exit(void)
 {
-        tipc_handler_stop();
-        tipc_core_stop_net();
         tipc_core_stop();
         pr_info("Deactivated\n");
 }
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 1ff477b0450d..4dfe137587bb 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -90,7 +90,6 @@ extern int tipc_random __read_mostly;
 /*
  * Routines available to privileged subsystems
  */
-int tipc_core_start_net(unsigned long);
 int tipc_handler_start(void);
 void tipc_handler_stop(void);
 int tipc_netlink_start(void);
@@ -192,6 +191,7 @@ static inline void k_term_timer(struct timer_list *timer)
 
 struct tipc_skb_cb {
         void *handle;
+        bool deferred;
 };
 
 #define TIPC_SKB_CB(__skb) ((struct tipc_skb_cb *)&((__skb)->cb[0]))
diff --git a/net/tipc/link.c b/net/tipc/link.c
index d4b5de41b682..da6018beb6eb 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1391,6 +1391,12 @@ static int link_recv_buf_validate(struct sk_buff *buf)
         u32 hdr_size;
         u32 min_hdr_size;
 
+        /* If this packet comes from the defer queue, the skb has already
+         * been validated
+         */
+        if (unlikely(TIPC_SKB_CB(buf)->deferred))
+                return 1;
+
         if (unlikely(buf->len < MIN_H_SIZE))
                 return 0;
 
@@ -1703,6 +1709,7 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
                                 &l_ptr->newest_deferred_in, buf)) {
                 l_ptr->deferred_inqueue_sz++;
                 l_ptr->stats.deferred_recv++;
+                TIPC_SKB_CB(buf)->deferred = true;
                 if ((l_ptr->deferred_inqueue_sz % 16) == 1)
                         tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
         } else
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 92a1533af4e0..48302be175ce 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -945,9 +945,6 @@ void tipc_nametbl_stop(void)
 {
         u32 i;
 
-        if (!table.types)
-                return;
-
         /* Verify name table is empty, then release it */
         write_lock_bh(&tipc_nametbl_lock);
         for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 9f72a6376362..3aaf73de9e2d 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -83,8 +83,6 @@ static struct genl_ops tipc_genl_ops[] = {
         },
 };
 
-static int tipc_genl_family_registered;
-
 int tipc_netlink_start(void)
 {
         int res;
@@ -94,16 +92,10 @@ int tipc_netlink_start(void)
                 pr_err("Failed to register netlink interface\n");
                 return res;
         }
-
-        tipc_genl_family_registered = 1;
         return 0;
 }
 
 void tipc_netlink_stop(void)
 {
-        if (!tipc_genl_family_registered)
-                return;
-
         genl_unregister_family(&tipc_genl_family);
-        tipc_genl_family_registered = 0;
 }
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index 2a2a938dc22c..de3d593e2fee 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -126,9 +126,6 @@ int tipc_ref_table_init(u32 requested_size, u32 start)
  */
 void tipc_ref_table_stop(void)
 {
-        if (!tipc_ref_table.entries)
-                return;
-
         vfree(tipc_ref_table.entries);
         tipc_ref_table.entries = NULL;
 }
diff --git a/net/tipc/server.c b/net/tipc/server.c
index b635ca347a87..373979789a73 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -573,7 +573,6 @@ int tipc_server_start(struct tipc_server *s)
                 kmem_cache_destroy(s->rcvbuf_cache);
                 return ret;
         }
-        s->enabled = 1;
         return ret;
 }
 
@@ -583,10 +582,6 @@ void tipc_server_stop(struct tipc_server *s)
         int total = 0;
         int id;
 
-        if (!s->enabled)
-                return;
-
-        s->enabled = 0;
         spin_lock_bh(&s->idr_lock);
         for (id = 0; total < s->idr_in_use; id++) {
                 con = idr_find(&s->conn_idr, id);
diff --git a/net/tipc/server.h b/net/tipc/server.h
index 98b23f20bc0f..be817b0b547e 100644
--- a/net/tipc/server.h
+++ b/net/tipc/server.h
@@ -56,7 +56,6 @@
  * @name: server name
  * @imp: message importance
  * @type: socket type
- * @enabled: identify whether server is launched or not
  */
 struct tipc_server {
         struct idr conn_idr;
@@ -74,7 +73,6 @@ struct tipc_server {
         const char name[TIPC_SERVER_NAME_LEN];
         int imp;
         int type;
-        int enabled;
 };
 
 int tipc_conn_sendmsg(struct tipc_server *s, int conid,
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index aab4948f0aff..a4cf274455aa 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -70,8 +70,6 @@ static const struct proto_ops msg_ops;
 static struct proto tipc_proto;
 static struct proto tipc_proto_kern;
 
-static int sockets_enabled;
-
 /*
  * Revised TIPC socket locking policy:
  *
@@ -2027,8 +2025,6 @@ int tipc_socket_init(void)
                 proto_unregister(&tipc_proto);
                 goto out;
         }
-
-        sockets_enabled = 1;
  out:
         return res;
 }
@@ -2038,10 +2034,6 @@ int tipc_socket_init(void)
  */
 void tipc_socket_stop(void)
 {
-        if (!sockets_enabled)
-                return;
-
-        sockets_enabled = 0;
         sock_unregister(tipc_family_ops.family);
         proto_unregister(&tipc_proto);
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 9b897fca7487..f0541370e68e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1700,7 +1700,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
                 return;
         case NL80211_REGDOM_SET_BY_USER:
                 treatment = reg_process_hint_user(reg_request);
-                if (treatment == REG_REQ_OK ||
+                if (treatment == REG_REQ_IGNORE ||
                     treatment == REG_REQ_ALREADY_SET)
                         return;
                 schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
@@ -2373,6 +2373,7 @@ static int reg_set_rd_country_ie(const struct ieee80211_regdomain *rd,
 int set_regdom(const struct ieee80211_regdomain *rd)
 {
         struct regulatory_request *lr;
+        bool user_reset = false;
         int r;
 
         if (!reg_is_valid_request(rd->alpha2)) {
@@ -2389,6 +2390,7 @@ int set_regdom(const struct ieee80211_regdomain *rd)
                 break;
         case NL80211_REGDOM_SET_BY_USER:
                 r = reg_set_rd_user(rd, lr);
+                user_reset = true;
                 break;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 r = reg_set_rd_driver(rd, lr);
@@ -2402,8 +2404,14 @@ int set_regdom(const struct ieee80211_regdomain *rd)
         }
 
         if (r) {
-                if (r == -EALREADY)
+                switch (r) {
+                case -EALREADY:
                         reg_set_request_processed();
+                        break;
+                default:
+                        /* Back to world regulatory in case of errors */
+                        restore_regulatory_settings(user_reset);
+                }
 
                 kfree(rd);
                 return r;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 4b98b25793c5..1d5c7bf29938 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1158,7 +1158,7 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
         if (hlist_unhashed(&pol->bydst))
                 return NULL;
 
-        hlist_del(&pol->bydst);
+        hlist_del_init(&pol->bydst);
         hlist_del(&pol->byidx);
         list_del(&pol->walk.all);
         net->xfrm.policy_count[dir]--;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a26b7aa79475..40f1b3e92e78 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1159,6 +1159,11 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         }
         x->props.aalgo = orig->props.aalgo;
 
+        if (orig->aead) {
+                x->aead = xfrm_algo_aead_clone(orig->aead);
+                if (!x->aead)
+                        goto error;
+        }
         if (orig->ealg) {
                 x->ealg = xfrm_algo_clone(orig->ealg);
                 if (!x->ealg)
@@ -1201,6 +1206,9 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         x->props.flags = orig->props.flags;
         x->props.extra_flags = orig->props.extra_flags;
 
+        x->tfcpad = orig->tfcpad;
+        x->replay_maxdiff = orig->replay_maxdiff;
+        x->replay_maxage = orig->replay_maxage;
         x->curlft.add_time = orig->curlft.add_time;
         x->km.state = orig->km.state;
         x->km.seq = orig->km.seq;
@@ -1215,11 +1223,12 @@ out:
         return NULL;
 }
 
-/* net->xfrm.xfrm_state_lock is held */
 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net)
 {
         unsigned int h;
-        struct xfrm_state *x;
+        struct xfrm_state *x = NULL;
+
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
 
         if (m->reqid) {
                 h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
@@ -1236,7 +1245,7 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n
                                              m->old_family))
                                 continue;
                         xfrm_state_hold(x);
-                        return x;
+                        break;
                 }
         } else {
                 h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
@@ -1251,11 +1260,13 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n
                                              m->old_family))
                                 continue;
                         xfrm_state_hold(x);
-                        return x;
+                        break;
                 }
         }
 
-        return NULL;
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+        return x;
 }
 EXPORT_SYMBOL(xfrm_migrate_state_find);
 
@@ -1451,7 +1462,7 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
 {
         int err = 0;
         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
-        struct net *net = xs_net(*dst);
+        struct net *net = xs_net(*src);
 
         if (!afinfo)
                 return -EAFNOSUPPORT;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 1ae3ec7c18b0..c274179d60a2 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -32,11 +32,6 @@
 #include <linux/in6.h>
 #endif
 
-static inline int aead_len(struct xfrm_algo_aead *alg)
-{
-        return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
-}
-
 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
 {
         struct nlattr *rt = attrs[type];
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 49392ecbef17..79c059e70860 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -152,6 +152,7 @@ ld_flags       = $(LDFLAGS) $(ldflags-y)
 dtc_cpp_flags  = -Wp,-MD,$(depfile).pre.tmp -nostdinc                    \
                  -I$(srctree)/arch/$(SRCARCH)/boot/dts                   \
                  -I$(srctree)/arch/$(SRCARCH)/boot/dts/include           \
+                 -I$(srctree)/drivers/of/testcase-data                   \
                  -undef -D__DTS__
 
 # Finds the multi-part object the current object will be linked into
diff --git a/scripts/gen_initramfs_list.sh b/scripts/gen_initramfs_list.sh
index ef474098d9f1..17fa901418ae 100644
--- a/scripts/gen_initramfs_list.sh
+++ b/scripts/gen_initramfs_list.sh
@@ -257,7 +257,7 @@ case "$arg" in
                 && compr="lzop -9 -f"
                 echo "$output_file" | grep -q "\.lz4$" \
                 && [ -x "`which lz4 2> /dev/null`" ] \
-                && compr="lz4 -9 -f"
+                && compr="lz4 -l -9 -f"
                 echo "$output_file" | grep -q "\.cpio$" && compr="cat"
                 shift
                 ;;
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 10085de886fe..276e84b8a8e5 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -330,8 +330,7 @@ static void write_src(void)
                                 printf("\tPTR\t_text + %#llx\n",
                                         table[i].addr - _text);
                         else
-                                printf("\tPTR\t_text - %#llx\n",
-                                        _text - table[i].addr);
+                                printf("\tPTR\t%#llx\n", table[i].addr);
                 } else {
                         printf("\tPTR\t%#llx\n", table[i].addr);
                 }
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 40610984a1b5..99a45fdc1bbf 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1502,6 +1502,16 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 #define R_ARM_JUMP24    29
 #endif
 
+#ifndef R_ARM_THM_CALL
+#define R_ARM_THM_CALL          10
+#endif
+#ifndef R_ARM_THM_JUMP24
+#define R_ARM_THM_JUMP24        30
+#endif
+#ifndef R_ARM_THM_JUMP19
+#define R_ARM_THM_JUMP19        51
+#endif
+
 static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 {
         unsigned int r_typ = ELF_R_TYPE(r->r_info);
@@ -1515,6 +1525,9 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
         case R_ARM_PC24:
         case R_ARM_CALL:
         case R_ARM_JUMP24:
+        case R_ARM_THM_CALL:
+        case R_ARM_THM_JUMP24:
+        case R_ARM_THM_JUMP19:
                 /* From ARM ABI: ((S + A) | T) - P */
                 r->r_addend = (int)(long)(elf->hdr +
                               sechdr->sh_offset +
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d46cbc5e335e..2fb2576dc644 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1000,7 +1000,11 @@ static int keyring_detect_cycle_iterator(const void *object,
 
         kenter("{%d}", key->serial);
 
-        BUG_ON(key != ctx->match_data);
+        /* We might get a keyring with matching index-key that is nonetheless a
+         * different keyring. */
+        if (key != ctx->match_data)
+                return 0;
+
         ctx->result = ERR_PTR(-EDEADLK);
         return 1;
 }
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index c0f498842129..9c5cdc2caaef 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -3338,10 +3338,10 @@ static int filename_write_helper(void *key, void *data, void *ptr)
         if (rc)
                 return rc;
 
-        buf[0] = ft->stype;
-        buf[1] = ft->ttype;
-        buf[2] = ft->tclass;
-        buf[3] = otype->otype;
+        buf[0] = cpu_to_le32(ft->stype);
+        buf[1] = cpu_to_le32(ft->ttype);
+        buf[2] = cpu_to_le32(ft->tclass);
+        buf[3] = cpu_to_le32(otype->otype);
 
         rc = put_entry(buf, sizeof(u32), 4, fp);
         if (rc)
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index df3652ad15ef..8ed0bcc01386 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -1026,6 +1026,9 @@ static void ad1884_fixup_thinkpad(struct hda_codec *codec,
                 spec->gen.keep_eapd_on = 1;
                 spec->gen.vmaster_mute.hook = ad_vmaster_eapd_hook;
                 spec->eapd_nid = 0x12;
+                /* Analog PC Beeper - allow firmware/ACPI beeps */
+                spec->beep_amp = HDA_COMPOSE_AMP_VAL(0x20, 3, 3, HDA_INPUT);
+                spec->gen.beep_nid = 0; /* no digital beep */
         }
 }
 
@@ -1092,6 +1095,7 @@ static int patch_ad1884(struct hda_codec *codec)
         spec = codec->spec;
 
         spec->gen.mixer_nid = 0x20;
+        spec->gen.mixer_merge_nid = 0x21;
         spec->gen.beep_nid = 0x10;
         set_beep_amp(spec, 0x10, 0, HDA_OUTPUT);
 
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 54d14793725a..46ecdbb9053f 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -2662,60 +2662,6 @@ static bool dspload_wait_loaded(struct hda_codec *codec)
 }
 
 /*
- * PCM stuffs
- */
-static void ca0132_setup_stream(struct hda_codec *codec, hda_nid_t nid,
-                                 u32 stream_tag,
-                                 int channel_id, int format)
-{
-        unsigned int oldval, newval;
-
-        if (!nid)
-                return;
-
-        snd_printdd(
-                   "ca0132_setup_stream: NID=0x%x, stream=0x%x, "
-                   "channel=%d, format=0x%x\n",
-                   nid, stream_tag, channel_id, format);
-
-        /* update the format-id if changed */
-        oldval = snd_hda_codec_read(codec, nid, 0,
-                                    AC_VERB_GET_STREAM_FORMAT,
-                                    0);
-        if (oldval != format) {
-                msleep(20);
-                snd_hda_codec_write(codec, nid, 0,
-                                    AC_VERB_SET_STREAM_FORMAT,
-                                    format);
-        }
-
-        oldval = snd_hda_codec_read(codec, nid, 0, AC_VERB_GET_CONV, 0);
-        newval = (stream_tag << 4) | channel_id;
-        if (oldval != newval) {
-                snd_hda_codec_write(codec, nid, 0,
-                                    AC_VERB_SET_CHANNEL_STREAMID,
-                                    newval);
-        }
-}
-
-static void ca0132_cleanup_stream(struct hda_codec *codec, hda_nid_t nid)
-{
-        unsigned int val;
-
-        if (!nid)
-                return;
-
-        snd_printdd(KERN_INFO "ca0132_cleanup_stream: NID=0x%x\n", nid);
-
-        val = snd_hda_codec_read(codec, nid, 0, AC_VERB_GET_CONV, 0);
-        if (!val)
-                return;
-
-        snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_STREAM_FORMAT, 0);
-        snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_CHANNEL_STREAMID, 0);
-}
-
-/*
  * PCM callbacks
  */
 static int ca0132_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
@@ -2726,7 +2672,7 @@ static int ca0132_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
 {
         struct ca0132_spec *spec = codec->spec;
 
-        ca0132_setup_stream(codec, spec->dacs[0], stream_tag, 0, format);
+        snd_hda_codec_setup_stream(codec, spec->dacs[0], stream_tag, 0, format);
 
         return 0;
 }
@@ -2745,7 +2691,7 @@ static int ca0132_playback_pcm_cleanup(struct hda_pcm_stream *hinfo,
         if (spec->effects_switch[PLAY_ENHANCEMENT - EFFECT_START_NID])
                 msleep(50);
 
-        ca0132_cleanup_stream(codec, spec->dacs[0]);
+        snd_hda_codec_cleanup_stream(codec, spec->dacs[0]);
 
         return 0;
 }
@@ -2822,10 +2768,8 @@ static int ca0132_capture_pcm_prepare(struct hda_pcm_stream *hinfo,
                                         unsigned int format,
                                         struct snd_pcm_substream *substream)
 {
-        struct ca0132_spec *spec = codec->spec;
-
-        ca0132_setup_stream(codec, spec->adcs[substream->number],
-                            stream_tag, 0, format);
+        snd_hda_codec_setup_stream(codec, hinfo->nid,
+                                   stream_tag, 0, format);
 
         return 0;
 }
@@ -2839,7 +2783,7 @@ static int ca0132_capture_pcm_cleanup(struct hda_pcm_stream *hinfo,
         if (spec->dsp_state == DSP_DOWNLOADING)
                 return 0;
 
-        ca0132_cleanup_stream(codec, hinfo->nid);
+        snd_hda_codec_cleanup_stream(codec, hinfo->nid);
         return 0;
 }
 
@@ -4742,6 +4686,8 @@ static int patch_ca0132(struct hda_codec *codec)
                 return err;
 
         codec->patch_ops = ca0132_patch_ops;
+        codec->pcm_format_first = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a9a83b85517a..850296a1e0ff 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4253,6 +4253,7 @@ static const struct hda_fixup alc269_fixups[] = {
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x1025, 0x0283, "Acer TravelMate 8371", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
@@ -4308,7 +4309,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0651, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0652, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0653, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0657, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0658, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x065f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0662, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
@@ -4317,6 +4320,54 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x1973, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
+        /* ALC282 */
+        SND_PCI_QUIRK(0x103c, 0x220f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2213, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2266, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2267, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2269, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x227a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x227b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22a0, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22b2, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c0, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c1, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c2, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22cd, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22ce, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22d0, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        /* ALC290 */
+        SND_PCI_QUIRK(0x103c, 0x2260, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2261, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2262, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2263, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2264, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2265, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x227d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x227e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x227f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2280, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2281, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2282, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x2289, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x228a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x228b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x228c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x228d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x228e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c5, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c6, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c3, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
         SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
         SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -5113,7 +5164,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0625, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_AUTO_MUTE),
-        SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_AUTO_MUTE),
         SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
         SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
         SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 7311badf6a94..3bc29c9b2529 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -83,6 +83,7 @@ enum {
         STAC_DELL_M6_BOTH,
         STAC_DELL_EQ,
         STAC_ALIENWARE_M17X,
+        STAC_92HD89XX_HP_FRONT_JACK,
         STAC_92HD73XX_MODELS
 };
 
@@ -97,6 +98,7 @@ enum {
         STAC_92HD83XXX_HP_LED,
         STAC_92HD83XXX_HP_INV_LED,
         STAC_92HD83XXX_HP_MIC_LED,
+        STAC_HP_LED_GPIO10,
         STAC_92HD83XXX_HEADSET_JACK,
         STAC_92HD83XXX_HP,
         STAC_HP_ENVY_BASS,
@@ -1795,6 +1797,12 @@ static const struct hda_pintbl intel_dg45id_pin_configs[] = {
         {}
 };
 
+static const struct hda_pintbl stac92hd89xx_hp_front_jack_pin_configs[] = {
+        { 0x0a, 0x02214030 },
+        { 0x0b, 0x02A19010 },
+        {}
+};
+
 static void stac92hd73xx_fixup_ref(struct hda_codec *codec,
                                    const struct hda_fixup *fix, int action)
 {
@@ -1913,6 +1921,10 @@ static const struct hda_fixup stac92hd73xx_fixups[] = {
         [STAC_92HD73XX_NO_JD] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = stac92hd73xx_fixup_no_jd,
+        },
+        [STAC_92HD89XX_HP_FRONT_JACK] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = stac92hd89xx_hp_front_jack_pin_configs,
         }
 };
 
@@ -1973,6 +1985,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
                       "Alienware M17x", STAC_ALIENWARE_M17X),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0490,
                       "Alienware M17x R3", STAC_DELL_EQ),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
+                                "unknown HP", STAC_92HD89XX_HP_FRONT_JACK),
         {} /* terminator */
 };
 
@@ -2117,6 +2131,17 @@ static void stac92hd83xxx_fixup_hp_mic_led(struct hda_codec *codec,
         }
 }
 
+static void stac92hd83xxx_fixup_hp_led_gpio10(struct hda_codec *codec,
+                                   const struct hda_fixup *fix, int action)
+{
+        struct sigmatel_spec *spec = codec->spec;
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->gpio_led = 0x10; /* GPIO4 */
+                spec->default_polarity = 0;
+        }
+}
+
 static void stac92hd83xxx_fixup_headset_jack(struct hda_codec *codec,
                                    const struct hda_fixup *fix, int action)
 {
@@ -2611,6 +2636,12 @@ static const struct hda_fixup stac92hd83xxx_fixups[] = {
                 .chained = true,
                 .chain_id = STAC_92HD83XXX_HP,
         },
+        [STAC_HP_LED_GPIO10] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = stac92hd83xxx_fixup_hp_led_gpio10,
+                .chained = true,
+                .chain_id = STAC_92HD83XXX_HP,
+        },
         [STAC_92HD83XXX_HEADSET_JACK] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = stac92hd83xxx_fixup_headset_jack,
@@ -2689,6 +2720,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
                           "HP", STAC_92HD83XXX_HP_cNB11_INTQUAD),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1888,
                           "HP Envy Spectre", STAC_HP_ENVY_BASS),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1899,
+                          "HP Folio 13", STAC_HP_LED_GPIO10),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x18df,
                           "HP Folio", STAC_HP_BNB13_EQ),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x18F8,
diff --git a/sound/soc/blackfin/Kconfig b/sound/soc/blackfin/Kconfig
index 54f74f8cbb75..4544d8eb1452 100644
--- a/sound/soc/blackfin/Kconfig
+++ b/sound/soc/blackfin/Kconfig
@@ -11,7 +11,7 @@ config SND_BF5XX_I2S
 
 config SND_BF5XX_SOC_SSM2602
         tristate "SoC SSM2602 Audio Codec Add-On Card support"
-        depends on SND_BF5XX_I2S && (SPI_MASTER || I2C)
+        depends on SND_BF5XX_I2S && SND_SOC_I2C_AND_SPI
         select SND_BF5XX_SOC_I2S if !BF60x
         select SND_BF6XX_SOC_I2S if BF60x
         select SND_SOC_SSM2602
@@ -21,10 +21,9 @@ config SND_BF5XX_SOC_SSM2602
 
 config SND_SOC_BFIN_EVAL_ADAU1701
         tristate "Support for the EVAL-ADAU1701MINIZ board on Blackfin eval boards"
-        depends on SND_BF5XX_I2S
+        depends on SND_BF5XX_I2S && I2C
         select SND_BF5XX_SOC_I2S
         select SND_SOC_ADAU1701
-        select I2C
         help
           Say Y if you want to add support for the Analog Devices EVAL-ADAU1701MINIZ
           board connected to one of the Blackfin evaluation boards like the
@@ -45,7 +44,7 @@ config SND_SOC_BFIN_EVAL_ADAU1373
 
 config SND_SOC_BFIN_EVAL_ADAV80X
         tristate "Support for the EVAL-ADAV80X boards on Blackfin eval boards"
-        depends on SND_BF5XX_I2S && (SPI_MASTER || I2C)
+        depends on SND_BF5XX_I2S && SND_SOC_I2C_AND_SPI
         select SND_BF5XX_SOC_I2S
         select SND_SOC_ADAV80X
         help
@@ -58,7 +57,7 @@ config SND_SOC_BFIN_EVAL_ADAV80X
 
 config SND_BF5XX_SOC_AD1836
         tristate "SoC AD1836 Audio support for BF5xx"
-        depends on SND_BF5XX_I2S
+        depends on SND_BF5XX_I2S && SPI_MASTER
         select SND_BF5XX_SOC_I2S
         select SND_SOC_AD1836
         help
@@ -66,7 +65,7 @@ config SND_BF5XX_SOC_AD1836
 
 config SND_BF5XX_SOC_AD193X
         tristate "SoC AD193X Audio support for Blackfin"
-        depends on SND_BF5XX_I2S
+        depends on SND_BF5XX_I2S && SND_SOC_I2C_AND_SPI
         select SND_BF5XX_SOC_I2S
         select SND_SOC_AD193X
         help
diff --git a/sound/soc/codecs/ad1980.c b/sound/soc/codecs/ad1980.c
index 7257a8885f42..34d965a4a040 100644
--- a/sound/soc/codecs/ad1980.c
+++ b/sound/soc/codecs/ad1980.c
@@ -57,8 +57,8 @@ static const u16 ad1980_reg[] = {
 static const char *ad1980_rec_sel[] = {"Mic", "CD", "NC", "AUX", "Line",
                 "Stereo Mix", "Mono Mix", "Phone"};
 
-static const struct soc_enum ad1980_cap_src =
-        SOC_ENUM_DOUBLE(AC97_REC_SEL, 8, 0, 7, ad1980_rec_sel);
+static SOC_ENUM_DOUBLE_DECL(ad1980_cap_src,
+                            AC97_REC_SEL, 8, 0, ad1980_rec_sel);
 
 static const struct snd_kcontrol_new ad1980_snd_ac97_controls[] = {
 SOC_DOUBLE("Master Playback Volume", AC97_MASTER, 8, 0, 31, 1),
diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
index f295b6569910..f4d965ebc29e 100644
--- a/sound/soc/codecs/da732x.c
+++ b/sound/soc/codecs/da732x.c
@@ -1268,11 +1268,23 @@ static struct snd_soc_dai_driver da732x_dai[] = {
         },
 };
 
+static bool da732x_volatile(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case DA732X_REG_HPL_DAC_OFF_CNTL:
+        case DA732X_REG_HPR_DAC_OFF_CNTL:
+                return true;
+        default:
+                return false;
+        }
+}
+
 static const struct regmap_config da732x_regmap = {
         .reg_bits               = 8,
         .val_bits               = 8,
 
         .max_register           = DA732X_MAX_REG,
+        .volatile_reg           = da732x_volatile,
         .reg_defaults           = da732x_reg_cache,
         .num_reg_defaults       = ARRAY_SIZE(da732x_reg_cache),
         .cache_type             = REGCACHE_RBTREE,
diff --git a/sound/soc/codecs/da9055.c b/sound/soc/codecs/da9055.c
index 52b79a487ac7..422812613a28 100644
--- a/sound/soc/codecs/da9055.c
+++ b/sound/soc/codecs/da9055.c
@@ -1523,8 +1523,15 @@ static int da9055_remove(struct i2c_client *client)
         return 0;
 }
 
+/*
+ * DO NOT change the device Ids. The naming is intentionally specific as both
+ * the CODEC and PMIC parts of this chip are instantiated separately as I2C
+ * devices (both have configurable I2C addresses, and are to all intents and
+ * purposes separate). As a result there are specific DA9055 Ids for CODEC
+ * and PMIC, which must be different to operate together.
+ */
 static const struct i2c_device_id da9055_i2c_id[] = {
-        { "da9055", 0 },
+        { "da9055-codec", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
@@ -1532,7 +1539,7 @@ MODULE_DEVICE_TABLE(i2c, da9055_i2c_id);
 /* I2C codec control layer */
 static struct i2c_driver da9055_i2c_driver = {
         .driver = {
-                .name = "da9055",
+                .name = "da9055-codec",
                 .owner = THIS_MODULE,
         },
         .probe          = da9055_i2c_probe,
diff --git a/sound/soc/codecs/isabelle.c b/sound/soc/codecs/isabelle.c
index 5839048ec467..cb736ddc446d 100644
--- a/sound/soc/codecs/isabelle.c
+++ b/sound/soc/codecs/isabelle.c
@@ -140,13 +140,17 @@ static const char *isabelle_rx1_texts[] = {"VRX1", "ARX1"};
 static const char *isabelle_rx2_texts[] = {"VRX2", "ARX2"};
 
 static const struct soc_enum isabelle_rx1_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_VOICE_HPF_CFG_REG, 3, 1, isabelle_rx1_texts),
-        SOC_ENUM_SINGLE(ISABELLE_AUDIO_HPF_CFG_REG, 5, 1, isabelle_rx1_texts),
+        SOC_ENUM_SINGLE(ISABELLE_VOICE_HPF_CFG_REG, 3,
+                        ARRAY_SIZE(isabelle_rx1_texts), isabelle_rx1_texts),
+        SOC_ENUM_SINGLE(ISABELLE_AUDIO_HPF_CFG_REG, 5,
+                        ARRAY_SIZE(isabelle_rx1_texts), isabelle_rx1_texts),
 };
 
 static const struct soc_enum isabelle_rx2_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_VOICE_HPF_CFG_REG, 2, 1, isabelle_rx2_texts),
-        SOC_ENUM_SINGLE(ISABELLE_AUDIO_HPF_CFG_REG, 4, 1, isabelle_rx2_texts),
+        SOC_ENUM_SINGLE(ISABELLE_VOICE_HPF_CFG_REG, 2,
+                        ARRAY_SIZE(isabelle_rx2_texts), isabelle_rx2_texts),
+        SOC_ENUM_SINGLE(ISABELLE_AUDIO_HPF_CFG_REG, 4,
+                        ARRAY_SIZE(isabelle_rx2_texts), isabelle_rx2_texts),
 };
 
 /* Headset DAC playback switches */
@@ -161,13 +165,17 @@ static const char *isabelle_atx_texts[] = {"AMIC1", "DMIC"};
 static const char *isabelle_vtx_texts[] = {"AMIC2", "DMIC"};
 
 static const struct soc_enum isabelle_atx_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_AMIC_CFG_REG, 7, 1, isabelle_atx_texts),
-        SOC_ENUM_SINGLE(ISABELLE_DMIC_CFG_REG, 0, 1, isabelle_atx_texts),
+        SOC_ENUM_SINGLE(ISABELLE_AMIC_CFG_REG, 7,
+                        ARRAY_SIZE(isabelle_atx_texts), isabelle_atx_texts),
+        SOC_ENUM_SINGLE(ISABELLE_DMIC_CFG_REG, 0,
+                        ARRAY_SIZE(isabelle_atx_texts), isabelle_atx_texts),
 };
 
 static const struct soc_enum isabelle_vtx_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_AMIC_CFG_REG, 6, 1, isabelle_vtx_texts),
-        SOC_ENUM_SINGLE(ISABELLE_DMIC_CFG_REG, 0, 1, isabelle_vtx_texts),
+        SOC_ENUM_SINGLE(ISABELLE_AMIC_CFG_REG, 6,
+                        ARRAY_SIZE(isabelle_vtx_texts), isabelle_vtx_texts),
+        SOC_ENUM_SINGLE(ISABELLE_DMIC_CFG_REG, 0,
+                        ARRAY_SIZE(isabelle_vtx_texts), isabelle_vtx_texts),
 };
 
 static const struct snd_kcontrol_new atx_mux_controls =
@@ -183,17 +191,13 @@ static const char *isabelle_amic1_texts[] = {
 /* Left analog microphone selection */
 static const char *isabelle_amic2_texts[] = {"Sub Mic", "Aux/FM Right"};
 
-static const struct soc_enum isabelle_amic1_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_AMIC_CFG_REG, 5,
-                        ARRAY_SIZE(isabelle_amic1_texts),
-                        isabelle_amic1_texts),
-};
+static SOC_ENUM_SINGLE_DECL(isabelle_amic1_enum,
+                            ISABELLE_AMIC_CFG_REG, 5,
+                            isabelle_amic1_texts);
 
-static const struct soc_enum isabelle_amic2_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_AMIC_CFG_REG, 4,
-                        ARRAY_SIZE(isabelle_amic2_texts),
-                        isabelle_amic2_texts),
-};
+static SOC_ENUM_SINGLE_DECL(isabelle_amic2_enum,
+                            ISABELLE_AMIC_CFG_REG, 4,
+                            isabelle_amic2_texts);
 
 static const struct snd_kcontrol_new amic1_control =
         SOC_DAPM_ENUM("Route", isabelle_amic1_enum);
@@ -206,16 +210,20 @@ static const char *isabelle_st_audio_texts[] = {"ATX1", "ATX2"};
 static const char *isabelle_st_voice_texts[] = {"VTX1", "VTX2"};
 
 static const struct soc_enum isabelle_st_audio_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_ATX_STPGA1_CFG_REG, 7, 1,
+        SOC_ENUM_SINGLE(ISABELLE_ATX_STPGA1_CFG_REG, 7,
+                        ARRAY_SIZE(isabelle_st_audio_texts),
                         isabelle_st_audio_texts),
-        SOC_ENUM_SINGLE(ISABELLE_ATX_STPGA2_CFG_REG, 7, 1,
+        SOC_ENUM_SINGLE(ISABELLE_ATX_STPGA2_CFG_REG, 7,
+                        ARRAY_SIZE(isabelle_st_audio_texts),
                         isabelle_st_audio_texts),
 };
 
 static const struct soc_enum isabelle_st_voice_enum[] = {
-        SOC_ENUM_SINGLE(ISABELLE_VTX_STPGA1_CFG_REG, 7, 1,
+        SOC_ENUM_SINGLE(ISABELLE_VTX_STPGA1_CFG_REG, 7,
+                        ARRAY_SIZE(isabelle_st_voice_texts),
                         isabelle_st_voice_texts),
-        SOC_ENUM_SINGLE(ISABELLE_VTX2_STPGA2_CFG_REG, 7, 1,
+        SOC_ENUM_SINGLE(ISABELLE_VTX2_STPGA2_CFG_REG, 7,
+                        ARRAY_SIZE(isabelle_st_voice_texts),
                         isabelle_st_voice_texts),
 };
 
diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
index 51f9b3d16b41..9f714ea86613 100644
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -336,6 +336,7 @@ static bool max98090_readable_register(struct device *dev, unsigned int reg)
         case M98090_REG_RECORD_TDM_SLOT:
         case M98090_REG_SAMPLE_RATE:
         case M98090_REG_DMIC34_BIQUAD_BASE ... M98090_REG_DMIC34_BIQUAD_BASE + 0x0E:
+        case M98090_REG_REVISION_ID:
                 return true;
         default:
                 return false;
@@ -1769,16 +1770,6 @@ static int max98090_set_bias_level(struct snd_soc_codec *codec,
 
         switch (level) {
         case SND_SOC_BIAS_ON:
-                if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) {
-                        ret = regcache_sync(max98090->regmap);
-
-                        if (ret != 0) {
-                                dev_err(codec->dev,
-                                        "Failed to sync cache: %d\n", ret);
-                                return ret;
-                        }
-                }
-
                 if (max98090->jack_state == M98090_JACK_STATE_HEADSET) {
                         /*
                          * Set to normal bias level.
@@ -1792,6 +1783,16 @@ static int max98090_set_bias_level(struct snd_soc_codec *codec,
                 break;
 
         case SND_SOC_BIAS_STANDBY:
+                if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) {
+                        ret = regcache_sync(max98090->regmap);
+                        if (ret != 0) {
+                                dev_err(codec->dev,
+                                        "Failed to sync cache: %d\n", ret);
+                                return ret;
+                        }
+                }
+                break;
+
         case SND_SOC_BIAS_OFF:
                 /* Set internal pull-up to lowest power mode */
                 snd_soc_update_bits(codec, M98090_REG_JACK_DETECT,
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index a3fb41179636..886924934aa5 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -2093,6 +2093,7 @@ MODULE_DEVICE_TABLE(i2c, rt5640_i2c_id);
 #ifdef CONFIG_ACPI
 static struct acpi_device_id rt5640_acpi_match[] = {
         { "INT33CA", 0 },
+        { "10EC5640", 0 },
         { },
 };
 MODULE_DEVICE_TABLE(acpi, rt5640_acpi_match);
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index 06edb396e733..2735361a4c3c 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -187,42 +187,42 @@ static const unsigned int sta32x_limiter_drc_release_tlv[] = {
         13, 16, TLV_DB_SCALE_ITEM(-1500, 300, 0),
 };
 
-static const struct soc_enum sta32x_drc_ac_enum =
-        SOC_ENUM_SINGLE(STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
-                        2, sta32x_drc_ac);
-static const struct soc_enum sta32x_auto_eq_enum =
-        SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
-                        3, sta32x_auto_eq_mode);
-static const struct soc_enum sta32x_auto_gc_enum =
-        SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
-                        4, sta32x_auto_gc_mode);
-static const struct soc_enum sta32x_auto_xo_enum =
-        SOC_ENUM_SINGLE(STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
-                        16, sta32x_auto_xo_mode);
-static const struct soc_enum sta32x_preset_eq_enum =
-        SOC_ENUM_SINGLE(STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
-                        32, sta32x_preset_eq_mode);
-static const struct soc_enum sta32x_limiter_ch1_enum =
-        SOC_ENUM_SINGLE(STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
-                        3, sta32x_limiter_select);
-static const struct soc_enum sta32x_limiter_ch2_enum =
-        SOC_ENUM_SINGLE(STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
-                        3, sta32x_limiter_select);
-static const struct soc_enum sta32x_limiter_ch3_enum =
-        SOC_ENUM_SINGLE(STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
-                        3, sta32x_limiter_select);
-static const struct soc_enum sta32x_limiter1_attack_rate_enum =
-        SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxA_SHIFT,
-                        16, sta32x_limiter_attack_rate);
-static const struct soc_enum sta32x_limiter2_attack_rate_enum =
-        SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxA_SHIFT,
-                        16, sta32x_limiter_attack_rate);
-static const struct soc_enum sta32x_limiter1_release_rate_enum =
-        SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxR_SHIFT,
-                        16, sta32x_limiter_release_rate);
-static const struct soc_enum sta32x_limiter2_release_rate_enum =
-        SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxR_SHIFT,
-                        16, sta32x_limiter_release_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_drc_ac_enum,
+                            STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
+                            sta32x_drc_ac);
+static SOC_ENUM_SINGLE_DECL(sta32x_auto_eq_enum,
+                            STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
+                            sta32x_auto_eq_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_auto_gc_enum,
+                            STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
+                            sta32x_auto_gc_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_auto_xo_enum,
+                            STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
+                            sta32x_auto_xo_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_preset_eq_enum,
+                            STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
+                            sta32x_preset_eq_mode);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch1_enum,
+                            STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
+                            sta32x_limiter_select);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch2_enum,
+                            STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
+                            sta32x_limiter_select);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch3_enum,
+                            STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
+                            sta32x_limiter_select);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_attack_rate_enum,
+                            STA32X_L1AR, STA32X_LxA_SHIFT,
+                            sta32x_limiter_attack_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_attack_rate_enum,
+                            STA32X_L2AR, STA32X_LxA_SHIFT,
+                            sta32x_limiter_attack_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_release_rate_enum,
+                            STA32X_L1AR, STA32X_LxR_SHIFT,
+                            sta32x_limiter_release_rate);
+static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
+                            STA32X_L2AR, STA32X_LxR_SHIFT,
+                            sta32x_limiter_release_rate);
 
 /* byte array controls for setting biquad, mixer, scaling coefficients;
  * for biquads all five coefficients need to be set in one go,
@@ -331,7 +331,7 @@ static int sta32x_sync_coef_shadow(struct snd_soc_codec *codec)
 
 static int sta32x_cache_sync(struct snd_soc_codec *codec)
 {
-        struct sta32x_priv *sta32x = codec->control_data;
+        struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec);
         unsigned int mute;
         int rc;
 
@@ -434,7 +434,7 @@ SOC_SINGLE_TLV("Treble Tone Control", STA32X_TONE, STA32X_TONE_TTC_SHIFT, 15, 0,
 SOC_ENUM("Limiter1 Attack Rate (dB/ms)", sta32x_limiter1_attack_rate_enum),
 SOC_ENUM("Limiter2 Attack Rate (dB/ms)", sta32x_limiter2_attack_rate_enum),
 SOC_ENUM("Limiter1 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum),
-SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum),
+SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter2_release_rate_enum),
 
 /* depending on mode, the attack/release thresholds have
  * two different enum definitions; provide both
diff --git a/sound/soc/codecs/wm8400.c b/sound/soc/codecs/wm8400.c
index 48dc7d2fee36..6d684d934f4d 100644
--- a/sound/soc/codecs/wm8400.c
+++ b/sound/soc/codecs/wm8400.c
@@ -117,19 +117,23 @@ static int wm8400_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol,
 static const char *wm8400_digital_sidetone[] =
         {"None", "Left ADC", "Right ADC", "Reserved"};
 
-static const struct soc_enum wm8400_left_digital_sidetone_enum =
-SOC_ENUM_SINGLE(WM8400_DIGITAL_SIDE_TONE,
-                WM8400_ADC_TO_DACL_SHIFT, 2, wm8400_digital_sidetone);
+static SOC_ENUM_SINGLE_DECL(wm8400_left_digital_sidetone_enum,
+                            WM8400_DIGITAL_SIDE_TONE,
+                            WM8400_ADC_TO_DACL_SHIFT,
+                            wm8400_digital_sidetone);
 
-static const struct soc_enum wm8400_right_digital_sidetone_enum =
-SOC_ENUM_SINGLE(WM8400_DIGITAL_SIDE_TONE,
-                WM8400_ADC_TO_DACR_SHIFT, 2, wm8400_digital_sidetone);
+static SOC_ENUM_SINGLE_DECL(wm8400_right_digital_sidetone_enum,
+                            WM8400_DIGITAL_SIDE_TONE,
+                            WM8400_ADC_TO_DACR_SHIFT,
+                            wm8400_digital_sidetone);
 
 static const char *wm8400_adcmode[] =
         {"Hi-fi mode", "Voice mode 1", "Voice mode 2", "Voice mode 3"};
 
-static const struct soc_enum wm8400_right_adcmode_enum =
-SOC_ENUM_SINGLE(WM8400_ADC_CTRL, WM8400_ADC_HPF_CUT_SHIFT, 3, wm8400_adcmode);
+static SOC_ENUM_SINGLE_DECL(wm8400_right_adcmode_enum,
+                            WM8400_ADC_CTRL,
+                            WM8400_ADC_HPF_CUT_SHIFT,
+                            wm8400_adcmode);
 
 static const struct snd_kcontrol_new wm8400_snd_controls[] = {
 /* INMIXL */
@@ -422,9 +426,10 @@ SOC_DAPM_SINGLE("RINPGA34 Switch", WM8400_INPUT_MIXER3, WM8400_L34MNB_SHIFT,
 static const char *wm8400_ainlmux[] =
         {"INMIXL Mix", "RXVOICE Mix", "DIFFINL Mix"};
 
-static const struct soc_enum wm8400_ainlmux_enum =
-SOC_ENUM_SINGLE( WM8400_INPUT_MIXER1, WM8400_AINLMODE_SHIFT,
-        ARRAY_SIZE(wm8400_ainlmux), wm8400_ainlmux);
+static SOC_ENUM_SINGLE_DECL(wm8400_ainlmux_enum,
+                            WM8400_INPUT_MIXER1,
+                            WM8400_AINLMODE_SHIFT,
+                            wm8400_ainlmux);
 
 static const struct snd_kcontrol_new wm8400_dapm_ainlmux_controls =
 SOC_DAPM_ENUM("Route", wm8400_ainlmux_enum);
@@ -435,9 +440,10 @@ SOC_DAPM_ENUM("Route", wm8400_ainlmux_enum);
 static const char *wm8400_ainrmux[] =
         {"INMIXR Mix", "RXVOICE Mix", "DIFFINR Mix"};
 
-static const struct soc_enum wm8400_ainrmux_enum =
-SOC_ENUM_SINGLE( WM8400_INPUT_MIXER1, WM8400_AINRMODE_SHIFT,
-        ARRAY_SIZE(wm8400_ainrmux), wm8400_ainrmux);
+static SOC_ENUM_SINGLE_DECL(wm8400_ainrmux_enum,
+                            WM8400_INPUT_MIXER1,
+                            WM8400_AINRMODE_SHIFT,
+                            wm8400_ainrmux);
 
 static const struct snd_kcontrol_new wm8400_dapm_ainrmux_controls =
 SOC_DAPM_ENUM("Route", wm8400_ainrmux_enum);
diff --git a/sound/soc/codecs/wm8770.c b/sound/soc/codecs/wm8770.c
index 89a18d82f303..5bce21013485 100644
--- a/sound/soc/codecs/wm8770.c
+++ b/sound/soc/codecs/wm8770.c
@@ -196,8 +196,8 @@ static const char *ain_text[] = {
         "AIN5", "AIN6", "AIN7", "AIN8"
 };
 
-static const struct soc_enum ain_enum =
-        SOC_ENUM_DOUBLE(WM8770_ADCMUX, 0, 4, 8, ain_text);
+static SOC_ENUM_DOUBLE_DECL(ain_enum,
+                            WM8770_ADCMUX, 0, 4, ain_text);
 
 static const struct snd_kcontrol_new ain_mux =
         SOC_DAPM_ENUM("Capture Mux", ain_enum);
diff --git a/sound/soc/codecs/wm8900.c b/sound/soc/codecs/wm8900.c
index e98bc7038a08..43c2201cb901 100644
--- a/sound/soc/codecs/wm8900.c
+++ b/sound/soc/codecs/wm8900.c
@@ -304,53 +304,53 @@ static const DECLARE_TLV_DB_SCALE(adc_tlv, -7200, 75, 1);
 
 static const char *mic_bias_level_txt[] = { "0.9*AVDD", "0.65*AVDD" };
 
-static const struct soc_enum mic_bias_level =
-SOC_ENUM_SINGLE(WM8900_REG_INCTL, 8, 2, mic_bias_level_txt);
+static SOC_ENUM_SINGLE_DECL(mic_bias_level,
+                            WM8900_REG_INCTL, 8, mic_bias_level_txt);
 
 static const char *dac_mute_rate_txt[] = { "Fast", "Slow" };
 
-static const struct soc_enum dac_mute_rate =
-SOC_ENUM_SINGLE(WM8900_REG_DACCTRL, 7, 2, dac_mute_rate_txt);
+static SOC_ENUM_SINGLE_DECL(dac_mute_rate,
+                            WM8900_REG_DACCTRL, 7, dac_mute_rate_txt);
 
 static const char *dac_deemphasis_txt[] = {
         "Disabled", "32kHz", "44.1kHz", "48kHz"
 };
 
-static const struct soc_enum dac_deemphasis =
-SOC_ENUM_SINGLE(WM8900_REG_DACCTRL, 4, 4, dac_deemphasis_txt);
+static SOC_ENUM_SINGLE_DECL(dac_deemphasis,
+                            WM8900_REG_DACCTRL, 4, dac_deemphasis_txt);
 
 static const char *adc_hpf_cut_txt[] = {
         "Hi-fi mode", "Voice mode 1", "Voice mode 2", "Voice mode 3"
 };
 
-static const struct soc_enum adc_hpf_cut =
-SOC_ENUM_SINGLE(WM8900_REG_ADCCTRL, 5, 4, adc_hpf_cut_txt);
+static SOC_ENUM_SINGLE_DECL(adc_hpf_cut,
+                            WM8900_REG_ADCCTRL, 5, adc_hpf_cut_txt);
 
 static const char *lr_txt[] = {
         "Left", "Right"
 };
 
-static const struct soc_enum aifl_src =
-SOC_ENUM_SINGLE(WM8900_REG_AUDIO1, 15, 2, lr_txt);
+static SOC_ENUM_SINGLE_DECL(aifl_src,
+                            WM8900_REG_AUDIO1, 15, lr_txt);
 
-static const struct soc_enum aifr_src =
-SOC_ENUM_SINGLE(WM8900_REG_AUDIO1, 14, 2, lr_txt);
+static SOC_ENUM_SINGLE_DECL(aifr_src,
+                            WM8900_REG_AUDIO1, 14, lr_txt);
 
-static const struct soc_enum dacl_src =
-SOC_ENUM_SINGLE(WM8900_REG_AUDIO2, 15, 2, lr_txt);
+static SOC_ENUM_SINGLE_DECL(dacl_src,
+                            WM8900_REG_AUDIO2, 15, lr_txt);
 
-static const struct soc_enum dacr_src =
-SOC_ENUM_SINGLE(WM8900_REG_AUDIO2, 14, 2, lr_txt);
+static SOC_ENUM_SINGLE_DECL(dacr_src,
+                            WM8900_REG_AUDIO2, 14, lr_txt);
 
 static const char *sidetone_txt[] = {
         "Disabled", "Left ADC", "Right ADC"
 };
 
-static const struct soc_enum dacl_sidetone =
-SOC_ENUM_SINGLE(WM8900_REG_SIDETONE, 2, 3, sidetone_txt);
+static SOC_ENUM_SINGLE_DECL(dacl_sidetone,
+                            WM8900_REG_SIDETONE, 2, sidetone_txt);
 
-static const struct soc_enum dacr_sidetone =
-SOC_ENUM_SINGLE(WM8900_REG_SIDETONE, 0, 3, sidetone_txt);
+static SOC_ENUM_SINGLE_DECL(dacr_sidetone,
+                            WM8900_REG_SIDETONE, 0, sidetone_txt);
 
 static const struct snd_kcontrol_new wm8900_snd_controls[] = {
 SOC_ENUM("Mic Bias Level", mic_bias_level),
@@ -496,8 +496,8 @@ SOC_DAPM_SINGLE("RINPUT3 Switch", WM8900_REG_INCTL, 0, 1, 0),
 
 static const char *wm8900_lp_mux[] = { "Disabled", "Enabled" };
 
-static const struct soc_enum wm8900_lineout2_lp_mux =
-SOC_ENUM_SINGLE(WM8900_REG_LOUTMIXCTL1, 1, 2, wm8900_lp_mux);
+static SOC_ENUM_SINGLE_DECL(wm8900_lineout2_lp_mux,
+                            WM8900_REG_LOUTMIXCTL1, 1, wm8900_lp_mux);
 
 static const struct snd_kcontrol_new wm8900_lineout2_lp =
 SOC_DAPM_ENUM("Route", wm8900_lineout2_lp_mux);
diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
index b7488f190d2b..d4248e00160e 100644
--- a/sound/soc/codecs/wm8958-dsp2.c
+++ b/sound/soc/codecs/wm8958-dsp2.c
@@ -153,7 +153,7 @@ static int wm8958_dsp2_fw(struct snd_soc_codec *codec, const char *name,
 
                         data32 &= 0xffffff;
 
-                        wm8994_bulk_write(codec->control_data,
+                        wm8994_bulk_write(wm8994->wm8994,
                                           data32 & 0xffffff,
                                           block_len / 2,
                                           (void *)(data + 8));
diff --git a/sound/soc/codecs/wm8993.c b/sound/soc/codecs/wm8993.c
index 433d59a0f3ef..2ee23a39622c 100644
--- a/sound/soc/codecs/wm8993.c
+++ b/sound/soc/codecs/wm8993.c
@@ -1562,7 +1562,6 @@ static int wm8993_remove(struct snd_soc_codec *codec)
         struct wm8993_priv *wm8993 = snd_soc_codec_get_drvdata(codec);
 
         wm8993_set_bias_level(codec, SND_SOC_BIAS_OFF);
-        regulator_bulk_free(ARRAY_SIZE(wm8993->supplies), wm8993->supplies);
         return 0;
 }
 
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index b9be9cbc4603..adb72063d44e 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -265,21 +265,21 @@ static const char *sidetone_hpf_text[] = {
         "2.7kHz", "1.35kHz", "675Hz", "370Hz", "180Hz", "90Hz", "45Hz"
 };
 
-static const struct soc_enum sidetone_hpf =
-        SOC_ENUM_SINGLE(WM8994_SIDETONE, 7, 7, sidetone_hpf_text);
+static SOC_ENUM_SINGLE_DECL(sidetone_hpf,
+                            WM8994_SIDETONE, 7, sidetone_hpf_text);
 
 static const char *adc_hpf_text[] = {
         "HiFi", "Voice 1", "Voice 2", "Voice 3"
 };
 
-static const struct soc_enum aif1adc1_hpf =
-        SOC_ENUM_SINGLE(WM8994_AIF1_ADC1_FILTERS, 13, 4, adc_hpf_text);
+static SOC_ENUM_SINGLE_DECL(aif1adc1_hpf,
+                            WM8994_AIF1_ADC1_FILTERS, 13, adc_hpf_text);
 
-static const struct soc_enum aif1adc2_hpf =
-        SOC_ENUM_SINGLE(WM8994_AIF1_ADC2_FILTERS, 13, 4, adc_hpf_text);
+static SOC_ENUM_SINGLE_DECL(aif1adc2_hpf,
+                            WM8994_AIF1_ADC2_FILTERS, 13, adc_hpf_text);
 
-static const struct soc_enum aif2adc_hpf =
-        SOC_ENUM_SINGLE(WM8994_AIF2_ADC_FILTERS, 13, 4, adc_hpf_text);
+static SOC_ENUM_SINGLE_DECL(aif2adc_hpf,
+                            WM8994_AIF2_ADC_FILTERS, 13, adc_hpf_text);
 
 static const DECLARE_TLV_DB_SCALE(aif_tlv, 0, 600, 0);
 static const DECLARE_TLV_DB_SCALE(digital_tlv, -7200, 75, 1);
@@ -501,39 +501,39 @@ static const char *aif_chan_src_text[] = {
         "Left", "Right"
 };
 
-static const struct soc_enum aif1adcl_src =
-        SOC_ENUM_SINGLE(WM8994_AIF1_CONTROL_1, 15, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif1adcl_src,
+                            WM8994_AIF1_CONTROL_1, 15, aif_chan_src_text);
 
-static const struct soc_enum aif1adcr_src =
-        SOC_ENUM_SINGLE(WM8994_AIF1_CONTROL_1, 14, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif1adcr_src,
+                            WM8994_AIF1_CONTROL_1, 14, aif_chan_src_text);
 
-static const struct soc_enum aif2adcl_src =
-        SOC_ENUM_SINGLE(WM8994_AIF2_CONTROL_1, 15, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif2adcl_src,
+                            WM8994_AIF2_CONTROL_1, 15, aif_chan_src_text);
 
-static const struct soc_enum aif2adcr_src =
-        SOC_ENUM_SINGLE(WM8994_AIF2_CONTROL_1, 14, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif2adcr_src,
+                            WM8994_AIF2_CONTROL_1, 14, aif_chan_src_text);
 
-static const struct soc_enum aif1dacl_src =
-        SOC_ENUM_SINGLE(WM8994_AIF1_CONTROL_2, 15, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif1dacl_src,
+                            WM8994_AIF1_CONTROL_2, 15, aif_chan_src_text);
 
-static const struct soc_enum aif1dacr_src =
-        SOC_ENUM_SINGLE(WM8994_AIF1_CONTROL_2, 14, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif1dacr_src,
+                            WM8994_AIF1_CONTROL_2, 14, aif_chan_src_text);
 
-static const struct soc_enum aif2dacl_src =
-        SOC_ENUM_SINGLE(WM8994_AIF2_CONTROL_2, 15, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif2dacl_src,
+                            WM8994_AIF2_CONTROL_2, 15, aif_chan_src_text);
 
-static const struct soc_enum aif2dacr_src =
-        SOC_ENUM_SINGLE(WM8994_AIF2_CONTROL_2, 14, 2, aif_chan_src_text);
+static SOC_ENUM_SINGLE_DECL(aif2dacr_src,
+                            WM8994_AIF2_CONTROL_2, 14, aif_chan_src_text);
 
 static const char *osr_text[] = {
         "Low Power", "High Performance",
 };
 
-static const struct soc_enum dac_osr =
-        SOC_ENUM_SINGLE(WM8994_OVERSAMPLING, 0, 2, osr_text);
+static SOC_ENUM_SINGLE_DECL(dac_osr,
+                            WM8994_OVERSAMPLING, 0, osr_text);
 
-static const struct soc_enum adc_osr =
-        SOC_ENUM_SINGLE(WM8994_OVERSAMPLING, 1, 2, osr_text);
+static SOC_ENUM_SINGLE_DECL(adc_osr,
+                            WM8994_OVERSAMPLING, 1, osr_text);
 
 static const struct snd_kcontrol_new wm8994_snd_controls[] = {
 SOC_DOUBLE_R_TLV("AIF1ADC1 Volume", WM8994_AIF1_ADC1_LEFT_VOLUME,
@@ -690,17 +690,20 @@ static const char *wm8958_ng_text[] = {
         "30ms", "125ms", "250ms", "500ms",
 };
 
-static const struct soc_enum wm8958_aif1dac1_ng_hold =
-        SOC_ENUM_SINGLE(WM8958_AIF1_DAC1_NOISE_GATE,
-                        WM8958_AIF1DAC1_NG_THR_SHIFT, 4, wm8958_ng_text);
+static SOC_ENUM_SINGLE_DECL(wm8958_aif1dac1_ng_hold,
+                            WM8958_AIF1_DAC1_NOISE_GATE,
+                            WM8958_AIF1DAC1_NG_THR_SHIFT,
+                            wm8958_ng_text);
 
-static const struct soc_enum wm8958_aif1dac2_ng_hold =
-        SOC_ENUM_SINGLE(WM8958_AIF1_DAC2_NOISE_GATE,
-                        WM8958_AIF1DAC2_NG_THR_SHIFT, 4, wm8958_ng_text);
+static SOC_ENUM_SINGLE_DECL(wm8958_aif1dac2_ng_hold,
+                            WM8958_AIF1_DAC2_NOISE_GATE,
+                            WM8958_AIF1DAC2_NG_THR_SHIFT,
+                            wm8958_ng_text);
 
-static const struct soc_enum wm8958_aif2dac_ng_hold =
-        SOC_ENUM_SINGLE(WM8958_AIF2_DAC_NOISE_GATE,
-                        WM8958_AIF2DAC_NG_THR_SHIFT, 4, wm8958_ng_text);
+static SOC_ENUM_SINGLE_DECL(wm8958_aif2dac_ng_hold,
+                            WM8958_AIF2_DAC_NOISE_GATE,
+                            WM8958_AIF2DAC_NG_THR_SHIFT,
+                            wm8958_ng_text);
 
 static const struct snd_kcontrol_new wm8958_snd_controls[] = {
 SOC_SINGLE_TLV("AIF3 Boost Volume", WM8958_AIF3_CONTROL_2, 10, 3, 0, aif_tlv),
@@ -1341,8 +1344,8 @@ static const char *adc_mux_text[] = {
         "DMIC",
 };
 
-static const struct soc_enum adc_enum =
-        SOC_ENUM_SINGLE(0, 0, 2, adc_mux_text);
+static SOC_ENUM_SINGLE_DECL(adc_enum,
+                            0, 0, adc_mux_text);
 
 static const struct snd_kcontrol_new adcl_mux =
         SOC_DAPM_ENUM_VIRT("ADCL Mux", adc_enum);
@@ -1478,14 +1481,14 @@ static const char *sidetone_text[] = {
         "ADC/DMIC1", "DMIC2",
 };
 
-static const struct soc_enum sidetone1_enum =
-        SOC_ENUM_SINGLE(WM8994_SIDETONE, 0, 2, sidetone_text);
+static SOC_ENUM_SINGLE_DECL(sidetone1_enum,
+                            WM8994_SIDETONE, 0, sidetone_text);
 
 static const struct snd_kcontrol_new sidetone1_mux =
         SOC_DAPM_ENUM("Left Sidetone Mux", sidetone1_enum);
 
-static const struct soc_enum sidetone2_enum =
-        SOC_ENUM_SINGLE(WM8994_SIDETONE, 1, 2, sidetone_text);
+static SOC_ENUM_SINGLE_DECL(sidetone2_enum,
+                            WM8994_SIDETONE, 1, sidetone_text);
 
 static const struct snd_kcontrol_new sidetone2_mux =
         SOC_DAPM_ENUM("Right Sidetone Mux", sidetone2_enum);
@@ -1498,22 +1501,24 @@ static const char *loopback_text[] = {
         "None", "ADCDAT",
 };
 
-static const struct soc_enum aif1_loopback_enum =
-        SOC_ENUM_SINGLE(WM8994_AIF1_CONTROL_2, WM8994_AIF1_LOOPBACK_SHIFT, 2,
-                        loopback_text);
+static SOC_ENUM_SINGLE_DECL(aif1_loopback_enum,
+                            WM8994_AIF1_CONTROL_2,
+                            WM8994_AIF1_LOOPBACK_SHIFT,
+                            loopback_text);
 
 static const struct snd_kcontrol_new aif1_loopback =
         SOC_DAPM_ENUM("AIF1 Loopback", aif1_loopback_enum);
 
-static const struct soc_enum aif2_loopback_enum =
-        SOC_ENUM_SINGLE(WM8994_AIF2_CONTROL_2, WM8994_AIF2_LOOPBACK_SHIFT, 2,
-                        loopback_text);
+static SOC_ENUM_SINGLE_DECL(aif2_loopback_enum,
+                            WM8994_AIF2_CONTROL_2,
+                            WM8994_AIF2_LOOPBACK_SHIFT,
+                            loopback_text);
 
 static const struct snd_kcontrol_new aif2_loopback =
         SOC_DAPM_ENUM("AIF2 Loopback", aif2_loopback_enum);
 
-static const struct soc_enum aif1dac_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 0, 2, aif1dac_text);
+static SOC_ENUM_SINGLE_DECL(aif1dac_enum,
+                            WM8994_POWER_MANAGEMENT_6, 0, aif1dac_text);
 
 static const struct snd_kcontrol_new aif1dac_mux =
         SOC_DAPM_ENUM("AIF1DAC Mux", aif1dac_enum);
@@ -1522,8 +1527,8 @@ static const char *aif2dac_text[] = {
         "AIF2DACDAT", "AIF3DACDAT",
 };
 
-static const struct soc_enum aif2dac_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 1, 2, aif2dac_text);
+static SOC_ENUM_SINGLE_DECL(aif2dac_enum,
+                            WM8994_POWER_MANAGEMENT_6, 1, aif2dac_text);
 
 static const struct snd_kcontrol_new aif2dac_mux =
         SOC_DAPM_ENUM("AIF2DAC Mux", aif2dac_enum);
@@ -1532,8 +1537,8 @@ static const char *aif2adc_text[] = {
         "AIF2ADCDAT", "AIF3DACDAT",
 };
 
-static const struct soc_enum aif2adc_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 2, 2, aif2adc_text);
+static SOC_ENUM_SINGLE_DECL(aif2adc_enum,
+                            WM8994_POWER_MANAGEMENT_6, 2, aif2adc_text);
 
 static const struct snd_kcontrol_new aif2adc_mux =
         SOC_DAPM_ENUM("AIF2ADC Mux", aif2adc_enum);
@@ -1542,14 +1547,14 @@ static const char *aif3adc_text[] = {
         "AIF1ADCDAT", "AIF2ADCDAT", "AIF2DACDAT", "Mono PCM",
 };
 
-static const struct soc_enum wm8994_aif3adc_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 3, 3, aif3adc_text);
+static SOC_ENUM_SINGLE_DECL(wm8994_aif3adc_enum,
+                            WM8994_POWER_MANAGEMENT_6, 3, aif3adc_text);
 
 static const struct snd_kcontrol_new wm8994_aif3adc_mux =
         SOC_DAPM_ENUM("AIF3ADC Mux", wm8994_aif3adc_enum);
 
-static const struct soc_enum wm8958_aif3adc_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 3, 4, aif3adc_text);
+static SOC_ENUM_SINGLE_DECL(wm8958_aif3adc_enum,
+                            WM8994_POWER_MANAGEMENT_6, 3, aif3adc_text);
 
 static const struct snd_kcontrol_new wm8958_aif3adc_mux =
         SOC_DAPM_ENUM("AIF3ADC Mux", wm8958_aif3adc_enum);
@@ -1558,8 +1563,8 @@ static const char *mono_pcm_out_text[] = {
         "None", "AIF2ADCL", "AIF2ADCR",
 };
 
-static const struct soc_enum mono_pcm_out_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 9, 3, mono_pcm_out_text);
+static SOC_ENUM_SINGLE_DECL(mono_pcm_out_enum,
+                            WM8994_POWER_MANAGEMENT_6, 9, mono_pcm_out_text);
 
 static const struct snd_kcontrol_new mono_pcm_out_mux =
         SOC_DAPM_ENUM("Mono PCM Out Mux", mono_pcm_out_enum);
@@ -1569,14 +1574,14 @@ static const char *aif2dac_src_text[] = {
 };
 
 /* Note that these two control shouldn't be simultaneously switched to AIF3 */
-static const struct soc_enum aif2dacl_src_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 7, 2, aif2dac_src_text);
+static SOC_ENUM_SINGLE_DECL(aif2dacl_src_enum,
+                            WM8994_POWER_MANAGEMENT_6, 7, aif2dac_src_text);
 
 static const struct snd_kcontrol_new aif2dacl_src_mux =
         SOC_DAPM_ENUM("AIF2DACL Mux", aif2dacl_src_enum);
 
-static const struct soc_enum aif2dacr_src_enum =
-        SOC_ENUM_SINGLE(WM8994_POWER_MANAGEMENT_6, 8, 2, aif2dac_src_text);
+static SOC_ENUM_SINGLE_DECL(aif2dacr_src_enum,
+                            WM8994_POWER_MANAGEMENT_6, 8, aif2dac_src_text);
 
 static const struct snd_kcontrol_new aif2dacr_src_mux =
         SOC_DAPM_ENUM("AIF2DACR Mux", aif2dacr_src_enum);
diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c
index 70ff3772079f..5e3bc3c6801a 100644
--- a/sound/soc/davinci/davinci-evm.c
+++ b/sound/soc/davinci/davinci-evm.c
@@ -399,6 +399,7 @@ static struct platform_driver davinci_evm_driver = {
         .driver         = {
                 .name   = "davinci_evm",
                 .owner  = THIS_MODULE,
+                .pm     = &snd_soc_pm_ops,
                 .of_match_table = of_match_ptr(davinci_evm_dt_ids),
         },
 };
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index b7858bfa0295..670afa29e30d 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -263,7 +263,9 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                                          unsigned int fmt)
 {
         struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret = 0;
 
+        pm_runtime_get_sync(mcasp->dev);
         switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
         case SND_SOC_DAIFMT_DSP_B:
         case SND_SOC_DAIFMT_AC97:
@@ -317,7 +319,8 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 break;
 
         default:
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
@@ -354,10 +357,12 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 break;
 
         default:
-                return -EINVAL;
+                ret = -EINVAL;
+                break;
         }
-
-        return 0;
+out:
+        pm_runtime_put_sync(mcasp->dev);
+        return ret;
 }
 
 static int davinci_mcasp_set_clkdiv(struct snd_soc_dai *dai, int div_id, int div)
@@ -448,7 +453,7 @@ static int davinci_config_channel_size(struct davinci_mcasp *mcasp,
         return 0;
 }
 
-static int davinci_hw_common_param(struct davinci_mcasp *mcasp, int stream,
+static int mcasp_common_hw_param(struct davinci_mcasp *mcasp, int stream,
                                     int channels)
 {
         int i;
@@ -524,12 +529,18 @@ static int davinci_hw_common_param(struct davinci_mcasp *mcasp, int stream,
         return 0;
 }
 
-static void davinci_hw_param(struct davinci_mcasp *mcasp, int stream)
+static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream)
 {
         int i, active_slots;
         u32 mask = 0;
         u32 busel = 0;
 
+        if ((mcasp->tdm_slots < 2) || (mcasp->tdm_slots > 32)) {
+                dev_err(mcasp->dev, "tdm slot %d not supported\n",
+                        mcasp->tdm_slots);
+                return -EINVAL;
+        }
+
         active_slots = (mcasp->tdm_slots > 31) ? 32 : mcasp->tdm_slots;
         for (i = 0; i < active_slots; i++)
                 mask |= (1 << i);
@@ -539,35 +550,21 @@ static void davinci_hw_param(struct davinci_mcasp *mcasp, int stream)
         if (!mcasp->dat_port)
                 busel = TXSEL;
 
-        if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                /* bit stream is MSB first  with no delay */
-                /* DSP_B mode */
-                mcasp_set_reg(mcasp, DAVINCI_MCASP_TXTDM_REG, mask);
-                mcasp_set_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, busel | TXORD);
-
-                if ((mcasp->tdm_slots >= 2) && (mcasp->tdm_slots <= 32))
-                        mcasp_mod_bits(mcasp, DAVINCI_MCASP_TXFMCTL_REG,
-                                       FSXMOD(mcasp->tdm_slots), FSXMOD(0x1FF));
-                else
-                        printk(KERN_ERR "playback tdm slot %d not supported\n",
-                                mcasp->tdm_slots);
-        } else {
-                /* bit stream is MSB first with no delay */
-                /* DSP_B mode */
-                mcasp_set_bits(mcasp, DAVINCI_MCASP_RXFMT_REG, busel | RXORD);
-                mcasp_set_reg(mcasp, DAVINCI_MCASP_RXTDM_REG, mask);
-
-                if ((mcasp->tdm_slots >= 2) && (mcasp->tdm_slots <= 32))
-                        mcasp_mod_bits(mcasp, DAVINCI_MCASP_RXFMCTL_REG,
-                                       FSRMOD(mcasp->tdm_slots), FSRMOD(0x1FF));
-                else
-                        printk(KERN_ERR "capture tdm slot %d not supported\n",
-                                mcasp->tdm_slots);
-        }
+        mcasp_set_reg(mcasp, DAVINCI_MCASP_TXTDM_REG, mask);
+        mcasp_set_bits(mcasp, DAVINCI_MCASP_TXFMT_REG, busel | TXORD);
+        mcasp_mod_bits(mcasp, DAVINCI_MCASP_TXFMCTL_REG,
+                       FSXMOD(mcasp->tdm_slots), FSXMOD(0x1FF));
+
+        mcasp_set_reg(mcasp, DAVINCI_MCASP_RXTDM_REG, mask);
+        mcasp_set_bits(mcasp, DAVINCI_MCASP_RXFMT_REG, busel | RXORD);
+        mcasp_mod_bits(mcasp, DAVINCI_MCASP_RXFMCTL_REG,
+                       FSRMOD(mcasp->tdm_slots), FSRMOD(0x1FF));
+
+        return 0;
 }
 
 /* S/PDIF */
-static void davinci_hw_dit_param(struct davinci_mcasp *mcasp)
+static int mcasp_dit_hw_param(struct davinci_mcasp *mcasp)
 {
         /* Set the TX format : 24 bit right rotation, 32 bit slot, Pad 0
            and LSB first */
@@ -589,6 +586,8 @@ static void davinci_hw_dit_param(struct davinci_mcasp *mcasp)
 
         /* Enable the DIT */
         mcasp_set_bits(mcasp, DAVINCI_MCASP_TXDITCTL_REG, DITEN);
+
+        return 0;
 }
 
 static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
@@ -605,13 +604,14 @@ static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
         u8 slots = mcasp->tdm_slots;
         u8 active_serializers;
         int channels;
+        int ret;
         struct snd_interval *pcm_channels = hw_param_interval(params,
                                         SNDRV_PCM_HW_PARAM_CHANNELS);
         channels = pcm_channels->min;
 
         active_serializers = (channels + slots - 1) / slots;
 
-        if (davinci_hw_common_param(mcasp, substream->stream, channels) == -EINVAL)
+        if (mcasp_common_hw_param(mcasp, substream->stream, channels) == -EINVAL)
                 return -EINVAL;
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                 fifo_level = mcasp->txnumevt * active_serializers;
@@ -619,9 +619,12 @@ static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
                 fifo_level = mcasp->rxnumevt * active_serializers;
 
         if (mcasp->op_mode == DAVINCI_MCASP_DIT_MODE)
-                davinci_hw_dit_param(mcasp);
+                ret = mcasp_dit_hw_param(mcasp);
         else
-                davinci_hw_param(mcasp, substream->stream);
+                ret = mcasp_i2s_hw_param(mcasp, substream->stream);
+
+        if (ret)
+                return ret;
 
         switch (params_format(params)) {
         case SNDRV_PCM_FORMAT_U8:
@@ -678,19 +681,9 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream,
         case SNDRV_PCM_TRIGGER_RESUME:
         case SNDRV_PCM_TRIGGER_START:
         case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                ret = pm_runtime_get_sync(mcasp->dev);
-                if (IS_ERR_VALUE(ret))
-                        dev_err(mcasp->dev, "pm_runtime_get_sync() failed\n");
                 davinci_mcasp_start(mcasp, substream->stream);
                 break;
-
         case SNDRV_PCM_TRIGGER_SUSPEND:
-                davinci_mcasp_stop(mcasp, substream->stream);
-                ret = pm_runtime_put_sync(mcasp->dev);
-                if (IS_ERR_VALUE(ret))
-                        dev_err(mcasp->dev, "pm_runtime_put_sync() failed\n");
-                break;
-
         case SNDRV_PCM_TRIGGER_STOP:
         case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                 davinci_mcasp_stop(mcasp, substream->stream);
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index d0c72ed261e7..c84026c99134 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -326,7 +326,7 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask,
         regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA,
                            ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask));
         regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMB_xS(tx_mask));
+                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask));
 
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
                            ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
@@ -334,7 +334,7 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask,
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA,
                            ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask));
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMB_xS(rx_mask));
+                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask));
 
         esai_priv->slot_width = slot_width;
 
diff --git a/sound/soc/fsl/fsl_esai.h b/sound/soc/fsl/fsl_esai.h
index 9c9f957fcae1..75e14033e8d8 100644
--- a/sound/soc/fsl/fsl_esai.h
+++ b/sound/soc/fsl/fsl_esai.h
@@ -322,7 +322,7 @@
 #define ESAI_xSMB_xS_SHIFT      0
 #define ESAI_xSMB_xS_WIDTH      16
 #define ESAI_xSMB_xS_MASK       (((1 << ESAI_xSMB_xS_WIDTH) - 1) << ESAI_xSMB_xS_SHIFT)
-#define ESAI_xSMB_xS(v)         (((v) >> ESAI_xSMA_xS_WIDTH) & ESAI_xSMA_xS_MASK)
+#define ESAI_xSMB_xS(v)         (((v) >> ESAI_xSMA_xS_WIDTH) & ESAI_xSMB_xS_MASK)
 
 /* Port C Direction Register -- REG_ESAI_PRRC 0xF8 */
 #define ESAI_PRRC_PDC_SHIFT     0
diff --git a/sound/soc/fsl/imx-mc13783.c b/sound/soc/fsl/imx-mc13783.c
index 79cee782dbbf..a2fd7321b5a9 100644
--- a/sound/soc/fsl/imx-mc13783.c
+++ b/sound/soc/fsl/imx-mc13783.c
@@ -160,7 +160,6 @@ static struct platform_driver imx_mc13783_audio_driver = {
         .driver = {
                 .name = "imx_mc13783",
                 .owner = THIS_MODULE,
-                .pm = &snd_soc_pm_ops,
         },
         .probe = imx_mc13783_probe,
         .remove = imx_mc13783_remove
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index f2beae78969f..1cb22dd034eb 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -33,8 +33,7 @@ struct imx_sgtl5000_data {
 
 static int imx_sgtl5000_dai_init(struct snd_soc_pcm_runtime *rtd)
 {
-        struct imx_sgtl5000_data *data = container_of(rtd->card,
-                                        struct imx_sgtl5000_data, card);
+        struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(rtd->card);
         struct device *dev = rtd->card->dev;
         int ret;
 
@@ -159,13 +158,15 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
         data->card.dapm_widgets = imx_sgtl5000_dapm_widgets;
         data->card.num_dapm_widgets = ARRAY_SIZE(imx_sgtl5000_dapm_widgets);
 
+        platform_set_drvdata(pdev, &data->card);
+        snd_soc_card_set_drvdata(&data->card, data);
+
         ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
         if (ret) {
                 dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
                 goto fail;
         }
 
-        platform_set_drvdata(pdev, data);
         of_node_put(ssi_np);
         of_node_put(codec_np);
 
@@ -184,7 +185,8 @@ fail:
 
 static int imx_sgtl5000_remove(struct platform_device *pdev)
 {
-        struct imx_sgtl5000_data *data = platform_get_drvdata(pdev);
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+        struct imx_sgtl5000_data *data = snd_soc_card_get_drvdata(card);
 
         clk_put(data->codec_clk);
 
diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
index 3fd76bc391de..3a3d17ce6ba4 100644
--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -71,7 +71,7 @@ static int imx_wm8962_set_bias_level(struct snd_soc_card *card,
 {
         struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
         struct imx_priv *priv = &card_priv;
-        struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev);
+        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         unsigned int pll_out;
         int ret;
@@ -137,7 +137,7 @@ static int imx_wm8962_late_probe(struct snd_soc_card *card)
 {
         struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
         struct imx_priv *priv = &card_priv;
-        struct imx_wm8962_data *data = platform_get_drvdata(priv->pdev);
+        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         int ret;
 
@@ -264,13 +264,15 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         data->card.late_probe = imx_wm8962_late_probe;
         data->card.set_bias_level = imx_wm8962_set_bias_level;
 
+        platform_set_drvdata(pdev, &data->card);
+        snd_soc_card_set_drvdata(&data->card, data);
+
         ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
         if (ret) {
                 dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
                 goto clk_fail;
         }
 
-        platform_set_drvdata(pdev, data);
         of_node_put(ssi_np);
         of_node_put(codec_np);
 
@@ -289,7 +291,8 @@ fail:
 
 static int imx_wm8962_remove(struct platform_device *pdev)
 {
-        struct imx_wm8962_data *data = platform_get_drvdata(pdev);
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
 
         if (!IS_ERR(data->codec_clk))
                 clk_disable_unprepare(data->codec_clk);
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index 454f41cfc828..350757400391 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -59,7 +59,7 @@ config SND_SOC_SAMSUNG_JIVE_WM8750
         select SND_SOC_WM8750
         select SND_S3C2412_SOC_I2S
         help
-          Sat Y if you want to add support for SoC audio on the Jive.
+          Say Y if you want to add support for SoC audio on the Jive.
 
 config SND_SOC_SAMSUNG_SMDK_WM8580
         tristate "SoC I2S Audio support for WM8580 on SMDK"
@@ -145,11 +145,11 @@ config SND_SOC_SAMSUNG_RX1950_UDA1380
 
 config SND_SOC_SAMSUNG_SMDK_WM9713
         tristate "SoC AC97 Audio support for SMDK with WM9713"
-        depends on SND_SOC_SAMSUNG && (MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110 || MACH_SMDKV310 || MACH_SMDKC210)
+        depends on SND_SOC_SAMSUNG && (MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110)
         select SND_SOC_WM9713
         select SND_SAMSUNG_AC97
         help
-          Sat Y if you want to add support for SoC audio on the SMDK.
+          Say Y if you want to add support for SoC audio on the SMDK.
 
 config SND_SOC_SMARTQ
         tristate "SoC I2S Audio support for SmartQ board"
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index dc8ff13187f7..b9dc6acbba8c 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1218,7 +1218,7 @@ int dapm_regulator_event(struct snd_soc_dapm_widget *w,
                         ret = regulator_allow_bypass(w->regulator, false);
                         if (ret != 0)
                                 dev_warn(w->dapm->dev,
-                                         "ASoC: Failed to bypass %s: %d\n",
+                                         "ASoC: Failed to unbypass %s: %d\n",
                                          w->name, ret);
                 }
 
@@ -1228,7 +1228,7 @@ int dapm_regulator_event(struct snd_soc_dapm_widget *w,
                         ret = regulator_allow_bypass(w->regulator, true);
                         if (ret != 0)
                                 dev_warn(w->dapm->dev,
-                                         "ASoC: Failed to unbypass %s: %d\n",
+                                         "ASoC: Failed to bypass %s: %d\n",
                                          w->name, ret);
                 }
 
@@ -3210,15 +3210,11 @@ int snd_soc_dapm_put_pin_switch(struct snd_kcontrol *kcontrol,
         struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
         const char *pin = (const char *)kcontrol->private_value;
 
-        mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
-
         if (ucontrol->value.integer.value[0])
                 snd_soc_dapm_enable_pin(&card->dapm, pin);
         else
                 snd_soc_dapm_disable_pin(&card->dapm, pin);
 
-        mutex_unlock(&card->dapm_mutex);
-
         snd_soc_dapm_sync(&card->dapm);
         return 0;
 }
@@ -3248,7 +3244,7 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
                         ret = regulator_allow_bypass(w->regulator, true);
                         if (ret != 0)
                                 dev_warn(w->dapm->dev,
-                                         "ASoC: Failed to unbypass %s: %d\n",
+                                         "ASoC: Failed to bypass %s: %d\n",
                                          w->name, ret);
                 }
                 break;
@@ -3767,23 +3763,52 @@ void snd_soc_dapm_stream_event(struct snd_soc_pcm_runtime *rtd, int stream,
 }
 
 /**
+ * snd_soc_dapm_enable_pin_unlocked - enable pin.
+ * @dapm: DAPM context
+ * @pin: pin name
+ *
+ * Enables input/output pin and its parents or children widgets iff there is
+ * a valid audio route and active audio stream.
+ *
+ * Requires external locking.
+ *
+ * NOTE: snd_soc_dapm_sync() needs to be called after this for DAPM to
+ * do any widget power switching.
+ */
+int snd_soc_dapm_enable_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                                   const char *pin)
+{
+        return snd_soc_dapm_set_pin(dapm, pin, 1);
+}
+EXPORT_SYMBOL_GPL(snd_soc_dapm_enable_pin_unlocked);
+
+/**
  * snd_soc_dapm_enable_pin - enable pin.
  * @dapm: DAPM context
  * @pin: pin name
  *
  * Enables input/output pin and its parents or children widgets iff there is
  * a valid audio route and active audio stream.
+ *
  * NOTE: snd_soc_dapm_sync() needs to be called after this for DAPM to
  * do any widget power switching.
  */
 int snd_soc_dapm_enable_pin(struct snd_soc_dapm_context *dapm, const char *pin)
 {
-        return snd_soc_dapm_set_pin(dapm, pin, 1);
+        int ret;
+
+        mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
+
+        ret = snd_soc_dapm_set_pin(dapm, pin, 1);
+
+        mutex_unlock(&dapm->card->dapm_mutex);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_enable_pin);
 
 /**
- * snd_soc_dapm_force_enable_pin - force a pin to be enabled
+ * snd_soc_dapm_force_enable_pin_unlocked - force a pin to be enabled
  * @dapm: DAPM context
  * @pin: pin name
  *
@@ -3791,11 +3816,13 @@ EXPORT_SYMBOL_GPL(snd_soc_dapm_enable_pin);
  * intended for use with microphone bias supplies used in microphone
  * jack detection.
  *
+ * Requires external locking.
+ *
  * NOTE: snd_soc_dapm_sync() needs to be called after this for DAPM to
  * do any widget power switching.
  */
-int snd_soc_dapm_force_enable_pin(struct snd_soc_dapm_context *dapm,
-                                  const char *pin)
+int snd_soc_dapm_force_enable_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                                         const char *pin)
 {
         struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true);
 
@@ -3811,25 +3838,103 @@ int snd_soc_dapm_force_enable_pin(struct snd_soc_dapm_context *dapm,
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(snd_soc_dapm_force_enable_pin_unlocked);
+
+/**
+ * snd_soc_dapm_force_enable_pin - force a pin to be enabled
+ * @dapm: DAPM context
+ * @pin: pin name
+ *
+ * Enables input/output pin regardless of any other state.  This is
+ * intended for use with microphone bias supplies used in microphone
+ * jack detection.
+ *
+ * NOTE: snd_soc_dapm_sync() needs to be called after this for DAPM to
+ * do any widget power switching.
+ */
+int snd_soc_dapm_force_enable_pin(struct snd_soc_dapm_context *dapm,
+                                  const char *pin)
+{
+        int ret;
+
+        mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
+
+        ret = snd_soc_dapm_force_enable_pin_unlocked(dapm, pin);
+
+        mutex_unlock(&dapm->card->dapm_mutex);
+
+        return ret;
+}
 EXPORT_SYMBOL_GPL(snd_soc_dapm_force_enable_pin);
 
 /**
+ * snd_soc_dapm_disable_pin_unlocked - disable pin.
+ * @dapm: DAPM context
+ * @pin: pin name
+ *
+ * Disables input/output pin and its parents or children widgets.
+ *
+ * Requires external locking.
+ *
+ * NOTE: snd_soc_dapm_sync() needs to be called after this for DAPM to
+ * do any widget power switching.
+ */
+int snd_soc_dapm_disable_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                                    const char *pin)
+{
+        return snd_soc_dapm_set_pin(dapm, pin, 0);
+}
+EXPORT_SYMBOL_GPL(snd_soc_dapm_disable_pin_unlocked);
+
+/**
  * snd_soc_dapm_disable_pin - disable pin.
  * @dapm: DAPM context
  * @pin: pin name
  *
  * Disables input/output pin and its parents or children widgets.
+ *
  * NOTE: snd_soc_dapm_sync() needs to be called after this for DAPM to
  * do any widget power switching.
  */
 int snd_soc_dapm_disable_pin(struct snd_soc_dapm_context *dapm,
                              const char *pin)
 {
-        return snd_soc_dapm_set_pin(dapm, pin, 0);
+        int ret;
+
+        mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
+
+        ret = snd_soc_dapm_set_pin(dapm, pin, 0);
+
+        mutex_unlock(&dapm->card->dapm_mutex);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_disable_pin);
 
 /**
+ * snd_soc_dapm_nc_pin_unlocked - permanently disable pin.
+ * @dapm: DAPM context
+ * @pin: pin name
+ *
+ * Marks the specified pin as being not connected, disabling it along
+ * any parent or child widgets.  At present this is identical to
+ * snd_soc_dapm_disable_pin() but in future it will be extended to do
+ * additional things such as disabling controls which only affect
+ * paths through the pin.
+ *
+ * Requires external locking.
+ *
+ * NOTE: snd_soc_dapm_sync() needs to be called after this for DAPM to
+ * do any widget power switching.
+ */
+int snd_soc_dapm_nc_pin_unlocked(struct snd_soc_dapm_context *dapm,
+                               const char *pin)
+{
+        return snd_soc_dapm_set_pin(dapm, pin, 0);
+}
+EXPORT_SYMBOL_GPL(snd_soc_dapm_nc_pin_unlocked);
+
+/**
  * snd_soc_dapm_nc_pin - permanently disable pin.
  * @dapm: DAPM context
  * @pin: pin name
@@ -3845,7 +3950,15 @@ EXPORT_SYMBOL_GPL(snd_soc_dapm_disable_pin);
  */
 int snd_soc_dapm_nc_pin(struct snd_soc_dapm_context *dapm, const char *pin)
 {
-        return snd_soc_dapm_set_pin(dapm, pin, 0);
+        int ret;
+
+        mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
+
+        ret = snd_soc_dapm_set_pin(dapm, pin, 0);
+
+        mutex_unlock(&dapm->card->dapm_mutex);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_nc_pin);
 
diff --git a/sound/soc/txx9/txx9aclc-ac97.c b/sound/soc/txx9/txx9aclc-ac97.c
index e0305a148568..9edd68db9f48 100644
--- a/sound/soc/txx9/txx9aclc-ac97.c
+++ b/sound/soc/txx9/txx9aclc-ac97.c
@@ -183,14 +183,16 @@ static int txx9aclc_ac97_dev_probe(struct platform_device *pdev)
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
                 return irq;
+
+        drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL);
+        if (!drvdata)
+                return -ENOMEM;
+
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         drvdata->base = devm_ioremap_resource(&pdev->dev, r);
         if (IS_ERR(drvdata->base))
                 return PTR_ERR(drvdata->base);
 
-        drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL);
-        if (!drvdata)
-                return -ENOMEM;
         platform_set_drvdata(pdev, drvdata);
         drvdata->physbase = r->start;
         if (sizeof(drvdata->physbase) > sizeof(r->start) &&
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 44b0ba4feab3..1bed780e21d9 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -883,6 +883,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
                 }
                 break;
 
+        case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
         case USB_ID(0x046d, 0x0808):
         case USB_ID(0x046d, 0x0809):
         case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 32af6b741ef5..d1d72ff50347 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -328,6 +328,11 @@ static struct usbmix_name_map gamecom780_map[] = {
         {}
 };
 
+static const struct usbmix_name_map kef_x300a_map[] = {
+        { 10, NULL }, /* firmware locks up (?) when we try to access this FU */
+        { 0 }
+};
+
 /*
  * Control map entries
  */
@@ -419,6 +424,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
                 .id = USB_ID(0x200c, 0x1018),
                 .map = ebox44_map,
         },
+        {
+                .id = USB_ID(0x27ac, 0x1000),
+                .map = kef_x300a_map,
+        },
         { 0 } /* terminator */
 };
 
diff --git a/tools/lib/lockdep/Makefile b/tools/lib/lockdep/Makefile
index da8b7aa3d351..07b0b7542511 100644
--- a/tools/lib/lockdep/Makefile
+++ b/tools/lib/lockdep/Makefile
@@ -87,8 +87,8 @@ endif # BUILD_SRC
 # We process the rest of the Makefile if this is the final invocation of make
 ifeq ($(skip-makefile),)
 
-srctree         := $(if $(BUILD_SRC),$(BUILD_SRC),$(CURDIR))
-objtree         := $(CURDIR)
+srctree         := $(realpath $(if $(BUILD_SRC),$(BUILD_SRC),$(CURDIR)))
+objtree         := $(realpath $(CURDIR))
 src             := $(srctree)
 obj             := $(objtree)
 
@@ -112,7 +112,7 @@ export Q VERBOSE
 
 LIBLOCKDEP_VERSION = $(LL_VERSION).$(LL_PATCHLEVEL).$(LL_EXTRAVERSION)
 
-INCLUDES = -I. -I/usr/local/include -I./uinclude $(CONFIG_INCLUDES)
+INCLUDES = -I. -I/usr/local/include -I./uinclude -I./include $(CONFIG_INCLUDES)
 
 # Set compile option CFLAGS if not set elsewhere
 CFLAGS ?= -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"$(LIBLOCKDEP_VERSION)"' -rdynamic -O0 -g
diff --git a/tools/lib/lockdep/preload.c b/tools/lib/lockdep/preload.c
index f8465a811aa5..23bd69cb5ade 100644
--- a/tools/lib/lockdep/preload.c
+++ b/tools/lib/lockdep/preload.c
@@ -418,7 +418,7 @@ int pthread_rwlock_unlock(pthread_rwlock_t *rwlock)
 
 __attribute__((constructor)) static void init_preload(void)
 {
-        if (__init_state != done)
+        if (__init_state == done)
                 return;
 
 #ifndef __GLIBC__
diff --git a/tools/lib/lockdep/run_tests.sh b/tools/lib/lockdep/run_tests.sh
index 5334ad9d39b7..5334ad9d39b7 100644..100755
--- a/tools/lib/lockdep/run_tests.sh
+++ b/tools/lib/lockdep/run_tests.sh
diff --git a/tools/lib/lockdep/uinclude/asm/hash.h b/tools/lib/lockdep/uinclude/asm/hash.h
new file mode 100644
index 000000000000..d82b170bb216
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/asm/hash.h
@@ -0,0 +1,6 @@
+#ifndef __ASM_GENERIC_HASH_H
+#define __ASM_GENERIC_HASH_H
+
+/* Stub */
+
+#endif /* __ASM_GENERIC_HASH_H */
diff --git a/tools/lib/lockdep/uinclude/linux/rcu.h b/tools/lib/lockdep/uinclude/linux/rcu.h
index 4c99fcb5da27..042ee8e463c9 100644
--- a/tools/lib/lockdep/uinclude/linux/rcu.h
+++ b/tools/lib/lockdep/uinclude/linux/rcu.h
@@ -13,4 +13,9 @@ static inline int rcu_is_cpu_idle(void)
         return 1;
 }
 
+static inline bool rcu_is_watching(void)
+{
+        return false;
+}
+
 #endif
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 3c53ec268fbc..02f985f3a396 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -113,14 +113,16 @@ static int report__add_mem_hist_entry(struct perf_tool *tool, struct addr_locati
         if (!he)
                 return -ENOMEM;
 
-        err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
-        if (err)
-                goto out;
+        if (ui__has_annotation()) {
+                err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
+                if (err)
+                        goto out;
 
-        mx = he->mem_info;
-        err = addr_map_symbol__inc_samples(&mx->daddr, evsel->idx);
-        if (err)
-                goto out;
+                mx = he->mem_info;
+                err = addr_map_symbol__inc_samples(&mx->daddr, evsel->idx);
+                if (err)
+                        goto out;
+        }
 
         evsel->hists.stats.total_period += cost;
         hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
@@ -164,14 +166,18 @@ static int report__add_branch_hist_entry(struct perf_tool *tool, struct addr_loc
                 he = __hists__add_entry(&evsel->hists, al, parent, &bi[i], NULL,
                                         1, 1, 0);
                 if (he) {
-                        bx = he->branch_info;
-                        err = addr_map_symbol__inc_samples(&bx->from, evsel->idx);
-                        if (err)
-                                goto out;
-
-                        err = addr_map_symbol__inc_samples(&bx->to, evsel->idx);
-                        if (err)
-                                goto out;
+                        if (ui__has_annotation()) {
+                                bx = he->branch_info;
+                                err = addr_map_symbol__inc_samples(&bx->from,
+                                                                   evsel->idx);
+                                if (err)
+                                        goto out;
+
+                                err = addr_map_symbol__inc_samples(&bx->to,
+                                                                   evsel->idx);
+                                if (err)
+                                        goto out;
+                        }
 
                         evsel->hists.stats.total_period += 1;
                         hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
@@ -205,7 +211,9 @@ static int report__add_hist_entry(struct perf_tool *tool, struct perf_evsel *evs
         if (err)
                 goto out;
 
-        err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
+        if (ui__has_annotation())
+                err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
+
         evsel->hists.stats.total_period += sample->period;
         hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
 out:
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 76cd510d34d0..5f989a7d8bc2 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -176,7 +176,7 @@ static void perf_top__record_precise_ip(struct perf_top *top,
 {
         struct annotation *notes;
         struct symbol *sym;
-        int err;
+        int err = 0;
 
         if (he == NULL || he->ms.sym == NULL ||
             ((top->sym_filter_entry == NULL ||
@@ -190,7 +190,9 @@ static void perf_top__record_precise_ip(struct perf_top *top,
                 return;
 
         ip = he->ms.map->map_ip(he->ms.map, ip);
-        err = hist_entry__inc_addr_samples(he, counter, ip);
+
+        if (ui__has_annotation())
+                err = hist_entry__inc_addr_samples(he, counter, ip);
 
         pthread_mutex_unlock(&notes->lock);
 
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 896f27047ed6..6aa6fb6f7bd9 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -37,6 +37,10 @@
 # define MADV_UNMERGEABLE       13
 #endif
 
+#ifndef EFD_SEMAPHORE
+# define EFD_SEMAPHORE          1
+#endif
+
 struct tp_field {
         int offset;
         union {
@@ -279,6 +283,11 @@ static size_t syscall_arg__scnprintf_strarray(char *bf, size_t size,
 
 #define SCA_STRARRAY syscall_arg__scnprintf_strarray
 
+#if defined(__i386__) || defined(__x86_64__)
+/*
+ * FIXME: Make this available to all arches as soon as the ioctl beautifier
+ *        gets rewritten to support all arches.
+ */
 static size_t syscall_arg__scnprintf_strhexarray(char *bf, size_t size,
                                                  struct syscall_arg *arg)
 {
@@ -286,6 +295,7 @@ static size_t syscall_arg__scnprintf_strhexarray(char *bf, size_t size,
 }
 
 #define SCA_STRHEXARRAY syscall_arg__scnprintf_strhexarray
+#endif /* defined(__i386__) || defined(__x86_64__) */
 
 static size_t syscall_arg__scnprintf_fd(char *bf, size_t size,
                                         struct syscall_arg *arg);
@@ -839,6 +849,10 @@ static size_t syscall_arg__scnprintf_signum(char *bf, size_t size, struct syscal
 
 #define SCA_SIGNUM syscall_arg__scnprintf_signum
 
+#if defined(__i386__) || defined(__x86_64__)
+/*
+ * FIXME: Make this available to all arches.
+ */
 #define TCGETS          0x5401
 
 static const char *tioctls[] = {
@@ -860,6 +874,7 @@ static const char *tioctls[] = {
 };
 
 static DEFINE_STRARRAY_OFFSET(tioctls, 0x5401);
+#endif /* defined(__i386__) || defined(__x86_64__) */
 
 #define STRARRAY(arg, name, array) \
           .arg_scnprintf = { [arg] = SCA_STRARRAY, }, \
@@ -941,9 +956,16 @@ static struct syscall_fmt {
         { .name     = "getrlimit",  .errmsg = true, STRARRAY(0, resource, rlimit_resources), },
         { .name     = "ioctl",      .errmsg = true,
           .arg_scnprintf = { [0] = SCA_FD, /* fd */ 
+#if defined(__i386__) || defined(__x86_64__)
+/*
+ * FIXME: Make this available to all arches.
+ */
                              [1] = SCA_STRHEXARRAY, /* cmd */
                              [2] = SCA_HEX, /* arg */ },
           .arg_parm      = { [1] = &strarray__tioctls, /* cmd */ }, },
+#else
+                             [2] = SCA_HEX, /* arg */ }, },
+#endif
         { .name     = "kill",       .errmsg = true,
           .arg_scnprintf = { [1] = SCA_SIGNUM, /* sig */ }, },
         { .name     = "linkat",     .errmsg = true,
diff --git a/tools/perf/config/Makefile b/tools/perf/config/Makefile
index c48d44958172..0331ea2701a3 100644
--- a/tools/perf/config/Makefile
+++ b/tools/perf/config/Makefile
@@ -478,7 +478,7 @@ else
 endif
 
 ifeq ($(feature-libbfd), 1)
-  EXTLIBS += -lbfd
+  EXTLIBS += -lbfd -lz -liberty
 endif
 
 ifdef NO_DEMANGLE
diff --git a/tools/perf/config/feature-checks/Makefile b/tools/perf/config/feature-checks/Makefile
index 12e551346fa6..523b7bc10553 100644
--- a/tools/perf/config/feature-checks/Makefile
+++ b/tools/perf/config/feature-checks/Makefile
@@ -121,7 +121,7 @@ test-libpython-version.bin:
         $(BUILD) $(FLAGS_PYTHON_EMBED)
 
 test-libbfd.bin:
-        $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl
+        $(BUILD) -DPACKAGE='"perf"' -lbfd -lz -liberty -ldl
 
 test-liberty.bin:
         $(CC) -o $(OUTPUT)$@ test-libbfd.c -DPACKAGE='"perf"' -lbfd -ldl -liberty
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 469eb679fb9d..3aa555ff9d89 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -8,6 +8,8 @@
  */
 
 #include "util.h"
+#include "ui/ui.h"
+#include "sort.h"
 #include "build-id.h"
 #include "color.h"
 #include "cache.h"
@@ -489,7 +491,7 @@ static int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
 {
         struct annotation *notes;
 
-        if (sym == NULL || use_browser != 1 || !sort__has_sym)
+        if (sym == NULL)
                 return 0;
 
         notes = symbol__annotation(sym);
@@ -1399,3 +1401,8 @@ int hist_entry__annotate(struct hist_entry *he, size_t privsize)
 {
         return symbol__annotate(he->ms.sym, he->ms.map, privsize);
 }
+
+bool ui__has_annotation(void)
+{
+        return use_browser == 1 && sort__has_sym;
+}
diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h
index b2aef59d6bb2..56ad4f5287de 100644
--- a/tools/perf/util/annotate.h
+++ b/tools/perf/util/annotate.h
@@ -151,6 +151,8 @@ void symbol__annotate_zero_histogram(struct symbol *sym, int evidx);
 void symbol__annotate_decay_histogram(struct symbol *sym, int evidx);
 void disasm__purge(struct list_head *head);
 
+bool ui__has_annotation(void);
+
 int symbol__tty_annotate(struct symbol *sym, struct map *map,
                          struct perf_evsel *evsel, bool print_lines,
                          bool full_paths, int min_pcnt, int max_lines);
diff --git a/tools/perf/util/include/linux/bitops.h b/tools/perf/util/include/linux/bitops.h
index 45cf10a562bd..dadfa7e54287 100644
--- a/tools/perf/util/include/linux/bitops.h
+++ b/tools/perf/util/include/linux/bitops.h
@@ -87,13 +87,15 @@ static __always_inline unsigned long __ffs(unsigned long word)
         return num;
 }
 
+typedef const unsigned long __attribute__((__may_alias__)) long_alias_t;
+
 /*
  * Find the first set bit in a memory region.
  */
 static inline unsigned long
 find_first_bit(const unsigned long *addr, unsigned long size)
 {
-        const unsigned long *p = addr;
+        long_alias_t *p = (long_alias_t *) addr;
         unsigned long result = 0;
         unsigned long tmp;
 
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index d248fca6d7ed..1e15df10a88c 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -1091,12 +1091,12 @@ int is_valid_tracepoint(const char *event_string)
 static bool is_event_supported(u8 type, unsigned config)
 {
         bool ret = true;
+        int open_return;
         struct perf_evsel *evsel;
         struct perf_event_attr attr = {
                 .type = type,
                 .config = config,
                 .disabled = 1,
-                .exclude_kernel = 1,
         };
         struct {
                 struct thread_map map;
@@ -1108,7 +1108,20 @@ static bool is_event_supported(u8 type, unsigned config)
 
         evsel = perf_evsel__new(&attr);
         if (evsel) {
-                ret = perf_evsel__open(evsel, NULL, &tmap.map) >= 0;
+                open_return = perf_evsel__open(evsel, NULL, &tmap.map);
+                ret = open_return >= 0;
+
+                if (open_return == -EACCES) {
+                        /*
+                         * This happens if the paranoid value
+                         * /proc/sys/kernel/perf_event_paranoid is set to 2
+                         * Re-run with exclude_kernel set; we don't do that
+                         * by default as some ARM machines do not support it.
+                         *
+                         */
+                        evsel->attr.exclude_kernel = 1;
+                        ret = perf_evsel__open(evsel, NULL, &tmap.map) >= 0;
+                }
                 perf_evsel__delete(evsel);
         }
 
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index a8a9b6cd93a8..d8b048c20cde 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -336,8 +336,8 @@ static int add_exec_to_probe_trace_events(struct probe_trace_event *tevs,
                 return ret;
 
         for (i = 0; i < ntevs && ret >= 0; i++) {
+                /* point.address is the addres of point.symbol + point.offset */
                 offset = tevs[i].point.address - stext;
-                offset += tevs[i].point.offset;
                 tevs[i].point.offset = 0;
                 zfree(&tevs[i].point.symbol);
                 ret = e_snprintf(buf, 32, "0x%lx", offset);
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 0b39a48e5110..5da6ce74c676 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -1008,6 +1008,12 @@ static int perf_session__process_user_event(struct perf_session *session, union
                 if (err == 0)
                         perf_session__set_id_hdr_size(session);
                 return err;
+        case PERF_RECORD_HEADER_EVENT_TYPE:
+                /*
+                 * Depreceated, but we need to handle it for sake
+                 * of old data files create in pipe mode.
+                 */
+                return 0;
         case PERF_RECORD_HEADER_TRACING_DATA:
                 /* setup for reading amidst mmap */
                 lseek(fd, file_offset, SEEK_SET);
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index a9d758a3b371..e89afc097d8a 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1336,6 +1336,8 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
 
                         if (syms_ss && runtime_ss)
                                 break;
+                } else {
+                        symsrc__destroy(ss);
                 }
 
         }