diff --git a/Documentation/filesystems/proc.txt 
b/Documentation/filesystems/proc.txt
index ddc531a74d04..225ae3ba74b3 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -139,7 +139,8 @@ Table 1-1: Process specific entries in /proc
  stat          Process status
  statm         Process memory status information
  status                Process status in human readable form
- wchan         If CONFIG_KALLSYMS is set, a pre-decoded wchan
+ wchan         Present with CONFIG_KALLSYMS=y: it shows the kernel function
+               symbol the task is blocked in - or "0" if not blocked.
  pagemap       Page table
  stack         Report full stack trace, enable via CONFIG_STACKTRACE
  smaps         a extension based on maps, showing the memory consumption of
@@ -301,7 +302,7 @@ Table 1-4: Contents of the stat files (as of 2.6.30-rc7)
   blocked       bitmap of blocked signals
   sigign        bitmap of ignored signals
   sigcatch      bitmap of caught signals
-  wchan         address where process went to sleep
+  0            (place holder, used to be the wchan address, use 
/proc/PID/wchan instead)
   0             (place holder)
   0             (place holder)
   exit_signal   signal to send to parent thread on exit
diff --git a/MAINTAINERS b/MAINTAINERS
index c2066f4c3286..e0b2f7c7f744 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8752,6 +8752,7 @@ F:        include/linux/swiotlb.h
 
 SYNOPSYS ARC ARCHITECTURE
 M:     Vineet Gupta <[email protected]>
+L:     [email protected]
 S:     Supported
 F:     arch/arc/
 F:     Documentation/devicetree/bindings/arc/
diff --git a/Makefile b/Makefile
index e306fdd87baa..3fd90647d973 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 16
 SUBLEVEL = 7
-EXTRAVERSION =-ckt20
+EXTRAVERSION =-ckt21
 NAME = Museum of Fishiegoodies
 
 # *DOCUMENTATION*
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index ea97e14e1f0b..7b12ed692373 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -403,7 +403,8 @@ static irqreturn_t dma_irq_handler(int irq, void *data)
                                        BIT(slot));
                        if (edma_cc[ctlr]->intr_data[channel].callback)
                                edma_cc[ctlr]->intr_data[channel].callback(
-                                       channel, EDMA_DMA_COMPLETE,
+                                       EDMA_CTLR_CHAN(ctlr, channel),
+                                       EDMA_DMA_COMPLETE,
                                        edma_cc[ctlr]->intr_data[channel].data);
                }
        } while (sh_ipr);
@@ -457,7 +458,8 @@ static irqreturn_t dma_ccerr_handler(int irq, void *data)
                                        if (edma_cc[ctlr]->intr_data[k].
                                                                callback) {
                                                edma_cc[ctlr]->intr_data[k].
-                                               callback(k,
+                                               callback(
+                                               EDMA_CTLR_CHAN(ctlr, k),
                                                EDMA_DMA_CC_ERROR,
                                                edma_cc[ctlr]->intr_data
                                                [k].data);
diff --git a/arch/arm/mach-pxa/include/mach/pxa27x.h 
b/arch/arm/mach-pxa/include/mach/pxa27x.h
index 7cff640582b8..66c4cbfc7f36 100644
--- a/arch/arm/mach-pxa/include/mach/pxa27x.h
+++ b/arch/arm/mach-pxa/include/mach/pxa27x.h
@@ -21,7 +21,7 @@
 
 extern void __init pxa27x_map_io(void);
 extern void __init pxa27x_init_irq(void);
-extern int __init pxa27x_set_pwrmode(unsigned int mode);
+extern int pxa27x_set_pwrmode(unsigned int mode);
 extern void pxa27x_cpu_pm_enter(suspend_state_t state);
 
 #define pxa27x_handle_irq      ichp_handle_irq
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index 301471a07a10..4fc7c57ec495 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -251,7 +251,7 @@ static struct clk_lookup pxa27x_clkregs[] = {
  */
 static unsigned int pwrmode = PWRMODE_SLEEP;
 
-int __init pxa27x_set_pwrmode(unsigned int mode)
+int pxa27x_set_pwrmode(unsigned int mode)
 {
        switch (mode) {
        case PWRMODE_SLEEP:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 0e09af35f69a..832b295eb4a5 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1459,12 +1459,19 @@ static int arm_iommu_mmap_attrs(struct device *dev, 
struct vm_area_struct *vma,
        unsigned long uaddr = vma->vm_start;
        unsigned long usize = vma->vm_end - vma->vm_start;
        struct page **pages = __iommu_get_pages(cpu_addr, attrs);
+       unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+       unsigned long off = vma->vm_pgoff;
 
        vma->vm_page_prot = __get_dma_pgprot(attrs, vma->vm_page_prot);
 
        if (!pages)
                return -ENXIO;
 
+       if (off >= nr_pages || (usize >> PAGE_SHIFT) > nr_pages - off)
+               return -ENXIO;
+
+       pages += off;
+
        do {
                int ret = vm_insert_page(vma, uaddr, *pages++);
                if (ret) {
diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
index 41ed9e13795e..88d6e2436808 100644
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -76,14 +76,14 @@
 #define compat_sp      regs[13]
 #define compat_lr      regs[14]
 #define compat_sp_hyp  regs[15]
-#define compat_sp_irq  regs[16]
-#define compat_lr_irq  regs[17]
-#define compat_sp_svc  regs[18]
-#define compat_lr_svc  regs[19]
-#define compat_sp_abt  regs[20]
-#define compat_lr_abt  regs[21]
-#define compat_sp_und  regs[22]
-#define compat_lr_und  regs[23]
+#define compat_lr_irq  regs[16]
+#define compat_sp_irq  regs[17]
+#define compat_lr_svc  regs[18]
+#define compat_sp_svc  regs[19]
+#define compat_lr_abt  regs[20]
+#define compat_sp_abt  regs[21]
+#define compat_lr_und  regs[22]
+#define compat_sp_und  regs[23]
 #define compat_r8_fiq  regs[24]
 #define compat_r9_fiq  regs[25]
 #define compat_r10_fiq regs[26]
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index 37b2befe651a..9bf39457d574 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -673,7 +673,7 @@ static __inline__ long atomic64_sub_if_positive(long i, 
atomic64_t * v)
  * @u: ...unless v is equal to u.
  *
  * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
+ * Returns true iff @v was not @u.
  */
 static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
 {
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 5e9217d96cfe..fd8a8373c275 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -429,7 +429,9 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
        if (!kvm->arch.sca)
                goto out_err;
        spin_lock(&kvm_lock);
-       sca_offset = (sca_offset + 16) & 0x7f0;
+       sca_offset += 16;
+       if (sca_offset + sizeof(struct sca_block) > PAGE_SIZE)
+               sca_offset = 0;
        kvm->arch.sca = (struct sca_block *) ((char *) kvm->arch.sca + 
sca_offset);
        spin_unlock(&kvm_lock);
 
diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index d3a87780c70b..d7dcef58aefa 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -23,7 +23,10 @@
 #define GP_VECTOR 13
 #define PF_VECTOR 14
 #define MF_VECTOR 16
+#define AC_VECTOR 17
 #define MC_VECTOR 18
+#define XM_VECTOR 19
+#define VE_VECTOR 20
 
 /* Select x86 specific features in <linux/kvm.h> */
 #define __KVM_HAVE_PIT
diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h
index b5d7640abc5d..8a4add8e4639 100644
--- a/arch/x86/include/uapi/asm/svm.h
+++ b/arch/x86/include/uapi/asm/svm.h
@@ -100,6 +100,7 @@
        { SVM_EXIT_EXCP_BASE + UD_VECTOR,       "UD excp" }, \
        { SVM_EXIT_EXCP_BASE + PF_VECTOR,       "PF excp" }, \
        { SVM_EXIT_EXCP_BASE + NM_VECTOR,       "NM excp" }, \
+       { SVM_EXIT_EXCP_BASE + AC_VECTOR,       "AC excp" }, \
        { SVM_EXIT_EXCP_BASE + MC_VECTOR,       "MC excp" }, \
        { SVM_EXIT_INTR,        "interrupt" }, \
        { SVM_EXIT_NMI,         "nmi" }, \
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index a2dc0add72ed..761fd69df6d9 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -65,6 +65,9 @@ startup_64:
         * tables and then reload them.
         */
 
+       /* Sanitize CPU configuration */
+       call verify_cpu
+
        /*
         * Compute the delta between the address I am compiled to run at and the
         * address I am actually running at.
@@ -174,6 +177,9 @@ ENTRY(secondary_startup_64)
         * after the boot processor executes this code.
         */
 
+       /* Sanitize CPU configuration */
+       call verify_cpu
+
        movq    $(init_level4_pgt - __START_KERNEL_map), %rax
 1:
 
@@ -288,6 +294,8 @@ ENTRY(secondary_startup_64)
        pushq   %rax            # target address in negative space
        lretq
 
+#include "verify_cpu.S"
+
 #ifdef CONFIG_HOTPLUG_CPU
 /*
  * Boot CPU0 entry point. It's called from play_dead(). Everything has been set
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 78a0e6298922..b1077b8ee7af 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1177,6 +1177,14 @@ void __init setup_arch(char **cmdline_p)
        clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
                        KERNEL_PGD_PTRS);
+
+       /*
+        * sync back low identity map too.  It is used for example
+        * in the 32-bit EFI stub.
+        */
+       clone_pgd_range(initial_page_table,
+                       swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
+                       min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
 #endif
 
        tboot_probe();
diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
index b9242bacbe59..4cf401f581e7 100644
--- a/arch/x86/kernel/verify_cpu.S
+++ b/arch/x86/kernel/verify_cpu.S
@@ -34,10 +34,11 @@
 #include <asm/msr-index.h>
 
 verify_cpu:
-       pushfl                          # Save caller passed flags
-       pushl   $0                      # Kill any dangerous flags
-       popfl
+       pushf                           # Save caller passed flags
+       push    $0                      # Kill any dangerous flags
+       popf
 
+#ifndef __x86_64__
        pushfl                          # standard way to check for cpuid
        popl    %eax
        movl    %eax,%ebx
@@ -48,6 +49,7 @@ verify_cpu:
        popl    %eax
        cmpl    %eax,%ebx
        jz      verify_cpu_no_longmode  # cpu has no cpuid
+#endif
 
        movl    $0x0,%eax               # See if cpuid 1 is implemented
        cpuid
@@ -130,10 +132,10 @@ verify_cpu_sse_test:
        jmp     verify_cpu_sse_test     # try again
 
 verify_cpu_no_longmode:
-       popfl                           # Restore caller passed flags
+       popf                            # Restore caller passed flags
        movl $1,%eax
        ret
 verify_cpu_sse_ok:
-       popfl                           # Restore caller passed flags
+       popf                            # Restore caller passed flags
        xorl %eax, %eax
        ret
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 539f233965f1..d09bc3e7882c 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1103,6 +1103,8 @@ static void init_vmcb(struct vcpu_svm *svm)
        set_exception_intercept(svm, PF_VECTOR);
        set_exception_intercept(svm, UD_VECTOR);
        set_exception_intercept(svm, MC_VECTOR);
+       set_exception_intercept(svm, AC_VECTOR);
+       set_exception_intercept(svm, DB_VECTOR);
 
        set_intercept(svm, INTERCEPT_INTR);
        set_intercept(svm, INTERCEPT_NMI);
@@ -1633,20 +1635,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
        mark_dirty(svm->vmcb, VMCB_SEG);
 }
 
-static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
 {
        struct vcpu_svm *svm = to_svm(vcpu);
 
-       clr_exception_intercept(svm, DB_VECTOR);
        clr_exception_intercept(svm, BP_VECTOR);
 
-       if (svm->nmi_singlestep)
-               set_exception_intercept(svm, DB_VECTOR);
-
        if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
-               if (vcpu->guest_debug &
-                   (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
-                       set_exception_intercept(svm, DB_VECTOR);
                if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
                        set_exception_intercept(svm, BP_VECTOR);
        } else
@@ -1752,7 +1747,6 @@ static int db_interception(struct vcpu_svm *svm)
                if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
                        svm->vmcb->save.rflags &=
                                ~(X86_EFLAGS_TF | X86_EFLAGS_RF);
-               update_db_bp_intercept(&svm->vcpu);
        }
 
        if (svm->vcpu.guest_debug &
@@ -1787,6 +1781,12 @@ static int ud_interception(struct vcpu_svm *svm)
        return 1;
 }
 
+static int ac_interception(struct vcpu_svm *svm)
+{
+       kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
+       return 1;
+}
+
 static void svm_fpu_activate(struct kvm_vcpu *vcpu)
 {
        struct vcpu_svm *svm = to_svm(vcpu);
@@ -3327,6 +3327,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm 
*svm) = {
        [SVM_EXIT_EXCP_BASE + PF_VECTOR]        = pf_interception,
        [SVM_EXIT_EXCP_BASE + NM_VECTOR]        = nm_interception,
        [SVM_EXIT_EXCP_BASE + MC_VECTOR]        = mc_interception,
+       [SVM_EXIT_EXCP_BASE + AC_VECTOR]        = ac_interception,
        [SVM_EXIT_INTR]                         = intr_interception,
        [SVM_EXIT_NMI]                          = nmi_interception,
        [SVM_EXIT_SMI]                          = nop_on_interception,
@@ -3714,7 +3715,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
         */
        svm->nmi_singlestep = true;
        svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
-       update_db_bp_intercept(vcpu);
 }
 
 static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
@@ -4320,7 +4320,7 @@ static struct kvm_x86_ops svm_x86_ops = {
        .vcpu_load = svm_vcpu_load,
        .vcpu_put = svm_vcpu_put,
 
-       .update_db_bp_intercept = update_db_bp_intercept,
+       .update_db_bp_intercept = update_bp_intercept,
        .get_msr = svm_get_msr,
        .set_msr = svm_set_msr,
        .get_segment_base = svm_get_segment_base,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index aa6bd8cc914c..d1d7086f0e9b 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1467,7 +1467,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu)
        u32 eb;
 
        eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
-            (1u << NM_VECTOR) | (1u << DB_VECTOR);
+            (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR);
        if ((vcpu->guest_debug &
             (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
            (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
@@ -3523,20 +3523,21 @@ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned 
long cr4)
                if (!is_paging(vcpu)) {
                        hw_cr4 &= ~X86_CR4_PAE;
                        hw_cr4 |= X86_CR4_PSE;
-                       /*
-                        * SMEP/SMAP is disabled if CPU is in non-paging mode
-                        * in hardware. However KVM always uses paging mode to
-                        * emulate guest non-paging mode with TDP.
-                        * To emulate this behavior, SMEP/SMAP needs to be
-                        * manually disabled when guest switches to non-paging
-                        * mode.
-                        */
-                       hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP);
                } else if (!(cr4 & X86_CR4_PAE)) {
                        hw_cr4 &= ~X86_CR4_PAE;
                }
        }
 
+       if (!enable_unrestricted_guest && !is_paging(vcpu))
+               /*
+                * SMEP/SMAP is disabled if CPU is in non-paging mode in
+                * hardware.  However KVM always uses paging mode without
+                * unrestricted guest.
+                * To emulate this behavior, SMEP/SMAP needs to be manually
+                * disabled when guest switches to non-paging mode.
+                */
+               hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP);
+
        vmcs_writel(CR4_READ_SHADOW, cr4);
        vmcs_writel(GUEST_CR4, hw_cr4);
        return 0;
@@ -4880,6 +4881,9 @@ static int handle_exception(struct kvm_vcpu *vcpu)
                return handle_rmode_exception(vcpu, ex_no, error_code);
 
        switch (ex_no) {
+       case AC_VECTOR:
+               kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
+               return 1;
        case DB_VECTOR:
                dr6 = vmcs_readl(EXIT_QUALIFICATION);
                if (!(vcpu->guest_debug &
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 2e555163c2fe..dca94c650d6a 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -385,7 +385,7 @@ char * __init xen_memory_setup(void)
                xen_ignore_unusable(map, memmap.nr_entries);
 
        /* Make sure the Xen-supplied memory map is well-ordered. */
-       sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries);
+       sanitize_e820_map(map, ARRAY_SIZE(map), &memmap.nr_entries);
 
        max_pages = xen_get_max_pages();
        if (max_pages > max_pfn)
diff --git a/arch/xtensa/include/asm/asmmacro.h 
b/arch/xtensa/include/asm/asmmacro.h
index 755320f6e0bc..746dcc8b5abc 100644
--- a/arch/xtensa/include/asm/asmmacro.h
+++ b/arch/xtensa/include/asm/asmmacro.h
@@ -35,9 +35,10 @@
  * __loop  as
  *        restart loop. 'as' register must not have been modified!
  *
- * __endla ar, at, incr
+ * __endla ar, as, incr
  *        ar   start address (modified)
- *        as   scratch register used by macro
+ *        as   scratch register used by __loops/__loopi macros or
+ *             end address used by __loopt macro
  *        inc  increment
  */
 
@@ -97,7 +98,7 @@
        .endm
 
 /*
- * loop from ar to ax
+ * loop from ar to as
  */
 
        .macro  __loopt ar, as, at, incr_log2
diff --git a/arch/xtensa/include/asm/pgtable.h 
b/arch/xtensa/include/asm/pgtable.h
index b2173e5da601..cd1c00fc744f 100644
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -178,6 +178,7 @@
 
 #else /* no mmu */
 
+# define _PAGE_CHG_MASK  (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY)
 # define PAGE_NONE       __pgprot(0)
 # define PAGE_SHARED     __pgprot(0)
 # define PAGE_COPY       __pgprot(0)
diff --git a/arch/xtensa/include/asm/vectors.h 
b/arch/xtensa/include/asm/vectors.h
index f74ddfbb92ef..29804fa6a7a3 100644
--- a/arch/xtensa/include/asm/vectors.h
+++ b/arch/xtensa/include/asm/vectors.h
@@ -47,6 +47,9 @@
   #define LOAD_MEMORY_ADDRESS          0xD0003000
 #endif
 
+#define RESET_VECTOR1_VADDR            (VIRTUAL_MEMORY_ADDRESS + \
+                                        XCHAL_RESET_VECTOR1_PADDR)
+
 #else /* !defined(CONFIG_MMU) */
   /* MMU Not being used - Virtual == Physical */
 
@@ -59,6 +62,8 @@
   /* Loaded just above possibly live vectors */
   #define LOAD_MEMORY_ADDRESS          0x00003000
 
+#define RESET_VECTOR1_VADDR            (XCHAL_RESET_VECTOR1_VADDR)
+
 #endif /* CONFIG_MMU */
 
 #define XC_VADDR(offset)               (VIRTUAL_MEMORY_ADDRESS  + offset)
@@ -70,10 +75,6 @@
                                                VECBASE_RESET_VADDR)
 #define RESET_VECTOR_VADDR             XC_VADDR(RESET_VECTOR_VECOFS)
 
-#define RESET_VECTOR1_VECOFS           (XCHAL_RESET_VECTOR1_VADDR - \
-                                               VECBASE_RESET_VADDR)
-#define RESET_VECTOR1_VADDR            XC_VADDR(RESET_VECTOR1_VECOFS)
-
 #if defined(XCHAL_HAVE_VECBASE) && XCHAL_HAVE_VECBASE
 
 #define USER_VECTOR_VADDR              XC_VADDR(XCHAL_USER_VECOFS)
diff --git a/arch/xtensa/kernel/Makefile b/arch/xtensa/kernel/Makefile
index 18d962a8c0c2..093be9122ee7 100644
--- a/arch/xtensa/kernel/Makefile
+++ b/arch/xtensa/kernel/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_FUNCTION_TRACER) += mcount.o
 obj-$(CONFIG_SMP) += smp.o mxhead.o
 
 AFLAGS_head.o += -mtext-section-literals
+AFLAGS_mxhead.o += -mtext-section-literals
 
 # In the Xtensa architecture, assembly generates literals which must always
 # precede the L32R instruction with a relative offset less than 256 kB.
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index cf8a354fa628..232dbf41df34 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -335,8 +335,10 @@ common_exception:
        s32i    a2, a1, PT_SYSCALL
        movi    a2, 0
        s32i    a3, a1, PT_EXCVADDR
+#if XCHAL_HAVE_LOOPS
        xsr     a2, lcount
        s32i    a2, a1, PT_LCOUNT
+#endif
 
        /* It is now save to restore the EXC_TABLE_FIXUP variable. */
 
@@ -368,11 +370,12 @@ common_exception:
        s32i    a3, a1, PT_PS           # save ps
 
        /* Save lbeg, lend */
-
+#if XCHAL_HAVE_LOOPS
        rsr     a2, lbeg
        rsr     a3, lend
        s32i    a2, a1, PT_LBEG
        s32i    a3, a1, PT_LEND
+#endif
 
        /* Save SCOMPARE1 */
 
@@ -664,13 +667,14 @@ common_exception_exit:
        wsr     a3, sar
 
        /* Restore LBEG, LEND, LCOUNT */
-
+#if XCHAL_HAVE_LOOPS
        l32i    a2, a1, PT_LBEG
        l32i    a3, a1, PT_LEND
        wsr     a2, lbeg
        l32i    a2, a1, PT_LCOUNT
        wsr     a3, lend
        wsr     a2, lcount
+#endif
 
        /* We control single stepping through the ICOUNTLEVEL register. */
 
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index aeeb3cc8a410..384a497d8566 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -244,7 +244,7 @@ ENTRY(_startup)
 
        __loopt a2, a3, a4, 2
        s32i    a0, a2, 0
-       __endla a2, a4, 4
+       __endla a2, a3, 4
 
 #if XCHAL_DCACHE_IS_WRITEBACK
 
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 06370ccea9e9..ed5b8b9b8d96 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -334,7 +334,10 @@ extern char _Level5InterruptVector_text_end;
 extern char _Level6InterruptVector_text_start;
 extern char _Level6InterruptVector_text_end;
 #endif
-
+#ifdef CONFIG_SMP
+extern char _SecondaryResetVector_text_start;
+extern char _SecondaryResetVector_text_end;
+#endif
 
 
 #ifdef CONFIG_S32C1I_SELFTEST
@@ -506,6 +509,10 @@ void __init setup_arch(char **cmdline_p)
                    __pa(&_Level6InterruptVector_text_end), 0);
 #endif
 
+#ifdef CONFIG_SMP
+       mem_reserve(__pa(&_SecondaryResetVector_text_start),
+                   __pa(&_SecondaryResetVector_text_end), 0);
+#endif
        parse_early_param();
        bootmem_init();
 
diff --git a/arch/xtensa/kernel/vectors.S b/arch/xtensa/kernel/vectors.S
index 8453e6e39895..7a1ff5e553b7 100644
--- a/arch/xtensa/kernel/vectors.S
+++ b/arch/xtensa/kernel/vectors.S
@@ -472,6 +472,9 @@ _DoubleExceptionVector_handle_exception:
 
 ENDPROC(_DoubleExceptionVector)
 
+       .end literal_prefix
+
+       .text
 /*
  * Fixup handler for TLB miss in double exception handler for window owerflow.
  * We get here with windowbase set to the window that was being spilled and
@@ -581,7 +584,6 @@ ENTRY(window_overflow_restore_a0_fixup)
 
 ENDPROC(window_overflow_restore_a0_fixup)
 
-       .end literal_prefix
 /*
  * Debug interrupt vector
  *
diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
index d16db6df86f8..126de5b30b9f 100644
--- a/arch/xtensa/kernel/vmlinux.lds.S
+++ b/arch/xtensa/kernel/vmlinux.lds.S
@@ -166,8 +166,6 @@ SECTIONS
     RELOCATE_ENTRY(_DebugInterruptVector_text,
                   .DebugInterruptVector.text);
 #if defined(CONFIG_SMP)
-    RELOCATE_ENTRY(_SecondaryResetVector_literal,
-                  .SecondaryResetVector.literal);
     RELOCATE_ENTRY(_SecondaryResetVector_text,
                   .SecondaryResetVector.text);
 #endif
@@ -282,17 +280,11 @@ SECTIONS
 
 #if defined(CONFIG_SMP)
 
-  SECTION_VECTOR (_SecondaryResetVector_literal,
-                 .SecondaryResetVector.literal,
-                 RESET_VECTOR1_VADDR - 4,
-                 SIZEOF(.DoubleExceptionVector.text),
-                 .DoubleExceptionVector.text)
-
   SECTION_VECTOR (_SecondaryResetVector_text,
                  .SecondaryResetVector.text,
                  RESET_VECTOR1_VADDR,
-                 4,
-                 .SecondaryResetVector.literal)
+                 SIZEOF(.DoubleExceptionVector.text),
+                 .DoubleExceptionVector.text)
 
   . = LOADADDR(.SecondaryResetVector.text)+SIZEOF(.SecondaryResetVector.text);
 
diff --git a/arch/xtensa/lib/usercopy.S b/arch/xtensa/lib/usercopy.S
index ace1892a875e..7ea4dd68893e 100644
--- a/arch/xtensa/lib/usercopy.S
+++ b/arch/xtensa/lib/usercopy.S
@@ -222,8 +222,8 @@ __xtensa_copy_user:
        loopnez a7, .Loop2done
 #else /* !XCHAL_HAVE_LOOPS */
        beqz    a7, .Loop2done
-       slli    a10, a7, 4
-       add     a10, a10, a3    # a10 = end of last 16B source chunk
+       slli    a12, a7, 4
+       add     a12, a12, a3    # a12 = end of last 16B source chunk
 #endif /* !XCHAL_HAVE_LOOPS */
 .Loop2:
        EX(l32i, a7, a3,  4, l_fixup)
@@ -241,7 +241,7 @@ __xtensa_copy_user:
        EX(s32i, a9, a5, 12, s_fixup)
        addi    a5, a5, 16
 #if !XCHAL_HAVE_LOOPS
-       blt     a3, a10, .Loop2
+       blt     a3, a12, .Loop2
 #endif /* !XCHAL_HAVE_LOOPS */
 .Loop2done:
        bbci.l  a4, 3, .L12
diff --git a/arch/xtensa/platforms/iss/setup.c 
b/arch/xtensa/platforms/iss/setup.c
index da7d18240866..391820539f0a 100644
--- a/arch/xtensa/platforms/iss/setup.c
+++ b/arch/xtensa/platforms/iss/setup.c
@@ -61,7 +61,9 @@ void platform_restart(void)
 #if XCHAL_NUM_IBREAK > 0
                             "wsr       a2, ibreakenable\n\t"
 #endif
+#if XCHAL_HAVE_LOOPS
                             "wsr       a2, lcount\n\t"
+#endif
                             "movi      a2, 0x1f\n\t"
                             "wsr       a2, ps\n\t"
                             "isync\n\t"
diff --git a/arch/xtensa/platforms/xt2000/setup.c 
b/arch/xtensa/platforms/xt2000/setup.c
index b90555cb8089..87678961a8c8 100644
--- a/arch/xtensa/platforms/xt2000/setup.c
+++ b/arch/xtensa/platforms/xt2000/setup.c
@@ -72,7 +72,9 @@ void platform_restart(void)
 #if XCHAL_NUM_IBREAK > 0
                              "wsr      a2, ibreakenable\n\t"
 #endif
+#if XCHAL_HAVE_LOOPS
                              "wsr      a2, lcount\n\t"
+#endif
                              "movi     a2, 0x1f\n\t"
                              "wsr      a2, ps\n\t"
                              "isync\n\t"
diff --git a/arch/xtensa/platforms/xtfpga/setup.c 
b/arch/xtensa/platforms/xtfpga/setup.c
index 57fd08b36f51..32c955e58e3d 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -63,7 +63,9 @@ void platform_restart(void)
 #if XCHAL_NUM_IBREAK > 0
                              "wsr      a2, ibreakenable\n\t"
 #endif
+#if XCHAL_HAVE_LOOPS
                              "wsr      a2, lcount\n\t"
+#endif
                              "movi     a2, 0x1f\n\t"
                              "wsr      a2, ps\n\t"
                              "isync\n\t"
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 850246206b12..a68b56a368a8 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -192,9 +192,14 @@ static int hash_accept(struct socket *sock, struct socket 
*newsock, int flags)
        struct sock *sk2;
        struct alg_sock *ask2;
        struct hash_ctx *ctx2;
+       bool more;
        int err;
 
-       err = crypto_ahash_export(req, state);
+       lock_sock(sk);
+       more = ctx->more;
+       err = more ? crypto_ahash_export(req, state) : 0;
+       release_sock(sk);
+
        if (err)
                return err;
 
@@ -205,7 +210,10 @@ static int hash_accept(struct socket *sock, struct socket 
*newsock, int flags)
        sk2 = newsock->sk;
        ask2 = alg_sk(sk2);
        ctx2 = ask2->private;
-       ctx2->more = 1;
+       ctx2->more = more;
+
+       if (!more)
+               return err;
 
        err = crypto_ahash_import(&ctx2->req, state);
        if (err) {
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 5e240a479b71..9fb0e4fd6ac0 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -83,6 +83,7 @@ static void *acpi_irq_context;
 static struct workqueue_struct *kacpid_wq;
 static struct workqueue_struct *kacpi_notify_wq;
 static struct workqueue_struct *kacpi_hotplug_wq;
+unsigned int acpi_sci_irq = INVALID_ACPI_IRQ;
 
 /*
  * This list of permanent mappings is for memory that may be accessed from
@@ -828,17 +829,19 @@ acpi_os_install_interrupt_handler(u32 gsi, 
acpi_osd_handler handler,
                acpi_irq_handler = NULL;
                return AE_NOT_ACQUIRED;
        }
+       acpi_sci_irq = irq;
 
        return AE_OK;
 }
 
-acpi_status acpi_os_remove_interrupt_handler(u32 irq, acpi_osd_handler handler)
+acpi_status acpi_os_remove_interrupt_handler(u32 gsi, acpi_osd_handler handler)
 {
-       if (irq != acpi_gbl_FADT.sci_interrupt)
+       if (gsi != acpi_gbl_FADT.sci_interrupt || !acpi_sci_irq_valid())
                return AE_BAD_PARAMETER;
 
-       free_irq(irq, acpi_irq);
+       free_irq(acpi_sci_irq, acpi_irq);
        acpi_irq_handler = NULL;
+       acpi_sci_irq = INVALID_ACPI_IRQ;
 
        return AE_OK;
 }
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index af9959e0d3a1..715b1597ee61 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -93,6 +93,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x04CA, 0x300f) },
        { USB_DEVICE(0x04CA, 0x3010) },
        { USB_DEVICE(0x0930, 0x0219) },
+       { USB_DEVICE(0x0930, 0x021c) },
        { USB_DEVICE(0x0930, 0x0220) },
        { USB_DEVICE(0x0930, 0x0227) },
        { USB_DEVICE(0x0b05, 0x17d0) },
@@ -104,6 +105,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x0CF3, 0x311F) },
        { USB_DEVICE(0x0cf3, 0x3121) },
        { USB_DEVICE(0x0CF3, 0x817a) },
+       { USB_DEVICE(0x0CF3, 0x817b) },
        { USB_DEVICE(0x0cf3, 0xe003) },
        { USB_DEVICE(0x0CF3, 0xE004) },
        { USB_DEVICE(0x0CF3, 0xE005) },
@@ -153,6 +155,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
@@ -164,6 +167,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x0CF3, 0x817b), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 0ff80ad6464b..78e20eb1b920 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -183,6 +183,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
@@ -194,6 +195,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index 643bba7d6f81..9eab751efeea 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -490,7 +490,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
                        }
                        ibmvtpm->rtce_size = be16_to_cpu(crq->len);
                        ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size,
-                                                   GFP_KERNEL);
+                                                   GFP_ATOMIC);
                        if (!ibmvtpm->rtce_buf) {
                                dev_err(ibmvtpm->dev, "Failed to allocate 
memory for rtce buffer\n");
                                return;
diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
index 98ba2bd1a355..565a0b39ae4e 100644
--- a/drivers/char/tpm/tpm_of.c
+++ b/drivers/char/tpm/tpm_of.c
@@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
                goto cleanup_eio;
        }
 
-       of_node_put(np);
        log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
        if (!log->bios_event_log) {
                pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
                       __func__);
+               of_node_put(np);
                return -ENOMEM;
        }
 
        log->bios_event_log_end = log->bios_event_log + *sizep;
 
        memcpy(log->bios_event_log, __va(be64_to_cpup(basep)), *sizep);
+       of_node_put(np);
 
        return 0;
 
diff --git a/drivers/clk/versatile/clk-icst.c b/drivers/clk/versatile/clk-icst.c
index bc96f103bd7c..9064636a867f 100644
--- a/drivers/clk/versatile/clk-icst.c
+++ b/drivers/clk/versatile/clk-icst.c
@@ -156,8 +156,10 @@ struct clk *icst_clk_register(struct device *dev,
        icst->lockreg = base + desc->lock_offset;
 
        clk = clk_register(dev, &icst->hw);
-       if (IS_ERR(clk))
+       if (IS_ERR(clk)) {
+               kfree(pclone);
                kfree(icst);
+       }
 
        return clk;
 }
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index a1315dd54514..b37d58f4cc93 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -176,7 +176,7 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
 
 /*----------------------------------------------------------------------*/
 
-static inline unsigned int dwc_fast_fls(unsigned long long v)
+static inline unsigned int dwc_fast_ffs(unsigned long long v)
 {
        /*
         * We can be a lot more clever here, but this should take care
@@ -720,7 +720,7 @@ dwc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, 
dma_addr_t src,
                           dw->data_width[dwc->dst_master]);
 
        src_width = dst_width = min_t(unsigned int, data_width,
-                                     dwc_fast_fls(src | dest | len));
+                                     dwc_fast_ffs(src | dest | len));
 
        ctllo = DWC_DEFAULT_CTLLO(chan)
                        | DWC_CTLL_DST_WIDTH(dst_width)
@@ -799,7 +799,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist 
*sgl,
 
        switch (direction) {
        case DMA_MEM_TO_DEV:
-               reg_width = __fls(sconfig->dst_addr_width);
+               reg_width = __ffs(sconfig->dst_addr_width);
                reg = sconfig->dst_addr;
                ctllo = (DWC_DEFAULT_CTLLO(chan)
                                | DWC_CTLL_DST_WIDTH(reg_width)
@@ -819,7 +819,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist 
*sgl,
                        len = sg_dma_len(sg);
 
                        mem_width = min_t(unsigned int,
-                                         data_width, dwc_fast_fls(mem | len));
+                                         data_width, dwc_fast_ffs(mem | len));
 
 slave_sg_todev_fill_desc:
                        desc = dwc_desc_get(dwc);
@@ -859,7 +859,7 @@ slave_sg_todev_fill_desc:
                }
                break;
        case DMA_DEV_TO_MEM:
-               reg_width = __fls(sconfig->src_addr_width);
+               reg_width = __ffs(sconfig->src_addr_width);
                reg = sconfig->src_addr;
                ctllo = (DWC_DEFAULT_CTLLO(chan)
                                | DWC_CTLL_SRC_WIDTH(reg_width)
@@ -879,7 +879,7 @@ slave_sg_todev_fill_desc:
                        len = sg_dma_len(sg);
 
                        mem_width = min_t(unsigned int,
-                                         data_width, dwc_fast_fls(mem | len));
+                                         data_width, dwc_fast_ffs(mem | len));
 
 slave_sg_fromdev_fill_desc:
                        desc = dwc_desc_get(dwc);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index a66a3217f1d9..f047d7c2b643 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -3682,6 +3682,11 @@ static int pci_probe(struct pci_dev *dev,
 
        reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0);
        ohci->it_context_support = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
+       /* JMicron JMB38x often shows 0 at first read, just ignore it */
+       if (!ohci->it_context_support) {
+               ohci_notice(ohci, "overriding IsoXmitIntMask\n");
+               ohci->it_context_support = 0xf;
+       }
        reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0);
        ohci->it_context_mask = ohci->it_context_support;
        ohci->n_it = hweight32(ohci->it_context_mask);
diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index 5d6a87573c33..7a49bd9fdacc 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -310,6 +310,7 @@ int ast_framebuffer_init(struct drm_device *dev,
 int ast_fbdev_init(struct drm_device *dev);
 void ast_fbdev_fini(struct drm_device *dev);
 void ast_fbdev_set_suspend(struct drm_device *dev, int state);
+void ast_fbdev_set_base(struct ast_private *ast, unsigned long gpu_addr);
 
 struct ast_bo {
        struct ttm_buffer_object bo;
diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
index a28640f47c27..b55b6b1c9fe2 100644
--- a/drivers/gpu/drm/ast/ast_fb.c
+++ b/drivers/gpu/drm/ast/ast_fb.c
@@ -367,3 +367,10 @@ void ast_fbdev_set_suspend(struct drm_device *dev, int 
state)
 
        fb_set_suspend(ast->fbdev->helper.fbdev, state);
 }
+
+void ast_fbdev_set_base(struct ast_private *ast, unsigned long gpu_addr)
+{
+       ast->fbdev->helper.fbdev->fix.smem_start =
+               ast->fbdev->helper.fbdev->apertures->ranges[0].base + gpu_addr;
+       ast->fbdev->helper.fbdev->fix.smem_len = ast->vram_size - gpu_addr;
+}
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index b792194e0d9c..0dfefbf929a3 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -385,6 +385,7 @@ int ast_driver_load(struct drm_device *dev, unsigned long 
flags)
        dev->mode_config.min_height = 0;
        dev->mode_config.preferred_depth = 24;
        dev->mode_config.prefer_shadow = 1;
+       dev->mode_config.fb_base = pci_resource_start(ast->dev->pdev, 0);
 
        if (ast->chip == AST2100 ||
            ast->chip == AST2200 ||
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 1550d80ea2bc..d7e615282d38 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -522,6 +522,8 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc,
                ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
                if (ret)
                        DRM_ERROR("failed to kmap fbcon\n");
+               else
+                       ast_fbdev_set_base(ast, gpu_addr);
        }
        ast_bo_unreserve(bo);
 
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index ee96912e0824..0dd2c26c55ab 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -369,8 +369,7 @@ EXPORT_SYMBOL(drm_get_format_name);
  * reference counted modeset objects like framebuffers.
  *
  * Returns:
- * New unique (relative to other objects in @dev) integer identifier for the
- * object.
+ * Zero on success, error code on failure.
  */
 int drm_mode_object_get(struct drm_device *dev,
                        struct drm_mode_object *obj, uint32_t obj_type)
@@ -492,7 +491,7 @@ int drm_framebuffer_init(struct drm_device *dev, struct 
drm_framebuffer *fb,
 out:
        mutex_unlock(&dev->mode_config.fb_lock);
 
-       return 0;
+       return ret;
 }
 EXPORT_SYMBOL(drm_framebuffer_init);
 
diff --git a/drivers/gpu/drm/i915/intel_display.c 
b/drivers/gpu/drm/i915/intel_display.c
index 535f11187dcc..c35353aadd02 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11711,6 +11711,9 @@ static struct intel_quirk intel_quirks[] = {
 
        /* Dell Chromebook 11 */
        { 0x0a06, 0x1028, 0x0a35, quirk_backlight_present },
+
+       /* Dell Chromebook 11 (2015 version) */
+       { 0x0a16, 0x1028, 0x0a35, quirk_backlight_present },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 46c945740b85..95aec32186c0 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2922,6 +2922,8 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
        { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
        { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
        { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
+       { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
+       { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
        { 0, 0, 0, 0 },
 };
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5ed3a7b91b4c..fb16c812816a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1561,7 +1561,7 @@ int hid_connect(struct hid_device *hdev, unsigned int 
connect_mask)
                "Multi-Axis Controller"
        };
        const char *type, *bus;
-       char buf[64];
+       char buf[64] = "";
        unsigned int i;
        int len;
        int ret;
diff --git a/drivers/hsi/controllers/omap_ssi_port.c 
b/drivers/hsi/controllers/omap_ssi_port.c
index 29aea0b93360..1c4d101c2844 100644
--- a/drivers/hsi/controllers/omap_ssi_port.c
+++ b/drivers/hsi/controllers/omap_ssi_port.c
@@ -1110,7 +1110,7 @@ static int __init ssi_port_probe(struct platform_device 
*pd)
        struct omap_ssi_port *omap_port;
        struct hsi_controller *ssi = dev_get_drvdata(pd->dev.parent);
        struct omap_ssi_controller *omap_ssi = hsi_controller_drvdata(ssi);
-       u32 cawake_gpio = 0;
+       int cawake_gpio = 0;
        u32 port_id;
        int err;
 
diff --git a/drivers/hsi/hsi.c b/drivers/hsi/hsi.c
index fe9371271ce2..35d631e91908 100644
--- a/drivers/hsi/hsi.c
+++ b/drivers/hsi/hsi.c
@@ -300,7 +300,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
        if (device_register(&cl->device) < 0) {
                pr_err("hsi: failed to register client: %s\n", name);
                put_device(&cl->device);
-               goto err3;
        }
 
        return;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index b8e9df5e5da5..f6f44bc78a75 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1402,6 +1402,13 @@ static const struct dmi_system_id 
elantech_dmi_force_crc_enabled[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E544"),
                },
        },
+       {
+               /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
+               .matches = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                       DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U745"),
+               },
+       },
 #endif
        { }
 };
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index baffab3948d7..544f968a440a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3798,14 +3798,17 @@ int dmar_find_matched_atsr_unit(struct pci_dev *dev)
        dev = pci_physfn(dev);
        for (bus = dev->bus; bus; bus = bus->parent) {
                bridge = bus->self;
-               if (!bridge || !pci_is_pcie(bridge) ||
+               /* If it's an integrated device, allow ATS */
+               if (!bridge)
+                       return 1;
+               /* Connected via non-PCIe: no ATS */
+               if (!pci_is_pcie(bridge) ||
                    pci_pcie_type(bridge) == PCI_EXP_TYPE_PCI_BRIDGE)
                        return 0;
+               /* If we found the root port, look it up in the ATSR */
                if (pci_pcie_type(bridge) == PCI_EXP_TYPE_ROOT_PORT)
                        break;
        }
-       if (!bridge)
-               return 0;
 
        rcu_read_lock();
        list_for_each_entry_rcu(atsru, &dmar_atsr_units, list) {
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index f4167b013d99..43e2b498732f 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1545,11 +1545,8 @@ static int multipath_ioctl(struct dm_target *ti, 
unsigned int cmd,
        /*
         * Only pass ioctls through if the device sizes match exactly.
         */
-       if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) {
-               int err = scsi_verify_blk_ioctl(NULL, cmd);
-               if (err)
-                       r = err;
-       }
+       if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
+               r = scsi_verify_blk_ioctl(NULL, cmd);
 
        if (r == -ENOTCONN && !fatal_signal_pending(current)) {
                spin_lock_irqsave(&m->lock, flags);
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 9afd00b45f83..8f7dfc58f965 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -88,7 +88,7 @@ static int create_strip_zones(struct mddev *mddev, struct 
r0conf **private_conf)
        char b[BDEVNAME_SIZE];
        char b2[BDEVNAME_SIZE];
        struct r0conf *conf = kzalloc(sizeof(*conf), GFP_KERNEL);
-       bool discard_supported = false;
+       unsigned short blksize = 512;
 
        if (!conf)
                return -ENOMEM;
@@ -103,6 +103,9 @@ static int create_strip_zones(struct mddev *mddev, struct 
r0conf **private_conf)
                sector_div(sectors, mddev->chunk_sectors);
                rdev1->sectors = sectors * mddev->chunk_sectors;
 
+               blksize = max(blksize, queue_logical_block_size(
+                                     rdev1->bdev->bd_disk->queue));
+
                rdev_for_each(rdev2, mddev) {
                        pr_debug("md/raid0:%s:   comparing %s(%llu)"
                                 " with %s(%llu)\n",
@@ -139,6 +142,18 @@ static int create_strip_zones(struct mddev *mddev, struct 
r0conf **private_conf)
        }
        pr_debug("md/raid0:%s: FINAL %d zones\n",
                 mdname(mddev), conf->nr_strip_zones);
+       /*
+        * now since we have the hard sector sizes, we can make sure
+        * chunk size is a multiple of that sector size
+        */
+       if ((mddev->chunk_sectors << 9) % blksize) {
+               printk(KERN_ERR "md/raid0:%s: chunk_size of %d not multiple of 
block size %d\n",
+                      mdname(mddev),
+                      mddev->chunk_sectors << 9, blksize);
+               err = -EINVAL;
+               goto abort;
+       }
+
        err = -ENOMEM;
        conf->strip_zone = kzalloc(sizeof(struct strip_zone)*
                                conf->nr_strip_zones, GFP_KERNEL);
@@ -193,18 +208,12 @@ static int create_strip_zones(struct mddev *mddev, struct 
r0conf **private_conf)
                }
                dev[j] = rdev1;
 
-               disk_stack_limits(mddev->gendisk, rdev1->bdev,
-                                 rdev1->data_offset << 9);
-
                if (rdev1->bdev->bd_disk->queue->merge_bvec_fn)
                        conf->has_merge_bvec = 1;
 
                if (!smallest || (rdev1->sectors < smallest->sectors))
                        smallest = rdev1;
                cnt++;
-
-               if (blk_queue_discard(bdev_get_queue(rdev1->bdev)))
-                       discard_supported = true;
        }
        if (cnt != mddev->raid_disks) {
                printk(KERN_ERR "md/raid0:%s: too few disks (%d of %d) - "
@@ -267,26 +276,6 @@ static int create_strip_zones(struct mddev *mddev, struct 
r0conf **private_conf)
        mddev->queue->backing_dev_info.congested_fn = raid0_congested;
        mddev->queue->backing_dev_info.congested_data = mddev;
 
-       /*
-        * now since we have the hard sector sizes, we can make sure
-        * chunk size is a multiple of that sector size
-        */
-       if ((mddev->chunk_sectors << 9) % 
queue_logical_block_size(mddev->queue)) {
-               printk(KERN_ERR "md/raid0:%s: chunk_size of %d not valid\n",
-                      mdname(mddev),
-                      mddev->chunk_sectors << 9);
-               goto abort;
-       }
-
-       blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
-       blk_queue_io_opt(mddev->queue,
-                        (mddev->chunk_sectors << 9) * mddev->raid_disks);
-
-       if (!discard_supported)
-               queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
-       else
-               queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
-
        pr_debug("md/raid0:%s: done.\n", mdname(mddev));
        *private_conf = conf;
 
@@ -429,6 +418,8 @@ static int raid0_run(struct mddev *mddev)
 {
        struct r0conf *conf;
        int ret;
+       struct md_rdev *rdev;
+       bool discard_supported = false;
 
        if (mddev->chunk_sectors == 0) {
                printk(KERN_ERR "md/raid0:%s: chunk size must be set.\n",
@@ -437,9 +428,6 @@ static int raid0_run(struct mddev *mddev)
        }
        if (md_check_no_bitmap(mddev))
                return -EINVAL;
-       blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
-       blk_queue_max_write_same_sectors(mddev->queue, mddev->chunk_sectors);
-       blk_queue_max_discard_sectors(mddev->queue, mddev->chunk_sectors);
 
        /* if private is not null, we are here after takeover */
        if (mddev->private == NULL) {
@@ -449,6 +437,25 @@ static int raid0_run(struct mddev *mddev)
                mddev->private = conf;
        }
        conf = mddev->private;
+       blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
+       blk_queue_max_write_same_sectors(mddev->queue, mddev->chunk_sectors);
+       blk_queue_max_discard_sectors(mddev->queue, mddev->chunk_sectors);
+
+       blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
+       blk_queue_io_opt(mddev->queue,
+                        (mddev->chunk_sectors << 9) * mddev->raid_disks);
+
+       rdev_for_each(rdev, mddev) {
+               disk_stack_limits(mddev->gendisk, rdev->bdev,
+                                 rdev->data_offset << 9);
+               if (blk_queue_discard(bdev_get_queue(rdev->bdev)))
+                       discard_supported = true;
+       }
+
+       if (!discard_supported)
+               queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
+       else
+               queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
 
        /* calculate array device size */
        md_set_array_sectors(mddev, raid0_size(mddev, 0, 0));
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c 
b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 7e2411c36419..6822ee43d821 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -264,7 +264,7 @@ static int put_v4l2_create32(struct v4l2_create_buffers 
*kp, struct v4l2_create_
 
 struct v4l2_standard32 {
        __u32                index;
-       __u32                id[2]; /* __u64 would get the alignment wrong */
+       compat_u64           id;
        __u8                 name[24];
        struct v4l2_fract    frameperiod; /* Frames, not fields */
        __u32                framelines;
@@ -284,7 +284,7 @@ static int put_v4l2_standard32(struct v4l2_standard *kp, 
struct v4l2_standard32
 {
        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) ||
                put_user(kp->index, &up->index) ||
-               copy_to_user(up->id, &kp->id, sizeof(__u64)) ||
+               put_user(kp->id, &up->id) ||
                copy_to_user(up->name, kp->name, 24) ||
                copy_to_user(&up->frameperiod, &kp->frameperiod, 
sizeof(kp->frameperiod)) ||
                put_user(kp->framelines, &up->framelines) ||
@@ -576,10 +576,10 @@ struct v4l2_input32 {
        __u32        type;              /*  Type of input */
        __u32        audioset;          /*  Associated audios (bitfield) */
        __u32        tuner;             /*  Associated tuner */
-       v4l2_std_id  std;
+       compat_u64   std;
        __u32        status;
        __u32        reserved[4];
-} __attribute__ ((packed));
+};
 
 /* The 64-bit v4l2_input struct has extra padding at the end of the struct.
    Otherwise it is identical to the 32-bit version. */
@@ -719,6 +719,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls 
*kp, struct v4l2_ext
 struct v4l2_event32 {
        __u32                           type;
        union {
+               compat_s64              value64;
                __u8                    data[64];
        } u;
        __u32                           pending;
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c 
b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index 880be0782dd9..9c838cd58761 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -117,7 +117,8 @@ static void vb2_dc_prepare(void *buf_priv)
        if (!sgt || buf->db_attach)
                return;
 
-       dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir);
+       dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->orig_nents,
+                              buf->dma_dir);
 }
 
 static void vb2_dc_finish(void *buf_priv)
@@ -129,7 +130,7 @@ static void vb2_dc_finish(void *buf_priv)
        if (!sgt || buf->db_attach)
                return;
 
-       dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir);
+       dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
 }
 
 /*********************************************/
diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c
index ae26d84b3a59..9e41d799a144 100644
--- a/drivers/mfd/twl6040.c
+++ b/drivers/mfd/twl6040.c
@@ -647,6 +647,8 @@ static int twl6040_probe(struct i2c_client *client,
 
        twl6040->clk32k = devm_clk_get(&client->dev, "clk32k");
        if (IS_ERR(twl6040->clk32k)) {
+               if (PTR_ERR(twl6040->clk32k) == -EPROBE_DEFER)
+                       return -EPROBE_DEFER;
                dev_info(&client->dev, "clk32k is not handled\n");
                twl6040->clk32k = NULL;
        }
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 7266a318628c..f2af5b91c0e3 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -199,8 +199,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t 
mode)
        if (!dev)
                return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
 
-       mutex_lock(&dev->lock);
        mutex_lock(&mtd_table_mutex);
+       mutex_lock(&dev->lock);
 
        if (dev->open)
                goto unlock;
@@ -224,8 +224,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t 
mode)
 
 unlock:
        dev->open++;
-       mutex_unlock(&mtd_table_mutex);
        mutex_unlock(&dev->lock);
+       mutex_unlock(&mtd_table_mutex);
        blktrans_dev_put(dev);
        return ret;
 
@@ -235,8 +235,8 @@ error_release:
 error_put:
        module_put(dev->tr->owner);
        kref_put(&dev->ref, blktrans_dev_release);
-       mutex_unlock(&mtd_table_mutex);
        mutex_unlock(&dev->lock);
+       mutex_unlock(&mtd_table_mutex);
        blktrans_dev_put(dev);
        return ret;
 }
@@ -248,8 +248,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t 
mode)
        if (!dev)
                return;
 
-       mutex_lock(&dev->lock);
        mutex_lock(&mtd_table_mutex);
+       mutex_lock(&dev->lock);
 
        if (--dev->open)
                goto unlock;
@@ -263,8 +263,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t 
mode)
                __put_mtd_device(dev->mtd);
        }
 unlock:
-       mutex_unlock(&mtd_table_mutex);
        mutex_unlock(&dev->lock);
+       mutex_unlock(&mtd_table_mutex);
        blktrans_dev_put(dev);
 }
 
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 1ca9aec141ff..822d634b9ed5 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -637,8 +637,10 @@ int add_mtd_partitions(struct mtd_info *master,
 
        for (i = 0; i < nbparts; i++) {
                slave = allocate_partition(master, parts + i, i, cur_offset);
-               if (IS_ERR(slave))
+               if (IS_ERR(slave)) {
+                       del_mtd_partitions(master);
                        return PTR_ERR(slave);
+               }
 
                mutex_lock(&mtd_partitions_mutex);
                list_add(&slave->list, &mtd_partitions);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index ddb2e2564470..8fe94f711f39 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1667,6 +1667,7 @@ err_undo_flags:
                                            slave_dev->dev_addr))
                        eth_hw_addr_random(bond_dev);
                if (bond_dev->type != ARPHRD_ETHER) {
+                       dev_close(bond_dev);
                        ether_setup(bond_dev);
                        bond_dev->flags |= IFF_MASTER;
                        bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index c543c3aaee4d..5635c6e7af57 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -835,7 +835,7 @@ static int can_fill_info(struct sk_buff *skb, const struct 
net_device *dev)
             nla_put(skb, IFLA_CAN_BITTIMING_CONST,
                     sizeof(*priv->bittiming_const), priv->bittiming_const)) ||
 
-           nla_put(skb, IFLA_CAN_CLOCK, sizeof(cm), &priv->clock) ||
+           nla_put(skb, IFLA_CAN_CLOCK, sizeof(priv->clock), &priv->clock) ||
            nla_put_u32(skb, IFLA_CAN_STATE, state) ||
            nla_put(skb, IFLA_CAN_CTRLMODE, sizeof(cm), &cm) ||
            nla_put_u32(skb, IFLA_CAN_RESTART_MS, priv->restart_ms) ||
diff --git a/drivers/net/ethernet/marvell/mvneta.c 
b/drivers/net/ethernet/marvell/mvneta.c
index 03ab691ad683..b6de763afef0 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -941,7 +941,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
        /* Set CPU queue access map - all CPUs have access to all RX
         * queues and to all TX queues
         */
-       for (cpu = 0; cpu < CONFIG_NR_CPUS; cpu++)
+       for_each_present_cpu(cpu)
                mvreg_write(pp, MVNETA_CPU_MAP(cpu),
                            (MVNETA_CPU_RXQ_ACCESS_ALL_MASK |
                             MVNETA_CPU_TXQ_ACCESS_ALL_MASK));
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c 
b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index c62e67f3c2f0..aa0480402c97 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -723,10 +723,13 @@ static int stmmac_get_ts_info(struct net_device *dev,
 {
        struct stmmac_priv *priv = netdev_priv(dev);
 
-       if ((priv->hwts_tx_en) && (priv->hwts_rx_en)) {
+       if ((priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) {
 
-               info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE |
+               info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE |
+                                       SOF_TIMESTAMPING_TX_HARDWARE |
+                                       SOF_TIMESTAMPING_RX_SOFTWARE |
                                        SOF_TIMESTAMPING_RX_HARDWARE |
+                                       SOF_TIMESTAMPING_SOFTWARE |
                                        SOF_TIMESTAMPING_RAW_HARDWARE;
 
                if (priv->ptp_clock)
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index e8c21f911b6f..6185874a088e 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -68,7 +68,7 @@ static const struct proto_ops macvtap_socket_ops;
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
                      NETIF_F_TSO6 | NETIF_F_UFO)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
-#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
+#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG | NETIF_F_FRAGLIST)
 
 static struct macvlan_dev *macvtap_get_vlan_rcu(const struct net_device *dev)
 {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b8a82b86f909..9f3fc25050e3 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -535,6 +535,10 @@ static const struct usb_device_id products[] = {
                                              USB_CDC_PROTO_NONE),
                .driver_info        = (unsigned long)&qmi_wwan_info,
        },
+       {       /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
+               USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, 
USB_CLASS_VENDOR_SPEC, 1, 7),
+               .driver_info = (unsigned long)&qmi_wwan_info,
+       },
 
        /* 3. Combined interface devices matching on interface number */
        {QMI_FIXED_INTF(0x0408, 0xea42, 4)},    /* Yota / Megafon M100-1 */
@@ -780,7 +784,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ 
(42Mbps) Mobile Broadband Card */
        {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 
4G LTE Mobile Broadband Card */
        {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 
4G LTE Mobile Broadband Card */
-       {QMI_FIXED_INTF(0x03f0, 0x581d, 4)},    /* HP lt4112 LTE/HSPA+ Gobi 4G 
Module (Huawei me906e) */
+       {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ 
Gobi 4G Module */
 
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/wireless/mwifiex/debugfs.c 
b/drivers/net/wireless/mwifiex/debugfs.c
index 7b419bbcd544..147250696181 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -660,7 +660,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf,
                (struct mwifiex_private *) file->private_data;
        unsigned long addr = get_zeroed_page(GFP_KERNEL);
        char *buf = (char *) addr;
-       int pos = 0, ret = 0, i;
+       int pos, ret, i;
        u8 value[MAX_EEPROM_DATA];
 
        if (!buf)
@@ -668,7 +668,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf,
 
        if (saved_offset == -1) {
                /* No command has been given */
-               pos += snprintf(buf, PAGE_SIZE, "0");
+               pos = snprintf(buf, PAGE_SIZE, "0");
                goto done;
        }
 
@@ -677,17 +677,17 @@ mwifiex_rdeeprom_read(struct file *file, char __user 
*ubuf,
                                  (u16) saved_bytes, value);
        if (ret) {
                ret = -EINVAL;
-               goto done;
+               goto out_free;
        }
 
-       pos += snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes);
+       pos = snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes);
 
        for (i = 0; i < saved_bytes; i++)
-               pos += snprintf(buf + strlen(buf), PAGE_SIZE, "%d ", value[i]);
-
-       ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos);
+               pos += scnprintf(buf + pos, PAGE_SIZE - pos, "%d ", value[i]);
 
 done:
+       ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos);
+out_free:
        free_page(addr);
        return ret;
 }
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 5c437ca532b3..24ad55129194 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -774,14 +774,15 @@ int __init early_init_dt_scan_chosen_serial(void)
                return -ENODEV;
 
        while (match->compatible[0]) {
-               unsigned long addr;
+               u64 addr;
+
                if (fdt_node_check_compatible(fdt, offset, match->compatible)) {
                        match++;
                        continue;
                }
 
                addr = fdt_translate_address(fdt, offset);
-               if (!addr)
+               if (addr == OF_BAD_ADDR)
                        return -ENXIO;
 
                of_setup_earlycon(addr, match->data);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 632aae861375..86f284f0960e 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -123,6 +123,10 @@ static int __init __reserved_mem_alloc_size(unsigned long 
node,
                align = dt_mem_next_cell(dt_root_addr_cells, &prop);
        }
 
+       /* Need adjust the alignment to satisfy the CMA requirement */
+       if (IS_ENABLED(CONFIG_CMA) && of_flat_dt_is_compatible(node, 
"shared-dma-pool"))
+               align = max(align, (phys_addr_t)PAGE_SIZE << max(MAX_ORDER - 1, 
pageblock_order));
+
        prop = of_get_flat_dt_prop(node, "alloc-ranges", &len);
        if (prop) {
 
diff --git a/drivers/platform/x86/ideapad-laptop.c 
b/drivers/platform/x86/ideapad-laptop.c
index cfc93618ebf1..964f83cc00c6 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -859,6 +859,13 @@ static struct dmi_system_id no_hw_rfkill_list[] = {
                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 
Pro-1370"),
                },
        },
+       {
+               .ident = "Lenovo Yoga 900",
+               .matches = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                       DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"),
+               },
+       },
        {}
 };
 
diff --git a/drivers/power/wm831x_power.c b/drivers/power/wm831x_power.c
index 3bed2f55cf7d..3ccadf631d45 100644
--- a/drivers/power/wm831x_power.c
+++ b/drivers/power/wm831x_power.c
@@ -567,7 +567,7 @@ static int wm831x_power_probe(struct platform_device *pdev)
 
        irq = wm831x_irq(wm831x, platform_get_irq_byname(pdev, "SYSLO"));
        ret = request_threaded_irq(irq, NULL, wm831x_syslo_irq,
-                                  IRQF_TRIGGER_RISING, "System power low",
+                                  IRQF_TRIGGER_RISING | IRQF_ONESHOT, "System 
power low",
                                   power);
        if (ret != 0) {
                dev_err(&pdev->dev, "Failed to request SYSLO IRQ %d: %d\n",
@@ -577,7 +577,7 @@ static int wm831x_power_probe(struct platform_device *pdev)
 
        irq = wm831x_irq(wm831x, platform_get_irq_byname(pdev, "PWR SRC"));
        ret = request_threaded_irq(irq, NULL, wm831x_pwr_src_irq,
-                                  IRQF_TRIGGER_RISING, "Power source",
+                                  IRQF_TRIGGER_RISING | IRQF_ONESHOT, "Power 
source",
                                   power);
        if (ret != 0) {
                dev_err(&pdev->dev, "Failed to request PWR SRC IRQ %d: %d\n",
@@ -590,7 +590,7 @@ static int wm831x_power_probe(struct platform_device *pdev)
                                 platform_get_irq_byname(pdev,
                                                         wm831x_bat_irqs[i]));
                ret = request_threaded_irq(irq, NULL, wm831x_bat_irq,
-                                          IRQF_TRIGGER_RISING,
+                                          IRQF_TRIGGER_RISING | IRQF_ONESHOT,
                                           wm831x_bat_irqs[i],
                                           power);
                if (ret != 0) {
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index f03d5ba96db1..f182dae3a4b7 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -727,9 +727,9 @@ static int mcp7941x_set_alarm(struct device *dev, struct 
rtc_wkalrm *t)
        regs[3] = bin2bcd(t->time.tm_sec);
        regs[4] = bin2bcd(t->time.tm_min);
        regs[5] = bin2bcd(t->time.tm_hour);
-       regs[6] = bin2bcd(t->time.tm_wday) + 1;
+       regs[6] = bin2bcd(t->time.tm_wday + 1);
        regs[7] = bin2bcd(t->time.tm_mday);
-       regs[8] = bin2bcd(t->time.tm_mon) + 1;
+       regs[8] = bin2bcd(t->time.tm_mon + 1);
 
        /* Clear the alarm 0 interrupt flag. */
        regs[6] &= ~MCP7941X_BIT_ALMX_IF;
diff --git a/drivers/scsi/megaraid/megaraid_sas.h 
b/drivers/scsi/megaraid/megaraid_sas.h
index 32166c2c7854..293a396b64ad 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -335,6 +335,8 @@ enum MR_EVT_ARGS {
        MR_EVT_ARGS_GENERIC,
 };
 
+
+#define SGE_BUFFER_SIZE        4096
 /*
  * define constants for device list query options
  */
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c 
b/drivers/scsi/megaraid/megaraid_sas_base.c
index 8677fa0deb2d..acecd7de4ea1 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4213,7 +4213,7 @@ static int megasas_init_fw(struct megasas_instance 
*instance)
                }
        }
        instance->max_sectors_per_req = instance->max_num_sge *
-                                               PAGE_SIZE / 512;
+                                               SGE_BUFFER_SIZE / 512;
        if (tmp_sectors && (instance->max_sectors_per_req > tmp_sectors))
                instance->max_sectors_per_req = tmp_sectors;
 
@@ -5812,6 +5812,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file 
*file, unsigned long arg)
        int i;
        int error = 0;
        compat_uptr_t ptr;
+       unsigned long local_raw_ptr;
+       u32 local_sense_off;
+       u32 local_sense_len;
 
        if (clear_user(ioc, sizeof(*ioc)))
                return -EFAULT;
@@ -5829,9 +5832,15 @@ static int megasas_mgmt_compat_ioctl_fw(struct file 
*file, unsigned long arg)
         * sense_len is not null, so prepare the 64bit value under
         * the same condition.
         */
-       if (ioc->sense_len) {
+       if (get_user(local_raw_ptr, ioc->frame.raw) ||
+               get_user(local_sense_off, &ioc->sense_off) ||
+               get_user(local_sense_len, &ioc->sense_len))
+               return -EFAULT;
+
+
+       if (local_sense_len) {
                void __user **sense_ioc_ptr =
-                       (void __user **)(ioc->frame.raw + ioc->sense_off);
+                       (void __user **)((u8*)local_raw_ptr + local_sense_off);
                compat_uptr_t *sense_cioc_ptr =
                        (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
                if (get_user(ptr, sense_cioc_ptr) ||
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 074e8cc30955..7e78015d6ab7 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -891,7 +891,7 @@ sdev_store_queue_ramp_up_period(struct device *dev,
                return -EINVAL;
 
        sdev->queue_ramp_up_period = msecs_to_jiffies(period);
-       return period;
+       return count;
 }
 
 static DEVICE_ATTR(queue_ramp_up_period, S_IRUGO | S_IWUSR,
@@ -1148,31 +1148,23 @@ static void __scsi_remove_target(struct scsi_target 
*starget)
 void scsi_remove_target(struct device *dev)
 {
        struct Scsi_Host *shost = dev_to_shost(dev->parent);
-       struct scsi_target *starget, *last = NULL;
+       struct scsi_target *starget;
        unsigned long flags;
 
-       /* remove targets being careful to lookup next entry before
-        * deleting the last
-        */
+restart:
        spin_lock_irqsave(shost->host_lock, flags);
        list_for_each_entry(starget, &shost->__targets, siblings) {
                if (starget->state == STARGET_DEL)
                        continue;
                if (starget->dev.parent == dev || &starget->dev == dev) {
-                       /* assuming new targets arrive at the end */
                        kref_get(&starget->reap_ref);
                        spin_unlock_irqrestore(shost->host_lock, flags);
-                       if (last)
-                               scsi_target_reap(last);
-                       last = starget;
                        __scsi_remove_target(starget);
-                       spin_lock_irqsave(shost->host_lock, flags);
+                       scsi_target_reap(starget);
+                       goto restart;
                }
        }
        spin_unlock_irqrestore(shost->host_lock, flags);
-
-       if (last)
-               scsi_target_reap(last);
 }
 EXPORT_SYMBOL(scsi_remove_target);
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 3bb6646bb406..f9da66fa850b 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1610,8 +1610,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, 
struct scsi_cmnd *scmnd)
        vm_srb->win8_extension.time_out_value = 60;
 
        vm_srb->win8_extension.srb_flags |=
-               (SRB_FLAGS_QUEUE_ACTION_ENABLE |
-               SRB_FLAGS_DISABLE_SYNCH_TRANSFER);
+               SRB_FLAGS_DISABLE_SYNCH_TRANSFER;
 
        /* Build the SRB */
        switch (scmnd->sc_data_direction) {
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index a65823bddf01..bbf7c5e79b95 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -593,7 +593,8 @@ static int atmel_spi_next_xfer_dma_submit(struct spi_master 
*master,
 
        *plen = len;
 
-       if (atmel_spi_dma_slave_config(as, &slave_config, 8))
+       if (atmel_spi_dma_slave_config(as, &slave_config,
+                                      xfer->bits_per_word))
                goto err_exit;
 
        /* Send both scatterlists */
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 4fc4c20893e1..66e9e5196c8c 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -652,8 +652,7 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
        snprintf(dws->name, sizeof(dws->name), "dw_spi%d",
                        dws->bus_num);
 
-       ret = devm_request_irq(dev, dws->irq, dw_spi_irq, IRQF_SHARED,
-                       dws->name, dws);
+       ret = request_irq(dws->irq, dw_spi_irq, IRQF_SHARED, dws->name, dws);
        if (ret < 0) {
                dev_err(&master->dev, "can not get IRQ\n");
                goto err_free_master;
@@ -695,6 +694,7 @@ err_dma_exit:
        if (dws->dma_ops && dws->dma_ops->dma_exit)
                dws->dma_ops->dma_exit(dws);
        spi_enable_chip(dws, 0);
+       free_irq(dws->irq, master);
 err_free_master:
        spi_master_put(master);
        return ret;
@@ -712,6 +712,8 @@ void dw_spi_remove_host(struct dw_spi *dws)
        spi_enable_chip(dws, 0);
        /* Disable clk */
        spi_set_clk(dws, 0);
+
+       free_irq(dws->irq, dws->master);
 }
 EXPORT_SYMBOL_GPL(dw_spi_remove_host);
 
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 6c211d1910b0..b68511204367 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -364,11 +364,10 @@ static int ti_qspi_start_transfer_one(struct spi_master 
*master,
 
        mutex_unlock(&qspi->list_lock);
 
+       ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
        m->status = status;
        spi_finalize_current_message(master);
 
-       ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
-
        return status;
 }
 
diff --git a/drivers/staging/rtl8712/usb_intf.c 
b/drivers/staging/rtl8712/usb_intf.c
index ba743542babc..22a28becf275 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -144,6 +144,7 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = {
        {USB_DEVICE(0x0DF6, 0x0058)},
        {USB_DEVICE(0x0DF6, 0x0049)},
        {USB_DEVICE(0x0DF6, 0x004C)},
+       {USB_DEVICE(0x0DF6, 0x006C)},
        {USB_DEVICE(0x0DF6, 0x0064)},
        /* Skyworth */
        {USB_DEVICE(0x14b2, 0x3300)},
diff --git a/drivers/thermal/samsung/exynos_tmu.c 
b/drivers/thermal/samsung/exynos_tmu.c
index efed4eedf47f..bd3ba217386e 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -558,27 +558,10 @@ static int exynos_map_dt_data(struct platform_device 
*pdev)
        struct exynos_tmu_data *data = platform_get_drvdata(pdev);
        struct exynos_tmu_platform_data *pdata;
        struct resource res;
-       int ret;
 
        if (!data || !pdev->dev.of_node)
                return -ENODEV;
 
-       /*
-        * Try enabling the regulator if found
-        * TODO: Add regulator as an SOC feature, so that regulator enable
-        * is a compulsory call.
-        */
-       data->regulator = devm_regulator_get(&pdev->dev, "vtmu");
-       if (!IS_ERR(data->regulator)) {
-               ret = regulator_enable(data->regulator);
-               if (ret) {
-                       dev_err(&pdev->dev, "failed to enable vtmu\n");
-                       return ret;
-               }
-       } else {
-               dev_info(&pdev->dev, "Regulator node (vtmu) not found\n");
-       }
-
        data->id = of_alias_get_id(pdev->dev.of_node, "tmuctrl");
        if (data->id < 0)
                data->id = 0;
@@ -643,6 +626,22 @@ static int exynos_tmu_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, data);
        mutex_init(&data->lock);
 
+       /*
+        * Try enabling the regulator if found
+        * TODO: Add regulator as an SOC feature, so that regulator enable
+        * is a compulsory call.
+        */
+       data->regulator = devm_regulator_get(&pdev->dev, "vtmu");
+       if (!IS_ERR(data->regulator)) {
+               ret = regulator_enable(data->regulator);
+               if (ret) {
+                       dev_err(&pdev->dev, "failed to enable vtmu\n");
+                       return ret;
+               }
+       } else {
+               dev_info(&pdev->dev, "Regulator node (vtmu) not found\n");
+       }
+
        ret = exynos_map_dt_data(pdev);
        if (ret)
                return ret;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 39ec99fbb135..29de4bfe5c70 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -364,8 +364,7 @@ static void n_tty_packet_mode_flush(struct tty_struct *tty)
        spin_lock_irqsave(&tty->ctrl_lock, flags);
        if (tty->link->packet) {
                tty->ctrl_status |= TIOCPKT_FLUSHREAD;
-               if (waitqueue_active(&tty->link->read_wait))
-                       wake_up_interruptible(&tty->link->read_wait);
+               wake_up_interruptible(&tty->link->read_wait);
        }
        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 }
@@ -1387,8 +1386,7 @@ handle_newline:
                        put_tty_queue(c, ldata);
                        ldata->canon_head = ldata->read_head;
                        kill_fasync(&tty->fasync, SIGIO, POLL_IN);
-                       if (waitqueue_active(&tty->read_wait))
-                               wake_up_interruptible(&tty->read_wait);
+                       wake_up_interruptible(&tty->read_wait);
                        return 0;
                }
        }
@@ -1671,8 +1669,7 @@ static void __receive_buf(struct tty_struct *tty, const 
unsigned char *cp,
        if ((!ldata->icanon && (read_cnt(ldata) >= ldata->minimum_to_wake)) ||
                L_EXTPROC(tty)) {
                kill_fasync(&tty->fasync, SIGIO, POLL_IN);
-               if (waitqueue_active(&tty->read_wait))
-                       wake_up_interruptible(&tty->read_wait);
+               wake_up_interruptible(&tty->read_wait);
        }
 }
 
@@ -1891,10 +1888,8 @@ static void n_tty_set_termios(struct tty_struct *tty, 
struct ktermios *old)
        }
 
        /* The termios change make the tty ready for I/O */
-       if (waitqueue_active(&tty->write_wait))
-               wake_up_interruptible(&tty->write_wait);
-       if (waitqueue_active(&tty->read_wait))
-               wake_up_interruptible(&tty->read_wait);
+       wake_up_interruptible(&tty->write_wait);
+       wake_up_interruptible(&tty->read_wait);
 }
 
 /**
diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
index 22e15cab8ea5..8de069abd15e 100644
--- a/drivers/usb/host/ehci-orion.c
+++ b/drivers/usb/host/ehci-orion.c
@@ -226,7 +226,8 @@ static int ehci_orion_drv_probe(struct platform_device 
*pdev)
        priv->phy = devm_phy_optional_get(&pdev->dev, "usb");
        if (IS_ERR(priv->phy)) {
                err = PTR_ERR(priv->phy);
-               goto err_phy_get;
+               if (err != -ENOSYS)
+                       goto err_phy_get;
        } else {
                err = phy_init(priv->phy);
                if (err)
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index ebcec8cda858..f49d262e926b 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -153,6 +153,8 @@ static const struct usb_device_id id_table[] = {
        {DEVICE_SWI(0x1199, 0x9056)},   /* Sierra Wireless Modem */
        {DEVICE_SWI(0x1199, 0x9060)},   /* Sierra Wireless Modem */
        {DEVICE_SWI(0x1199, 0x9061)},   /* Sierra Wireless Modem */
+       {DEVICE_SWI(0x1199, 0x9070)},   /* Sierra Wireless MC74xx/EM74xx */
+       {DEVICE_SWI(0x1199, 0x9071)},   /* Sierra Wireless MC74xx/EM74xx */
        {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE 
Mobile Broadband Card */
        {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) 
Mobile Broadband Card */
        {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) 
Mobile Broadband Card */
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index c13a138c1016..57464b34d153 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -683,16 +683,16 @@ static int load_elf_binary(struct linux_binprm *bprm)
                         */
                        would_dump(bprm, interpreter);
 
-                       retval = kernel_read(interpreter, 0, bprm->buf,
-                                            BINPRM_BUF_SIZE);
-                       if (retval != BINPRM_BUF_SIZE) {
+                       /* Get the exec headers */
+                       retval = kernel_read(interpreter, 0,
+                                            (void *)&loc->interp_elf_ex,
+                                            sizeof(loc->interp_elf_ex));
+                       if (retval != sizeof(loc->interp_elf_ex)) {
                                if (retval >= 0)
                                        retval = -EIO;
                                goto out_free_dentry;
                        }
 
-                       /* Get the exec headers */
-                       loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
                        break;
                }
                elf_ppnt++;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 39aa46612541..7a71c7885835 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -760,8 +760,16 @@ next_slot:
                }
 
                btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
-               if (key.objectid > ino ||
-                   key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end)
+
+               if (key.objectid > ino)
+                       break;
+               if (WARN_ON_ONCE(key.objectid < ino) ||
+                   key.type < BTRFS_EXTENT_DATA_KEY) {
+                       ASSERT(del_nr == 0);
+                       path->slots[0]++;
+                       goto next_slot;
+               }
+               if (key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end)
                        break;
 
                fi = btrfs_item_ptr(leaf, path->slots[0],
@@ -780,8 +788,8 @@ next_slot:
                                btrfs_file_extent_inline_len(leaf,
                                                     path->slots[0], fi);
                } else {
-                       WARN_ON(1);
-                       extent_end = search_start;
+                       /* can't happen */
+                       BUG();
                }
 
                /*
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 89c876aabe24..ba556d752858 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1247,8 +1247,14 @@ next_slot:
                num_bytes = 0;
                btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]);
 
-               if (found_key.objectid > ino ||
-                   found_key.type > BTRFS_EXTENT_DATA_KEY ||
+               if (found_key.objectid > ino)
+                       break;
+               if (WARN_ON_ONCE(found_key.objectid < ino) ||
+                   found_key.type < BTRFS_EXTENT_DATA_KEY) {
+                       path->slots[0]++;
+                       goto next_slot;
+               }
+               if (found_key.type > BTRFS_EXTENT_DATA_KEY ||
                    found_key.offset > end)
                        break;
 
@@ -3993,6 +3999,47 @@ out:
        return err;
 }
 
+static int truncate_inline_extent(struct inode *inode,
+                                 struct btrfs_path *path,
+                                 struct btrfs_key *found_key,
+                                 const u64 item_end,
+                                 const u64 new_size)
+{
+       struct extent_buffer *leaf = path->nodes[0];
+       int slot = path->slots[0];
+       struct btrfs_file_extent_item *fi;
+       u32 size = (u32)(new_size - found_key->offset);
+       struct btrfs_root *root = BTRFS_I(inode)->root;
+
+       fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
+
+       if (btrfs_file_extent_compression(leaf, fi) != BTRFS_COMPRESS_NONE) {
+               loff_t offset = new_size;
+               loff_t page_end = ALIGN(offset, PAGE_CACHE_SIZE);
+
+               /*
+                * Zero out the remaining of the last page of our inline extent,
+                * instead of directly truncating our inline extent here - that
+                * would be much more complex (decompressing all the data, then
+                * compressing the truncated data, which might be bigger than
+                * the size of the inline extent, resize the extent, etc).
+                * We release the path because to get the page we might need to
+                * read the extent item from disk (data not in the page cache).
+                */
+               btrfs_release_path(path);
+               return btrfs_truncate_page(inode, offset, page_end - offset, 0);
+       }
+
+       btrfs_set_file_extent_ram_bytes(leaf, fi, size);
+       size = btrfs_file_extent_calc_inline_size(size);
+       btrfs_truncate_item(root, path, size, 1);
+
+       if (test_bit(BTRFS_ROOT_REF_COWS, &root->state))
+               inode_sub_bytes(inode, item_end + 1 - new_size);
+
+       return 0;
+}
+
 /*
  * this can truncate away extent items, csum items and directory items.
  * It starts at a high offset and removes keys until it can't find
@@ -4162,27 +4209,40 @@ search_again:
                         * special encodings
                         */
                        if (!del_item &&
-                           btrfs_file_extent_compression(leaf, fi) == 0 &&
                            btrfs_file_extent_encryption(leaf, fi) == 0 &&
                            btrfs_file_extent_other_encoding(leaf, fi) == 0) {
-                               u32 size = new_size - found_key.offset;
-
-                               if (test_bit(BTRFS_ROOT_REF_COWS, &root->state))
-                                       inode_sub_bytes(inode, item_end + 1 -
-                                                       new_size);
 
                                /*
-                                * update the ram bytes to properly reflect
-                                * the new size of our item
+                                * Need to release path in order to truncate a
+                                * compressed extent. So delete any accumulated
+                                * extent items so far.
                                 */
-                               btrfs_set_file_extent_ram_bytes(leaf, fi, size);
-                               size =
-                                   btrfs_file_extent_calc_inline_size(size);
-                               btrfs_truncate_item(root, path, size, 1);
+                               if (btrfs_file_extent_compression(leaf, fi) !=
+                                   BTRFS_COMPRESS_NONE && pending_del_nr) {
+                                       err = btrfs_del_items(trans, root, path,
+                                                             pending_del_slot,
+                                                             pending_del_nr);
+                                       if (err) {
+                                               btrfs_abort_transaction(trans,
+                                                                       root,
+                                                                       err);
+                                               goto error;
+                                       }
+                                       pending_del_nr = 0;
+                               }
+
+                               err = truncate_inline_extent(inode, path,
+                                                            &found_key,
+                                                            item_end,
+                                                            new_size);
+                               if (err) {
+                                       btrfs_abort_transaction(trans,
+                                                               root, err);
+                                       goto error;
+                               }
                        } else if (test_bit(BTRFS_ROOT_REF_COWS,
                                            &root->state)) {
-                               inode_sub_bytes(inode, item_end + 1 -
-                                               found_key.offset);
+                               inode_sub_bytes(inode, item_end + 1 - new_size);
                        }
                }
 delete:
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 0b5f9183362c..d0733078e5c5 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3205,6 +3205,150 @@ static void clone_update_extent_map(struct inode *inode,
                        &BTRFS_I(inode)->runtime_flags);
 }
 
+/*
+ * Make sure we do not end up inserting an inline extent into a file that has
+ * already other (non-inline) extents. If a file has an inline extent it can
+ * not have any other extents and the (single) inline extent must start at the
+ * file offset 0. Failing to respect these rules will lead to file corruption,
+ * resulting in EIO errors on read/write operations, hitting BUG_ON's in mm, 
etc
+ *
+ * We can have extents that have been already written to disk or we can have
+ * dirty ranges still in delalloc, in which case the extent maps and items are
+ * created only when we run delalloc, and the delalloc ranges might fall 
outside
+ * the range we are currently locking in the inode's io tree. So we check the
+ * inode's i_size because of that (i_size updates are done while holding the
+ * i_mutex, which we are holding here).
+ * We also check to see if the inode has a size not greater than "datal" but 
has
+ * extents beyond it, due to an fallocate with FALLOC_FL_KEEP_SIZE (and we are
+ * protected against such concurrent fallocate calls by the i_mutex).
+ *
+ * If the file has no extents but a size greater than datal, do not allow the
+ * copy because we would need turn the inline extent into a non-inline one 
(even
+ * with NO_HOLES enabled). If we find our destination inode only has one inline
+ * extent, just overwrite it with the source inline extent if its size is less
+ * than the source extent's size, or we could copy the source inline extent's
+ * data into the destination inode's inline extent if the later is greater then
+ * the former.
+ */
+static int clone_copy_inline_extent(struct inode *src,
+                                   struct inode *dst,
+                                   struct btrfs_trans_handle *trans,
+                                   struct btrfs_path *path,
+                                   struct btrfs_key *new_key,
+                                   const u64 drop_start,
+                                   const u64 datal,
+                                   const u64 skip,
+                                   const u64 size,
+                                   char *inline_data)
+{
+       struct btrfs_root *root = BTRFS_I(dst)->root;
+       const u64 aligned_end = ALIGN(new_key->offset + datal,
+                                     root->sectorsize);
+       int ret;
+       struct btrfs_key key;
+
+       if (new_key->offset > 0)
+               return -EOPNOTSUPP;
+
+       key.objectid = btrfs_ino(dst);
+       key.type = BTRFS_EXTENT_DATA_KEY;
+       key.offset = 0;
+       ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+       if (ret < 0) {
+               return ret;
+       } else if (ret > 0) {
+               if (path->slots[0] >= btrfs_header_nritems(path->nodes[0])) {
+                       ret = btrfs_next_leaf(root, path);
+                       if (ret < 0)
+                               return ret;
+                       else if (ret > 0)
+                               goto copy_inline_extent;
+               }
+               btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
+               if (key.objectid == btrfs_ino(dst) &&
+                   key.type == BTRFS_EXTENT_DATA_KEY) {
+                       ASSERT(key.offset > 0);
+                       return -EOPNOTSUPP;
+               }
+       } else if (i_size_read(dst) <= datal) {
+               struct btrfs_file_extent_item *ei;
+               u64 ext_len;
+
+               /*
+                * If the file size is <= datal, make sure there are no other
+                * extents following (can happen do to an fallocate call with
+                * the flag FALLOC_FL_KEEP_SIZE).
+                */
+               ei = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                   struct btrfs_file_extent_item);
+               /*
+                * If it's an inline extent, it can not have other extents
+                * following it.
+                */
+               if (btrfs_file_extent_type(path->nodes[0], ei) ==
+                   BTRFS_FILE_EXTENT_INLINE)
+                       goto copy_inline_extent;
+
+               ext_len = btrfs_file_extent_num_bytes(path->nodes[0], ei);
+               if (ext_len > aligned_end)
+                       return -EOPNOTSUPP;
+
+               ret = btrfs_next_item(root, path);
+               if (ret < 0) {
+                       return ret;
+               } else if (ret == 0) {
+                       btrfs_item_key_to_cpu(path->nodes[0], &key,
+                                             path->slots[0]);
+                       if (key.objectid == btrfs_ino(dst) &&
+                           key.type == BTRFS_EXTENT_DATA_KEY)
+                               return -EOPNOTSUPP;
+               }
+       }
+
+copy_inline_extent:
+       /*
+        * We have no extent items, or we have an extent at offset 0 which may
+        * or may not be inlined. All these cases are dealt the same way.
+        */
+       if (i_size_read(dst) > datal) {
+               /*
+                * If the destination inode has an inline extent...
+                * This would require copying the data from the source inline
+                * extent into the beginning of the destination's inline extent.
+                * But this is really complex, both extents can be compressed
+                * or just one of them, which would require decompressing and
+                * re-compressing data (which could increase the new compressed
+                * size, not allowing the compressed data to fit anymore in an
+                * inline extent).
+                * So just don't support this case for now (it should be rare,
+                * we are not really saving space when cloning inline extents).
+                */
+               return -EOPNOTSUPP;
+       }
+
+       btrfs_release_path(path);
+       ret = btrfs_drop_extents(trans, root, dst, drop_start, aligned_end, 1);
+       if (ret)
+               return ret;
+       ret = btrfs_insert_empty_item(trans, root, path, new_key, size);
+       if (ret)
+               return ret;
+
+       if (skip) {
+               const u32 start = btrfs_file_extent_calc_inline_size(0);
+
+               memmove(inline_data + start, inline_data + start + skip, datal);
+       }
+
+       write_extent_buffer(path->nodes[0], inline_data,
+                           btrfs_item_ptr_offset(path->nodes[0],
+                                                 path->slots[0]),
+                           size);
+       inode_add_bytes(dst, datal);
+
+       return 0;
+}
+
 /**
  * btrfs_clone() - clone a range from inode file to another
  *
@@ -3469,21 +3613,6 @@ process_slot:
                        } else if (type == BTRFS_FILE_EXTENT_INLINE) {
                                u64 skip = 0;
                                u64 trim = 0;
-                               u64 aligned_end = 0;
-
-                               /*
-                                * Don't copy an inline extent into an offset
-                                * greater than zero. Having an inline extent
-                                * at such an offset results in chaos as btrfs
-                                * isn't prepared for such cases. Just skip
-                                * this case for the same reasons as commented
-                                * at btrfs_ioctl_clone().
-                                */
-                               if (last_dest_end > 0) {
-                                       ret = -EOPNOTSUPP;
-                                       btrfs_end_transaction(trans, root);
-                                       goto out;
-                               }
 
                                if (off > key.offset) {
                                        skip = off - key.offset;
@@ -3501,42 +3630,22 @@ process_slot:
                                size -= skip + trim;
                                datal -= skip + trim;
 
-                               aligned_end = ALIGN(new_key.offset + datal,
-                                                   root->sectorsize);
-                               ret = btrfs_drop_extents(trans, root, inode,
-                                                        drop_start,
-                                                        aligned_end,
-                                                        1);
+                               ret = clone_copy_inline_extent(src, inode,
+                                                              trans, path,
+                                                              &new_key,
+                                                              drop_start,
+                                                              datal,
+                                                              skip, size, buf);
                                if (ret) {
                                        if (ret != -EOPNOTSUPP)
                                                btrfs_abort_transaction(trans,
-                                                       root, ret);
-                                       btrfs_end_transaction(trans, root);
-                                       goto out;
-                               }
-
-                               ret = btrfs_insert_empty_item(trans, root, path,
-                                                             &new_key, size);
-                               if (ret) {
-                                       btrfs_abort_transaction(trans, root,
-                                                               ret);
+                                                                       root,
+                                                                       ret);
                                        btrfs_end_transaction(trans, root);
                                        goto out;
                                }
-
-                               if (skip) {
-                                       u32 start =
-                                         btrfs_file_extent_calc_inline_size(0);
-                                       memmove(buf+start, buf+start+skip,
-                                               datal);
-                               }
-
                                leaf = path->nodes[0];
                                slot = path->slots[0];
-                               write_extent_buffer(leaf, buf,
-                                           btrfs_item_ptr_offset(leaf, slot),
-                                           size);
-                               inode_add_bytes(inode, datal);
                        }
 
                        /* If we have an implicit hole (NO_HOLES feature). */
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index 618e86ceede7..ef136a553e6f 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -309,8 +309,10 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char 
*buffer, size_t size)
                /* check to make sure this item is what we want */
                if (found_key.objectid != key.objectid)
                        break;
-               if (btrfs_key_type(&found_key) != BTRFS_XATTR_ITEM_KEY)
+               if (found_key.type > BTRFS_XATTR_ITEM_KEY)
                        break;
+               if (found_key.type < BTRFS_XATTR_ITEM_KEY)
+                       goto next;
 
                di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
                if (verify_dir_item(root, leaf, di))
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 4b1fb5ca65b8..88483abe08d3 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -912,6 +912,15 @@ int cachefiles_write_page(struct fscache_storage *op, 
struct page *page)
        cache = container_of(object->fscache.cache,
                             struct cachefiles_cache, cache);
 
+       pos = (loff_t)page->index << PAGE_SHIFT;
+
+       /* We mustn't write more data than we have, so we have to beware of a
+        * partial page at EOF.
+        */
+       eof = object->fscache.store_limit_l;
+       if (pos >= eof)
+               goto error;
+
        /* write the page to the backing filesystem and let it store it in its
         * own time */
        path.mnt = cache->mnt;
@@ -919,49 +928,43 @@ int cachefiles_write_page(struct fscache_storage *op, 
struct page *page)
        file = dentry_open(&path, O_RDWR | O_LARGEFILE, cache->cache_cred);
        if (IS_ERR(file)) {
                ret = PTR_ERR(file);
-       } else {
-               ret = -EIO;
-               if (file->f_op->write) {
-                       pos = (loff_t) page->index << PAGE_SHIFT;
-
-                       /* we mustn't write more data than we have, so we have
-                        * to beware of a partial page at EOF */
-                       eof = object->fscache.store_limit_l;
-                       len = PAGE_SIZE;
-                       if (eof & ~PAGE_MASK) {
-                               ASSERTCMP(pos, <, eof);
-                               if (eof - pos < PAGE_SIZE) {
-                                       _debug("cut short %llx to %llx",
-                                              pos, eof);
-                                       len = eof - pos;
-                                       ASSERTCMP(pos + len, ==, eof);
-                               }
-                       }
+               goto error_2;
+       }
 
-                       data = kmap(page);
-                       file_start_write(file);
-                       old_fs = get_fs();
-                       set_fs(KERNEL_DS);
-                       ret = file->f_op->write(
-                               file, (const void __user *) data, len, &pos);
-                       set_fs(old_fs);
-                       kunmap(page);
-                       file_end_write(file);
-                       if (ret != len)
-                               ret = -EIO;
+       len = PAGE_SIZE;
+       if (eof & ~PAGE_MASK) {
+               if (eof - pos < PAGE_SIZE) {
+                       _debug("cut short %llx to %llx",
+                              pos, eof);
+                       len = eof - pos;
+                       ASSERTCMP(pos + len, ==, eof);
                }
-               fput(file);
        }
 
-       if (ret < 0) {
-               if (ret == -EIO)
-                       cachefiles_io_error_obj(
-                               object, "Write page to backing file failed");
-               ret = -ENOBUFS;
-       }
+       data = kmap(page);
+       file_start_write(file);
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+       ret = file->f_op->write(
+               file, (const void __user *) data, len, &pos);
+       set_fs(old_fs);
+       kunmap(page);
+       fput(file);
+       if (ret != len)
+               goto error_eio;
+
+       _leave(" = 0");
+       return 0;
 
-       _leave(" = %d", ret);
-       return ret;
+error_eio:
+       ret = -EIO;
+error_2:
+       if (ret == -EIO)
+               cachefiles_io_error_obj(object,
+                                       "Write page to backing file failed");
+error:
+       _leave(" = -ENOBUFS [%d]", ret);
+       return -ENOBUFS;
 }
 
 /*
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 92a2548278fc..63f2bc82f4af 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1786,7 +1786,7 @@ static struct ceph_msg *create_request_message(struct 
ceph_mds_client *mdsc,
 
        len = sizeof(*head) +
                pathlen1 + pathlen2 + 2*(1 + sizeof(u32) + sizeof(u64)) +
-               sizeof(struct timespec);
+               sizeof(struct ceph_timespec);
 
        /* calculate (max) length for cap releases */
        len += sizeof(struct ceph_mds_request_release) *
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index 44c89188c62c..23349f00e77c 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -88,13 +88,13 @@ int __ext4_journal_stop(const char *where, unsigned int 
line, handle_t *handle)
                return 0;
        }
 
+       err = handle->h_err;
        if (!handle->h_transaction) {
-               err = jbd2_journal_stop(handle);
-               return handle->h_err ? handle->h_err : err;
+               rc = jbd2_journal_stop(handle);
+               return err ? err : rc;
        }
 
        sb = handle->h_transaction->t_journal->j_private;
-       err = handle->h_err;
        rc = jbd2_journal_stop(handle);
 
        if (!err)
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index ca4588388fc3..dd4f37e2f18f 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1040,7 +1040,7 @@ exit_free:
  * do not copy the full number of backups at this time.  The resize
  * which changed s_groups_count will backup again.
  */
-static void update_backups(struct super_block *sb, int blk_off, char *data,
+static void update_backups(struct super_block *sb, sector_t blk_off, char 
*data,
                           int size, int meta_bg)
 {
        struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -1065,7 +1065,7 @@ static void update_backups(struct super_block *sb, int 
blk_off, char *data,
                group = ext4_list_backups(sb, &three, &five, &seven);
                last = sbi->s_groups_count;
        } else {
-               group = ext4_meta_bg_first_group(sb, group) + 1;
+               group = ext4_get_group_number(sb, blk_off) + 1;
                last = (ext4_group_t)(group + EXT4_DESC_PER_BLOCK(sb) - 2);
        }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index a8f6f6a358ce..9b9168705e16 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -405,9 +405,13 @@ static void ext4_handle_error(struct super_block *sb)
                smp_wmb();
                sb->s_flags |= MS_RDONLY;
        }
-       if (test_opt(sb, ERRORS_PANIC))
+       if (test_opt(sb, ERRORS_PANIC)) {
+               if (EXT4_SB(sb)->s_journal &&
+                 !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
+                       return;
                panic("EXT4-fs (device %s): panic forced after error\n",
                        sb->s_id);
+       }
 }
 
 #define ext4_error_ratelimit(sb)                                       \
@@ -596,8 +600,12 @@ void __ext4_abort(struct super_block *sb, const char 
*function,
                        jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
                save_error_info(sb, function, line);
        }
-       if (test_opt(sb, ERRORS_PANIC))
+       if (test_opt(sb, ERRORS_PANIC)) {
+               if (EXT4_SB(sb)->s_journal &&
+                 !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
+                       return;
                panic("EXT4-fs panic from previous error\n");
+       }
 }
 
 void __ext4_msg(struct super_block *sb,
diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
index 6d941f56faf4..9b28649df3a1 100644
--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -22,6 +22,7 @@ static LIST_HEAD(fscache_netfs_list);
 int __fscache_register_netfs(struct fscache_netfs *netfs)
 {
        struct fscache_netfs *ptr;
+       struct fscache_cookie *cookie;
        int ret;
 
        _enter("{%s}", netfs->name);
@@ -29,29 +30,25 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
        INIT_LIST_HEAD(&netfs->link);
 
        /* allocate a cookie for the primary index */
-       netfs->primary_index =
-               kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);
+       cookie = kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);
 
-       if (!netfs->primary_index) {
+       if (!cookie) {
                _leave(" = -ENOMEM");
                return -ENOMEM;
        }
 
        /* initialise the primary index cookie */
-       atomic_set(&netfs->primary_index->usage, 1);
-       atomic_set(&netfs->primary_index->n_children, 0);
-       atomic_set(&netfs->primary_index->n_active, 1);
+       atomic_set(&cookie->usage, 1);
+       atomic_set(&cookie->n_children, 0);
+       atomic_set(&cookie->n_active, 1);
 
-       netfs->primary_index->def               = &fscache_fsdef_netfs_def;
-       netfs->primary_index->parent            = &fscache_fsdef_index;
-       netfs->primary_index->netfs_data        = netfs;
-       netfs->primary_index->flags             = 1 << FSCACHE_COOKIE_ENABLED;
+       cookie->def             = &fscache_fsdef_netfs_def;
+       cookie->parent          = &fscache_fsdef_index;
+       cookie->netfs_data      = netfs;
+       cookie->flags           = 1 << FSCACHE_COOKIE_ENABLED;
 
-       atomic_inc(&netfs->primary_index->parent->usage);
-       atomic_inc(&netfs->primary_index->parent->n_children);
-
-       spin_lock_init(&netfs->primary_index->lock);
-       INIT_HLIST_HEAD(&netfs->primary_index->backing_objects);
+       spin_lock_init(&cookie->lock);
+       INIT_HLIST_HEAD(&cookie->backing_objects);
 
        /* check the netfs type is not already present */
        down_write(&fscache_addremove_sem);
@@ -62,6 +59,10 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
                        goto already_registered;
        }
 
+       atomic_inc(&cookie->parent->usage);
+       atomic_inc(&cookie->parent->n_children);
+
+       netfs->primary_index = cookie;
        list_add(&netfs->link, &fscache_netfs_list);
        ret = 0;
 
@@ -70,11 +71,8 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
 already_registered:
        up_write(&fscache_addremove_sem);
 
-       if (ret < 0) {
-               netfs->primary_index->parent = NULL;
-               __fscache_cookie_put(netfs->primary_index);
-               netfs->primary_index = NULL;
-       }
+       if (ret < 0)
+               kmem_cache_free(fscache_cookie_jar, cookie);
 
        _leave(" = %d", ret);
        return ret;
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index ed70714503fa..e387cc646868 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -801,7 +801,7 @@ static void fscache_write_op(struct fscache_operation *_op)
                goto superseded;
        page = results[0];
        _debug("gang %d [%lx]", n, page->index);
-       if (page->index > op->store_limit) {
+       if (page->index >= op->store_limit) {
                fscache_stat(&fscache_n_store_pages_over_limit);
                goto superseded;
        }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 8c649c3f0a80..39c3c2c64740 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2088,8 +2088,12 @@ static void __journal_abort_soft (journal_t *journal, 
int errno)
 
        __jbd2_journal_abort_hard(journal);
 
-       if (errno)
+       if (errno) {
                jbd2_journal_update_sb_errno(journal);
+               write_lock(&journal->j_state_lock);
+               journal->j_flags |= JBD2_REC_ERR;
+               write_unlock(&journal->j_state_lock);
+       }
 }
 
 /**
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 969d589c848d..b5f3c3ab0d5f 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -116,7 +116,7 @@ static struct nlm_host *nlm_alloc_host(struct 
nlm_lookup_host_info *ni,
                atomic_inc(&nsm->sm_count);
        else {
                host = NULL;
-               nsm = nsm_get_handle(ni->sap, ni->salen,
+               nsm = nsm_get_handle(ni->net, ni->sap, ni->salen,
                                        ni->hostname, ni->hostname_len);
                if (unlikely(nsm == NULL)) {
                        dprintk("lockd: %s failed; no nsm handle\n",
@@ -534,17 +534,18 @@ static struct nlm_host *next_host_state(struct hlist_head 
*cache,
 
 /**
  * nlm_host_rebooted - Release all resources held by rebooted host
+ * @net:  network namespace
  * @info: pointer to decoded results of NLM_SM_NOTIFY call
  *
  * We were notified that the specified host has rebooted.  Release
  * all resources held by that peer.
  */
-void nlm_host_rebooted(const struct nlm_reboot *info)
+void nlm_host_rebooted(const struct net *net, const struct nlm_reboot *info)
 {
        struct nsm_handle *nsm;
        struct nlm_host *host;
 
-       nsm = nsm_reboot_lookup(info);
+       nsm = nsm_reboot_lookup(net, info);
        if (unlikely(nsm == NULL))
                return;
 
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index 6ae664b489af..13fac49aff7f 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -51,7 +51,6 @@ struct nsm_res {
 };
 
 static const struct rpc_program        nsm_program;
-static                         LIST_HEAD(nsm_handles);
 static                         DEFINE_SPINLOCK(nsm_lock);
 
 /*
@@ -259,33 +258,35 @@ void nsm_unmonitor(const struct nlm_host *host)
        }
 }
 
-static struct nsm_handle *nsm_lookup_hostname(const char *hostname,
-                                             const size_t len)
+static struct nsm_handle *nsm_lookup_hostname(const struct list_head 
*nsm_handles,
+                                       const char *hostname, const size_t len)
 {
        struct nsm_handle *nsm;
 
-       list_for_each_entry(nsm, &nsm_handles, sm_link)
+       list_for_each_entry(nsm, nsm_handles, sm_link)
                if (strlen(nsm->sm_name) == len &&
                    memcmp(nsm->sm_name, hostname, len) == 0)
                        return nsm;
        return NULL;
 }
 
-static struct nsm_handle *nsm_lookup_addr(const struct sockaddr *sap)
+static struct nsm_handle *nsm_lookup_addr(const struct list_head *nsm_handles,
+                                       const struct sockaddr *sap)
 {
        struct nsm_handle *nsm;
 
-       list_for_each_entry(nsm, &nsm_handles, sm_link)
+       list_for_each_entry(nsm, nsm_handles, sm_link)
                if (rpc_cmp_addr(nsm_addr(nsm), sap))
                        return nsm;
        return NULL;
 }
 
-static struct nsm_handle *nsm_lookup_priv(const struct nsm_private *priv)
+static struct nsm_handle *nsm_lookup_priv(const struct list_head *nsm_handles,
+                                       const struct nsm_private *priv)
 {
        struct nsm_handle *nsm;
 
-       list_for_each_entry(nsm, &nsm_handles, sm_link)
+       list_for_each_entry(nsm, nsm_handles, sm_link)
                if (memcmp(nsm->sm_priv.data, priv->data,
                                        sizeof(priv->data)) == 0)
                        return nsm;
@@ -350,6 +351,7 @@ static struct nsm_handle *nsm_create_handle(const struct 
sockaddr *sap,
 
 /**
  * nsm_get_handle - Find or create a cached nsm_handle
+ * @net: network namespace
  * @sap: pointer to socket address of handle to find
  * @salen: length of socket address
  * @hostname: pointer to C string containing hostname to find
@@ -362,11 +364,13 @@ static struct nsm_handle *nsm_create_handle(const struct 
sockaddr *sap,
  * @hostname cannot be found in the handle cache.  Returns NULL if
  * an error occurs.
  */
-struct nsm_handle *nsm_get_handle(const struct sockaddr *sap,
+struct nsm_handle *nsm_get_handle(const struct net *net,
+                                 const struct sockaddr *sap,
                                  const size_t salen, const char *hostname,
                                  const size_t hostname_len)
 {
        struct nsm_handle *cached, *new = NULL;
+       struct lockd_net *ln = net_generic(net, lockd_net_id);
 
        if (hostname && memchr(hostname, '/', hostname_len) != NULL) {
                if (printk_ratelimit()) {
@@ -381,9 +385,10 @@ retry:
        spin_lock(&nsm_lock);
 
        if (nsm_use_hostnames && hostname != NULL)
-               cached = nsm_lookup_hostname(hostname, hostname_len);
+               cached = nsm_lookup_hostname(&ln->nsm_handles,
+                                       hostname, hostname_len);
        else
-               cached = nsm_lookup_addr(sap);
+               cached = nsm_lookup_addr(&ln->nsm_handles, sap);
 
        if (cached != NULL) {
                atomic_inc(&cached->sm_count);
@@ -397,7 +402,7 @@ retry:
        }
 
        if (new != NULL) {
-               list_add(&new->sm_link, &nsm_handles);
+               list_add(&new->sm_link, &ln->nsm_handles);
                spin_unlock(&nsm_lock);
                dprintk("lockd: created nsm_handle for %s (%s)\n",
                                new->sm_name, new->sm_addrbuf);
@@ -414,19 +419,22 @@ retry:
 
 /**
  * nsm_reboot_lookup - match NLMPROC_SM_NOTIFY arguments to an nsm_handle
+ * @net:  network namespace
  * @info: pointer to NLMPROC_SM_NOTIFY arguments
  *
  * Returns a matching nsm_handle if found in the nsm cache. The returned
  * nsm_handle's reference count is bumped. Otherwise returns NULL if some
  * error occurred.
  */
-struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info)
+struct nsm_handle *nsm_reboot_lookup(const struct net *net,
+                               const struct nlm_reboot *info)
 {
        struct nsm_handle *cached;
+       struct lockd_net *ln = net_generic(net, lockd_net_id);
 
        spin_lock(&nsm_lock);
 
-       cached = nsm_lookup_priv(&info->priv);
+       cached = nsm_lookup_priv(&ln->nsm_handles, &info->priv);
        if (unlikely(cached == NULL)) {
                spin_unlock(&nsm_lock);
                dprintk("lockd: never saw rebooted peer '%.*s' before\n",
diff --git a/fs/lockd/netns.h b/fs/lockd/netns.h
index 5010b55628b4..414da99744e9 100644
--- a/fs/lockd/netns.h
+++ b/fs/lockd/netns.h
@@ -16,6 +16,7 @@ struct lockd_net {
        spinlock_t nsm_clnt_lock;
        unsigned int nsm_users;
        struct rpc_clnt *nsm_clnt;
+       struct list_head nsm_handles;
 };
 
 extern int lockd_net_id;
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 3f5a7248e771..e9e47aad47f9 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -583,6 +583,7 @@ static int lockd_init_net(struct net *net)
        INIT_DELAYED_WORK(&ln->grace_period_end, grace_ender);
        INIT_LIST_HEAD(&ln->grace_list);
        spin_lock_init(&ln->nsm_clnt_lock);
+       INIT_LIST_HEAD(&ln->nsm_handles);
        return 0;
 }
 
diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
index b147d1ae71fd..09c576f26c7b 100644
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -421,7 +421,7 @@ nlm4svc_proc_sm_notify(struct svc_rqst *rqstp, struct 
nlm_reboot *argp,
                return rpc_system_err;
        }
 
-       nlm_host_rebooted(argp);
+       nlm_host_rebooted(SVC_NET(rqstp), argp);
        return rpc_success;
 }
 
diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
index 21171f0c6477..fb26b9f522e7 100644
--- a/fs/lockd/svcproc.c
+++ b/fs/lockd/svcproc.c
@@ -464,7 +464,7 @@ nlmsvc_proc_sm_notify(struct svc_rqst *rqstp, struct 
nlm_reboot *argp,
                return rpc_system_err;
        }
 
-       nlm_host_rebooted(argp);
+       nlm_host_rebooted(SVC_NET(rqstp), argp);
        return rpc_success;
 }
 
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 46d876487795..577bb8d849f7 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1482,7 +1482,7 @@ restart:
                                        spin_unlock(&state->state_lock);
                                }
                                nfs4_put_open_state(state);
-                               clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
+                               clear_bit(NFS_STATE_RECLAIM_NOGRACE,
                                        &state->flags);
                                spin_lock(&sp->so_lock);
                                goto restart;
diff --git a/fs/pipe.c b/fs/pipe.c
index 21981e58e2a6..6c856a155530 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -367,18 +367,17 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
                int offset = buf->offset + buf->len;
 
                if (ops->can_merge && offset + chars <= PAGE_SIZE) {
-                       int error = ops->confirm(pipe, buf);
-                       if (error)
+                       ret = ops->confirm(pipe, buf);
+                       if (ret)
                                goto out;
 
                        ret = copy_page_from_iter(buf->page, offset, chars, 
from);
                        if (unlikely(ret < chars)) {
-                               error = -EFAULT;
+                               ret = -EFAULT;
                                goto out;
                        }
                        do_wakeup = 1;
-                       buf->len += chars;
-                       ret = chars;
+                       buf->len += ret;
                        if (!iov_iter_count(from))
                                goto out;
                }
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 3e1290b0492e..98f368b7c857 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -371,7 +371,7 @@ int proc_pid_status(struct seq_file *m, struct 
pid_namespace *ns,
 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                        struct pid *pid, struct task_struct *task, int whole)
 {
-       unsigned long vsize, eip, esp, wchan = ~0UL;
+       unsigned long vsize, eip, esp, wchan = 0;
        int priority, nice;
        int tty_pgrp = -1, tty_nr = 0;
        sigset_t sigign, sigcatch;
@@ -508,7 +508,19 @@ static int do_task_stat(struct seq_file *m, struct 
pid_namespace *ns,
        seq_put_decimal_ull(m, ' ', task->blocked.sig[0] & 0x7fffffffUL);
        seq_put_decimal_ull(m, ' ', sigign.sig[0] & 0x7fffffffUL);
        seq_put_decimal_ull(m, ' ', sigcatch.sig[0] & 0x7fffffffUL);
-       seq_put_decimal_ull(m, ' ', wchan);
+
+       /*
+        * We used to output the absolute kernel address, but that's an
+        * information leak - so instead we show a 0/1 flag here, to signal
+        * to user-space whether there's a wchan field in /proc/PID/wchan.
+        *
+        * This works with older implementations of procps as well.
+        */
+       if (wchan)
+               seq_puts(m, " 1");
+       else
+               seq_puts(m, " 0");
+
        seq_put_decimal_ull(m, ' ', 0);
        seq_put_decimal_ull(m, ' ', 0);
        seq_put_decimal_ll(m, ' ', task->exit_signal);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 71d855747fe8..2d038a7e16a1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -236,13 +236,10 @@ static int proc_pid_wchan(struct task_struct *task, char 
*buffer)
 
        wchan = get_wchan(task);
 
-       if (lookup_symbol_name(wchan, symname) < 0)
-               if (!ptrace_may_access(task, PTRACE_MODE_READ))
-                       return 0;
-               else
-                       return sprintf(buffer, "%lu", wchan);
-       else
+       if (wchan && ptrace_may_access(task, PTRACE_MODE_READ) && 
!lookup_symbol_name(wchan, symname))
                return sprintf(buffer, "%s", symname);
+       else
+               return sprintf(buffer, "0");
 }
 #endif /* CONFIG_KALLSYMS */
 
diff --git a/fs/proc/fd.c b/fs/proc/fd.c
index 0788d093f5d8..f1073ea64b41 100644
--- a/fs/proc/fd.c
+++ b/fs/proc/fd.c
@@ -285,11 +285,19 @@ static struct dentry *proc_lookupfd(struct inode *dir, 
struct dentry *dentry,
  */
 int proc_fd_permission(struct inode *inode, int mask)
 {
-       int rv = generic_permission(inode, mask);
+       struct task_struct *p;
+       int rv;
+
+       rv = generic_permission(inode, mask);
        if (rv == 0)
-               return 0;
-       if (task_tgid(current) == proc_pid(inode))
+               return rv;
+
+       rcu_read_lock();
+       p = pid_task(proc_pid(inode), PIDTYPE_PID);
+       if (p && same_thread_group(p, current))
                rv = 0;
+       rcu_read_unlock();
+
        return rv;
 }
 
diff --git a/fs/splice.c b/fs/splice.c
index f5cb9ba84510..92acf7074d45 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1174,7 +1174,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct 
splice_desc *sd,
        long ret, bytes;
        umode_t i_mode;
        size_t len;
-       int i, flags;
+       int i, flags, more;
 
        /*
         * We require the input being a regular file, as we don't want to
@@ -1217,6 +1217,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct 
splice_desc *sd,
         * Don't block on output, we have to drain the direct pipe.
         */
        sd->flags &= ~SPLICE_F_NONBLOCK;
+       more = sd->flags & SPLICE_F_MORE;
 
        while (len) {
                size_t read_len;
@@ -1230,6 +1231,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct 
splice_desc *sd,
                sd->total_len = read_len;
 
                /*
+                * If more data is pending, set SPLICE_F_MORE
+                * If this is the last data and SPLICE_F_MORE was not set
+                * initially, clears it.
+                */
+               if (read_len < len)
+                       sd->flags |= SPLICE_F_MORE;
+               else if (!more)
+                       sd->flags &= ~SPLICE_F_MORE;
+               /*
                 * NOTE: nonblocking mode only applies to the input. We
                 * must not do the output in nonblocking mode as then we
                 * could get stuck data in the internal pipe:
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 3b18cb3d5307..7e52e670d6ad 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -151,6 +151,12 @@ int acpi_unregister_ioapic(acpi_handle handle, u32 
gsi_base);
 void acpi_irq_stats_init(void);
 extern u32 acpi_irq_handled;
 extern u32 acpi_irq_not_handled;
+extern unsigned int acpi_sci_irq;
+#define INVALID_ACPI_IRQ       ((unsigned)-1)
+static inline bool acpi_sci_irq_valid(void)
+{
+       return acpi_sci_irq != INVALID_ACPI_IRQ;
+}
 
 extern int sbf_port;
 extern unsigned long acpi_realmode_flags;
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 385593d748f6..e137e962834b 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1007,6 +1007,7 @@ struct journal_s
 #define JBD2_ABORT_ON_SYNCDATA_ERR     0x040   /* Abort the journal on file
                                                 * data write error in ordered
                                                 * mode */
+#define JBD2_REC_ERR   0x080   /* The errno in the sb has been recorded */
 
 /*
  * Function declarations for the journaling transaction and buffer
diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
index 219d79627c05..294e23c243c6 100644
--- a/include/linux/lockd/lockd.h
+++ b/include/linux/lockd/lockd.h
@@ -236,7 +236,8 @@ void                  nlm_rebind_host(struct nlm_host *);
 struct nlm_host * nlm_get_host(struct nlm_host *);
 void             nlm_shutdown_hosts(void);
 void             nlm_shutdown_hosts_net(struct net *net);
-void             nlm_host_rebooted(const struct nlm_reboot *);
+void             nlm_host_rebooted(const struct net *net,
+                                       const struct nlm_reboot *);
 
 /*
  * Host monitoring
@@ -244,11 +245,13 @@ void                nlm_host_rebooted(const struct 
nlm_reboot *);
 int              nsm_monitor(const struct nlm_host *host);
 void             nsm_unmonitor(const struct nlm_host *host);
 
-struct nsm_handle *nsm_get_handle(const struct sockaddr *sap,
+struct nsm_handle *nsm_get_handle(const struct net *net,
+                                       const struct sockaddr *sap,
                                        const size_t salen,
                                        const char *hostname,
                                        const size_t hostname_len);
-struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info);
+struct nsm_handle *nsm_reboot_lookup(const struct net *net,
+                                       const struct nlm_reboot *info);
 void             nsm_release(struct nsm_handle *nsm);
 
 /*
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index fe7994c48b75..fd1da045dabc 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -40,7 +40,8 @@ int inet_ctl_sock_create(struct sock **sk, unsigned short 
family,
 
 static inline void inet_ctl_sock_destroy(struct sock *sk)
 {
-       sk_release_kernel(sk);
+       if (sk)
+               sk_release_kernel(sk);
 }
 
 #endif
diff --git a/include/net/netfilter/nf_conntrack.h 
b/include/net/netfilter/nf_conntrack.h
index 37252f71a380..5c53572b5f0d 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -181,10 +181,6 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int 
nulls);
 
 void nf_ct_free_hashtable(void *hash, unsigned int size);
 
-struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(struct net *net, u16 zone,
-                   const struct nf_conntrack_tuple *tuple);
-
 int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 bool nf_ct_delete(struct nf_conn *ct, u32 pid, int report);
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b9305281ede8..259b9fdb6ba4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6032,6 +6032,10 @@ static int perf_tp_filter_match(struct perf_event *event,
 {
        void *record = data->raw->data;
 
+       /* only top level events have filters set */
+       if (event->parent)
+               event = event->parent;
+
        if (likely(!event->filter) || filter_match_preds(event->filter, record))
                return 1;
        return 0;
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index f7f6f7e5ff8a..5fa3f3b3b338 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -259,6 +259,9 @@ static u32 clear_idx;
 #define PREFIX_MAX             32
 #define LOG_LINE_MAX           1024 - PREFIX_MAX
 
+#define LOG_LEVEL(v)           ((v) & 0x07)
+#define LOG_FACILITY(v)                ((v) >> 3 & 0xff)
+
 /* record buffer */
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
 #define LOG_ALIGN 4
@@ -547,12 +550,13 @@ static ssize_t devkmsg_writev(struct kiocb *iocb, const 
struct iovec *iv,
        line = buf;
        if (line[0] == '<') {
                char *endp = NULL;
+               unsigned int u;
 
-               i = simple_strtoul(line+1, &endp, 10);
+               u = simple_strtoul(line + 1, &endp, 10);
                if (endp && endp[0] == '>') {
-                       level = i & 7;
-                       if (i >> 3)
-                               facility = i >> 3;
+                       level = LOG_LEVEL(u);
+                       if (LOG_FACILITY(u) != 0)
+                               facility = LOG_FACILITY(u);
                        endp++;
                        len -= endp - line;
                        line = endp;
diff --git a/lib/devres.c b/lib/devres.c
index f562bf6ff71d..eaa04de41e42 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -425,7 +425,7 @@ void pcim_iounmap_regions(struct pci_dev *pdev, int mask)
        if (!iomap)
                return;
 
-       for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+       for (i = 0; i < PCIM_IOMAP_MAX; i++) {
                if (!(mask & (1 << i)))
                        continue;
 
diff --git a/mm/slab.c b/mm/slab.c
index 9a8dc5470e5e..084985404fec 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -279,6 +279,7 @@ static void kmem_cache_node_init(struct kmem_cache_node 
*parent)
 
 #define CFLGS_OFF_SLAB         (0x80000000UL)
 #define        OFF_SLAB(x)     ((x)->flags & CFLGS_OFF_SLAB)
+#define OFF_SLAB_MIN_SIZE (max_t(size_t, PAGE_SIZE >> 5, KMALLOC_MIN_SIZE + 1))
 
 #define BATCHREFILL_LIMIT      16
 /*
@@ -2328,7 +2329,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned 
long flags)
         * it too early on. Always use on-slab management when
         * SLAB_NOLEAKTRACE to avoid recursive calls into kmemleak)
         */
-       if ((size >= (PAGE_SIZE >> 5)) && !slab_early_init &&
+       if (size >= OFF_SLAB_MIN_SIZE && !slab_early_init &&
            !(flags & SLAB_NOLEAKTRACE))
                /*
                 * Size is large, assume best to place the slab management obj
@@ -2392,7 +2393,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned 
long flags)
                /*
                 * This is a possibility for one of the kmalloc_{dma,}_caches.
                 * But since we go off slab only for object size greater than
-                * PAGE_SIZE/8, and kmalloc_{dma,}_caches get created
+                * OFF_SLAB_MIN_SIZE, and kmalloc_{dma,}_caches get created
                 * in ascending order,this should not happen at all.
                 * But leave a BUG_ON for some lucky dude.
                 */
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 8181ea4bc2f2..3b45cfee3743 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -400,6 +400,20 @@ static void hidp_idle_timeout(unsigned long arg)
 {
        struct hidp_session *session = (struct hidp_session *) arg;
 
+       /* The HIDP user-space API only contains calls to add and remove
+        * devices. There is no way to forward events of any kind. Therefore,
+        * we have to forcefully disconnect a device on idle-timeouts. This is
+        * unfortunate and weird API design, but it is spec-compliant and
+        * required for backwards-compatibility. Hence, on idle-timeout, we
+        * signal driver-detach events, so poll() will be woken up with an
+        * error-condition on both sockets.
+        */
+
+       session->intr_sock->sk->sk_err = EUNATCH;
+       session->ctrl_sock->sk->sk_err = EUNATCH;
+       wake_up_interruptible(sk_sleep(session->intr_sock->sk));
+       wake_up_interruptible(sk_sleep(session->ctrl_sock->sk));
+
        hidp_session_terminate(session);
 }
 
diff --git a/net/core/dst.c b/net/core/dst.c
index a028409ee438..a80e92346b9b 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -285,7 +285,7 @@ void dst_release(struct dst_entry *dst)
 
                newrefcnt = atomic_dec_return(&dst->__refcnt);
                WARN_ON(newrefcnt < 0);
-               if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
+               if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
                        call_rcu(&dst->rcu_head, dst_destroy_rcu);
        }
 }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index fead914b09f6..d91fda8257bc 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -436,7 +436,7 @@ packet_routed:
        skb->priority = sk->sk_priority;
        skb->mark = sk->sk_mark;
 
-       res = ip_local_out(skb);
+       res = ip_local_out_sk(sk, skb);
        rcu_read_unlock();
        return res;
 
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 65bcaa789043..ac7909c8c8d8 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1674,8 +1674,8 @@ static inline int ipmr_forward_finish(struct sk_buff *skb)
 {
        struct ip_options *opt = &(IPCB(skb)->opt);
 
-       IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), 
IPSTATS_MIB_OUTFORWDATAGRAMS);
-       IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, 
skb->len);
+       IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
+       IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, 
skb->len);
 
        if (unlikely(opt->optlen))
                ip_forward_options(skb);
@@ -1737,7 +1737,7 @@ static void ipmr_queue_xmit(struct net *net, struct 
mr_table *mrt,
                 * to blackhole.
                 */
 
-               IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
+               IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
                ip_rt_put(rt);
                goto out_free;
        }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0cdaa633059b..e3d40a303b8f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2891,9 +2891,6 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, 
const int flag,
         * Karn's algorithm forbids taking RTT if some retransmitted data
         * is acked (RFC6298).
         */
-       if (flag & FLAG_RETRANS_DATA_ACKED)
-               seq_rtt_us = -1L;
-
        if (seq_rtt_us < 0)
                seq_rtt_us = sack_rtt_us;
 
@@ -3115,7 +3112,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int 
prior_fackets,
                flag |= FLAG_SACK_RENEGING;
 
        skb_mstamp_get(&now);
-       if (first_ackt.v64) {
+       if (first_ackt.v64 && !(flag & FLAG_RETRANS_DATA_ACKED)) {
                seq_rtt_us = skb_mstamp_us_delta(&now, &first_ackt);
                ca_seq_rtt_us = skb_mstamp_us_delta(&now, &last_ackt);
        }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 051e9c508933..b5bdd2aeb2f8 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1374,34 +1374,20 @@ static int ipip6_tunnel_init(struct net_device *dev)
        return 0;
 }
 
-static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
+static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        struct iphdr *iph = &tunnel->parms.iph;
        struct net *net = dev_net(dev);
        struct sit_net *sitn = net_generic(net, sit_net_id);
 
-       tunnel->dev = dev;
-       tunnel->net = dev_net(dev);
-
        iph->version            = 4;
        iph->protocol           = IPPROTO_IPV6;
        iph->ihl                = 5;
        iph->ttl                = 64;
 
-       dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
-       if (!dev->tstats)
-               return -ENOMEM;
-
-       tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
-       if (!tunnel->dst_cache) {
-               free_percpu(dev->tstats);
-               return -ENOMEM;
-       }
-
        dev_hold(dev);
        rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
-       return 0;
 }
 
 static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -1738,23 +1724,18 @@ static int __net_init sit_init_net(struct net *net)
         */
        sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
 
-       err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
-       if (err)
-               goto err_dev_free;
-
-       ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
-
        if ((err = register_netdev(sitn->fb_tunnel_dev)))
                goto err_reg_dev;
 
+       ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
+       ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+
        t = netdev_priv(sitn->fb_tunnel_dev);
 
        strcpy(t->parms.name, sitn->fb_tunnel_dev->name);
        return 0;
 
 err_reg_dev:
-       dev_put(sitn->fb_tunnel_dev);
-err_dev_free:
        ipip6_dev_free(sitn->fb_tunnel_dev);
 err_alloc_dev:
        return err;
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 2c4e4c5c7614..e1e4811a1e82 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -146,6 +146,16 @@ static void tunnel6_err(struct sk_buff *skb, struct 
inet6_skb_parm *opt,
                        break;
 }
 
+static void tunnel46_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                        u8 type, u8 code, int offset, __be32 info)
+{
+       struct xfrm6_tunnel *handler;
+
+       for_each_tunnel_rcu(tunnel46_handlers, handler)
+               if (!handler->err_handler(skb, opt, type, code, offset, info))
+                       break;
+}
+
 static const struct inet6_protocol tunnel6_protocol = {
        .handler        = tunnel6_rcv,
        .err_handler    = tunnel6_err,
@@ -154,7 +164,7 @@ static const struct inet6_protocol tunnel6_protocol = {
 
 static const struct inet6_protocol tunnel46_protocol = {
        .handler        = tunnel46_rcv,
-       .err_handler    = tunnel6_err,
+       .err_handler    = tunnel46_err,
        .flags          = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 98ad6ec4bd3c..8ad149478e19 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -1876,7 +1876,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state 
*iter, loff_t *off)
        for (element = hashbin_get_first(iter->hashbin);
             element != NULL;
             element = hashbin_get_next(iter->hashbin)) {
-               if (!off || *off-- == 0) {
+               if (!off || (*off)-- == 0) {
                        /* NB: hashbin left locked */
                        return element;
                }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a59a78b6923d..db469ec12387 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2978,7 +2978,7 @@ static void ieee80211_rx_mgmt_beacon(struct 
ieee80211_sub_if_data *sdata,
 
        if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
            ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
-               int sig = ifmgd->ave_beacon_signal;
+               int sig = ifmgd->ave_beacon_signal / 16;
                int last_sig = ifmgd->last_ave_beacon_signal;
 
                /*
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index cfe1a0688b5c..569332bdb10f 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -32,11 +32,11 @@
                        __field(u32, chan_width)                                
        \
                        __field(u32, center_freq1)                              
        \
                        __field(u32, center_freq2)
-#define CHANDEF_ASSIGN(c)                                                      
        \
-                       __entry->control_freq = (c)->chan ? 
(c)->chan->center_freq : 0; \
-                       __entry->chan_width = (c)->width;                       
        \
-                       __entry->center_freq1 = (c)->center_freq1;              
        \
-                       __entry->center_freq2 = (c)->center_freq2;
+#define CHANDEF_ASSIGN(c)                                                      
\
+                       __entry->control_freq = (c) ? ((c)->chan ? 
(c)->chan->center_freq : 0) : 0;     \
+                       __entry->chan_width = (c) ? (c)->width : 0;             
        \
+                       __entry->center_freq1 = (c) ? (c)->center_freq1 : 0;    
        \
+                       __entry->center_freq2 = (c) ? (c)->center_freq2 : 0;
 #define CHANDEF_PR_FMT " control:%d MHz width:%d center: %d/%d MHz"
 #define CHANDEF_PR_ARG __entry->control_freq, __entry->chan_width,             
        \
                        __entry->center_freq1, __entry->center_freq2
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 01fe82e9d1b0..c68e6cf4367e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2664,6 +2664,13 @@ ieee80211_extend_noa_desc(struct ieee80211_noa_data 
*data, u32 tsf, int i)
        if (end > 0)
                return false;
 
+       /* One shot NOA  */
+       if (data->count[i] == 1)
+               return false;
+
+       if (data->desc[i].interval == 0)
+               return false;
+
        /* End time is in the past, check for repetitions */
        skip = DIV_ROUND_UP(-end, data->desc[i].interval);
        if (data->count[i] < 255) {
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 6ae88ace21cb..cddab2101569 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -406,7 +406,7 @@ static int nfnetlink_bind(int group)
        int type = nfnl_group2type[group];
 
        rcu_read_lock();
-       ss = nfnetlink_get_subsys(type);
+       ss = nfnetlink_get_subsys(type << 8);
        rcu_read_unlock();
        if (!ss)
                request_module("nfnetlink-subsys-%d", type);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 1f2e7d341781..1f618bbce0ac 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1412,10 +1412,10 @@ static void __fanout_unlink(struct sock *sk, struct 
packet_sock *po)
 
 static bool match_fanout_group(struct packet_type *ptype, struct sock *sk)
 {
-       if (ptype->af_packet_priv == (void *)((struct packet_sock *)sk)->fanout)
-               return true;
+       if (sk->sk_family != PF_PACKET)
+               return false;
 
-       return false;
+       return ptype->af_packet_priv == pkt_sk(sk)->fanout;
 }
 
 static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
@@ -2653,22 +2653,40 @@ static int packet_release(struct socket *sock)
  *     Attach a packet hook.
  */
 
-static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 
proto)
+static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
+                         __be16 proto)
 {
        struct packet_sock *po = pkt_sk(sk);
        struct net_device *dev_curr;
        __be16 proto_curr;
        bool need_rehook;
+       struct net_device *dev = NULL;
+       int ret = 0;
+       bool unlisted = false;
 
-       if (po->fanout) {
-               if (dev)
-                       dev_put(dev);
-
+       if (po->fanout)
                return -EINVAL;
-       }
 
        lock_sock(sk);
        spin_lock(&po->bind_lock);
+       rcu_read_lock();
+
+       if (name) {
+               dev = dev_get_by_name_rcu(sock_net(sk), name);
+               if (!dev) {
+                       ret = -ENODEV;
+                       goto out_unlock;
+               }
+       } else if (ifindex) {
+               dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
+               if (!dev) {
+                       ret = -ENODEV;
+                       goto out_unlock;
+               }
+       }
+
+       if (dev)
+               dev_hold(dev);
 
        proto_curr = po->prot_hook.type;
        dev_curr = po->prot_hook.dev;
@@ -2676,14 +2694,29 @@ static int packet_do_bind(struct sock *sk, struct 
net_device *dev, __be16 proto)
        need_rehook = proto_curr != proto || dev_curr != dev;
 
        if (need_rehook) {
-               unregister_prot_hook(sk, true);
+               if (po->running) {
+                       rcu_read_unlock();
+                       __unregister_prot_hook(sk, true);
+                       rcu_read_lock();
+                       dev_curr = po->prot_hook.dev;
+                       if (dev)
+                               unlisted = !dev_get_by_index_rcu(sock_net(sk),
+                                                                dev->ifindex);
+               }
 
                po->num = proto;
                po->prot_hook.type = proto;
-               po->prot_hook.dev = dev;
 
-               po->ifindex = dev ? dev->ifindex : 0;
-               packet_cached_dev_assign(po, dev);
+               if (unlikely(unlisted)) {
+                       dev_put(dev);
+                       po->prot_hook.dev = NULL;
+                       po->ifindex = -1;
+                       packet_cached_dev_reset(po);
+               } else {
+                       po->prot_hook.dev = dev;
+                       po->ifindex = dev ? dev->ifindex : 0;
+                       packet_cached_dev_assign(po, dev);
+               }
        }
        if (dev_curr)
                dev_put(dev_curr);
@@ -2691,7 +2724,7 @@ static int packet_do_bind(struct sock *sk, struct 
net_device *dev, __be16 proto)
        if (proto == 0 || !need_rehook)
                goto out_unlock;
 
-       if (!dev || (dev->flags & IFF_UP)) {
+       if (!unlisted && (!dev || (dev->flags & IFF_UP))) {
                register_prot_hook(sk);
        } else {
                sk->sk_err = ENETDOWN;
@@ -2700,9 +2733,10 @@ static int packet_do_bind(struct sock *sk, struct 
net_device *dev, __be16 proto)
        }
 
 out_unlock:
+       rcu_read_unlock();
        spin_unlock(&po->bind_lock);
        release_sock(sk);
-       return 0;
+       return ret;
 }
 
 /*
@@ -2714,8 +2748,6 @@ static int packet_bind_spkt(struct socket *sock, struct 
sockaddr *uaddr,
 {
        struct sock *sk = sock->sk;
        char name[15];
-       struct net_device *dev;
-       int err = -ENODEV;
 
        /*
         *      Check legality
@@ -2725,19 +2757,13 @@ static int packet_bind_spkt(struct socket *sock, struct 
sockaddr *uaddr,
                return -EINVAL;
        strlcpy(name, uaddr->sa_data, sizeof(name));
 
-       dev = dev_get_by_name(sock_net(sk), name);
-       if (dev)
-               err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
-       return err;
+       return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
 }
 
 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int 
addr_len)
 {
        struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
        struct sock *sk = sock->sk;
-       struct net_device *dev = NULL;
-       int err;
-
 
        /*
         *      Check legality
@@ -2748,16 +2774,8 @@ static int packet_bind(struct socket *sock, struct 
sockaddr *uaddr, int addr_len
        if (sll->sll_family != AF_PACKET)
                return -EINVAL;
 
-       if (sll->sll_ifindex) {
-               err = -ENODEV;
-               dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex);
-               if (dev == NULL)
-                       goto out;
-       }
-       err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
-
-out:
-       return err;
+       return packet_do_bind(sk, NULL, sll->sll_ifindex,
+                             sll->sll_protocol ? : pkt_sk(sk)->num);
 }
 
 static struct proto packet_proto = {
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index 9ae6e0a264ec..2dd88db4a1a2 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -234,8 +234,15 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, 
struct sk_buff *skb,
                        }
 
                        to_copy = min(tc->t_tinc_data_rem, left);
-                       pskb_pull(clone, offset);
-                       pskb_trim(clone, to_copy);
+                       if (!pskb_pull(clone, offset) ||
+                           pskb_trim(clone, to_copy)) {
+                               pr_warn("rds_tcp_data_recv: pull/trim failed "
+                                       "left %zu data_rem %zu skb_len %d\n",
+                                       left, tc->t_tinc_data_rem, skb->len);
+                               kfree_skb(clone);
+                               desc->error = -ENOMEM;
+                               goto out;
+                       }
                        skb_queue_tail(&tinc->ti_skb_list, clone);
 
                        rdsdebug("skb %p data %p len %d off %u to_copy %zu -> "
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 8467373e2ace..b456c8f09b60 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -182,38 +182,17 @@ rpcrdma_sendcq_poll(struct ib_cq *cq, struct rpcrdma_ep 
*ep)
        return 0;
 }
 
-/*
- * Handle send, fast_reg_mr, and local_inv completions.
- *
- * Send events are typically suppressed and thus do not result
- * in an upcall. Occasionally one is signaled, however. This
- * prevents the provider's completion queue from wrapping and
- * losing a completion.
+/* Handle provider send completion upcalls.
  */
 static void
 rpcrdma_sendcq_upcall(struct ib_cq *cq, void *cq_context)
 {
        struct rpcrdma_ep *ep = (struct rpcrdma_ep *)cq_context;
-       int rc;
-
-       rc = rpcrdma_sendcq_poll(cq, ep);
-       if (rc) {
-               dprintk("RPC:       %s: ib_poll_cq failed: %i\n",
-                       __func__, rc);
-               return;
-       }
 
-       rc = ib_req_notify_cq(cq,
-                       IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
-       if (rc == 0)
-               return;
-       if (rc < 0) {
-               dprintk("RPC:       %s: ib_req_notify_cq failed: %i\n",
-                       __func__, rc);
-               return;
-       }
-
-       rpcrdma_sendcq_poll(cq, ep);
+       do {
+               rpcrdma_sendcq_poll(cq, ep);
+       } while (ib_req_notify_cq(cq, IB_CQ_NEXT_COMP |
+                                 IB_CQ_REPORT_MISSED_EVENTS) > 0);
 }
 
 static void
@@ -272,42 +251,17 @@ rpcrdma_recvcq_poll(struct ib_cq *cq, struct rpcrdma_ep 
*ep)
        return 0;
 }
 
-/*
- * Handle receive completions.
- *
- * It is reentrant but processes single events in order to maintain
- * ordering of receives to keep server credits.
- *
- * It is the responsibility of the scheduled tasklet to return
- * recv buffers to the pool. NOTE: this affects synchronization of
- * connection shutdown. That is, the structures required for
- * the completion of the reply handler must remain intact until
- * all memory has been reclaimed.
+/* Handle provider receive completion upcalls.
  */
 static void
 rpcrdma_recvcq_upcall(struct ib_cq *cq, void *cq_context)
 {
        struct rpcrdma_ep *ep = (struct rpcrdma_ep *)cq_context;
-       int rc;
-
-       rc = rpcrdma_recvcq_poll(cq, ep);
-       if (rc) {
-               dprintk("RPC:       %s: ib_poll_cq failed: %i\n",
-                       __func__, rc);
-               return;
-       }
 
-       rc = ib_req_notify_cq(cq,
-                       IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
-       if (rc == 0)
-               return;
-       if (rc < 0) {
-               dprintk("RPC:       %s: ib_req_notify_cq failed: %i\n",
-                       __func__, rc);
-               return;
-       }
-
-       rpcrdma_recvcq_poll(cq, ep);
+       do {
+               rpcrdma_recvcq_poll(cq, ep);
+       } while (ib_req_notify_cq(cq, IB_CQ_NEXT_COMP |
+                                 IB_CQ_REPORT_MISSED_EVENTS) > 0);
 }
 
 #ifdef RPC_DEBUG
diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
index 49b582a225b0..b9897e2be404 100644
--- a/scripts/recordmcount.h
+++ b/scripts/recordmcount.h
@@ -377,7 +377,7 @@ static void nop_mcount(Elf_Shdr const *const relhdr,
 
                if (mcountsym == Elf_r_sym(relp) && !is_fake_mcount(relp)) {
                        if (make_nop)
-                               ret = make_nop((void *)ehdr, shdr->sh_offset + 
relp->r_offset);
+                               ret = make_nop((void *)ehdr, 
_w(shdr->sh_offset) + _w(relp->r_offset));
                        if (warn_on_notrace_sect && !once) {
                                printf("Section %s has mcount callers being 
ignored\n",
                                       txtname);
diff --git a/sound/firewire/bebob/Makefile b/sound/firewire/bebob/Makefile
index 6cf470c80d1f..af7ed6643266 100644
--- a/sound/firewire/bebob/Makefile
+++ b/sound/firewire/bebob/Makefile
@@ -1,4 +1,4 @@
 snd-bebob-objs := bebob_command.o bebob_stream.o bebob_proc.o bebob_midi.o \
                  bebob_pcm.o bebob_hwdep.o bebob_terratec.o bebob_yamaha.o \
                  bebob_focusrite.o bebob_maudio.o bebob.o
-obj-m += snd-bebob.o
+obj-$(CONFIG_SND_BEBOB) += snd-bebob.o
diff --git a/sound/firewire/bebob/bebob_maudio.c 
b/sound/firewire/bebob/bebob_maudio.c
index 0215a9194d88..96f770024c3b 100644
--- a/sound/firewire/bebob/bebob_maudio.c
+++ b/sound/firewire/bebob/bebob_maudio.c
@@ -644,7 +644,7 @@ static char *const special_meter_labels[] = {
 static int
 special_meter_get(struct snd_bebob *bebob, u32 *target, unsigned int size)
 {
-       u16 *buf;
+       __be16 *buf;
        unsigned int i, c, channels;
        int err;
 
diff --git a/sound/firewire/fireworks/Makefile 
b/sound/firewire/fireworks/Makefile
index 0c7440826db8..15ef7f75a8ef 100644
--- a/sound/firewire/fireworks/Makefile
+++ b/sound/firewire/fireworks/Makefile
@@ -1,4 +1,4 @@
 snd-fireworks-objs := fireworks_transaction.o fireworks_command.o \
                      fireworks_stream.o fireworks_proc.o fireworks_midi.o \
                      fireworks_pcm.o fireworks_hwdep.o fireworks.o
-obj-m += snd-fireworks.o
+obj-$(CONFIG_SND_FIREWORKS) += snd-fireworks.o
diff --git a/sound/firewire/fireworks/fireworks_command.c 
b/sound/firewire/fireworks/fireworks_command.c
index 166f80584c2a..94bab0476a65 100644
--- a/sound/firewire/fireworks/fireworks_command.c
+++ b/sound/firewire/fireworks/fireworks_command.c
@@ -257,7 +257,7 @@ int snd_efw_command_get_phys_meters(struct snd_efw *efw,
                                    struct snd_efw_phys_meters *meters,
                                    unsigned int len)
 {
-       __be32 *buf = (__be32 *)meters;
+       u32 *buf = (u32 *)meters;
        unsigned int i;
        int err;
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 89dfe344ee75..d4268a2bbca7 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -262,7 +262,8 @@ enum {
         AZX_DCAPS_CORBRP_SELF_CLEAR)
 
 #define AZX_DCAPS_PRESET_CTHDA \
-       (AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_4K_BDLE_BOUNDARY)
+       (AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_4K_BDLE_BOUNDARY 
|\
+        AZX_DCAPS_NO_64BIT)
 
 /*
  * VGA-switcher support
@@ -1791,6 +1792,11 @@ static const struct pci_device_id azx_ids[] = {
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
        { PCI_DEVICE(0x8086, 0x8d21),
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+       /* Lewisburg */
+       { PCI_DEVICE(0x8086, 0xa1f0),
+         .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+       { PCI_DEVICE(0x8086, 0xa270),
+         .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
        /* Lynx Point-LP */
        { PCI_DEVICE(0x8086, 0x9c20),
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
@@ -1958,11 +1964,13 @@ static const struct pci_device_id azx_ids[] = {
          .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
          .class_mask = 0xffffff,
          .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
+         AZX_DCAPS_NO_64BIT |
          AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
 #else
        /* this entry seems still valid -- i.e. without emu20kx chip */
        { PCI_DEVICE(0x1102, 0x0009),
          .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
+         AZX_DCAPS_NO_64BIT |
          AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
 #endif
        /* Vortex86MX */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ba5bebbe859d..a68209c245e2 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4317,6 +4317,7 @@ enum {
        ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
        ALC292_FIXUP_TPT440_DOCK,
        ALC292_FIXUP_TPT440_DOCK2,
+       ALC275_FIXUP_DELL_XPS,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -4769,6 +4770,17 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
        },
+       [ALC275_FIXUP_DELL_XPS] = {
+               .type = HDA_FIXUP_VERBS,
+               .v.verbs = (const struct hda_verb[]) {
+                       /* Enables internal speaker */
+                       {0x20, AC_VERB_SET_COEF_INDEX, 0x1f},
+                       {0x20, AC_VERB_SET_PROC_COEF, 0x00c0},
+                       {0x20, AC_VERB_SET_COEF_INDEX, 0x30},
+                       {0x20, AC_VERB_SET_PROC_COEF, 0x00b1},
+                       {}
+               }
+       },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -4783,6 +4795,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
        SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", 
ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
        SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+       SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", 
ALC275_FIXUP_DELL_XPS),
        SND_PCI_QUIRK(0x1028, 0x05bd, "Dell", 
ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05be, "Dell", 
ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05c4, "Dell", 
ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 78e0c83993d5..28c9f20c2f63 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -732,6 +732,7 @@ static bool hp_bnb2011_with_dock(struct hda_codec *codec)
 static bool hp_blike_system(u32 subsystem_id)
 {
        switch (subsystem_id) {
+       case 0x103c1473: /* HP ProBook 6550b */
        case 0x103c1520:
        case 0x103c1521:
        case 0x103c1523:
diff --git a/tools/perf/Documentation/perf-trace.txt 
b/tools/perf/Documentation/perf-trace.txt
index fae38d9a44a4..65d6a7a88c53 100644
--- a/tools/perf/Documentation/perf-trace.txt
+++ b/tools/perf/Documentation/perf-trace.txt
@@ -59,7 +59,6 @@ OPTIONS
 --verbose=::
         Verbosity level.
 
--i::
 --no-inherit::
        Child tasks do not inherit counters.
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to