269 files changed, 1895 insertions, 1817 deletions
diff --git a/Documentation/devicetree/bindings/net/micrel-ks8851.txt b/Documentation/devicetree/bindings/net/micrel-ks8851.txt
index 11ace3c3d805..4fc392763611 100644
--- a/Documentation/devicetree/bindings/net/micrel-ks8851.txt
+++ b/Documentation/devicetree/bindings/net/micrel-ks8851.txt
@@ -7,3 +7,4 @@ Required properties:
 Optional properties:
 - local-mac-address : Ethernet mac address to use
+- vdd-supply:   supply for Ethernet mac
diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt
index b26122973525..c6af4bac5aa8 100644
--- a/Documentation/networking/netlink_mmap.txt
+++ b/Documentation/networking/netlink_mmap.txt
@@ -226,9 +226,9 @@ Ring setup:
        void *rx_ring, *tx_ring;
        /* Configure ring parameters */
-        if (setsockopt(fd, NETLINK_RX_RING, &req, sizeof(req)) < 0)
+        if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0)
                exit(1);
-        if (setsockopt(fd, NETLINK_TX_RING, &req, sizeof(req)) < 0)
+        if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0)
                exit(1)
        /* Calculate size of each individual ring */
diff --git a/Documentation/networking/packet_mmap.txt b/Documentation/networking/packet_mmap.txt
index 1404674c0a02..6fea79efb4cb 100644
--- a/Documentation/networking/packet_mmap.txt
+++ b/Documentation/networking/packet_mmap.txt
@@ -453,7 +453,7 @@ TP_STATUS_COPY        : This flag indicates that the frame (and associated
                        enabled previously with setsockopt() and 
                        the PACKET_COPY_THRESH option. 
-                        The number of frames than can be buffered to 
+                        The number of frames that can be buffered to
                        be read with recvfrom is limited like a normal socket.
                        See the SO_RCVBUF option in the socket (7) man page.
diff --git a/Documentation/networking/timestamping.txt b/Documentation/networking/timestamping.txt
index 661d3c316a17..048c92b487f6 100644
--- a/Documentation/networking/timestamping.txt
+++ b/Documentation/networking/timestamping.txt
@@ -21,26 +21,38 @@ has such a feature).
 SO_TIMESTAMPING:
-Instructs the socket layer which kind of information is wanted. The
+Instructs the socket layer which kind of information should be collected
-parameter is an integer with some of the following bits set. Setting
+and/or reported.  The parameter is an integer with some of the following
-other bits is an error and doesn't change the current state.
+bits set. Setting other bits is an error and doesn't change the current
+state.
-SOF_TIMESTAMPING_TX_HARDWARE:  try to obtain send time stamp in hardware
-SOF_TIMESTAMPING_TX_SOFTWARE:  if SOF_TIMESTAMPING_TX_HARDWARE is off or
+Four of the bits are requests to the stack to try to generate
-                               fails, then do it in software
+timestamps.  Any combination of them is valid.
-SOF_TIMESTAMPING_RX_HARDWARE:  return the original, unmodified time stamp
-                               as generated by the hardware
+SOF_TIMESTAMPING_TX_HARDWARE:  try to obtain send time stamps in hardware
-SOF_TIMESTAMPING_RX_SOFTWARE:  if SOF_TIMESTAMPING_RX_HARDWARE is off or
+SOF_TIMESTAMPING_TX_SOFTWARE:  try to obtain send time stamps in software
-                               fails, then do it in software
+SOF_TIMESTAMPING_RX_HARDWARE:  try to obtain receive time stamps in hardware
-SOF_TIMESTAMPING_RAW_HARDWARE: return original raw hardware time stamp
+SOF_TIMESTAMPING_RX_SOFTWARE:  try to obtain receive time stamps in software
-SOF_TIMESTAMPING_SYS_HARDWARE: return hardware time stamp transformed to
-                               the system time base
+The other three bits control which timestamps will be reported in a
-SOF_TIMESTAMPING_SOFTWARE:     return system time stamp generated in
+generated control message.  If none of these bits are set or if none of
-                               software
+the set bits correspond to data that is available, then the control
+message will not be generated:
-SOF_TIMESTAMPING_TX/RX determine how time stamps are generated.
-SOF_TIMESTAMPING_RAW/SYS determine how they are reported in the
+SOF_TIMESTAMPING_SOFTWARE:     report systime if available
-following control message:
+SOF_TIMESTAMPING_SYS_HARDWARE: report hwtimetrans if available
+SOF_TIMESTAMPING_RAW_HARDWARE: report hwtimeraw if available
+It is worth noting that timestamps may be collected for reasons other
+than being requested by a particular socket with
+SOF_TIMESTAMPING_[TR]X_(HARD|SOFT)WARE.  For example, most drivers that
+can generate hardware receive timestamps ignore
+SOF_TIMESTAMPING_RX_HARDWARE.  It is still a good idea to set that flag
+in case future drivers pay attention.
+If timestamps are reported, they will appear in a control message with
+cmsg_level==SOL_SOCKET, cmsg_type==SO_TIMESTAMPING, and a payload like
+this:
 struct scm_timestamping {
        struct timespec systime;
diff --git a/MAINTAINERS b/MAINTAINERS
index df5296229089..ec01455c7afe 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -911,11 +911,11 @@ F:	arch/arm/include/asm/hardware/dec21285.h
 F:      arch/arm/mach-footbridge/
 ARM/FREESCALE IMX / MXC ARM ARCHITECTURE
-M:      Shawn Guo <shawn.guo@linaro.org>
+M:      Shawn Guo <shawn.guo@freescale.com>
 M:      Sascha Hauer <kernel@pengutronix.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
 F:      arch/arm/mach-imx/
 F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
@@ -1738,6 +1738,7 @@ F:	include/uapi/linux/bfs_fs.h
 BLACKFIN ARCHITECTURE
 M:      Steven Miao <realmz6@gmail.com>
 L:      adi-buildroot-devel@lists.sourceforge.net
+T:      git git://git.code.sf.net/p/adi-linux/code
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      arch/blackfin/
@@ -4551,6 +4552,7 @@ M:	Greg Rose <gregory.v.rose@intel.com>
 M:      Alex Duyck <alexander.h.duyck@intel.com>
 M:      John Ronciak <john.ronciak@intel.com>
 M:      Mitch Williams <mitch.a.williams@intel.com>
+M:      Linux NICS <linux.nics@intel.com>
 L:      e1000-devel@lists.sourceforge.net
 W:      http://www.intel.com/support/feedback.htm
 W:      http://e1000.sourceforge.net/
@@ -6009,6 +6011,8 @@ F:	include/linux/netdevice.h
 F:      include/uapi/linux/in.h
 F:      include/uapi/linux/net.h
 F:      include/uapi/linux/netdevice.h
+F:      tools/net/
+F:      tools/testing/selftests/net/
 NETWORKING [IPv4/IPv6]
 M:      "David S. Miller" <davem@davemloft.net>
diff --git a/Makefile b/Makefile
index 1a2628ee5d91..c10b734339db 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc8
 NAME = Shuffling Zombie Juror
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/sama5d36.dtsi b/arch/arm/boot/dts/sama5d36.dtsi
index 6c31c26e6cc0..db58cad6acd3 100644
--- a/arch/arm/boot/dts/sama5d36.dtsi
+++ b/arch/arm/boot/dts/sama5d36.dtsi
@@ -8,8 +8,8 @@
 */
 #include "sama5d3.dtsi"
 #include "sama5d3_can.dtsi"
-#include "sama5d3_emac.dtsi"
 #include "sama5d3_gmac.dtsi"
+#include "sama5d3_emac.dtsi"
 #include "sama5d3_lcd.dtsi"
 #include "sama5d3_mci2.dtsi"
 #include "sama5d3_tcb1.dtsi"
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 93533e2710a8..9323854242ca 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -988,14 +988,12 @@ static struct asoc_simple_card_info fsi_wm8978_info = {
        .card           = "FSI2A-WM8978",
        .codec          = "wm8978.0-001a",
        .platform       = "sh_fsi2",
-        .daifmt         = SND_SOC_DAIFMT_I2S,
+        .daifmt         = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBM_CFM,
        .cpu_dai = {
                .name   = "fsia-dai",
-                .fmt    = SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_IB_NF,
        },
        .codec_dai = {
                .name   = "wm8978-hifi",
-                .fmt    = SND_SOC_DAIFMT_CBM_CFM | SND_SOC_DAIFMT_NB_NF,
                .sysclk = 12288000,
        },
 };
diff --git a/arch/arm/mach-shmobile/board-bockw.c b/arch/arm/mach-shmobile/board-bockw.c
index c475220545f2..74c27d9d6900 100644
--- a/arch/arm/mach-shmobile/board-bockw.c
+++ b/arch/arm/mach-shmobile/board-bockw.c
@@ -429,14 +429,12 @@ static struct asoc_simple_card_info rsnd_card_info[] = {
                .card           = "SSI56-AK4643",
                .codec          = "ak4642-codec.0-0012",
                .platform       = "rcar_sound",
-                .daifmt         = SND_SOC_DAIFMT_LEFT_J,
+                .daifmt         = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM,
                .cpu_dai = {
                        .name   = "rsnd-dai.0",
-                        .fmt    = SND_SOC_DAIFMT_CBS_CFS,
                },
                .codec_dai = {
                        .name   = "ak4642-hifi",
-                        .fmt    = SND_SOC_DAIFMT_CBM_CFM,
                        .sysclk = 11289600,
                },
        },
@@ -446,10 +444,9 @@ static struct asoc_simple_card_info rsnd_card_info[] = {
                .card           = "SSI3-AK4554(playback)",
                .codec          = "ak4554-adc-dac.0",
                .platform       = "rcar_sound",
+                .daifmt         = SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_RIGHT_J,
                .cpu_dai = {
                        .name   = "rsnd-dai.1",
-                        .fmt    = SND_SOC_DAIFMT_CBM_CFM |
-                                  SND_SOC_DAIFMT_RIGHT_J,
                },
                .codec_dai = {
                        .name   = "ak4554-hifi",
@@ -461,10 +458,9 @@ static struct asoc_simple_card_info rsnd_card_info[] = {
                .card           = "SSI4-AK4554(capture)",
                .codec          = "ak4554-adc-dac.0",
                .platform       = "rcar_sound",
+                .daifmt         = SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_LEFT_J,
                .cpu_dai = {
                        .name   = "rsnd-dai.2",
-                        .fmt    = SND_SOC_DAIFMT_CBM_CFM |
-                                  SND_SOC_DAIFMT_LEFT_J,
                },
                .codec_dai = {
                        .name   = "ak4554-hifi",
@@ -476,10 +472,9 @@ static struct asoc_simple_card_info rsnd_card_info[] = {
                .card           = "SSI7-AK4554(playback)",
                .codec          = "ak4554-adc-dac.1",
                .platform       = "rcar_sound",
+                .daifmt         = SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_RIGHT_J,
                .cpu_dai = {
                        .name   = "rsnd-dai.3",
-                        .fmt    = SND_SOC_DAIFMT_CBM_CFM |
-                                  SND_SOC_DAIFMT_RIGHT_J,
                },
                .codec_dai = {
                        .name   = "ak4554-hifi",
@@ -491,10 +486,9 @@ static struct asoc_simple_card_info rsnd_card_info[] = {
                .card           = "SSI8-AK4554(capture)",
                .codec          = "ak4554-adc-dac.1",
                .platform       = "rcar_sound",
+                .daifmt         = SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_LEFT_J,
                .cpu_dai = {
                        .name   = "rsnd-dai.4",
-                        .fmt    = SND_SOC_DAIFMT_CBM_CFM |
-                                  SND_SOC_DAIFMT_LEFT_J,
                },
                .codec_dai = {
                        .name   = "ak4554-hifi",
diff --git a/arch/arm/mach-shmobile/board-kzm9g.c b/arch/arm/mach-shmobile/board-kzm9g.c
index bc40b853ffd3..03dc3ac84502 100644
--- a/arch/arm/mach-shmobile/board-kzm9g.c
+++ b/arch/arm/mach-shmobile/board-kzm9g.c
@@ -589,14 +589,12 @@ static struct asoc_simple_card_info fsi2_ak4648_info = {
        .card           = "FSI2A-AK4648",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi2",
-        .daifmt         = SND_SOC_DAIFMT_LEFT_J,
+        .daifmt         = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM,
        .cpu_dai = {
                .name   = "fsia-dai",
-                .fmt    = SND_SOC_DAIFMT_CBS_CFS,
        },
        .codec_dai = {
                .name   = "ak4642-hifi",
-                .fmt    = SND_SOC_DAIFMT_CBM_CFM,
                .sysclk = 11289600,
        },
 };
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 3aba0372f630..0ff4d8e45cf7 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -509,9 +509,9 @@ static struct asoc_simple_card_info fsi2_hdmi_info = {
        .card           = "FSI2B-HDMI",
        .codec          = "sh-mobile-hdmi",
        .platform       = "sh_fsi2",
+        .daifmt         = SND_SOC_DAIFMT_CBS_CFS,
        .cpu_dai = {
                .name   = "fsib-dai",
-                .fmt    = SND_SOC_DAIFMT_CBM_CFM | SND_SOC_DAIFMT_IB_NF,
        },
        .codec_dai = {
                .name   = "sh_mobile_hdmi-hifi",
@@ -905,14 +905,12 @@ static struct asoc_simple_card_info fsi2_ak4643_info = {
        .card           = "FSI2A-AK4643",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi2",
-        .daifmt         = SND_SOC_DAIFMT_LEFT_J,
+        .daifmt         = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM,
        .cpu_dai = {
                .name   = "fsia-dai",
-                .fmt    = SND_SOC_DAIFMT_CBS_CFS,
        },
        .codec_dai = {
                .name   = "ak4642-hifi",
-                .fmt    = SND_SOC_DAIFMT_CBM_CFM,
                .sysclk = 11289600,
        },
 };
diff --git a/arch/cris/include/asm/bitops.h b/arch/cris/include/asm/bitops.h
index 184066ceb1f6..053c17b36559 100644
--- a/arch/cris/include/asm/bitops.h
+++ b/arch/cris/include/asm/bitops.h
@@ -144,7 +144,7 @@ static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
 * definition, which doesn't have the same semantics.  We don't want to
 * use -fno-builtin, so just hide the name ffs.
 */
-#define ffs kernel_ffs
+#define ffs(x) kernel_ffs(x)
 #include <asm-generic/bitops/fls.h>
 #include <asm-generic/bitops/__fls.h>
diff --git a/arch/ia64/kernel/uncached.c b/arch/ia64/kernel/uncached.c
index a96bcf83a735..20e8a9b21d75 100644
--- a/arch/ia64/kernel/uncached.c
+++ b/arch/ia64/kernel/uncached.c
@@ -98,7 +98,7 @@ static int uncached_add_chunk(struct uncached_pool *uc_pool, int nid)
        /* attempt to allocate a granule's worth of cached memory pages */
        page = alloc_pages_exact_node(nid,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                IA64_GRANULE_SHIFT-PAGE_SHIFT);
        if (!page) {
                mutex_unlock(&uc_pool->add_chunk_mutex);
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index dcae3a7035db..95fa1f1d5c8b 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1776,12 +1776,12 @@ endchoice
 config FORCE_MAX_ZONEORDER
        int "Maximum zone order"
-        range 14 64 if HUGETLB_PAGE && PAGE_SIZE_64KB
+        range 14 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_64KB
-        default "14" if HUGETLB_PAGE && PAGE_SIZE_64KB
+        default "14" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_64KB
-        range 13 64 if HUGETLB_PAGE && PAGE_SIZE_32KB
+        range 13 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_32KB
-        default "13" if HUGETLB_PAGE && PAGE_SIZE_32KB
+        default "13" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_32KB
-        range 12 64 if HUGETLB_PAGE && PAGE_SIZE_16KB
+        range 12 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_16KB
-        default "12" if HUGETLB_PAGE && PAGE_SIZE_16KB
+        default "12" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_16KB
        range 11 64
        default "11"
        help
@@ -2353,9 +2353,8 @@ config SECCOMP
          If unsure, say Y. Only embedded should say N here.
 config MIPS_O32_FP64_SUPPORT
-        bool "Support for O32 binaries using 64-bit FP"
+        bool "Support for O32 binaries using 64-bit FP (EXPERIMENTAL)"
        depends on 32BIT || MIPS32_O32
-        default y
        help
          When this is enabled, the kernel will support use of 64-bit floating
          point registers with binaries using the O32 ABI along with the
@@ -2367,7 +2366,14 @@ config MIPS_O32_FP64_SUPPORT
          of your kernel & potentially improve FP emulation performance by
          saying N here.
-          If unsure, say Y.
+          Although binutils currently supports use of this flag the details
+          concerning its effect upon the O32 ABI in userland are still being
+          worked on. In order to avoid userland becoming dependant upon current
+          behaviour before the details have been finalised, this option should
+          be considered experimental and only enabled by those working upon
+          said details.
+          If unsure, say N.
 config USE_OF
        bool
diff --git a/arch/mips/alchemy/board-gpr.c b/arch/mips/alchemy/board-gpr.c
index 9edc35ff8cf1..acf9a2a37f5a 100644
--- a/arch/mips/alchemy/board-gpr.c
+++ b/arch/mips/alchemy/board-gpr.c
@@ -53,10 +53,8 @@ void __init prom_init(void)
        prom_init_cmdline();
        memsize_str = prom_getenv("memsize");
-        if (!memsize_str)
+        if (!memsize_str || kstrtoul(memsize_str, 0, &memsize))
                memsize = 0x04000000;
-        else
-                strict_strtoul(memsize_str, 0, &memsize);
        add_memory_region(0, memsize, BOOT_MEM_RAM);
 }
diff --git a/arch/mips/alchemy/board-mtx1.c b/arch/mips/alchemy/board-mtx1.c
index 9969dbab19e3..25a59a23547e 100644
--- a/arch/mips/alchemy/board-mtx1.c
+++ b/arch/mips/alchemy/board-mtx1.c
@@ -52,10 +52,8 @@ void __init prom_init(void)
        prom_init_cmdline();
        memsize_str = prom_getenv("memsize");
-        if (!memsize_str)
+        if (!memsize_str || kstrtoul(memsize_str, 0, &memsize))
                memsize = 0x04000000;
-        else
-                strict_strtoul(memsize_str, 0, &memsize);
        add_memory_region(0, memsize, BOOT_MEM_RAM);
 }
diff --git a/arch/mips/bcm47xx/board.c b/arch/mips/bcm47xx/board.c
index 6d612e2b949b..cdd8246f92b3 100644
--- a/arch/mips/bcm47xx/board.c
+++ b/arch/mips/bcm47xx/board.c
@@ -1,3 +1,4 @@
+#include <linux/errno.h>
 #include <linux/export.h>
 #include <linux/string.h>
 #include <bcm47xx_board.h>
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
index 6decb27cf48b..2bed73a684ae 100644
--- a/arch/mips/bcm47xx/nvram.c
+++ b/arch/mips/bcm47xx/nvram.c
@@ -196,7 +196,7 @@ int bcm47xx_nvram_gpio_pin(const char *name)
        char nvram_var[10];
        char buf[30];
-        for (i = 0; i < 16; i++) {
+        for (i = 0; i < 32; i++) {
                err = snprintf(nvram_var, sizeof(nvram_var), "gpio%i", i);
                if (err <= 0)
                        continue;
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 25fbfae06c1f..c2bb4f896ce7 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -975,10 +975,6 @@ static int octeon_irq_ciu_xlat(struct irq_domain *d,
        if (ciu > 1 || bit > 63)
                return -EINVAL;
-        /* These are the GPIO lines */
-        if (ciu == 0 && bit >= 16 && bit < 32)
-                return -EINVAL;
        *out_hwirq = (ciu << 6) | bit;
        *out_type = 0;
@@ -1007,6 +1003,10 @@ static int octeon_irq_ciu_map(struct irq_domain *d,
        if (!octeon_irq_virq_in_range(virq))
                return -EINVAL;
+        /* Don't map irq if it is reserved for GPIO. */
+        if (line == 0 && bit >= 16 && bit <32)
+                return 0;
        if (line > 1 || octeon_irq_ciu_to_irq[line][bit] != 0)
                return -EINVAL;
@@ -1525,10 +1525,6 @@ static int octeon_irq_ciu2_xlat(struct irq_domain *d,
        ciu = intspec[0];
        bit = intspec[1];
-        /* Line 7  are the GPIO lines */
-        if (ciu > 6 || bit > 63)
-                return -EINVAL;
        *out_hwirq = (ciu << 6) | bit;
        *out_type = 0;
@@ -1570,8 +1566,14 @@ static int octeon_irq_ciu2_map(struct irq_domain *d,
        if (!octeon_irq_virq_in_range(virq))
                return -EINVAL;
-        /* Line 7  are the GPIO lines */
+        /*
-        if (line > 6 || octeon_irq_ciu_to_irq[line][bit] != 0)
+         * Don't map irq if it is reserved for GPIO.
+         * (Line 7 are the GPIO lines.)
+         */
+        if (line == 7)
+                return 0;
+        if (line > 7 || octeon_irq_ciu_to_irq[line][bit] != 0)
                return -EINVAL;
        if (octeon_irq_ciu2_is_edge(line, bit))
diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
index 3220c93ea981..4225e99bd7bf 100644
--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -9,6 +9,7 @@
 #define _ASM_ASMMACRO_H
 #include <asm/hazards.h>
+#include <asm/asm-offsets.h>
 #ifdef CONFIG_32BIT
 #include <asm/asmmacro-32.h>
@@ -54,11 +55,21 @@
        .endm
        .macro  local_irq_disable reg=t0
+#ifdef CONFIG_PREEMPT
+        lw      \reg, TI_PRE_COUNT($28)
+        addi    \reg, \reg, 1
+        sw      \reg, TI_PRE_COUNT($28)
+#endif
        mfc0    \reg, CP0_STATUS
        ori     \reg, \reg, 1
        xori    \reg, \reg, 1
        mtc0    \reg, CP0_STATUS
        irq_disable_hazard
+#ifdef CONFIG_PREEMPT
+        lw      \reg, TI_PRE_COUNT($28)
+        addi    \reg, \reg, -1
+        sw      \reg, TI_PRE_COUNT($28)
+#endif
        .endm
 #endif /* CONFIG_MIPS_MT_SMTC */
@@ -106,7 +117,7 @@
        .endm
        .macro  fpu_save_double thread status tmp
-#if defined(CONFIG_MIPS64) || defined(CONFIG_CPU_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        sll     \tmp, \status, 5
        bgez    \tmp, 10f
        fpu_save_16odd \thread
@@ -159,7 +170,7 @@
        .endm
        .macro  fpu_restore_double thread status tmp
-#if defined(CONFIG_MIPS64) || defined(CONFIG_CPU_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        sll     \tmp, \status, 5
        bgez    \tmp, 10f                               # 16 register mode?
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 6b9749540edf..58e50cbdb1a6 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -57,7 +57,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
                return 0;
        case FPU_64BIT:
-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_MIPS64))
+#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_64BIT))
                /* we only have a 32-bit FPU */
                return SIGFPE;
 #endif
diff --git a/arch/mips/include/asm/ftrace.h b/arch/mips/include/asm/ftrace.h
index ce35c9af0c28..992aaba603b5 100644
--- a/arch/mips/include/asm/ftrace.h
+++ b/arch/mips/include/asm/ftrace.h
@@ -22,12 +22,12 @@ extern void _mcount(void);
 #define safe_load(load, src, dst, error)                \
 do {                                                    \
        asm volatile (                                  \
-                "1: " load " %[" STR(dst) "], 0(%[" STR(src) "])\n"\
+                "1: " load " %[tmp_dst], 0(%[tmp_src])\n"       \
-                "   li %[" STR(error) "], 0\n"          \
+                "   li %[tmp_err], 0\n"                 \
                "2:\n"                                  \
                                                        \
                ".section .fixup, \"ax\"\n"             \
-                "3: li %[" STR(error) "], 1\n"          \
+                "3: li %[tmp_err], 1\n"                 \
                "   j 2b\n"                             \
                ".previous\n"                           \
                                                        \
@@ -35,8 +35,8 @@ do {							\
                STR(PTR) "\t1b, 3b\n\t"                 \
                ".previous\n"                           \
                                                        \
-                : [dst] "=&r" (dst), [error] "=r" (error)\
+                : [tmp_dst] "=&r" (dst), [tmp_err] "=r" (error)\
-                : [src] "r" (src)                       \
+                : [tmp_src] "r" (src)                   \
                : "memory"                              \
        );                                              \
 } while (0)
@@ -44,12 +44,12 @@ do {							\
 #define safe_store(store, src, dst, error)      \
 do {                                            \
        asm volatile (                          \
-                "1: " store " %[" STR(src) "], 0(%[" STR(dst) "])\n"\
+                "1: " store " %[tmp_src], 0(%[tmp_dst])\n"\
-                "   li %[" STR(error) "], 0\n"  \
+                "   li %[tmp_err], 0\n"         \
                "2:\n"                          \
                                                \
                ".section .fixup, \"ax\"\n"     \
-                "3: li %[" STR(error) "], 1\n"  \
+                "3: li %[tmp_err], 1\n"         \
                "   j 2b\n"                     \
                ".previous\n"                   \
                                                \
@@ -57,8 +57,8 @@ do {						\
                STR(PTR) "\t1b, 3b\n\t"         \
                ".previous\n"                   \
                                                \
-                : [error] "=r" (error)          \
+                : [tmp_err] "=r" (error)        \
-                : [dst] "r" (dst), [src] "r" (src)\
+                : [tmp_dst] "r" (dst), [tmp_src] "r" (src)\
                : "memory"                      \
        );                                      \
 } while (0)
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 33e8dbfc1b63..f35b131977e6 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -13,6 +13,7 @@
 #ifndef __ASM_MIPS_SYSCALL_H
 #define __ASM_MIPS_SYSCALL_H
+#include <linux/compiler.h>
 #include <linux/audit.h>
 #include <linux/elf-em.h>
 #include <linux/kernel.h>
@@ -39,14 +40,14 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
 #ifdef CONFIG_32BIT
        case 4: case 5: case 6: case 7:
-                return get_user(*arg, (int *)usp + 4 * n);
+                return get_user(*arg, (int *)usp + n);
 #endif
 #ifdef CONFIG_64BIT
        case 4: case 5: case 6: case 7:
 #ifdef CONFIG_MIPS32_O32
                if (test_thread_flag(TIF_32BIT_REGS))
-                        return get_user(*arg, (int *)usp + 4 * n);
+                        return get_user(*arg, (int *)usp + n);
                else
 #endif
                        *arg = regs->regs[4 + n];
@@ -57,6 +58,8 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
        default:
                BUG();
        }
+        unreachable();
 }
 static inline long syscall_get_return_value(struct task_struct *task,
@@ -83,11 +86,10 @@ static inline void syscall_get_arguments(struct task_struct *task,
                                         unsigned int i, unsigned int n,
                                         unsigned long *args)
 {
-        unsigned long arg;
        int ret;
        while (n--)
-                ret |= mips_get_syscall_arg(&arg, task, regs, i++);
+                ret |= mips_get_syscall_arg(args++, task, regs, i++);
        /*
         * No way to communicate an error because this is a void function.
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index b39ba25b41cc..f25181b19941 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -163,8 +163,8 @@ enum cop1_sdw_func {
 */
 enum cop1x_func {
        lwxc1_op     =  0x00, ldxc1_op     =  0x01,
-        pfetch_op    =  0x07, swxc1_op     =  0x08,
+        swxc1_op     =  0x08, sdxc1_op     =  0x09,
-        sdxc1_op     =  0x09, madd_s_op    =  0x20,
+        pfetch_op    =  0x0f, madd_s_op    =  0x20,
        madd_d_op    =  0x21, madd_e_op    =  0x22,
        msub_s_op    =  0x28, msub_d_op    =  0x29,
        msub_e_op    =  0x2a, nmadd_s_op   =  0x30,
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 185ba258361b..374ed74cd516 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -111,11 +111,10 @@ static int ftrace_modify_code_2(unsigned long ip, unsigned int new_code1,
        safe_store_code(new_code1, ip, faulted);
        if (unlikely(faulted))
                return -EFAULT;
-        ip += 4;
+        safe_store_code(new_code2, ip + 4, faulted);
-        safe_store_code(new_code2, ip, faulted);
        if (unlikely(faulted))
                return -EFAULT;
-        flush_icache_range(ip, ip + 8); /* original ip + 12 */
+        flush_icache_range(ip, ip + 8);
        return 0;
 }
 #endif
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 253b2fb52026..73b0ddf910d4 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -35,9 +35,9 @@
 LEAF(_save_fp_context)
        cfc1    t1, fcr31
-#if defined(CONFIG_64BIT) || defined(CONFIG_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        .set    push
-#ifdef CONFIG_MIPS32_R2
+#ifdef CONFIG_CPU_MIPS32_R2
        .set    mips64r2
        mfc0    t0, CP0_STATUS
        sll     t0, t0, 5
@@ -146,11 +146,11 @@ LEAF(_save_fp_context32)
 *  - cp1 status/control register
 */
 LEAF(_restore_fp_context)
-        EX      lw t0, SC_FPC_CSR(a0)
+        EX      lw t1, SC_FPC_CSR(a0)
-#if defined(CONFIG_64BIT) || defined(CONFIG_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        .set    push
-#ifdef CONFIG_MIPS32_R2
+#ifdef CONFIG_CPU_MIPS32_R2
        .set    mips64r2
        mfc0    t0, CP0_STATUS
        sll     t0, t0, 5
@@ -191,7 +191,7 @@ LEAF(_restore_fp_context)
        EX      ldc1 $f26, SC_FPREGS+208(a0)
        EX      ldc1 $f28, SC_FPREGS+224(a0)
        EX      ldc1 $f30, SC_FPREGS+240(a0)
-        ctc1    t0, fcr31
+        ctc1    t1, fcr31
        jr      ra
         li     v0, 0                                   # success
        END(_restore_fp_context)
@@ -199,7 +199,7 @@ LEAF(_restore_fp_context)
 #ifdef CONFIG_MIPS32_COMPAT
 LEAF(_restore_fp_context32)
        /* Restore an o32 sigcontext.  */
-        EX      lw t0, SC32_FPC_CSR(a0)
+        EX      lw t1, SC32_FPC_CSR(a0)
        mfc0    t0, CP0_STATUS
        sll     t0, t0, 5
@@ -239,7 +239,7 @@ LEAF(_restore_fp_context32)
        EX      ldc1 $f26, SC32_FPREGS+208(a0)
        EX      ldc1 $f28, SC32_FPREGS+224(a0)
        EX      ldc1 $f30, SC32_FPREGS+240(a0)
-        ctc1    t0, fcr31
+        ctc1    t1, fcr31
        jr      ra
         li     v0, 0                                   # success
        END(_restore_fp_context32)
diff --git a/arch/mips/kernel/rtlx-cmp.c b/arch/mips/kernel/rtlx-cmp.c
index 56dc69635153..758fb3cd2326 100644
--- a/arch/mips/kernel/rtlx-cmp.c
+++ b/arch/mips/kernel/rtlx-cmp.c
@@ -112,5 +112,8 @@ void __exit rtlx_module_exit(void)
        for (i = 0; i < RTLX_CHANNELS; i++)
                device_destroy(mt_class, MKDEV(major, i));
        unregister_chrdev(major, RTLX_MODULE_NAME);
+        aprp_hook = NULL;
 }
diff --git a/arch/mips/kernel/rtlx-mt.c b/arch/mips/kernel/rtlx-mt.c
index 91d61ba422b4..9c1aca00fd54 100644
--- a/arch/mips/kernel/rtlx-mt.c
+++ b/arch/mips/kernel/rtlx-mt.c
@@ -144,5 +144,8 @@ void __exit rtlx_module_exit(void)
        for (i = 0; i < RTLX_CHANNELS; i++)
                device_destroy(mt_class, MKDEV(major, i));
        unregister_chrdev(major, RTLX_MODULE_NAME);
+        aprp_hook = NULL;
 }
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 506925b2c3f3..0b4e2e38294b 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -1538,10 +1538,10 @@ static int fpux_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
                break;
        }
-        case 0x7:               /* 7 */
+        case 0x3:
-                if (MIPSInst_FUNC(ir) != pfetch_op) {
+                if (MIPSInst_FUNC(ir) != pfetch_op)
                        return SIGILL;
-                }
                /* ignore prefx operation */
                break;
diff --git a/arch/mips/mti-malta/malta-amon.c b/arch/mips/mti-malta/malta-amon.c
index 592ac0427426..84ac523b0ce0 100644
--- a/arch/mips/mti-malta/malta-amon.c
+++ b/arch/mips/mti-malta/malta-amon.c
@@ -72,7 +72,7 @@ int amon_cpu_start(int cpu,
        return 0;
 }
-#ifdef CONFIG_MIPS_VPE_LOADER
+#ifdef CONFIG_MIPS_VPE_LOADER_CMP
 int vpe_run(struct vpe *v)
 {
        struct vpe_notifications *n;
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index ca3e3a46a42f..2242181a6284 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -119,7 +119,7 @@ static void malta_hw0_irqdispatch(void)
        do_IRQ(MALTA_INT_BASE + irq);
-#ifdef MIPS_VPE_APSP_API
+#ifdef CONFIG_MIPS_VPE_APSP_API_MT
        if (aprp_hook)
                aprp_hook();
 #endif
@@ -310,7 +310,7 @@ static void ipi_call_dispatch(void)
 static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 {
-#ifdef MIPS_VPE_APSP_API
+#ifdef CONFIG_MIPS_VPE_APSP_API_CMP
        if (aprp_hook)
                aprp_hook();
 #endif
diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c
index d37be36dc659..2b91b0e61566 100644
--- a/arch/mips/pci/msi-octeon.c
+++ b/arch/mips/pci/msi-octeon.c
@@ -150,6 +150,7 @@ msi_irq_allocated:
                msg.address_lo =
                        ((128ul << 20) + CVMX_PCI_MSI_RCV) & 0xffffffff;
                msg.address_hi = ((128ul << 20) + CVMX_PCI_MSI_RCV) >> 32;
+                break;
        case OCTEON_DMA_BAR_TYPE_BIG:
                /* When using big bar, Bar 0 is based at 0 */
                msg.address_lo = (0 + CVMX_PCI_MSI_RCV) & 0xffffffff;
diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index 637fe031aa84..60d5d174dfe4 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -32,17 +32,6 @@ void copy_page_asm(void *to, void *from);
 void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
                        struct page *pg);
-/* #define CONFIG_PARISC_TMPALIAS */
-#ifdef CONFIG_PARISC_TMPALIAS
-void clear_user_highpage(struct page *page, unsigned long vaddr);
-#define clear_user_highpage clear_user_highpage
-struct vm_area_struct;
-void copy_user_highpage(struct page *to, struct page *from,
-        unsigned long vaddr, struct vm_area_struct *vma);
-#define __HAVE_ARCH_COPY_USER_HIGHPAGE
-#endif
 /*
 * These are used to make use of C type-checking..
 */
diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
index 3516e0b27044..64f2992e439f 100644
--- a/arch/parisc/include/asm/spinlock.h
+++ b/arch/parisc/include/asm/spinlock.h
@@ -191,8 +191,4 @@ static __inline__ int arch_write_can_lock(arch_rwlock_t *rw)
 #define arch_read_lock_flags(lock, flags) arch_read_lock(lock)
 #define arch_write_lock_flags(lock, flags) arch_write_lock(lock)
-#define arch_spin_relax(lock)   cpu_relax()
-#define arch_read_relax(lock)   cpu_relax()
-#define arch_write_relax(lock)  cpu_relax()
 #endif /* __ASM_SPINLOCK_H */
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 42706794a36f..265ae5190b0a 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -828,13 +828,13 @@
 #define __NR_finit_module       (__NR_Linux + 333)
 #define __NR_sched_setattr      (__NR_Linux + 334)
 #define __NR_sched_getattr      (__NR_Linux + 335)
+#define __NR_utimes             (__NR_Linux + 336)
-#define __NR_Linux_syscalls     (__NR_sched_getattr + 1)
+#define __NR_Linux_syscalls     (__NR_utimes + 1)
 #define __IGNORE_select         /* newselect */
 #define __IGNORE_fadvise64      /* fadvise64_64 */
-#define __IGNORE_utimes         /* utime */
 #define HPUX_GATEWAY_ADDR       0xC0000004
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index ac87a40502e6..a6ffc775a9f8 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -581,67 +581,3 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
        }
 }
-#ifdef CONFIG_PARISC_TMPALIAS
-void clear_user_highpage(struct page *page, unsigned long vaddr)
-{
-        void *vto;
-        unsigned long flags;
-        /* Clear using TMPALIAS region.  The page doesn't need to
-           be flushed but the kernel mapping needs to be purged.  */
-        vto = kmap_atomic(page);
-        /* The PA-RISC 2.0 Architecture book states on page F-6:
-           "Before a write-capable translation is enabled, *all*
-           non-equivalently-aliased translations must be removed
-           from the page table and purged from the TLB.  (Note
-           that the caches are not required to be flushed at this
-           time.)  Before any non-equivalent aliased translation
-           is re-enabled, the virtual address range for the writeable
-           page (the entire page) must be flushed from the cache,
-           and the write-capable translation removed from the page
-           table and purged from the TLB."  */
-        purge_kernel_dcache_page_asm((unsigned long)vto);
-        purge_tlb_start(flags);
-        pdtlb_kernel(vto);
-        purge_tlb_end(flags);
-        preempt_disable();
-        clear_user_page_asm(vto, vaddr);
-        preempt_enable();
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER0); */
-}
-void copy_user_highpage(struct page *to, struct page *from,
-        unsigned long vaddr, struct vm_area_struct *vma)
-{
-        void *vfrom, *vto;
-        unsigned long flags;
-        /* Copy using TMPALIAS region.  This has the advantage
-           that the `from' page doesn't need to be flushed.  However,
-           the `to' page must be flushed in copy_user_page_asm since
-           it can be used to bring in executable code.  */
-        vfrom = kmap_atomic(from);
-        vto = kmap_atomic(to);
-        purge_kernel_dcache_page_asm((unsigned long)vto);
-        purge_tlb_start(flags);
-        pdtlb_kernel(vto);
-        pdtlb_kernel(vfrom);
-        purge_tlb_end(flags);
-        preempt_disable();
-        copy_user_page_asm(vto, vfrom, vaddr);
-        flush_dcache_page_asm(__pa(vto), vaddr);
-        preempt_enable();
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER1); */
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER0); */
-}
-#endif /* CONFIG_PARISC_TMPALIAS */
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 8fa3fbb3e4d3..80e5dd248934 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -431,6 +431,7 @@
        ENTRY_SAME(finit_module)
        ENTRY_SAME(sched_setattr)
        ENTRY_SAME(sched_getattr)       /* 335 */
+        ENTRY_COMP(utimes)
        /* Nothing yet */
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index e66d4ec04d95..818dce344e82 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1504,73 +1504,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 1:      addi    r8,r8,16
        .endr
-        /* Save DEC */
-        mfspr   r5,SPRN_DEC
-        mftb    r6
-        extsw   r5,r5
-        add     r5,r5,r6
-        std     r5,VCPU_DEC_EXPIRES(r9)
-BEGIN_FTR_SECTION
-        b       8f
-END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
-        /* Turn on TM so we can access TFHAR/TFIAR/TEXASR */
-        mfmsr   r8
-        li      r0, 1
-        rldimi  r8, r0, MSR_TM_LG, 63-MSR_TM_LG
-        mtmsrd  r8
-        /* Save POWER8-specific registers */
-        mfspr   r5, SPRN_IAMR
-        mfspr   r6, SPRN_PSPB
-        mfspr   r7, SPRN_FSCR
-        std     r5, VCPU_IAMR(r9)
-        stw     r6, VCPU_PSPB(r9)
-        std     r7, VCPU_FSCR(r9)
-        mfspr   r5, SPRN_IC
-        mfspr   r6, SPRN_VTB
-        mfspr   r7, SPRN_TAR
-        std     r5, VCPU_IC(r9)
-        std     r6, VCPU_VTB(r9)
-        std     r7, VCPU_TAR(r9)
-#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-        mfspr   r5, SPRN_TFHAR
-        mfspr   r6, SPRN_TFIAR
-        mfspr   r7, SPRN_TEXASR
-        std     r5, VCPU_TFHAR(r9)
-        std     r6, VCPU_TFIAR(r9)
-        std     r7, VCPU_TEXASR(r9)
-#endif
-        mfspr   r8, SPRN_EBBHR
-        std     r8, VCPU_EBBHR(r9)
-        mfspr   r5, SPRN_EBBRR
-        mfspr   r6, SPRN_BESCR
-        mfspr   r7, SPRN_CSIGR
-        mfspr   r8, SPRN_TACR
-        std     r5, VCPU_EBBRR(r9)
-        std     r6, VCPU_BESCR(r9)
-        std     r7, VCPU_CSIGR(r9)
-        std     r8, VCPU_TACR(r9)
-        mfspr   r5, SPRN_TCSCR
-        mfspr   r6, SPRN_ACOP
-        mfspr   r7, SPRN_PID
-        mfspr   r8, SPRN_WORT
-        std     r5, VCPU_TCSCR(r9)
-        std     r6, VCPU_ACOP(r9)
-        stw     r7, VCPU_GUEST_PID(r9)
-        std     r8, VCPU_WORT(r9)
-8:
-        /* Save and reset AMR and UAMOR before turning on the MMU */
-BEGIN_FTR_SECTION
-        mfspr   r5,SPRN_AMR
-        mfspr   r6,SPRN_UAMOR
-        std     r5,VCPU_AMR(r9)
-        std     r6,VCPU_UAMOR(r9)
-        li      r6,0
-        mtspr   SPRN_AMR,r6
-END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
        /* Unset guest mode */
        li      r0, KVM_GUEST_MODE_NONE
        stb     r0, HSTATE_IN_GUEST(r13)
@@ -2203,7 +2136,7 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
        mfspr   r6,SPRN_VRSAVE
-        stw     r6,VCPU_VRSAVE(r3)
+        stw     r6,VCPU_VRSAVE(r31)
        mtlr    r30
        mtmsrd  r5
        isync
@@ -2240,7 +2173,7 @@ BEGIN_FTR_SECTION
        bl      .load_vr_state
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
-        lwz     r7,VCPU_VRSAVE(r4)
+        lwz     r7,VCPU_VRSAVE(r31)
        mtspr   SPRN_VRSAVE,r7
        mtlr    r30
        mr      r4,r31
diff --git a/arch/powerpc/platforms/cell/ras.c b/arch/powerpc/platforms/cell/ras.c
index 5ec1e47a0d77..e865d748179b 100644
--- a/arch/powerpc/platforms/cell/ras.c
+++ b/arch/powerpc/platforms/cell/ras.c
@@ -123,7 +123,8 @@ static int __init cbe_ptcal_enable_on_node(int nid, int order)
        area->nid = nid;
        area->order = order;
-        area->pages = alloc_pages_exact_node(area->nid, GFP_KERNEL|GFP_THISNODE,
+        area->pages = alloc_pages_exact_node(area->nid,
+                                                GFP_KERNEL|__GFP_THISNODE,
                                                area->order);
        if (!area->pages) {
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 5bc3a15465c7..85d5255d259f 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -861,14 +861,12 @@ static struct asoc_simple_card_info fsi_da7210_info = {
        .card           = "FSIB-DA7210",
        .codec          = "da7210.0-001a",
        .platform       = "sh_fsi.0",
-        .daifmt         = SND_SOC_DAIFMT_I2S,
+        .daifmt         = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBM_CFM,
        .cpu_dai = {
                .name   = "fsib-dai",
-                .fmt    = SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_IB_NF,
        },
        .codec_dai = {
                .name   = "da7210-hifi",
-                .fmt    = SND_SOC_DAIFMT_CBM_CFM,
        },
 };
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 21e4230659a5..1162bc6945a3 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -304,14 +304,12 @@ static struct asoc_simple_card_info fsi_ak4642_info = {
        .card           = "FSIA-AK4642",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi.0",
-        .daifmt         = SND_SOC_DAIFMT_LEFT_J,
+        .daifmt         = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM,
        .cpu_dai = {
                .name   = "fsia-dai",
-                .fmt    = SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_IB_NF,
        },
        .codec_dai = {
                .name   = "ak4642-hifi",
-                .fmt    = SND_SOC_DAIFMT_CBM_CFM,
                .sysclk = 11289600,
        },
 };
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 32a280ec38c1..d7b4967f8fa6 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -58,9 +58,12 @@ void arch_cpu_idle(void)
 {
        if (tlb_type != hypervisor) {
                touch_nmi_watchdog();
+                local_irq_enable();
        } else {
                unsigned long pstate;
+                local_irq_enable();
                /* The sun4v sleeping code requires that we have PSTATE.IE cleared over
                 * the cpu sleep hypervisor call.
                 */
@@ -82,7 +85,6 @@ void arch_cpu_idle(void)
                        : "=&r" (pstate)
                        : "i" (PSTATE_IE));
        }
-        local_irq_enable();
 }
 #ifdef CONFIG_HOTPLUG_CPU
diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
index 87729fff13b9..33a17e7b3ccd 100644
--- a/arch/sparc/kernel/syscalls.S
+++ b/arch/sparc/kernel/syscalls.S
@@ -189,7 +189,8 @@ linux_sparc_syscall32:
         mov    %i0, %l5                                ! IEU1
 5:      call    %l7                                     ! CTI   Group brk forced
         srl    %i5, 0, %o5                             ! IEU1
-        ba,a,pt %xcc, 3f
+        ba,pt   %xcc, 3f
+         sra    %o0, 0, %o0
        /* Linux native system calls enter here... */
        .align  32
@@ -217,7 +218,6 @@ linux_sparc_syscall:
 3:      stx     %o0, [%sp + PTREGS_OFF + PT_V9_I0]
 ret_sys_call:
        ldx     [%sp + PTREGS_OFF + PT_V9_TSTATE], %g3
-        sra     %o0, 0, %o0
        mov     %ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2
        sllx    %g2, 32, %g2
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index 3b3a360b429a..f5d506fdddad 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -273,7 +273,7 @@ void __init pgtable_cache_init(void)
                prom_halt();
        }
-        for (i = 0; i < 8; i++) {
+        for (i = 0; i < ARRAY_SIZE(tsb_cache_names); i++) {
                unsigned long size = 8192 << i;
                const char *name = tsb_cache_names[i];
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index c026cca5602c..f3aaf231b4e5 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -341,10 +341,6 @@ config X86_USE_3DNOW
        def_bool y
        depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
-config X86_OOSTORE
-        def_bool y
-        depends on (MWINCHIP3D || MWINCHIPC6) && MTRR
 #
 # P6_NOPs are a relatively minor optimization that require a family >=
 # 6 processor, except that it is broken on certain VIA chips.
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 04a48903b2eb..69bbb4845020 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -85,11 +85,7 @@
 #else
 # define smp_rmb()      barrier()
 #endif
-#ifdef CONFIG_X86_OOSTORE
+#define smp_wmb()       barrier()
-# define smp_wmb()      wmb()
-#else
-# define smp_wmb()      barrier()
-#endif
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
 #else /* !SMP */
@@ -100,7 +96,7 @@
 #define set_mb(var, value) do { var = value; barrier(); } while (0)
 #endif /* SMP */
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
 /*
 * For either of these options x86 doesn't have a strong TSO memory
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 34f69cb9350a..91d9c69a629e 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -237,7 +237,7 @@ memcpy_toio(volatile void __iomem *dst, const void *src, size_t count)
 static inline void flush_write_buffers(void)
 {
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
        asm volatile("lock; addl $0,0(%%esp)": : :"memory");
 #endif
 }
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index bf156ded74b5..0f62f5482d91 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -26,10 +26,9 @@
 # define LOCK_PTR_REG "D"
 #endif
-#if defined(CONFIG_X86_32) && \
+#if defined(CONFIG_X86_32) && (defined(CONFIG_X86_PPRO_FENCE))
-        (defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE))
 /*
- * On PPro SMP or if we are using OOSTORE, we use a locked operation to unlock
+ * On PPro SMP, we use a locked operation to unlock
 * (PPro errata 66, 92)
 */
 # define UNLOCK_LOCK_PREFIX LOCK_PREFIX
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index fd972a3e4cbb..9fa8aa051f54 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -18,7 +18,6 @@
 #include <linux/pci_ids.h>
 #include <linux/pci.h>
 #include <linux/bitops.h>
-#include <linux/ioport.h>
 #include <linux/suspend.h>
 #include <asm/e820.h>
 #include <asm/io.h>
@@ -54,18 +53,6 @@ int fallback_aper_force __initdata;
 int fix_aperture __initdata = 1;
-static struct resource gart_resource = {
-        .name   = "GART",
-        .flags  = IORESOURCE_MEM,
-};
-static void __init insert_aperture_resource(u32 aper_base, u32 aper_size)
-{
-        gart_resource.start = aper_base;
-        gart_resource.end = aper_base + aper_size - 1;
-        insert_resource(&iomem_resource, &gart_resource);
-}
 /* This code runs before the PCI subsystem is initialized, so just
   access the northbridge directly. */
@@ -96,7 +83,6 @@ static u32 __init allocate_aperture(void)
        memblock_reserve(addr, aper_size);
        printk(KERN_INFO "Mapping aperture over %d KB of RAM @ %lx\n",
                        aper_size >> 10, addr);
-        insert_aperture_resource((u32)addr, aper_size);
        register_nosave_region(addr >> PAGE_SHIFT,
                               (addr+aper_size) >> PAGE_SHIFT);
@@ -444,12 +430,8 @@ int __init gart_iommu_hole_init(void)
 out:
        if (!fix && !fallback_aper_force) {
-                if (last_aper_base) {
+                if (last_aper_base)
-                        unsigned long n = (32 * 1024 * 1024) << last_aper_order;
-                        insert_aperture_resource((u32)last_aper_base, n);
                        return 1;
-                }
                return 0;
        }
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index 8779edab684e..d8fba5c15fbd 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -8,236 +8,6 @@
 #include "cpu.h"
-#ifdef CONFIG_X86_OOSTORE
-static u32 power2(u32 x)
-{
-        u32 s = 1;
-        while (s <= x)
-                s <<= 1;
-        return s >>= 1;
-}
-/*
- * Set up an actual MCR
- */
-static void centaur_mcr_insert(int reg, u32 base, u32 size, int key)
-{
-        u32 lo, hi;
-        hi = base & ~0xFFF;
-        lo = ~(size-1);         /* Size is a power of 2 so this makes a mask */
-        lo &= ~0xFFF;           /* Remove the ctrl value bits */
-        lo |= key;              /* Attribute we wish to set */
-        wrmsr(reg+MSR_IDT_MCR0, lo, hi);
-        mtrr_centaur_report_mcr(reg, lo, hi);   /* Tell the mtrr driver */
-}
-/*
- * Figure what we can cover with MCR's
- *
- * Shortcut: We know you can't put 4Gig of RAM on a winchip
- */
-static u32 ramtop(void)
-{
-        u32 clip = 0xFFFFFFFFUL;
-        u32 top = 0;
-        int i;
-        for (i = 0; i < e820.nr_map; i++) {
-                unsigned long start, end;
-                if (e820.map[i].addr > 0xFFFFFFFFUL)
-                        continue;
-                /*
-                 * Don't MCR over reserved space. Ignore the ISA hole
-                 * we frob around that catastrophe already
-                 */
-                if (e820.map[i].type == E820_RESERVED) {
-                        if (e820.map[i].addr >= 0x100000UL &&
-                            e820.map[i].addr < clip)
-                                clip = e820.map[i].addr;
-                        continue;
-                }
-                start = e820.map[i].addr;
-                end = e820.map[i].addr + e820.map[i].size;
-                if (start >= end)
-                        continue;
-                if (end > top)
-                        top = end;
-        }
-        /*
-         * Everything below 'top' should be RAM except for the ISA hole.
-         * Because of the limited MCR's we want to map NV/ACPI into our
-         * MCR range for gunk in RAM
-         *
-         * Clip might cause us to MCR insufficient RAM but that is an
-         * acceptable failure mode and should only bite obscure boxes with
-         * a VESA hole at 15Mb
-         *
-         * The second case Clip sometimes kicks in is when the EBDA is marked
-         * as reserved. Again we fail safe with reasonable results
-         */
-        if (top > clip)
-                top = clip;
-        return top;
-}
-/*
- * Compute a set of MCR's to give maximum coverage
- */
-static int centaur_mcr_compute(int nr, int key)
-{
-        u32 mem = ramtop();
-        u32 root = power2(mem);
-        u32 base = root;
-        u32 top = root;
-        u32 floor = 0;
-        int ct = 0;
-        while (ct < nr) {
-                u32 fspace = 0;
-                u32 high;
-                u32 low;
-                /*
-                 * Find the largest block we will fill going upwards
-                 */
-                high = power2(mem-top);
-                /*
-                 * Find the largest block we will fill going downwards
-                 */
-                low = base/2;
-                /*
-                 * Don't fill below 1Mb going downwards as there
-                 * is an ISA hole in the way.
-                 */
-                if (base <= 1024*1024)
-                        low = 0;
-                /*
-                 * See how much space we could cover by filling below
-                 * the ISA hole
-                 */
-                if (floor == 0)
-                        fspace = 512*1024;
-                else if (floor == 512*1024)
-                        fspace = 128*1024;
-                /* And forget ROM space */
-                /*
-                 * Now install the largest coverage we get
-                 */
-                if (fspace > high && fspace > low) {
-                        centaur_mcr_insert(ct, floor, fspace, key);
-                        floor += fspace;
-                } else if (high > low) {
-                        centaur_mcr_insert(ct, top, high, key);
-                        top += high;
-                } else if (low > 0) {
-                        base -= low;
-                        centaur_mcr_insert(ct, base, low, key);
-                } else
-                        break;
-                ct++;
-        }
-        /*
-         * We loaded ct values. We now need to set the mask. The caller
-         * must do this bit.
-         */
-        return ct;
-}
-static void centaur_create_optimal_mcr(void)
-{
-        int used;
-        int i;
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining and weak write ordered.
-         *
-         * To experiment with: Linux never uses stack operations for
-         * mmio spaces so we could globally enable stack operation wc
-         *
-         * Load the registers with type 31 - full write combining, all
-         * writes weakly ordered.
-         */
-        used = centaur_mcr_compute(6, 31);
-        /*
-         * Wipe unused MCRs
-         */
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-static void winchip2_create_optimal_mcr(void)
-{
-        u32 lo, hi;
-        int used;
-        int i;
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining, weak store ordered.
-         *
-         * Load the registers with type 25
-         *      8       -       weak write ordering
-         *      16      -       weak read ordering
-         *      1       -       write combining
-         */
-        used = centaur_mcr_compute(6, 25);
-        /*
-         * Mark the registers we are using.
-         */
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        for (i = 0; i < used; i++)
-                lo |= 1<<(9+i);
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        /*
-         * Wipe unused MCRs
-         */
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-/*
- * Handle the MCR key on the Winchip 2.
- */
-static void winchip2_unprotect_mcr(void)
-{
-        u32 lo, hi;
-        u32 key;
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        key = (lo>>17) & 7;
-        lo |= key<<6;   /* replace with unlock key */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-static void winchip2_protect_mcr(void)
-{
-        u32 lo, hi;
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-#endif /* CONFIG_X86_OOSTORE */
 #define ACE_PRESENT     (1 << 6)
 #define ACE_ENABLED     (1 << 7)
 #define ACE_FCR         (1 << 28)       /* MSR_VIA_FCR */
@@ -362,20 +132,6 @@ static void init_centaur(struct cpuinfo_x86 *c)
                        fcr_clr = DPDC;
                        printk(KERN_NOTICE "Disabling bugged TSC.\n");
                        clear_cpu_cap(c, X86_FEATURE_TSC);
-#ifdef CONFIG_X86_OOSTORE
-                        centaur_create_optimal_mcr();
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         *
-                         * The C6 original lacks weak read order
-                         *
-                         * Note 0x120 is write only on Winchip 1
-                         */
-                        wrmsr(MSR_IDT_MCR_CTRL, 0x01F0001F, 0);
-#endif
                        break;
                case 8:
                        switch (c->x86_mask) {
@@ -392,40 +148,12 @@ static void init_centaur(struct cpuinfo_x86 *c)
                        fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                  E2MMX|EAMD3D;
                        fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                        break;
                case 9:
                        name = "3";
                        fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                  E2MMX|EAMD3D;
                        fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                        break;
                default:
                        name = "??";
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index c88f7f4b03ee..047f540cf3f7 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -3334,6 +3334,8 @@ static int __init uncore_type_init(struct intel_uncore_type *type)
        if (!pmus)
                return -ENOMEM;
+        type->pmus = pmus;
        type->unconstrainted = (struct event_constraint)
                __EVENT_CONSTRAINT(0, (1ULL << type->num_counters) - 1,
                                0, type->num_counters, 0, 0);
@@ -3369,7 +3371,6 @@ static int __init uncore_type_init(struct intel_uncore_type *type)
        }
        type->pmu_group = &uncore_pmu_attr_group;
-        type->pmus = pmus;
        return 0;
 fail:
        uncore_type_exit(type);
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index e8368c6dd2a2..d5dd80814419 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -86,10 +86,19 @@ EXPORT_SYMBOL(__kernel_fpu_begin);
 void __kernel_fpu_end(void)
 {
-        if (use_eager_fpu())
+        if (use_eager_fpu()) {
-                math_state_restore();
+                /*
-        else
+                 * For eager fpu, most the time, tsk_used_math() is true.
+                 * Restore the user math as we are done with the kernel usage.
+                 * At few instances during thread exit, signal handling etc,
+                 * tsk_used_math() is false. Those few places will take proper
+                 * actions, so we don't need to restore the math here.
+                 */
+                if (likely(tsk_used_math(current)))
+                        math_state_restore();
+        } else {
                stts();
+        }
 }
 EXPORT_SYMBOL(__kernel_fpu_end);
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index 7c6acd4b8995..ff898bbf579d 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -529,7 +529,7 @@ static void quirk_amd_nb_node(struct pci_dev *dev)
                return;
        pci_read_config_dword(nb_ht, 0x60, &val);
-        node = val & 7;
+        node = pcibus_to_node(dev->bus) | (val & 7);
        /*
         * Some hardware may return an invalid node ID,
         * so check it first:
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e81df8fce027..2de1bc09a8d4 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3002,10 +3002,8 @@ static int cr8_write_interception(struct vcpu_svm *svm)
        u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
        /* instruction emulation calls kvm_set_cr8() */
        r = cr_interception(svm);
-        if (irqchip_in_kernel(svm->vcpu.kvm)) {
+        if (irqchip_in_kernel(svm->vcpu.kvm))
-                clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
                return r;
-        }
        if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
                return r;
        kvm_run->exit_reason = KVM_EXIT_SET_TPR;
@@ -3567,6 +3565,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
        if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
                return;
+        clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
        if (irr == -1)
                return;
diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
index 877b9a1b2152..01495755701b 100644
--- a/arch/x86/net/bpf_jit.S
+++ b/arch/x86/net/bpf_jit.S
@@ -140,7 +140,7 @@ bpf_slow_path_byte_msh:
        push    %r9;                                            \
        push    SKBDATA;                                        \
 /* rsi already has offset */                                    \
-        mov     $SIZE,%ecx;     /* size */                      \
+        mov     $SIZE,%edx;     /* size */                      \
        call    bpf_internal_load_pointer_neg_helper;           \
        test    %rax,%rax;                                      \
        pop     SKBDATA;                                        \
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
index 7d01b8c56c00..cc04e67bfd05 100644
--- a/arch/x86/um/asm/barrier.h
+++ b/arch/x86/um/asm/barrier.h
@@ -40,11 +40,7 @@
 #define smp_rmb()       barrier()
 #endif /* CONFIG_X86_PPRO_FENCE */
-#ifdef CONFIG_X86_OOSTORE
-#define smp_wmb()       wmb()
-#else /* CONFIG_X86_OOSTORE */
 #define smp_wmb()       barrier()
-#endif /* CONFIG_X86_OOSTORE */
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
diff --git a/block/blk-core.c b/block/blk-core.c
index 853f92749202..bfe16d5af9f9 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -693,20 +693,11 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
        if (!uninit_q)
                return NULL;
-        uninit_q->flush_rq = kzalloc(sizeof(struct request), GFP_KERNEL);
-        if (!uninit_q->flush_rq)
-                goto out_cleanup_queue;
        q = blk_init_allocated_queue(uninit_q, rfn, lock);
        if (!q)
-                goto out_free_flush_rq;
+                blk_cleanup_queue(uninit_q);
-        return q;
-out_free_flush_rq:
+        return q;
-        kfree(uninit_q->flush_rq);
-out_cleanup_queue:
-        blk_cleanup_queue(uninit_q);
-        return NULL;
 }
 EXPORT_SYMBOL(blk_init_queue_node);
@@ -717,9 +708,13 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
        if (!q)
                return NULL;
-        if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
+        q->flush_rq = kzalloc(sizeof(struct request), GFP_KERNEL);
+        if (!q->flush_rq)
                return NULL;
+        if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
+                goto fail;
        q->request_fn           = rfn;
        q->prep_rq_fn           = NULL;
        q->unprep_rq_fn         = NULL;
@@ -742,12 +737,16 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
        /* init elevator */
        if (elevator_init(q, NULL)) {
                mutex_unlock(&q->sysfs_lock);
-                return NULL;
+                goto fail;
        }
        mutex_unlock(&q->sysfs_lock);
        return q;
+fail:
+        kfree(q->flush_rq);
+        return NULL;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);
diff --git a/block/blk-flush.c b/block/blk-flush.c
index f598f794c3c6..43e6b4755e9a 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -140,14 +140,17 @@ static void mq_flush_run(struct work_struct *work)
        blk_mq_insert_request(rq, false, true, false);
 }
-static bool blk_flush_queue_rq(struct request *rq)
+static bool blk_flush_queue_rq(struct request *rq, bool add_front)
 {
        if (rq->q->mq_ops) {
                INIT_WORK(&rq->mq_flush_work, mq_flush_run);
                kblockd_schedule_work(rq->q, &rq->mq_flush_work);
                return false;
        } else {
-                list_add_tail(&rq->queuelist, &rq->q->queue_head);
+                if (add_front)
+                        list_add(&rq->queuelist, &rq->q->queue_head);
+                else
+                        list_add_tail(&rq->queuelist, &rq->q->queue_head);
                return true;
        }
 }
@@ -193,7 +196,7 @@ static bool blk_flush_complete_seq(struct request *rq, unsigned int seq,
        case REQ_FSEQ_DATA:
                list_move_tail(&rq->flush.list, &q->flush_data_in_flight);
-                queued = blk_flush_queue_rq(rq);
+                queued = blk_flush_queue_rq(rq, true);
                break;
        case REQ_FSEQ_DONE:
@@ -326,7 +329,7 @@ static bool blk_kick_flush(struct request_queue *q)
        q->flush_rq->rq_disk = first_rq->rq_disk;
        q->flush_rq->end_io = flush_end_io;
-        return blk_flush_queue_rq(q->flush_rq);
+        return blk_flush_queue_rq(q->flush_rq, false);
 }
 static void flush_data_end_io(struct request *rq, int error)
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index b718806657cd..c40fb2e81bbc 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -71,6 +71,17 @@ static int acpi_sleep_prepare(u32 acpi_state)
        return 0;
 }
+static bool acpi_sleep_state_supported(u8 sleep_state)
+{
+        acpi_status status;
+        u8 type_a, type_b;
+        status = acpi_get_sleep_type_data(sleep_state, &type_a, &type_b);
+        return ACPI_SUCCESS(status) && (!acpi_gbl_reduced_hardware
+                || (acpi_gbl_FADT.sleep_control.address
+                        && acpi_gbl_FADT.sleep_status.address));
+}
 #ifdef CONFIG_ACPI_SLEEP
 static u32 acpi_target_sleep_state = ACPI_STATE_S0;
@@ -604,15 +615,9 @@ static void acpi_sleep_suspend_setup(void)
 {
        int i;
-        for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++) {
+        for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++)
-                acpi_status status;
+                if (acpi_sleep_state_supported(i))
-                u8 type_a, type_b;
-                status = acpi_get_sleep_type_data(i, &type_a, &type_b);
-                if (ACPI_SUCCESS(status)) {
                        sleep_states[i] = 1;
-                }
-        }
        suspend_set_ops(old_suspend_ordering ?
                &acpi_suspend_ops_old : &acpi_suspend_ops);
@@ -740,11 +745,7 @@ static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
 static void acpi_sleep_hibernate_setup(void)
 {
-        acpi_status status;
+        if (!acpi_sleep_state_supported(ACPI_STATE_S4))
-        u8 type_a, type_b;
-        status = acpi_get_sleep_type_data(ACPI_STATE_S4, &type_a, &type_b);
-        if (ACPI_FAILURE(status))
                return;
        hibernation_set_ops(old_suspend_ordering ?
@@ -793,8 +794,6 @@ static void acpi_power_off(void)
 int __init acpi_sleep_init(void)
 {
-        acpi_status status;
-        u8 type_a, type_b;
        char supported[ACPI_S_STATE_COUNT * 3 + 1];
        char *pos = supported;
        int i;
@@ -806,8 +805,7 @@ int __init acpi_sleep_init(void)
        acpi_sleep_suspend_setup();
        acpi_sleep_hibernate_setup();
-        status = acpi_get_sleep_type_data(ACPI_STATE_S5, &type_a, &type_b);
+        if (acpi_sleep_state_supported(ACPI_STATE_S5)) {
-        if (ACPI_SUCCESS(status)) {
                sleep_states[ACPI_STATE_S5] = 1;
                pm_power_off_prepare = acpi_power_off_prepare;
                pm_power_off = acpi_power_off;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 65d3f1b5966c..8cb2522d592a 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4225,8 +4225,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        /* devices that don't properly handle queued TRIM commands */
        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD3",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
        /*
         * Some WD SATA-I drives spin up and down erratically when the link
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 516026954be6..d777bb7cea93 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4498,7 +4498,7 @@ static int mtip_pci_probe(struct pci_dev *pdev,
        }
        dev_info(&pdev->dev, "NUMA node %d (closest: %d,%d, probe on %d:%d)\n",
                my_node, pcibus_to_node(pdev->bus), dev_to_node(&pdev->dev),
-                cpu_to_node(smp_processor_id()), smp_processor_id());
+                cpu_to_node(raw_smp_processor_id()), raw_smp_processor_id());
        dd = kzalloc_node(sizeof(struct driver_data), GFP_KERNEL, my_node);
        if (dd == NULL) {
diff --git a/drivers/clocksource/vf_pit_timer.c b/drivers/clocksource/vf_pit_timer.c
index 02821b06a39e..a918bc481c52 100644
--- a/drivers/clocksource/vf_pit_timer.c
+++ b/drivers/clocksource/vf_pit_timer.c
@@ -54,7 +54,7 @@ static inline void pit_irq_acknowledge(void)
 static u64 pit_read_sched_clock(void)
 {
-        return __raw_readl(clksrc_base + PITCVAL);
+        return ~__raw_readl(clksrc_base + PITCVAL);
 }
 static int __init pit_clocksource_init(unsigned long rate)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index cf485d928903..199b52b7c3e1 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1129,7 +1129,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                per_cpu(cpufreq_cpu_data, j) = policy;
        write_unlock_irqrestore(&cpufreq_driver_lock, flags);
-        if (cpufreq_driver->get) {
+        if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
                policy->cur = cpufreq_driver->get(policy->cpu);
                if (!policy->cur) {
                        pr_err("%s: ->get() failed\n", __func__);
@@ -2143,7 +2143,7 @@ int cpufreq_update_policy(unsigned int cpu)
         * BIOS might change freq behind our back
         * -> ask driver for current freq and notify governors about a change
         */
-        if (cpufreq_driver->get) {
+        if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
                new_policy.cur = cpufreq_driver->get(cpu);
                if (!policy->cur) {
                        pr_debug("Driver did not initialize current freq");
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index 5736aaa7e86c..f7af69bcf3f4 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -468,8 +468,8 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver)
        } else {
                list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list,
                                         legacy_dev_list) {
-                        drm_put_dev(dev);
                        list_del(&dev->legacy_dev_list);
+                        drm_put_dev(dev);
                }
        }
        DRM_INFO("Module unloaded\n");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 215131ab1dd2..c204b4e3356e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -172,20 +172,24 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
        ret = exynos_drm_subdrv_open(dev, file);
        if (ret)
-                goto out;
+                goto err_file_priv_free;
        anon_filp = anon_inode_getfile("exynos_gem", &exynos_drm_gem_fops,
                                        NULL, 0);
        if (IS_ERR(anon_filp)) {
                ret = PTR_ERR(anon_filp);
-                goto out;
+                goto err_subdrv_close;
        }
        anon_filp->f_mode = FMODE_READ | FMODE_WRITE;
        file_priv->anon_filp = anon_filp;
        return ret;
-out:
+err_subdrv_close:
+        exynos_drm_subdrv_close(dev, file);
+err_file_priv_free:
        kfree(file_priv);
        file->driver_priv = NULL;
        return ret;
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index d58b4e287e32..28d24caa49f3 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -214,6 +214,13 @@ int i915_gem_init_stolen(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        int bios_reserved = 0;
+#ifdef CONFIG_INTEL_IOMMU
+        if (intel_iommu_gfx_mapped) {
+                DRM_INFO("DMAR active, disabling use of stolen memory\n");
+                return 0;
+        }
+#endif
        if (dev_priv->gtt.stolen_size == 0)
                return 0;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 9fec71175571..d554169ac592 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -618,33 +618,25 @@ static u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
 /* raw reads, only for fast reads of display block, no need for forcewake etc. */
 #define __raw_i915_read32(dev_priv__, reg__) readl((dev_priv__)->regs + (reg__))
-#define __raw_i915_read16(dev_priv__, reg__) readw((dev_priv__)->regs + (reg__))
 static bool ilk_pipe_in_vblank_locked(struct drm_device *dev, enum pipe pipe)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        uint32_t status;
+        int reg;
-        if (INTEL_INFO(dev)->gen < 7) {
-                status = pipe == PIPE_A ?
+        if (INTEL_INFO(dev)->gen >= 8) {
-                        DE_PIPEA_VBLANK :
+                status = GEN8_PIPE_VBLANK;
-                        DE_PIPEB_VBLANK;
+                reg = GEN8_DE_PIPE_ISR(pipe);
+        } else if (INTEL_INFO(dev)->gen >= 7) {
+                status = DE_PIPE_VBLANK_IVB(pipe);
+                reg = DEISR;
        } else {
-                switch (pipe) {
+                status = DE_PIPE_VBLANK(pipe);
-                default:
+                reg = DEISR;
-                case PIPE_A:
-                        status = DE_PIPEA_VBLANK_IVB;
-                        break;
-                case PIPE_B:
-                        status = DE_PIPEB_VBLANK_IVB;
-                        break;
-                case PIPE_C:
-                        status = DE_PIPEC_VBLANK_IVB;
-                        break;
-                }
        }
-        return __raw_i915_read32(dev_priv, DEISR) & status;
+        return __raw_i915_read32(dev_priv, reg) & status;
 }
 static int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
@@ -702,7 +694,28 @@ static int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
                else
                        position = __raw_i915_read32(dev_priv, PIPEDSL(pipe)) & DSL_LINEMASK_GEN3;
-                if (HAS_PCH_SPLIT(dev)) {
+                if (HAS_DDI(dev)) {
+                        /*
+                         * On HSW HDMI outputs there seems to be a 2 line
+                         * difference, whereas eDP has the normal 1 line
+                         * difference that earlier platforms have. External
+                         * DP is unknown. For now just check for the 2 line
+                         * difference case on all output types on HSW+.
+                         *
+                         * This might misinterpret the scanline counter being
+                         * one line too far along on eDP, but that's less
+                         * dangerous than the alternative since that would lead
+                         * the vblank timestamp code astray when it sees a
+                         * scanline count before vblank_start during a vblank
+                         * interrupt.
+                         */
+                        in_vbl = ilk_pipe_in_vblank_locked(dev, pipe);
+                        if ((in_vbl && (position == vbl_start - 2 ||
+                                        position == vbl_start - 1)) ||
+                            (!in_vbl && (position == vbl_end - 2 ||
+                                         position == vbl_end - 1)))
+                                position = (position + 2) % vtotal;
+                } else if (HAS_PCH_SPLIT(dev)) {
                        /*
                         * The scanline counter increments at the leading edge
                         * of hsync, ie. it completely misses the active portion
@@ -2769,10 +2782,9 @@ static void ibx_irq_postinstall(struct drm_device *dev)
                return;
        if (HAS_PCH_IBX(dev)) {
-                mask = SDE_GMBUS | SDE_AUX_MASK | SDE_TRANSB_FIFO_UNDER |
+                mask = SDE_GMBUS | SDE_AUX_MASK | SDE_POISON;
-                       SDE_TRANSA_FIFO_UNDER | SDE_POISON;
        } else {
-                mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT | SDE_ERROR_CPT;
+                mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT;
                I915_WRITE(SERR_INT, I915_READ(SERR_INT));
        }
@@ -2832,20 +2844,19 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
                display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE_IVB |
                                DE_PCH_EVENT_IVB | DE_PLANEC_FLIP_DONE_IVB |
                                DE_PLANEB_FLIP_DONE_IVB |
-                                DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB |
+                                DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB);
-                                DE_ERR_INT_IVB);
                extra_mask = (DE_PIPEC_VBLANK_IVB | DE_PIPEB_VBLANK_IVB |
-                              DE_PIPEA_VBLANK_IVB);
+                              DE_PIPEA_VBLANK_IVB | DE_ERR_INT_IVB);
                I915_WRITE(GEN7_ERR_INT, I915_READ(GEN7_ERR_INT));
        } else {
                display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
                                DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE |
                                DE_AUX_CHANNEL_A |
-                                DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN |
                                DE_PIPEB_CRC_DONE | DE_PIPEA_CRC_DONE |
                                DE_POISON);
-                extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT;
+                extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT |
+                                DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN;
        }
        dev_priv->irq_mask = ~display_mask;
@@ -2961,9 +2972,9 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv)
        struct drm_device *dev = dev_priv->dev;
        uint32_t de_pipe_masked = GEN8_PIPE_FLIP_DONE |
                GEN8_PIPE_CDCLK_CRC_DONE |
-                GEN8_PIPE_FIFO_UNDERRUN |
                GEN8_DE_PIPE_IRQ_FAULT_ERRORS;
-        uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK;
+        uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK |
+                GEN8_PIPE_FIFO_UNDERRUN;
        int pipe;
        dev_priv->de_irq_mask[PIPE_A] = ~de_pipe_masked;
        dev_priv->de_irq_mask[PIPE_B] = ~de_pipe_masked;
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index e06b9e017d6b..234ac5f7bc5a 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1244,6 +1244,7 @@ static void intel_ddi_post_disable(struct intel_encoder *intel_encoder)
        if (type == INTEL_OUTPUT_DISPLAYPORT || type == INTEL_OUTPUT_EDP) {
                struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
+                ironlake_edp_panel_vdd_on(intel_dp);
                ironlake_edp_panel_off(intel_dp);
        }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 57552eb386b0..2688f6d64bb9 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1249,17 +1249,24 @@ void ironlake_edp_panel_off(struct intel_dp *intel_dp)
        DRM_DEBUG_KMS("Turn eDP power off\n");
+        WARN(!intel_dp->want_panel_vdd, "Need VDD to turn off panel\n");
        pp = ironlake_get_pp_control(intel_dp);
        /* We need to switch off panel power _and_ force vdd, for otherwise some
         * panels get very unhappy and cease to work. */
-        pp &= ~(POWER_TARGET_ON | PANEL_POWER_RESET | EDP_BLC_ENABLE);
+        pp &= ~(POWER_TARGET_ON | EDP_FORCE_VDD | PANEL_POWER_RESET | EDP_BLC_ENABLE);
        pp_ctrl_reg = _pp_ctrl_reg(intel_dp);
        I915_WRITE(pp_ctrl_reg, pp);
        POSTING_READ(pp_ctrl_reg);
+        intel_dp->want_panel_vdd = false;
        ironlake_wait_panel_off(intel_dp);
+        /* We got a reference when we enabled the VDD. */
+        intel_runtime_pm_put(dev_priv);
 }
 void ironlake_edp_backlight_on(struct intel_dp *intel_dp)
@@ -1639,7 +1646,7 @@ static void intel_edp_psr_enable_source(struct intel_dp *intel_dp)
                val |= EDP_PSR_LINK_DISABLE;
        I915_WRITE(EDP_PSR_CTL(dev), val |
-                   IS_BROADWELL(dev) ? 0 : link_entry_time |
+                   (IS_BROADWELL(dev) ? 0 : link_entry_time) |
                   max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT |
                   idle_frames << EDP_PSR_IDLE_FRAME_SHIFT |
                   EDP_PSR_ENABLE);
@@ -1784,6 +1791,7 @@ static void intel_disable_dp(struct intel_encoder *encoder)
        /* Make sure the panel is off before trying to change the mode. But also
         * ensure that we have vdd while we switch off the panel. */
+        ironlake_edp_panel_vdd_on(intel_dp);
        ironlake_edp_backlight_off(intel_dp);
        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
        ironlake_edp_panel_off(intel_dp);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e22be8458d92..bbb17841a9e5 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4134,8 +4134,11 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
 {
        if (enable)
                WREG32(CP_MEC_CNTL, 0);
-        else
+        else {
                WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
+                rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
+                rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
+        }
        udelay(50);
 }
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 1ecb3f1070e3..94626ea90fa5 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -264,6 +264,8 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
                WREG32(SDMA0_GFX_RB_CNTL + reg_offset, rb_cntl);
                WREG32(SDMA0_GFX_IB_CNTL + reg_offset, 0);
        }
+        rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
+        rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
 }
 /**
@@ -291,6 +293,11 @@ void cik_sdma_enable(struct radeon_device *rdev, bool enable)
        u32 me_cntl, reg_offset;
        int i;
+        if (enable == false) {
+                cik_sdma_gfx_stop(rdev);
+                cik_sdma_rlc_stop(rdev);
+        }
        for (i = 0; i < 2; i++) {
                if (i == 0)
                        reg_offset = SDMA0_REGISTER_OFFSET;
@@ -420,10 +427,6 @@ static int cik_sdma_load_microcode(struct radeon_device *rdev)
        if (!rdev->sdma_fw)
                return -EINVAL;
-        /* stop the gfx rings and rlc compute queues */
-        cik_sdma_gfx_stop(rdev);
-        cik_sdma_rlc_stop(rdev);
        /* halt the MEs */
        cik_sdma_enable(rdev, false);
@@ -492,9 +495,6 @@ int cik_sdma_resume(struct radeon_device *rdev)
 */
 void cik_sdma_fini(struct radeon_device *rdev)
 {
-        /* stop the gfx rings and rlc compute queues */
-        cik_sdma_gfx_stop(rdev);
-        cik_sdma_rlc_stop(rdev);
        /* halt the MEs */
        cik_sdma_enable(rdev, false);
        radeon_ring_fini(rdev, &rdev->ring[R600_RING_TYPE_DMA_INDEX]);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 2aecd6dc2610..66ed3ea71440 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -33,6 +33,13 @@
 #include <linux/vga_switcheroo.h>
 #include <linux/slab.h>
 #include <linux/pm_runtime.h>
+#if defined(CONFIG_VGA_SWITCHEROO)
+bool radeon_is_px(void);
+#else
+static inline bool radeon_is_px(void) { return false; }
+#endif
 /**
 * radeon_driver_unload_kms - Main unload function for KMS.
 *
@@ -130,7 +137,8 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
                                "Error during ACPI methods call\n");
        }
-        if (radeon_runtime_pm != 0) {
+        if ((radeon_runtime_pm == 1) ||
+            ((radeon_runtime_pm == -1) && radeon_is_px())) {
                pm_runtime_use_autosuspend(dev->dev);
                pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                pm_runtime_set_active(dev->dev);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index a06651309388..214b7992a3aa 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -351,9 +351,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 moved:
        if (bo->evicted) {
-                ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
+                if (bdev->driver->invalidate_caches) {
-                if (ret)
+                        ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
-                        pr_err("Can not flush read caches\n");
+                        if (ret)
+                                pr_err("Can not flush read caches\n");
+                }
                bo->evicted = false;
        }
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 801231c9ae48..0ce48e5a9cb4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -339,11 +339,13 @@ int ttm_bo_mmap(struct file *filp, struct vm_area_struct *vma,
        vma->vm_private_data = bo;
        /*
-         * PFNMAP is faster than MIXEDMAP due to reduced page
+         * We'd like to use VM_PFNMAP on shared mappings, where
-         * administration. So use MIXEDMAP only if private VMA, where
+         * (vma->vm_flags & VM_SHARED) != 0, for performance reasons,
-         * we need to support COW.
+         * but for some reason VM_PFNMAP + x86 PAT + write-combine is very
+         * bad for performance. Until that has been sorted out, use
+         * VM_MIXEDMAP on all mappings. See freedesktop.org bug #75719
         */
-        vma->vm_flags |= (vma->vm_flags & VM_SHARED) ? VM_PFNMAP : VM_MIXEDMAP;
+        vma->vm_flags |= VM_MIXEDMAP;
        vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
        return 0;
 out_unref:
@@ -359,7 +361,7 @@ int ttm_fbdev_mmap(struct vm_area_struct *vma, struct ttm_buffer_object *bo)
        vma->vm_ops = &ttm_bo_vm_ops;
        vma->vm_private_data = ttm_bo_reference(bo);
-        vma->vm_flags |= (vma->vm_flags & VM_SHARED) ? VM_PFNMAP : VM_MIXEDMAP;
+        vma->vm_flags |= VM_MIXEDMAP;
        vma->vm_flags |= VM_IO | VM_DONTEXPAND;
        return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 82468d902915..e7af580ab977 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -830,6 +830,24 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
        if (unlikely(ret != 0))
                goto out_unlock;
+        /*
+         * A gb-aware client referencing a shared surface will
+         * expect a backup buffer to be present.
+         */
+        if (dev_priv->has_mob && req->shareable) {
+                uint32_t backup_handle;
+                ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
+                                            res->backup_size,
+                                            true,
+                                            &backup_handle,
+                                            &res->backup);
+                if (unlikely(ret != 0)) {
+                        vmw_resource_unreference(&res);
+                        goto out_unlock;
+                }
+        }
        tmp = vmw_resource_reference(&srf->res);
        ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
                                    req->shareable, VMW_RES_SURFACE,
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index befe0e336471..24883b4d1a49 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -43,6 +43,7 @@
 #define G25_REV_MIN 0x22
 #define G27_REV_MAJ 0x12
 #define G27_REV_MIN 0x38
+#define G27_2_REV_MIN 0x39
 #define to_hid_device(pdev) container_of(pdev, struct hid_device, dev)
@@ -130,6 +131,7 @@ static const struct lg4ff_usb_revision lg4ff_revs[] = {
        {DFP_REV_MAJ,  DFP_REV_MIN,  &native_dfp},      /* Driving Force Pro */
        {G25_REV_MAJ,  G25_REV_MIN,  &native_g25},      /* G25 */
        {G27_REV_MAJ,  G27_REV_MIN,  &native_g27},      /* G27 */
+        {G27_REV_MAJ,  G27_2_REV_MIN,  &native_g27},    /* G27 v2 */
 };
 /* Recalculates X axis value accordingly to currently selected range */
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 12354055d474..2f19b15f47f2 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -42,6 +42,7 @@
 #define DUALSHOCK4_CONTROLLER_BT  BIT(6)
 #define SONY_LED_SUPPORT (SIXAXIS_CONTROLLER_USB | BUZZ_CONTROLLER | DUALSHOCK4_CONTROLLER_USB)
+#define SONY_FF_SUPPORT (SIXAXIS_CONTROLLER_USB | DUALSHOCK4_CONTROLLER_USB)
 #define MAX_LEDS 4
@@ -499,6 +500,7 @@ struct sony_sc {
        __u8 right;
 #endif
+        __u8 worker_initialized;
        __u8 led_state[MAX_LEDS];
        __u8 led_count;
 };
@@ -993,22 +995,11 @@ static int sony_init_ff(struct hid_device *hdev)
        return input_ff_create_memless(input_dev, NULL, sony_play_effect);
 }
-static void sony_destroy_ff(struct hid_device *hdev)
-{
-        struct sony_sc *sc = hid_get_drvdata(hdev);
-        cancel_work_sync(&sc->state_worker);
-}
 #else
 static int sony_init_ff(struct hid_device *hdev)
 {
        return 0;
 }
-static void sony_destroy_ff(struct hid_device *hdev)
-{
-}
 #endif
 static int sony_set_output_report(struct sony_sc *sc, int req_id, int req_size)
@@ -1077,6 +1068,8 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
        if (sc->quirks & SIXAXIS_CONTROLLER_USB) {
                hdev->hid_output_raw_report = sixaxis_usb_output_raw_report;
                ret = sixaxis_set_operational_usb(hdev);
+                sc->worker_initialized = 1;
                INIT_WORK(&sc->state_worker, sixaxis_state_worker);
        }
        else if (sc->quirks & SIXAXIS_CONTROLLER_BT)
@@ -1087,6 +1080,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                if (ret < 0)
                        goto err_stop;
+                sc->worker_initialized = 1;
                INIT_WORK(&sc->state_worker, dualshock4_state_worker);
        } else {
                ret = 0;
@@ -1101,9 +1095,11 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                        goto err_stop;
        }
-        ret = sony_init_ff(hdev);
+        if (sc->quirks & SONY_FF_SUPPORT) {
-        if (ret < 0)
+                ret = sony_init_ff(hdev);
-                goto err_stop;
+                if (ret < 0)
+                        goto err_stop;
+        }
        return 0;
 err_stop:
@@ -1120,7 +1116,8 @@ static void sony_remove(struct hid_device *hdev)
        if (sc->quirks & SONY_LED_SUPPORT)
                sony_leds_remove(hdev);
-        sony_destroy_ff(hdev);
+        if (sc->worker_initialized)
+                cancel_work_sync(&sc->state_worker);
        hid_hw_stop(hdev);
 }
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index cb0137b3718d..ab24ce2eb28f 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -320,13 +320,13 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
                        hid_hw_close(hidraw->hid);
                        wake_up_interruptible(&hidraw->wait);
                }
+                device_destroy(hidraw_class,
+                               MKDEV(hidraw_major, hidraw->minor));
        } else {
                --hidraw->open;
        }
        if (!hidraw->open) {
                if (!hidraw->exist) {
-                        device_destroy(hidraw_class,
-                                        MKDEV(hidraw_major, hidraw->minor));
                        hidraw_table[hidraw->minor] = NULL;
                        kfree(hidraw);
                } else {
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index f5ed03164d86..de17c5593d97 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -387,7 +387,7 @@ config I2C_CBUS_GPIO
 config I2C_CPM
        tristate "Freescale CPM1 or CPM2 (MPC8xx/826x)"
-        depends on (CPM1 || CPM2) && OF_I2C
+        depends on CPM1 || CPM2
        help
          This supports the use of the I2C interface on Freescale
          processors with CPM1 or CPM2.
diff --git a/drivers/isdn/capi/Kconfig b/drivers/isdn/capi/Kconfig
index f04686580040..9816c51eb5c2 100644
--- a/drivers/isdn/capi/Kconfig
+++ b/drivers/isdn/capi/Kconfig
@@ -16,9 +16,17 @@ config CAPI_TRACE
          This will increase the size of the kernelcapi module by 20 KB.
          If unsure, say Y.
+config ISDN_CAPI_CAPI20
+        tristate "CAPI2.0 /dev/capi support"
+        help
+          This option will provide the CAPI 2.0 interface to userspace
+          applications via /dev/capi20. Applications should use the
+          standardized libcapi20 to access this functionality.  You should say
+          Y/M here.
 config ISDN_CAPI_MIDDLEWARE
        bool "CAPI2.0 Middleware support"
-        depends on TTY
+        depends on ISDN_CAPI_CAPI20 && TTY
        help
          This option will enhance the capabilities of the /dev/capi20
          interface.  It will provide a means of moving a data connection,
@@ -26,14 +34,6 @@ config ISDN_CAPI_MIDDLEWARE
          device.  If you want to use pppd with pppdcapiplugin to dial up to
          your ISP, say Y here.
-config ISDN_CAPI_CAPI20
-        tristate "CAPI2.0 /dev/capi support"
-        help
-          This option will provide the CAPI 2.0 interface to userspace
-          applications via /dev/capi20. Applications should use the
-          standardized libcapi20 to access this functionality.  You should say
-          Y/M here.
 config ISDN_CAPI_CAPIDRV
        tristate "CAPI2.0 capidrv interface support"
        depends on ISDN_I4L
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1af70145fab9..074b9c8e4cf0 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -979,12 +979,13 @@ static void issue_copy_real(struct dm_cache_migration *mg)
        int r;
        struct dm_io_region o_region, c_region;
        struct cache *cache = mg->cache;
+        sector_t cblock = from_cblock(mg->cblock);
        o_region.bdev = cache->origin_dev->bdev;
        o_region.count = cache->sectors_per_block;
        c_region.bdev = cache->cache_dev->bdev;
-        c_region.sector = from_cblock(mg->cblock) * cache->sectors_per_block;
+        c_region.sector = cblock * cache->sectors_per_block;
        c_region.count = cache->sectors_per_block;
        if (mg->writeback || mg->demote) {
@@ -2464,20 +2465,18 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
        bool discarded_block;
        struct dm_bio_prison_cell *cell;
        struct policy_result lookup_result;
-        struct per_bio_data *pb;
+        struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size);
-        if (from_oblock(block) > from_oblock(cache->origin_blocks)) {
+        if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) {
                /*
                 * This can only occur if the io goes to a partial block at
                 * the end of the origin device.  We don't cache these.
                 * Just remap to the origin and carry on.
                 */
-                remap_to_origin_clear_discard(cache, bio, block);
+                remap_to_origin(cache, bio);
                return DM_MAPIO_REMAPPED;
        }
-        pb = init_per_bio_data(bio, pb_data_size);
        if (bio->bi_rw & (REQ_FLUSH | REQ_FUA | REQ_DISCARD)) {
                defer_bio(cache, bio);
                return DM_MAPIO_SUBMITTED;
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index b9e2000969f0..95c894482fdd 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -240,7 +240,7 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
        nid = cpu_to_node(cpu);
        page = alloc_pages_exact_node(nid,
-                                      GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                      GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                      pg_order);
        if (page == NULL) {
                dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index a2c47476804d..e8f133e926aa 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -730,7 +730,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
                        client_info->ntt = 0;
                }
-                if (!vlan_get_tag(skb, &client_info->vlan_id))
+                if (vlan_get_tag(skb, &client_info->vlan_id))
                        client_info->vlan_id = 0;
                if (!client_info->assigned) {
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index c37878432717..298c26509095 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -121,6 +121,7 @@ static struct bond_opt_value bond_resend_igmp_tbl[] = {
 static struct bond_opt_value bond_lp_interval_tbl[] = {
        { "minval",  1,       BOND_VALFLAG_MIN | BOND_VALFLAG_DEFAULT},
        { "maxval",  INT_MAX, BOND_VALFLAG_MAX},
+        { NULL,      -1,      0},
 };
 static struct bond_option bond_opts[] = {
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 2e45f6ec1bf0..380d24922049 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1248,19 +1248,13 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         * shared register for the high 32 bits, so only a single, aligned,
         * 4 GB physical address range can be used for descriptors.
         */
-        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
+        if (!dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64))) {
-            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
                dev_dbg(&pdev->dev, "DMA to 64-BIT addresses\n");
        } else {
-                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+                err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
                if (err) {
-                        err = dma_set_coherent_mask(&pdev->dev,
+                        dev_err(&pdev->dev, "No usable DMA config, aborting\n");
-                                                    DMA_BIT_MASK(32));
+                        goto out_pci_disable;
-                        if (err) {
-                                dev_err(&pdev->dev,
-                                        "No usable DMA config, aborting\n");
-                                goto out_pci_disable;
-                        }
                }
        }
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index d5c2d3e912e5..422aab27ea1b 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -2436,7 +2436,7 @@ err_reset:
 err_register:
 err_sw_init:
 err_eeprom:
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
 err_init_netdev:
 err_ioremap:
        free_netdev(netdev);
@@ -2474,7 +2474,7 @@ static void atl1e_remove(struct pci_dev *pdev)
        unregister_netdev(netdev);
        atl1e_free_ring_resources(adapter);
        atl1e_force_ps(&adapter->hw);
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
        pci_release_regions(pdev);
        free_netdev(netdev);
        pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index cda25ac45b47..6c9e1c9bdeb8 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -2507,6 +2507,7 @@ bnx2_fw_sync(struct bnx2 *bp, u32 msg_data, int ack, int silent)
        bp->fw_wr_seq++;
        msg_data |= bp->fw_wr_seq;
+        bp->fw_last_msg = msg_data;
        bnx2_shmem_wr(bp, BNX2_DRV_MB, msg_data);
@@ -4000,8 +4001,23 @@ bnx2_setup_wol(struct bnx2 *bp)
                        wol_msg = BNX2_DRV_MSG_CODE_SUSPEND_NO_WOL;
        }
-        if (!(bp->flags & BNX2_FLAG_NO_WOL))
+        if (!(bp->flags & BNX2_FLAG_NO_WOL)) {
-                bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT3 | wol_msg, 1, 0);
+                u32 val;
+                wol_msg |= BNX2_DRV_MSG_DATA_WAIT3;
+                if (bp->fw_last_msg || BNX2_CHIP(bp) != BNX2_CHIP_5709) {
+                        bnx2_fw_sync(bp, wol_msg, 1, 0);
+                        return;
+                }
+                /* Tell firmware not to power down the PHY yet, otherwise
+                 * the chip will take a long time to respond to MMIO reads.
+                 */
+                val = bnx2_shmem_rd(bp, BNX2_PORT_FEATURE);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE,
+                              val | BNX2_PORT_FEATURE_ASF_ENABLED);
+                bnx2_fw_sync(bp, wol_msg, 1, 0);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE, val);
+        }
 }
@@ -4033,9 +4049,22 @@ bnx2_set_power_state(struct bnx2 *bp, pci_power_t state)
                        if (bp->wol)
                                pci_set_power_state(bp->pdev, PCI_D3hot);
-                } else {
+                        break;
-                        pci_set_power_state(bp->pdev, PCI_D3hot);
+                }
+                if (!bp->fw_last_msg && BNX2_CHIP(bp) == BNX2_CHIP_5709) {
+                        u32 val;
+                        /* Tell firmware not to power down the PHY yet,
+                         * otherwise the other port may not respond to
+                         * MMIO reads.
+                         */
+                        val = bnx2_shmem_rd(bp, BNX2_BC_STATE_CONDITION);
+                        val &= ~BNX2_CONDITION_PM_STATE_MASK;
+                        val |= BNX2_CONDITION_PM_STATE_UNPREP;
+                        bnx2_shmem_wr(bp, BNX2_BC_STATE_CONDITION, val);
                }
+                pci_set_power_state(bp->pdev, PCI_D3hot);
                /* No more memory access after this point until
                 * device is brought back to D0.
diff --git a/drivers/net/ethernet/broadcom/bnx2.h b/drivers/net/ethernet/broadcom/bnx2.h
index f1cf2c44e7ed..e341bc366fa5 100644
--- a/drivers/net/ethernet/broadcom/bnx2.h
+++ b/drivers/net/ethernet/broadcom/bnx2.h
@@ -6900,6 +6900,7 @@ struct bnx2 {
        u16                     fw_wr_seq;
        u16                     fw_drv_pulse_wr_seq;
+        u32                     fw_last_msg;
        int                     rx_max_ring;
        int                     rx_ring_size;
@@ -7406,6 +7407,10 @@ struct bnx2_rv2p_fw_file {
 #define BNX2_CONDITION_MFW_RUN_NCSI              0x00006000
 #define BNX2_CONDITION_MFW_RUN_NONE              0x0000e000
 #define BNX2_CONDITION_MFW_RUN_MASK              0x0000e000
+#define BNX2_CONDITION_PM_STATE_MASK             0x00030000
+#define BNX2_CONDITION_PM_STATE_FULL             0x00030000
+#define BNX2_CONDITION_PM_STATE_PREP             0x00020000
+#define BNX2_CONDITION_PM_STATE_UNPREP           0x00010000
 #define BNX2_BC_STATE_DEBUG_CMD                 0x1dc
 #define BNX2_BC_STATE_BC_DBG_CMD_SIGNATURE       0x42440000
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index fcf9105a5476..09f3fefcbf9c 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1,6 +1,6 @@
 /* cnic.c: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -342,7 +342,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
        while (retry < 3) {
                rc = 0;
                rcu_read_lock();
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
+                ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
                if (ulp_ops)
                        rc = ulp_ops->iscsi_nl_send_msg(
                                cp->ulp_handle[CNIC_ULP_ISCSI],
@@ -726,7 +726,7 @@ static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
        for (i = 0; i < dma->num_pages; i++) {
                if (dma->pg_arr[i]) {
-                        dma_free_coherent(&dev->pcidev->dev, BNX2_PAGE_SIZE,
+                        dma_free_coherent(&dev->pcidev->dev, CNIC_PAGE_SIZE,
                                          dma->pg_arr[i], dma->pg_map_arr[i]);
                        dma->pg_arr[i] = NULL;
                }
@@ -785,7 +785,7 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
        for (i = 0; i < pages; i++) {
                dma->pg_arr[i] = dma_alloc_coherent(&dev->pcidev->dev,
-                                                    BNX2_PAGE_SIZE,
+                                                    CNIC_PAGE_SIZE,
                                                    &dma->pg_map_arr[i],
                                                    GFP_ATOMIC);
                if (dma->pg_arr[i] == NULL)
@@ -794,8 +794,8 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
        if (!use_pg_tbl)
                return 0;
-        dma->pgtbl_size = ((pages * 8) + BNX2_PAGE_SIZE - 1) &
+        dma->pgtbl_size = ((pages * 8) + CNIC_PAGE_SIZE - 1) &
-                          ~(BNX2_PAGE_SIZE - 1);
+                          ~(CNIC_PAGE_SIZE - 1);
        dma->pgtbl = dma_alloc_coherent(&dev->pcidev->dev, dma->pgtbl_size,
                                        &dma->pgtbl_map, GFP_ATOMIC);
        if (dma->pgtbl == NULL)
@@ -900,8 +900,8 @@ static int cnic_alloc_context(struct cnic_dev *dev)
        if (BNX2_CHIP(cp) == BNX2_CHIP_5709) {
                int i, k, arr_size;
-                cp->ctx_blk_size = BNX2_PAGE_SIZE;
+                cp->ctx_blk_size = CNIC_PAGE_SIZE;
-                cp->cids_per_blk = BNX2_PAGE_SIZE / 128;
+                cp->cids_per_blk = CNIC_PAGE_SIZE / 128;
                arr_size = BNX2_MAX_CID / cp->cids_per_blk *
                           sizeof(struct cnic_ctx);
                cp->ctx_arr = kzalloc(arr_size, GFP_KERNEL);
@@ -933,7 +933,7 @@ static int cnic_alloc_context(struct cnic_dev *dev)
                for (i = 0; i < cp->ctx_blks; i++) {
                        cp->ctx_arr[i].ctx =
                                dma_alloc_coherent(&dev->pcidev->dev,
-                                                   BNX2_PAGE_SIZE,
+                                                   CNIC_PAGE_SIZE,
                                                   &cp->ctx_arr[i].mapping,
                                                   GFP_KERNEL);
                        if (cp->ctx_arr[i].ctx == NULL)
@@ -1013,7 +1013,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
        if (udev->l2_ring)
                return 0;
-        udev->l2_ring_size = pages * BNX2_PAGE_SIZE;
+        udev->l2_ring_size = pages * CNIC_PAGE_SIZE;
        udev->l2_ring = dma_alloc_coherent(&udev->pdev->dev, udev->l2_ring_size,
                                           &udev->l2_ring_map,
                                           GFP_KERNEL | __GFP_COMP);
@@ -1021,7 +1021,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
                return -ENOMEM;
        udev->l2_buf_size = (cp->l2_rx_ring_size + 1) * cp->l2_single_buf_size;
-        udev->l2_buf_size = PAGE_ALIGN(udev->l2_buf_size);
+        udev->l2_buf_size = CNIC_PAGE_ALIGN(udev->l2_buf_size);
        udev->l2_buf = dma_alloc_coherent(&udev->pdev->dev, udev->l2_buf_size,
                                          &udev->l2_buf_map,
                                          GFP_KERNEL | __GFP_COMP);
@@ -1102,7 +1102,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
                                                     TX_MAX_TSS_RINGS + 1);
                uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
-                                        PAGE_MASK;
+                                        CNIC_PAGE_MASK;
                if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
                        uinfo->mem[1].size = BNX2_SBLK_MSIX_ALIGN_SIZE * 9;
                else
@@ -1113,7 +1113,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
                uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
-                        PAGE_MASK;
+                        CNIC_PAGE_MASK;
                uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
                uinfo->name = "bnx2x_cnic";
@@ -1267,14 +1267,14 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
        for (i = MAX_ISCSI_TBL_SZ; i < cp->max_cid_space; i++)
                cp->ctx_tbl[i].ulp_proto_id = CNIC_ULP_FCOE;
-        pages = PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
+        pages = CNIC_PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
-                PAGE_SIZE;
+                CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
        if (ret)
                return -ENOMEM;
-        n = PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
+        n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
        for (i = 0, j = 0; i < cp->max_cid_space; i++) {
                long off = CNIC_KWQ16_DATA_SIZE * (i % n);
@@ -1296,7 +1296,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
                        goto error;
        }
-        pages = PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &cp->gbl_buf_info, pages, 0);
        if (ret)
                goto error;
@@ -1466,8 +1466,8 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        cp->r2tq_size = cp->num_iscsi_tasks * BNX2X_ISCSI_MAX_PENDING_R2TS *
                        BNX2X_ISCSI_R2TQE_SIZE;
        cp->hq_size = cp->num_ccells * BNX2X_ISCSI_HQ_BD_SIZE;
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
-        hq_bds = pages * (PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
+        hq_bds = pages * (CNIC_PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
        cp->num_cqs = req1->num_cqs;
        if (!dev->max_iscsi_conn)
@@ -1477,9 +1477,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_RQ_SIZE_OFFSET(pfid),
                  req1->rq_num_wqes);
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM +
                  TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1489,9 +1489,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
                  USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(pfid),
                  req1->rq_buffer_size);
        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_USTRORM_INTMEM +
-                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_USTRORM_INTMEM +
                  USTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1504,9 +1504,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        /* init Xstorm RAM */
        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
                  XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1519,9 +1519,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        /* init Cstorm RAM */
        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
                  CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1623,18 +1623,18 @@ static int cnic_alloc_bnx2x_conn_resc(struct cnic_dev *dev, u32 l5_cid)
        }
        ctx->cid = cid;
-        pages = PAGE_ALIGN(cp->task_array_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->task_array_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->task_array_info, pages, 1);
        if (ret)
                goto error;
-        pages = PAGE_ALIGN(cp->r2tq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->r2tq_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->r2tq_info, pages, 1);
        if (ret)
                goto error;
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->hq_info, pages, 1);
        if (ret)
                goto error;
@@ -1760,7 +1760,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
        ictx->tstorm_st_context.iscsi.hdr_bytes_2_fetch = ISCSI_HEADER_SIZE;
        /* TSTORM requires the base address of RQ DB & not PTE */
        ictx->tstorm_st_context.iscsi.rq_db_phy_addr.lo =
-                req2->rq_page_table_addr_lo & PAGE_MASK;
+                req2->rq_page_table_addr_lo & CNIC_PAGE_MASK;
        ictx->tstorm_st_context.iscsi.rq_db_phy_addr.hi =
                req2->rq_page_table_addr_hi;
        ictx->tstorm_st_context.iscsi.iscsi_conn_id = req1->iscsi_conn_id;
@@ -1842,7 +1842,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
        /* CSTORM and USTORM initialization is different, CSTORM requires
         * CQ DB base & not PTE addr */
        ictx->cstorm_st_context.cq_db_base.lo =
-                req1->cq_page_table_addr_lo & PAGE_MASK;
+                req1->cq_page_table_addr_lo & CNIC_PAGE_MASK;
        ictx->cstorm_st_context.cq_db_base.hi = req1->cq_page_table_addr_hi;
        ictx->cstorm_st_context.iscsi_conn_id = req1->iscsi_conn_id;
        ictx->cstorm_st_context.cq_proc_en_bit_map = (1 << cp->num_cqs) - 1;
@@ -2911,7 +2911,7 @@ static int cnic_l2_completion(struct cnic_local *cp)
        u16 hw_cons, sw_cons;
        struct cnic_uio_dev *udev = cp->udev;
        union eth_rx_cqe *cqe, *cqe_ring = (union eth_rx_cqe *)
-                                        (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                        (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
        u32 cmd;
        int comp = 0;
@@ -3244,7 +3244,8 @@ static int cnic_copy_ulp_stats(struct cnic_dev *dev, int ulp_type)
        int rc;
        mutex_lock(&cnic_lock);
-        ulp_ops = cnic_ulp_tbl_prot(ulp_type);
+        ulp_ops = rcu_dereference_protected(cp->ulp_ops[ulp_type],
+                                            lockdep_is_held(&cnic_lock));
        if (ulp_ops && ulp_ops->cnic_get_stats)
                rc = ulp_ops->cnic_get_stats(cp->ulp_handle[ulp_type]);
        else
@@ -4384,7 +4385,7 @@ static int cnic_setup_5709_context(struct cnic_dev *dev, int valid)
                u32 idx = cp->ctx_arr[i].cid / cp->cids_per_blk;
                u32 val;
-                memset(cp->ctx_arr[i].ctx, 0, BNX2_PAGE_SIZE);
+                memset(cp->ctx_arr[i].ctx, 0, CNIC_PAGE_SIZE);
                CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA0,
                        (cp->ctx_arr[i].mapping & 0xffffffff) | valid_bit);
@@ -4628,7 +4629,7 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                val = BNX2_L2CTX_L2_STATUSB_NUM(sb_id);
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_HOST_BDIDX, val);
-        rxbd = udev->l2_ring + BNX2_PAGE_SIZE;
+        rxbd = udev->l2_ring + CNIC_PAGE_SIZE;
        for (i = 0; i < BNX2_MAX_RX_DESC_CNT; i++, rxbd++) {
                dma_addr_t buf_map;
                int n = (i % cp->l2_rx_ring_size) + 1;
@@ -4639,11 +4640,11 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                rxbd->rx_bd_haddr_hi = (u64) buf_map >> 32;
                rxbd->rx_bd_haddr_lo = (u64) buf_map & 0xffffffff;
        }
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_HI, val);
        rxbd->rx_bd_haddr_hi = val;
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_LO, val);
        rxbd->rx_bd_haddr_lo = val;
@@ -4709,10 +4710,10 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        val = CNIC_RD(dev, BNX2_MQ_CONFIG);
        val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
-        if (BNX2_PAGE_BITS > 12)
+        if (CNIC_PAGE_BITS > 12)
                val |= (12 - 8)  << 4;
        else
-                val |= (BNX2_PAGE_BITS - 8)  << 4;
+                val |= (CNIC_PAGE_BITS - 8)  << 4;
        CNIC_WR(dev, BNX2_MQ_CONFIG, val);
@@ -4742,13 +4743,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        /* Initialize the kernel work queue context. */
        val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_TYPE, val);
-        val = (BNX2_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
        val = (u32) ((u64) cp->kwq_info.pgtbl_map >> 32);
@@ -4768,13 +4769,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        /* Initialize the kernel complete queue context. */
        val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_TYPE, val);
-        val = (BNX2_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
        val = (u32) ((u64) cp->kcq1.dma.pgtbl_map >> 32);
@@ -4918,7 +4919,7 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev,
        u32 cli = cp->ethdev->iscsi_l2_client_id;
        u32 val;
-        memset(txbd, 0, BNX2_PAGE_SIZE);
+        memset(txbd, 0, CNIC_PAGE_SIZE);
        buf_map = udev->l2_buf_map;
        for (i = 0; i < BNX2_MAX_TX_DESC_CNT; i += 3, txbd += 3) {
@@ -4978,9 +4979,9 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
        struct bnx2x *bp = netdev_priv(dev->netdev);
        struct cnic_uio_dev *udev = cp->udev;
        struct eth_rx_bd *rxbd = (struct eth_rx_bd *) (udev->l2_ring +
-                                BNX2_PAGE_SIZE);
+                                CNIC_PAGE_SIZE);
        struct eth_rx_cqe_next_page *rxcqe = (struct eth_rx_cqe_next_page *)
-                                (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
        struct host_sp_status_block *sb = cp->bnx2x_def_status_blk;
        int i;
        u32 cli = cp->ethdev->iscsi_l2_client_id;
@@ -5004,20 +5005,20 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
                rxbd->addr_lo = cpu_to_le32(buf_map & 0xffffffff);
        }
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
        rxbd->addr_hi = cpu_to_le32(val);
        data->rx.bd_page_base.hi = cpu_to_le32(val);
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
        rxbd->addr_lo = cpu_to_le32(val);
        data->rx.bd_page_base.lo = cpu_to_le32(val);
        rxcqe += BNX2X_MAX_RCQ_DESC_CNT;
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) >> 32;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) >> 32;
        rxcqe->addr_hi = cpu_to_le32(val);
        data->rx.cqe_page_base.hi = cpu_to_le32(val);
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) & 0xffffffff;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) & 0xffffffff;
        rxcqe->addr_lo = cpu_to_le32(val);
        data->rx.cqe_page_base.lo = cpu_to_le32(val);
@@ -5265,8 +5266,8 @@ static void cnic_shutdown_rings(struct cnic_dev *dev)
                msleep(10);
        }
        clear_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags);
-        rx_ring = udev->l2_ring + BNX2_PAGE_SIZE;
+        rx_ring = udev->l2_ring + CNIC_PAGE_SIZE;
-        memset(rx_ring, 0, BNX2_PAGE_SIZE);
+        memset(rx_ring, 0, CNIC_PAGE_SIZE);
 }
 static int cnic_register_netdev(struct cnic_dev *dev)
diff --git a/drivers/net/ethernet/broadcom/cnic.h b/drivers/net/ethernet/broadcom/cnic.h
index 0d6b13f854d9..d535ae4228b4 100644
--- a/drivers/net/ethernet/broadcom/cnic.h
+++ b/drivers/net/ethernet/broadcom/cnic.h
@@ -1,6 +1,6 @@
 /* cnic.h: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_defs.h b/drivers/net/ethernet/broadcom/cnic_defs.h
index 95a8e4b11c9f..dcbca6997e8f 100644
--- a/drivers/net/ethernet/broadcom/cnic_defs.h
+++ b/drivers/net/ethernet/broadcom/cnic_defs.h
@@ -1,7 +1,7 @@
 /* cnic.c: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_if.h b/drivers/net/ethernet/broadcom/cnic_if.h
index 8cf6b1926069..5f4d5573a73d 100644
--- a/drivers/net/ethernet/broadcom/cnic_if.h
+++ b/drivers/net/ethernet/broadcom/cnic_if.h
@@ -1,6 +1,6 @@
 /* cnic_if.h: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -14,8 +14,8 @@
 #include "bnx2x/bnx2x_mfw_req.h"
-#define CNIC_MODULE_VERSION     "2.5.19"
+#define CNIC_MODULE_VERSION     "2.5.20"
-#define CNIC_MODULE_RELDATE     "December 19, 2013"
+#define CNIC_MODULE_RELDATE     "March 14, 2014"
 #define CNIC_ULP_RDMA           0
 #define CNIC_ULP_ISCSI          1
@@ -24,6 +24,16 @@
 #define MAX_CNIC_ULP_TYPE_EXT   3
 #define MAX_CNIC_ULP_TYPE       4
+/* Use CPU native page size up to 16K for cnic ring sizes.  */
+#if (PAGE_SHIFT > 14)
+#define CNIC_PAGE_BITS  14
+#else
+#define CNIC_PAGE_BITS  PAGE_SHIFT
+#endif
+#define CNIC_PAGE_SIZE  (1 << (CNIC_PAGE_BITS))
+#define CNIC_PAGE_ALIGN(addr) ALIGN(addr, CNIC_PAGE_SIZE)
+#define CNIC_PAGE_MASK  (~((CNIC_PAGE_SIZE) - 1))
 struct kwqe {
        u32 kwqe_op_flag;
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 1803c3959044..354ae9792bad 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -1704,7 +1704,7 @@ bfa_flash_sem_get(void __iomem *bar)
        while (!bfa_raw_sem_get(bar)) {
                if (--n <= 0)
                        return BFA_STATUS_BADFLASH;
-                udelay(10000);
+                mdelay(10);
        }
        return BFA_STATUS_OK;
 }
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 3190d38e16fb..d0c38e01e99f 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -632,11 +632,16 @@ static void gem_rx_refill(struct macb *bp)
                                           "Unable to allocate sk_buff\n");
                                break;
                        }
-                        bp->rx_skbuff[entry] = skb;
                        /* now fill corresponding descriptor entry */
                        paddr = dma_map_single(&bp->pdev->dev, skb->data,
                                               bp->rx_buffer_size, DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&bp->pdev->dev, paddr)) {
+                                dev_kfree_skb(skb);
+                                break;
+                        }
+                        bp->rx_skbuff[entry] = skb;
                        if (entry == RX_RING_SIZE - 1)
                                paddr |= MACB_BIT(RX_WRAP);
@@ -725,7 +730,7 @@ static int gem_rx(struct macb *bp, int budget)
                skb_put(skb, len);
                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, addr));
                dma_unmap_single(&bp->pdev->dev, addr,
-                                 len, DMA_FROM_DEVICE);
+                                 bp->rx_buffer_size, DMA_FROM_DEVICE);
                skb->protocol = eth_type_trans(skb, bp->dev);
                skb_checksum_none_assert(skb);
@@ -1036,11 +1041,15 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        entry = macb_tx_ring_wrap(bp->tx_head);
-        bp->tx_head++;
        netdev_vdbg(bp->dev, "Allocated ring entry %u\n", entry);
        mapping = dma_map_single(&bp->pdev->dev, skb->data,
                                 len, DMA_TO_DEVICE);
+        if (dma_mapping_error(&bp->pdev->dev, mapping)) {
+                kfree_skb(skb);
+                goto unlock;
+        }
+        bp->tx_head++;
        tx_skb = &bp->tx_skb[entry];
        tx_skb->skb = skb;
        tx_skb->mapping = mapping;
@@ -1066,6 +1075,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (CIRC_SPACE(bp->tx_head, bp->tx_tail, TX_RING_SIZE) < 1)
                netif_stop_queue(dev);
+unlock:
        spin_unlock_irqrestore(&bp->lock, flags);
        return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 479a7cba45c0..03a351300013 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -528,13 +528,6 @@ fec_restart(struct net_device *ndev, int duplex)
        /* Clear any outstanding interrupt. */
        writel(0xffc00000, fep->hwp + FEC_IEVENT);
-        /* Setup multicast filter. */
-        set_multicast_list(ndev);
-#ifndef CONFIG_M5272
-        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
-        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
-#endif
        /* Set maximum receive buffer size. */
        writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE);
@@ -655,6 +648,13 @@ fec_restart(struct net_device *ndev, int duplex)
        writel(rcntl, fep->hwp + FEC_R_CNTRL);
+        /* Setup multicast filter. */
+        set_multicast_list(ndev);
+#ifndef CONFIG_M5272
+        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
+        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
+#endif
        if (id_entry->driver_data & FEC_QUIRK_ENET_MAC) {
                /* enable ENET endian swap */
                ecntl |= (1 << 8);
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 4be971590461..1fc8334fc181 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -522,10 +522,21 @@ retry:
        return rc;
 }
+static u64 ibmveth_encode_mac_addr(u8 *mac)
+{
+        int i;
+        u64 encoded = 0;
+        for (i = 0; i < ETH_ALEN; i++)
+                encoded = (encoded << 8) | mac[i];
+        return encoded;
+}
 static int ibmveth_open(struct net_device *netdev)
 {
        struct ibmveth_adapter *adapter = netdev_priv(netdev);
-        u64 mac_address = 0;
+        u64 mac_address;
        int rxq_entries = 1;
        unsigned long lpar_rc;
        int rc;
@@ -579,8 +590,7 @@ static int ibmveth_open(struct net_device *netdev)
        adapter->rx_queue.num_slots = rxq_entries;
        adapter->rx_queue.toggle = 1;
-        memcpy(&mac_address, netdev->dev_addr, netdev->addr_len);
+        mac_address = ibmveth_encode_mac_addr(netdev->dev_addr);
-        mac_address = mac_address >> 16;
        rxq_desc.fields.flags_len = IBMVETH_BUF_VALID |
                                        adapter->rx_queue.queue_len;
@@ -1183,8 +1193,8 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                /* add the addresses to the filter table */
                netdev_for_each_mc_addr(ha, netdev) {
                        /* add the multicast address to the filter table */
-                        unsigned long mcast_addr = 0;
+                        u64 mcast_addr;
-                        memcpy(((char *)&mcast_addr)+2, ha->addr, ETH_ALEN);
+                        mcast_addr = ibmveth_encode_mac_addr(ha->addr);
                        lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                                   IbmVethMcastAddFilter,
                                                   mcast_addr);
@@ -1372,9 +1382,6 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
        netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
-        adapter->mac_addr = 0;
-        memcpy(&adapter->mac_addr, mac_addr_p, ETH_ALEN);
        netdev->irq = dev->irq;
        netdev->netdev_ops = &ibmveth_netdev_ops;
        netdev->ethtool_ops = &netdev_ethtool_ops;
@@ -1383,7 +1390,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
        netdev->features |= netdev->hw_features;
-        memcpy(netdev->dev_addr, &adapter->mac_addr, netdev->addr_len);
+        memcpy(netdev->dev_addr, mac_addr_p, ETH_ALEN);
        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                struct kobject *kobj = &adapter->rx_buff_pool[i].kobj;
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index 451ba7949e15..1f37499d4398 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -138,7 +138,6 @@ struct ibmveth_adapter {
    struct napi_struct napi;
    struct net_device_stats stats;
    unsigned int mcastFilterSize;
-    unsigned long mac_addr;
    void * buffer_list_addr;
    void * filter_list_addr;
    dma_addr_t buffer_list_dma;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index fad45316200a..84a96f70dfb5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -742,6 +742,14 @@ static int mlx4_en_replace_mac(struct mlx4_en_priv *priv, int qpn,
                                err = mlx4_en_uc_steer_add(priv, new_mac,
                                                           &qpn,
                                                           &entry->reg_id);
+                                if (err)
+                                        return err;
+                                if (priv->tunnel_reg_id) {
+                                        mlx4_flow_detach(priv->mdev->dev, priv->tunnel_reg_id);
+                                        priv->tunnel_reg_id = 0;
+                                }
+                                err = mlx4_en_tunnel_steer_add(priv, new_mac, qpn,
+                                                               &priv->tunnel_reg_id);
                                return err;
                        }
                }
@@ -1792,6 +1800,8 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
                mc_list[5] = priv->port;
                mlx4_multicast_detach(mdev->dev, &priv->rss_map.indir_qp,
                                      mc_list, MLX4_PROT_ETH, mclist->reg_id);
+                if (mclist->tunnel_reg_id)
+                        mlx4_flow_detach(mdev->dev, mclist->tunnel_reg_id);
        }
        mlx4_en_clear_list(dev);
        list_for_each_entry_safe(mclist, tmp, &priv->curr_list, list) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 91b69ff4b4a2..7e2995ecea6f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -129,13 +129,14 @@ static void dump_dev_cap_flags2(struct mlx4_dev *dev, u64 flags)
                [0] = "RSS support",
                [1] = "RSS Toeplitz Hash Function support",
                [2] = "RSS XOR Hash Function support",
-                [3] = "Device manage flow steering support",
+                [3] = "Device managed flow steering support",
                [4] = "Automatic MAC reassignment support",
                [5] = "Time stamping support",
                [6] = "VST (control vlan insertion/stripping) support",
                [7] = "FSM (MAC anti-spoofing) support",
                [8] = "Dynamic QP updates support",
-                [9] = "TCP/IP offloads/flow-steering for VXLAN support"
+                [9] = "Device managed flow steering IPoIB support",
+                [10] = "TCP/IP offloads/flow-steering for VXLAN support"
        };
        int i;
@@ -859,7 +860,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_CQ_TS_SUPPORT_OFFSET);
        /* For guests, disable vxlan tunneling */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_VXLAN);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_VXLAN);
        field &= 0xf7;
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_VXLAN);
@@ -869,7 +870,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_BF_OFFSET);
        /* For guests, disable mw type 2 */
-        MLX4_GET(bmme_flags, outbox, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
+        MLX4_GET(bmme_flags, outbox->buf, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
        bmme_flags &= ~MLX4_BMME_FLAG_TYPE_2_WIN;
        MLX4_PUT(outbox->buf, bmme_flags, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
@@ -883,7 +884,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
        }
        /* turn off ipoib managed steering for guests */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
        field &= ~0x80;
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index d711158b0d4b..936c15364739 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -150,6 +150,8 @@ struct mlx4_port_config {
        struct pci_dev *pdev;
 };
+static atomic_t pf_loading = ATOMIC_INIT(0);
 int mlx4_check_port_params(struct mlx4_dev *dev,
                           enum mlx4_port_type *port_type)
 {
@@ -749,7 +751,7 @@ static void mlx4_request_modules(struct mlx4_dev *dev)
                        has_eth_port = true;
        }
-        if (has_ib_port)
+        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
                request_module_nowait(IB_DRV_NAME);
        if (has_eth_port)
                request_module_nowait(EN_DRV_NAME);
@@ -1407,6 +1409,11 @@ static int mlx4_init_slave(struct mlx4_dev *dev)
        u32 slave_read;
        u32 cmd_channel_ver;
+        if (atomic_read(&pf_loading)) {
+                mlx4_warn(dev, "PF is not ready. Deferring probe\n");
+                return -EPROBE_DEFER;
+        }
        mutex_lock(&priv->cmd.slave_cmd_mutex);
        priv->cmd.max_cmds = 1;
        mlx4_warn(dev, "Sending reset\n");
@@ -2319,7 +2326,11 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data)
                if (num_vfs) {
                        mlx4_warn(dev, "Enabling SR-IOV with %d VFs\n", num_vfs);
+                        atomic_inc(&pf_loading);
                        err = pci_enable_sriov(pdev, num_vfs);
+                        atomic_dec(&pf_loading);
                        if (err) {
                                mlx4_err(dev, "Failed to enable SR-IOV, continuing without SR-IOV (err = %d).\n",
                                         err);
@@ -2684,6 +2695,7 @@ static struct pci_driver mlx4_driver = {
        .name           = DRV_NAME,
        .id_table       = mlx4_pci_table,
        .probe          = mlx4_init_one,
+        .shutdown       = mlx4_remove_one,
        .remove         = mlx4_remove_one,
        .err_handler    = &mlx4_err_handler,
 };
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 727b546a9eb8..e0c92e0e5e1d 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -23,6 +23,7 @@
 #include <linux/crc32.h>
 #include <linux/mii.h>
 #include <linux/eeprom_93cx6.h>
+#include <linux/regulator/consumer.h>
 #include <linux/spi/spi.h>
@@ -83,6 +84,7 @@ union ks8851_tx_hdr {
 * @rc_rxqcr: Cached copy of KS_RXQCR.
 * @eeprom_size: Companion eeprom size in Bytes, 0 if no eeprom
 * @eeprom: 93CX6 EEPROM state for accessing on-board EEPROM.
+ * @vdd_reg:    Optional regulator supplying the chip
 *
 * The @lock ensures that the chip is protected when certain operations are
 * in progress. When the read or write packet transfer is in progress, most
@@ -130,6 +132,7 @@ struct ks8851_net {
        struct spi_transfer     spi_xfer2[2];
        struct eeprom_93cx6     eeprom;
+        struct regulator        *vdd_reg;
 };
 static int msg_enable;
@@ -1414,6 +1417,21 @@ static int ks8851_probe(struct spi_device *spi)
        ks->spidev = spi;
        ks->tx_space = 6144;
+        ks->vdd_reg = regulator_get_optional(&spi->dev, "vdd");
+        if (IS_ERR(ks->vdd_reg)) {
+                ret = PTR_ERR(ks->vdd_reg);
+                if (ret == -EPROBE_DEFER)
+                        goto err_reg;
+        } else {
+                ret = regulator_enable(ks->vdd_reg);
+                if (ret) {
+                        dev_err(&spi->dev, "regulator enable fail: %d\n",
+                                ret);
+                        goto err_reg_en;
+                }
+        }
        mutex_init(&ks->lock);
        spin_lock_init(&ks->statelock);
@@ -1508,8 +1526,14 @@ static int ks8851_probe(struct spi_device *spi)
 err_netdev:
        free_irq(ndev->irq, ks);
-err_id:
 err_irq:
+err_id:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_disable(ks->vdd_reg);
+err_reg_en:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_put(ks->vdd_reg);
+err_reg:
        free_netdev(ndev);
        return ret;
 }
@@ -1523,6 +1547,10 @@ static int ks8851_remove(struct spi_device *spi)
        unregister_netdev(priv->netdev);
        free_irq(spi->irq, priv);
+        if (!IS_ERR(priv->vdd_reg)) {
+                regulator_disable(priv->vdd_reg);
+                regulator_put(priv->vdd_reg);
+        }
        free_netdev(priv->netdev);
        return 0;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index e9779653cd4c..3ff7bc3e7a23 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -209,7 +209,7 @@ static const struct {
        [RTL_GIGA_MAC_VER_16] =
                _R("RTL8101e",          RTL_TD_0, NULL, JUMBO_1K, true),
        [RTL_GIGA_MAC_VER_17] =
-                _R("RTL8168b/8111b",    RTL_TD_1, NULL, JUMBO_4K, false),
+                _R("RTL8168b/8111b",    RTL_TD_0, NULL, JUMBO_4K, false),
        [RTL_GIGA_MAC_VER_18] =
                _R("RTL8168cp/8111cp",  RTL_TD_1, NULL, JUMBO_6K, false),
        [RTL_GIGA_MAC_VER_19] =
diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index 72d282bf33a5..c553f6b5a913 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -151,7 +151,7 @@ static void stmmac_clean_desc3(void *priv_ptr, struct dma_desc *p)
                                          sizeof(struct dma_desc)));
 }
-const struct stmmac_chain_mode_ops chain_mode_ops = {
+const struct stmmac_mode_ops chain_mode_ops = {
        .init = stmmac_init_dma_chain,
        .is_jumbo_frm = stmmac_is_jumbo_frm,
        .jumbo_frm = stmmac_jumbo_frm,
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 7834a3993946..74610f3aca9e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -419,20 +419,13 @@ struct mii_regs {
        unsigned int data;      /* MII Data */
 };
-struct stmmac_ring_mode_ops {
+struct stmmac_mode_ops {
-        unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
-        unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
-        void (*refill_desc3) (void *priv, struct dma_desc *p);
-        void (*init_desc3) (struct dma_desc *p);
-        void (*clean_desc3) (void *priv, struct dma_desc *p);
-        int (*set_16kib_bfsize) (int mtu);
-};
-struct stmmac_chain_mode_ops {
        void (*init) (void *des, dma_addr_t phy_addr, unsigned int size,
                      unsigned int extend_desc);
        unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
        unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
+        int (*set_16kib_bfsize)(int mtu);
+        void (*init_desc3)(struct dma_desc *p);
        void (*refill_desc3) (void *priv, struct dma_desc *p);
        void (*clean_desc3) (void *priv, struct dma_desc *p);
 };
@@ -441,8 +434,7 @@ struct mac_device_info {
        const struct stmmac_ops *mac;
        const struct stmmac_desc_ops *desc;
        const struct stmmac_dma_ops *dma;
-        const struct stmmac_ring_mode_ops *ring;
+        const struct stmmac_mode_ops *mode;
-        const struct stmmac_chain_mode_ops *chain;
        const struct stmmac_hwtimestamp *ptp;
        struct mii_regs mii;    /* MII register Addresses */
        struct mac_link link;
@@ -460,7 +452,7 @@ void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
 void stmmac_set_mac(void __iomem *ioaddr, bool enable);
 void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
-extern const struct stmmac_ring_mode_ops ring_mode_ops;
+extern const struct stmmac_mode_ops ring_mode_ops;
-extern const struct stmmac_chain_mode_ops chain_mode_ops;
+extern const struct stmmac_mode_ops chain_mode_ops;
 #endif /* __COMMON_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index a96c7c2f5f3f..650a4be6bce5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -100,10 +100,9 @@ static void stmmac_refill_desc3(void *priv_ptr, struct dma_desc *p)
 {
        struct stmmac_priv *priv = (struct stmmac_priv *)priv_ptr;
-        if (unlikely(priv->plat->has_gmac))
+        /* Fill DES3 in case of RING mode */
-                /* Fill DES3 in case of RING mode */
+        if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
-                if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
+                p->des3 = p->des2 + BUF_SIZE_8KiB;
-                        p->des3 = p->des2 + BUF_SIZE_8KiB;
 }
 /* In ring mode we need to fill the desc3 because it is used as buffer */
@@ -126,7 +125,7 @@ static int stmmac_set_16kib_bfsize(int mtu)
        return ret;
 }
-const struct stmmac_ring_mode_ops ring_mode_ops = {
+const struct stmmac_mode_ops ring_mode_ops = {
        .is_jumbo_frm = stmmac_is_jumbo_frm,
        .jumbo_frm = stmmac_jumbo_frm,
        .refill_desc3 = stmmac_refill_desc3,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 078ad0ec8593..8543e1cfd55e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -92,8 +92,8 @@ static int tc = TC_DEFAULT;
 module_param(tc, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(tc, "DMA threshold control value");
-#define DMA_BUFFER_SIZE BUF_SIZE_4KiB
+#define DEFAULT_BUFSIZE 1536
-static int buf_sz = DMA_BUFFER_SIZE;
+static int buf_sz = DEFAULT_BUFSIZE;
 module_param(buf_sz, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(buf_sz, "DMA buffer size");
@@ -136,8 +136,8 @@ static void stmmac_verify_args(void)
                dma_rxsize = DMA_RX_SIZE;
        if (unlikely(dma_txsize < 0))
                dma_txsize = DMA_TX_SIZE;
-        if (unlikely((buf_sz < DMA_BUFFER_SIZE) || (buf_sz > BUF_SIZE_16KiB)))
+        if (unlikely((buf_sz < DEFAULT_BUFSIZE) || (buf_sz > BUF_SIZE_16KiB)))
-                buf_sz = DMA_BUFFER_SIZE;
+                buf_sz = DEFAULT_BUFSIZE;
        if (unlikely(flow_ctrl > 1))
                flow_ctrl = FLOW_AUTO;
        else if (likely(flow_ctrl < 0))
@@ -286,10 +286,25 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
        /* MAC core supports the EEE feature. */
        if (priv->dma_cap.eee) {
+                int tx_lpi_timer = priv->tx_lpi_timer;
                /* Check if the PHY supports EEE */
-                if (phy_init_eee(priv->phydev, 1))
+                if (phy_init_eee(priv->phydev, 1)) {
+                        /* To manage at run-time if the EEE cannot be supported
+                         * anymore (for example because the lp caps have been
+                         * changed).
+                         * In that case the driver disable own timers.
+                         */
+                        if (priv->eee_active) {
+                                pr_debug("stmmac: disable EEE\n");
+                                del_timer_sync(&priv->eee_ctrl_timer);
+                                priv->hw->mac->set_eee_timer(priv->ioaddr, 0,
+                                                             tx_lpi_timer);
+                        }
+                        priv->eee_active = 0;
                        goto out;
+                }
+                /* Activate the EEE and start timers */
                if (!priv->eee_active) {
                        priv->eee_active = 1;
                        init_timer(&priv->eee_ctrl_timer);
@@ -300,13 +315,13 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                        priv->hw->mac->set_eee_timer(priv->ioaddr,
                                                     STMMAC_DEFAULT_LIT_LS,
-                                                     priv->tx_lpi_timer);
+                                                     tx_lpi_timer);
                } else
                        /* Set HW EEE according to the speed */
                        priv->hw->mac->set_eee_pls(priv->ioaddr,
                                                   priv->phydev->link);
-                pr_info("stmmac: Energy-Efficient Ethernet initialized\n");
+                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
                ret = true;
        }
@@ -886,10 +901,10 @@ static int stmmac_set_bfsize(int mtu, int bufsize)
                ret = BUF_SIZE_8KiB;
        else if (mtu >= BUF_SIZE_2KiB)
                ret = BUF_SIZE_4KiB;
-        else if (mtu >= DMA_BUFFER_SIZE)
+        else if (mtu > DEFAULT_BUFSIZE)
                ret = BUF_SIZE_2KiB;
        else
-                ret = DMA_BUFFER_SIZE;
+                ret = DEFAULT_BUFSIZE;
        return ret;
 }
@@ -951,9 +966,9 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
        p->des2 = priv->rx_skbuff_dma[i];
-        if ((priv->mode == STMMAC_RING_MODE) &&
+        if ((priv->hw->mode->init_desc3) &&
            (priv->dma_buf_sz == BUF_SIZE_16KiB))
-                priv->hw->ring->init_desc3(p);
+                priv->hw->mode->init_desc3(p);
        return 0;
 }
@@ -984,11 +999,8 @@ static int init_dma_desc_rings(struct net_device *dev)
        unsigned int bfsize = 0;
        int ret = -ENOMEM;
-        /* Set the max buffer size according to the DESC mode
+        if (priv->hw->mode->set_16kib_bfsize)
-         * and the MTU. Note that RING mode allows 16KiB bsize.
+                bfsize = priv->hw->mode->set_16kib_bfsize(dev->mtu);
-         */
-        if (priv->mode == STMMAC_RING_MODE)
-                bfsize = priv->hw->ring->set_16kib_bfsize(dev->mtu);
        if (bfsize < BUF_SIZE_16KiB)
                bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
@@ -1029,15 +1041,15 @@ static int init_dma_desc_rings(struct net_device *dev)
        /* Setup the chained descriptor addresses */
        if (priv->mode == STMMAC_CHAIN_MODE) {
                if (priv->extend_desc) {
-                        priv->hw->chain->init(priv->dma_erx, priv->dma_rx_phy,
+                        priv->hw->mode->init(priv->dma_erx, priv->dma_rx_phy,
-                                              rxsize, 1);
+                                             rxsize, 1);
-                        priv->hw->chain->init(priv->dma_etx, priv->dma_tx_phy,
+                        priv->hw->mode->init(priv->dma_etx, priv->dma_tx_phy,
-                                              txsize, 1);
+                                             txsize, 1);
                } else {
-                        priv->hw->chain->init(priv->dma_rx, priv->dma_rx_phy,
+                        priv->hw->mode->init(priv->dma_rx, priv->dma_rx_phy,
-                                              rxsize, 0);
+                                             rxsize, 0);
-                        priv->hw->chain->init(priv->dma_tx, priv->dma_tx_phy,
+                        priv->hw->mode->init(priv->dma_tx, priv->dma_tx_phy,
-                                              txsize, 0);
+                                             txsize, 0);
                }
        }
@@ -1288,7 +1300,7 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
                                         DMA_TO_DEVICE);
                        priv->tx_skbuff_dma[entry] = 0;
                }
-                priv->hw->ring->clean_desc3(priv, p);
+                priv->hw->mode->clean_desc3(priv, p);
                if (likely(skb != NULL)) {
                        dev_kfree_skb(skb);
@@ -1844,6 +1856,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        int nfrags = skb_shinfo(skb)->nr_frags;
        struct dma_desc *desc, *first;
        unsigned int nopaged_len = skb_headlen(skb);
+        unsigned int enh_desc = priv->plat->enh_desc;
        if (unlikely(stmmac_tx_avail(priv) < nfrags + 1)) {
                if (!netif_queue_stopped(dev)) {
@@ -1871,27 +1884,19 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        first = desc;
        /* To program the descriptors according to the size of the frame */
-        if (priv->mode == STMMAC_RING_MODE) {
+        if (enh_desc)
-                is_jumbo = priv->hw->ring->is_jumbo_frm(skb->len,
+                is_jumbo = priv->hw->mode->is_jumbo_frm(skb->len, enh_desc);
-                                                        priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->ring->jumbo_frm(priv, skb,
-                                                          csum_insertion);
-        } else {
-                is_jumbo = priv->hw->chain->is_jumbo_frm(skb->len,
-                                                         priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->chain->jumbo_frm(priv, skb,
-                                                           csum_insertion);
-        }
        if (likely(!is_jumbo)) {
                desc->des2 = dma_map_single(priv->device, skb->data,
                                            nopaged_len, DMA_TO_DEVICE);
                priv->tx_skbuff_dma[entry] = desc->des2;
                priv->hw->desc->prepare_tx_desc(desc, 1, nopaged_len,
                                                csum_insertion, priv->mode);
-        } else
+        } else {
                desc = first;
+                entry = priv->hw->mode->jumbo_frm(priv, skb, csum_insertion);
+        }
        for (i = 0; i < nfrags; i++) {
                const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
@@ -2029,7 +2034,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                        p->des2 = priv->rx_skbuff_dma[entry];
-                        priv->hw->ring->refill_desc3(priv, p);
+                        priv->hw->mode->refill_desc3(priv, p);
                        if (netif_msg_rx_status(priv))
                                pr_debug("\trefill entry #%d\n", entry);
@@ -2633,11 +2638,11 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
        /* To use the chained or ring mode */
        if (chain_mode) {
-                priv->hw->chain = &chain_mode_ops;
+                priv->hw->mode = &chain_mode_ops;
                pr_info(" Chain mode enabled\n");
                priv->mode = STMMAC_CHAIN_MODE;
        } else {
-                priv->hw->ring = &ring_mode_ops;
+                priv->hw->mode = &ring_mode_ops;
                pr_info(" Ring mode enabled\n");
                priv->mode = STMMAC_RING_MODE;
        }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index c61bc72b8e90..8fb32a80f1c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -36,7 +36,7 @@ static const struct of_device_id stmmac_dt_ids[] = {
 #ifdef CONFIG_DWMAC_STI
        { .compatible = "st,stih415-dwmac", .data = &sti_gmac_data},
        { .compatible = "st,stih416-dwmac", .data = &sti_gmac_data},
-        { .compatible = "st,stih127-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stid127-dwmac", .data = &sti_gmac_data},
 #endif
        /* SoC specific glue layers should come before generic bindings */
        { .compatible = "st,spear600-gmac"},
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index ffd4d12acf6d..7d6d8ec676c8 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2229,10 +2229,6 @@ static int cpsw_probe(struct platform_device *pdev)
                goto clean_ale_ret;
        }
-        if (cpts_register(&pdev->dev, priv->cpts,
-                          data->cpts_clock_mult, data->cpts_clock_shift))
-                dev_err(priv->dev, "error registering cpts device\n");
        cpsw_notice(priv, probe, "initialized device (regs %pa, irq %d)\n",
                    &ss_res->start, ndev->irq);
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 364d0c7952c0..88ef27067bf2 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -355,7 +355,7 @@ int cpdma_ctlr_stop(struct cpdma_ctlr *ctlr)
        int i;
        spin_lock_irqsave(&ctlr->lock, flags);
-        if (ctlr->state != CPDMA_STATE_ACTIVE) {
+        if (ctlr->state == CPDMA_STATE_TEARDOWN) {
                spin_unlock_irqrestore(&ctlr->lock, flags);
                return -EINVAL;
        }
@@ -891,7 +891,7 @@ int cpdma_chan_stop(struct cpdma_chan *chan)
        unsigned                timeout;
        spin_lock_irqsave(&chan->lock, flags);
-        if (chan->state != CPDMA_STATE_ACTIVE) {
+        if (chan->state == CPDMA_STATE_TEARDOWN) {
                spin_unlock_irqrestore(&chan->lock, flags);
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index cd9b164a0434..8f0e69ce07ca 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1532,9 +1532,9 @@ static int emac_dev_open(struct net_device *ndev)
        struct device *emac_dev = &ndev->dev;
        u32 cnt;
        struct resource *res;
-        int ret;
+        int q, m, ret;
+        int res_num = 0, irq_num = 0;
        int i = 0;
-        int k = 0;
        struct emac_priv *priv = netdev_priv(ndev);
        pm_runtime_get(&priv->pdev->dev);
@@ -1564,15 +1564,24 @@ static int emac_dev_open(struct net_device *ndev)
        }
        /* Request IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ,
+                                            res_num))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++) {
+                        dev_err(emac_dev, "Request IRQ %d\n", irq_num);
+                        if (request_irq(irq_num, emac_irq, 0, ndev->name,
+                                        ndev)) {
+                                dev_err(emac_dev,
+                                        "DaVinci EMAC: request_irq() failed\n");
+                                ret = -EBUSY;
-        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
-                for (i = res->start; i <= res->end; i++) {
-                        if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
-                                             0, ndev->name, ndev))
                                goto rollback;
+                        }
                }
-                k++;
+                res_num++;
        }
+        /* prepare counters for rollback in case of an error */
+        res_num--;
+        irq_num--;
        /* Start/Enable EMAC hardware */
        emac_hw_enable(priv);
@@ -1639,11 +1648,23 @@ static int emac_dev_open(struct net_device *ndev)
        return 0;
-rollback:
-        dev_err(emac_dev, "DaVinci EMAC: devm_request_irq() failed");
-        ret = -EBUSY;
 err:
+        emac_int_disable(priv);
+        napi_disable(&priv->napi);
+rollback:
+        for (q = res_num; q >= 0; q--) {
+                res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, q);
+                /* at the first iteration, irq_num is already set to the
+                 * right value
+                 */
+                if (q != res_num)
+                        irq_num = res->end;
+                for (m = irq_num; m >= res->start; m--)
+                        free_irq(m, ndev);
+        }
+        cpdma_ctlr_stop(priv->dma);
        pm_runtime_put(&priv->pdev->dev);
        return ret;
 }
@@ -1659,6 +1680,9 @@ err:
 */
 static int emac_dev_stop(struct net_device *ndev)
 {
+        struct resource *res;
+        int i = 0;
+        int irq_num;
        struct emac_priv *priv = netdev_priv(ndev);
        struct device *emac_dev = &ndev->dev;
@@ -1674,6 +1698,13 @@ static int emac_dev_stop(struct net_device *ndev)
        if (priv->phydev)
                phy_disconnect(priv->phydev);
+        /* Free IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, i))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++)
+                        free_irq(irq_num, priv->ndev);
+                i++;
+        }
        if (netif_msg_drv(priv))
                dev_notice(emac_dev, "DaVinci EMAC: %s stopped\n", ndev->name);
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index ef312bc6b865..6ac20a6738f4 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -923,7 +923,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (rc) {
                dev_err(&pdev->dev,
                        "32-bit PCI DMA addresses not supported by the card!?\n");
-                goto err_out;
+                goto err_out_pci_disable;
        }
        /* sanity check */
@@ -931,7 +931,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
            (pci_resource_len(pdev, 1) < io_size)) {
                rc = -EIO;
                dev_err(&pdev->dev, "Insufficient PCI resources, aborting\n");
-                goto err_out;
+                goto err_out_pci_disable;
        }
        pioaddr = pci_resource_start(pdev, 0);
@@ -942,7 +942,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        dev = alloc_etherdev(sizeof(struct rhine_private));
        if (!dev) {
                rc = -ENOMEM;
-                goto err_out;
+                goto err_out_pci_disable;
        }
        SET_NETDEV_DEV(dev, &pdev->dev);
@@ -1084,6 +1084,8 @@ err_out_free_res:
        pci_release_regions(pdev);
 err_out_free_netdev:
        free_netdev(dev);
+err_out_pci_disable:
+        pci_disable_device(pdev);
 err_out:
        return rc;
 }
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 7141a1937360..d6fce9750b95 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -442,6 +442,8 @@ static int netvsc_probe(struct hv_device *dev,
        if (!net)
                return -ENOMEM;
+        netif_carrier_off(net);
        net_device_ctx = netdev_priv(net);
        net_device_ctx->device_ctx = dev;
        hv_set_drvdata(dev, net);
@@ -473,6 +475,8 @@ static int netvsc_probe(struct hv_device *dev,
                pr_err("Unable to register netdev.\n");
                rndis_filter_device_remove(dev);
                free_netdev(net);
+        } else {
+                schedule_delayed_work(&net_device_ctx->dwork, 0);
        }
        return ret;
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 1084e5de3ceb..b54fd257652b 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -243,6 +243,22 @@ static int rndis_filter_send_request(struct rndis_device *dev,
        return ret;
 }
+static void rndis_set_link_state(struct rndis_device *rdev,
+                                 struct rndis_request *request)
+{
+        u32 link_status;
+        struct rndis_query_complete *query_complete;
+        query_complete = &request->response_msg.msg.query_complete;
+        if (query_complete->status == RNDIS_STATUS_SUCCESS &&
+            query_complete->info_buflen == sizeof(u32)) {
+                memcpy(&link_status, (void *)((unsigned long)query_complete +
+                       query_complete->info_buf_offset), sizeof(u32));
+                rdev->link_state = link_status != 0;
+        }
+}
 static void rndis_filter_receive_response(struct rndis_device *dev,
                                       struct rndis_message *resp)
 {
@@ -272,6 +288,10 @@ static void rndis_filter_receive_response(struct rndis_device *dev,
                    sizeof(struct rndis_message) + RNDIS_EXT_LEN) {
                        memcpy(&request->response_msg, resp,
                               resp->msg_len);
+                        if (request->request_msg.ndis_msg_type ==
+                            RNDIS_MSG_QUERY && request->request_msg.msg.
+                            query_req.oid == RNDIS_OID_GEN_MEDIA_CONNECT_STATUS)
+                                rndis_set_link_state(dev, request);
                } else {
                        netdev_err(ndev,
                                "rndis response buffer overflow "
@@ -620,7 +640,6 @@ static int rndis_filter_query_device_link_status(struct rndis_device *dev)
        ret = rndis_filter_query_device(dev,
                                      RNDIS_OID_GEN_MEDIA_CONNECT_STATUS,
                                      &link_status, &size);
-        dev->link_state = (link_status != 0) ? true : false;
        return ret;
 }
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index ab31544bc254..a30258aad139 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -546,12 +546,12 @@ at86rf230_xmit(struct ieee802154_dev *dev, struct sk_buff *skb)
        int rc;
        unsigned long flags;
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
        if  (lp->irq_busy) {
-                spin_unlock(&lp->lock);
+                spin_unlock_irqrestore(&lp->lock, flags);
                return -EBUSY;
        }
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
        might_sleep();
@@ -725,10 +725,11 @@ static void at86rf230_irqwork_level(struct work_struct *work)
 static irqreturn_t at86rf230_isr(int irq, void *data)
 {
        struct at86rf230_local *lp = data;
+        unsigned long flags;
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
        lp->irq_busy = 1;
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
        schedule_work(&lp->irqwork);
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 19c9eca0ef26..76d96b9ebcdb 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -164,9 +164,9 @@ static const struct phy_setting settings[] = {
 *   of that setting.  Returns the index of the last setting if
 *   none of the others match.
 */
-static inline int phy_find_setting(int speed, int duplex)
+static inline unsigned int phy_find_setting(int speed, int duplex)
 {
-        int idx = 0;
+        unsigned int idx = 0;
        while (idx < ARRAY_SIZE(settings) &&
               (settings[idx].speed != speed || settings[idx].duplex != duplex))
@@ -185,7 +185,7 @@ static inline int phy_find_setting(int speed, int duplex)
 *   the mask in features.  Returns the index of the last setting
 *   if nothing else matches.
 */
-static inline int phy_find_valid(int idx, u32 features)
+static inline unsigned int phy_find_valid(unsigned int idx, u32 features)
 {
        while (idx < MAX_NUM_SETTINGS && !(settings[idx].setting & features))
                idx++;
@@ -204,7 +204,7 @@ static inline int phy_find_valid(int idx, u32 features)
 static void phy_sanitize_settings(struct phy_device *phydev)
 {
        u32 features = phydev->supported;
-        int idx;
+        unsigned int idx;
        /* Sanitize settings based on PHY capabilities */
        if ((features & SUPPORTED_Autoneg) == 0)
@@ -954,7 +954,8 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
            (phydev->interface == PHY_INTERFACE_MODE_RGMII))) {
                int eee_lp, eee_cap, eee_adv;
                u32 lp, cap, adv;
-                int idx, status;
+                int status;
+                unsigned int idx;
                /* Read phy status to properly get the right settings */
                status = phy_read_status(phydev);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 4b970f7624c0..2f6989b1e0dc 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -683,10 +683,9 @@ EXPORT_SYMBOL(phy_detach);
 int phy_suspend(struct phy_device *phydev)
 {
        struct phy_driver *phydrv = to_phy_driver(phydev->dev.driver);
-        struct ethtool_wolinfo wol;
+        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
        /* If the device has WOL enabled, we cannot suspend the PHY */
-        wol.cmd = ETHTOOL_GWOL;
        phy_ethtool_get_wol(phydev, &wol);
        if (wol.wolopts)
                return -EBUSY;
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 433f0a00c683..e2797f1e1b31 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -11,7 +11,7 @@ obj-$(CONFIG_USB_HSO)		+= hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 asix-y := asix_devices.o asix_common.o ax88172a.o
 obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
-obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o r815x.o
+obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SR9700)    += sr9700.o
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 42e176912c8e..bd363b27e854 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -652,6 +652,13 @@ static const struct usb_device_id	products[] = {
        .driver_info = 0,
 },
+/* Samsung USB Ethernet Adapters */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, 0xa101, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
 /* WHITELIST!!!
 *
 * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index dbff290ed0e4..d350d2795e10 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -68,7 +68,6 @@ static struct usb_driver cdc_ncm_driver;
 static int cdc_ncm_setup(struct usbnet *dev)
 {
        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
-        struct usb_cdc_ncm_ntb_parameters ncm_parm;
        u32 val;
        u8 flags;
        u8 iface_no;
@@ -82,22 +81,22 @@ static int cdc_ncm_setup(struct usbnet *dev)
        err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_PARAMETERS,
                              USB_TYPE_CLASS | USB_DIR_IN
                              |USB_RECIP_INTERFACE,
-                              0, iface_no, &ncm_parm,
+                              0, iface_no, &ctx->ncm_parm,
-                              sizeof(ncm_parm));
+                              sizeof(ctx->ncm_parm));
        if (err < 0) {
                dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
                return err; /* GET_NTB_PARAMETERS is required */
        }
        /* read correct set of parameters according to device mode */
-        ctx->rx_max = le32_to_cpu(ncm_parm.dwNtbInMaxSize);
+        ctx->rx_max = le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize);
-        ctx->tx_max = le32_to_cpu(ncm_parm.dwNtbOutMaxSize);
+        ctx->tx_max = le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize);
-        ctx->tx_remainder = le16_to_cpu(ncm_parm.wNdpOutPayloadRemainder);
+        ctx->tx_remainder = le16_to_cpu(ctx->ncm_parm.wNdpOutPayloadRemainder);
-        ctx->tx_modulus = le16_to_cpu(ncm_parm.wNdpOutDivisor);
+        ctx->tx_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutDivisor);
-        ctx->tx_ndp_modulus = le16_to_cpu(ncm_parm.wNdpOutAlignment);
+        ctx->tx_ndp_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutAlignment);
        /* devices prior to NCM Errata shall set this field to zero */
-        ctx->tx_max_datagrams = le16_to_cpu(ncm_parm.wNtbOutMaxDatagrams);
+        ctx->tx_max_datagrams = le16_to_cpu(ctx->ncm_parm.wNtbOutMaxDatagrams);
-        ntb_fmt_supported = le16_to_cpu(ncm_parm.bmNtbFormatsSupported);
+        ntb_fmt_supported = le16_to_cpu(ctx->ncm_parm.bmNtbFormatsSupported);
        /* there are some minor differences in NCM and MBIM defaults */
        if (cdc_ncm_comm_intf_is_mbim(ctx->control->cur_altsetting)) {
@@ -146,7 +145,7 @@ static int cdc_ncm_setup(struct usbnet *dev)
        }
        /* inform device about NTB input size changes */
-        if (ctx->rx_max != le32_to_cpu(ncm_parm.dwNtbInMaxSize)) {
+        if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
                __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
                err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_INPUT_SIZE,
@@ -162,14 +161,6 @@ static int cdc_ncm_setup(struct usbnet *dev)
                dev_dbg(&dev->intf->dev, "Using default maximum transmit length=%d\n",
                        CDC_NCM_NTB_MAX_SIZE_TX);
                ctx->tx_max = CDC_NCM_NTB_MAX_SIZE_TX;
-                /* Adding a pad byte here simplifies the handling in
-                 * cdc_ncm_fill_tx_frame, by making tx_max always
-                 * represent the real skb max size.
-                 */
-                if (ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
-                        ctx->tx_max++;
        }
        /*
@@ -439,6 +430,10 @@ advance:
                goto error2;
        }
+        /* initialize data interface */
+        if (cdc_ncm_setup(dev))
+                goto error2;
        /* configure data interface */
        temp = usb_set_interface(dev->udev, iface_no, data_altsetting);
        if (temp) {
@@ -453,12 +448,6 @@ advance:
                goto error2;
        }
-        /* initialize data interface */
-        if (cdc_ncm_setup(dev)) {
-                dev_dbg(&intf->dev, "cdc_ncm_setup() failed\n");
-                goto error2;
-        }
        usb_set_intfdata(ctx->data, dev);
        usb_set_intfdata(ctx->control, dev);
@@ -475,6 +464,15 @@ advance:
        dev->hard_mtu = ctx->tx_max;
        dev->rx_urb_size = ctx->rx_max;
+        /* cdc_ncm_setup will override dwNtbOutMaxSize if it is
+         * outside the sane range. Adding a pad byte here if necessary
+         * simplifies the handling in cdc_ncm_fill_tx_frame, making
+         * tx_max always represent the real skb max size.
+         */
+        if (ctx->tx_max != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
+            ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
+                ctx->tx_max++;
        return 0;
 error2:
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d89dbe395ad2..adb12f349a61 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -449,9 +449,6 @@ enum rtl8152_flags {
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
-#define REALTEK_USB_DEVICE(vend, prod)  \
-        USB_DEVICE_INTERFACE_CLASS(vend, prod, USB_CLASS_VENDOR_SPEC)
 struct rx_desc {
        __le32 opts1;
 #define RX_LEN_MASK                     0x7fff
@@ -2739,6 +2736,12 @@ static int rtl8152_probe(struct usb_interface *intf,
        struct net_device *netdev;
        int ret;
+        if (udev->actconfig->desc.bConfigurationValue != 1) {
+                usb_driver_set_configuration(udev, 1);
+                return -ENODEV;
+        }
+        usb_reset_device(udev);
        netdev = alloc_etherdev(sizeof(struct r8152));
        if (!netdev) {
                dev_err(&intf->dev, "Out of memory\n");
@@ -2819,9 +2822,9 @@ static void rtl8152_disconnect(struct usb_interface *intf)
 /* table of devices that work with this driver */
 static struct usb_device_id rtl8152_table[] = {
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
+        {USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
        {}
 };
diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
deleted file mode 100644
index f0a8791b7636..000000000000
--- a/drivers/net/usb/r815x.c
+++ /dev/null
@@ -1,248 +0,0 @@
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/mii.h>
-#include <linux/usb.h>
-#include <linux/usb/cdc.h>
-#include <linux/usb/usbnet.h>
-#define RTL815x_REQT_READ       0xc0
-#define RTL815x_REQT_WRITE      0x40
-#define RTL815x_REQ_GET_REGS    0x05
-#define RTL815x_REQ_SET_REGS    0x05
-#define MCU_TYPE_PLA            0x0100
-#define OCP_BASE                0xe86c
-#define BASE_MII                0xa400
-#define BYTE_EN_DWORD           0xff
-#define BYTE_EN_WORD            0x33
-#define BYTE_EN_BYTE            0x11
-#define R815x_PHY_ID            32
-#define REALTEK_VENDOR_ID       0x0bda
-static int pla_read_word(struct usb_device *udev, u16 index)
-{
-        int ret;
-        u8 shift = index & 2;
-        __le32 *tmp;
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-        index &= ~3;
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out2;
-        ret = __le32_to_cpu(*tmp);
-        ret >>= (shift * 8);
-        ret &= 0xffff;
-out2:
-        kfree(tmp);
-        return ret;
-}
-static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
-{
-        __le32 *tmp;
-        u32 mask = 0xffff;
-        u16 byen = BYTE_EN_WORD;
-        u8 shift = index & 2;
-        int ret;
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-        data &= mask;
-        if (shift) {
-                byen <<= shift;
-                mask <<= (shift * 8);
-                data <<= (shift * 8);
-                index &= ~3;
-        }
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out3;
-        data |= __le32_to_cpu(*tmp) & ~mask;
-        *tmp = __cpu_to_le32(data);
-        ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
-                              RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
-                              index, MCU_TYPE_PLA | byen, tmp, sizeof(*tmp),
-                              500);
-out3:
-        kfree(tmp);
-        return ret;
-}
-static int ocp_reg_read(struct usbnet *dev, u16 addr)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out;
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_read_word(dev->udev, ocp_index);
-out:
-        return ret;
-}
-static int ocp_reg_write(struct usbnet *dev, u16 addr, u16 data)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out1;
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_write_word(dev->udev, ocp_index, data);
-out1:
-        return ret;
-}
-static int r815x_mdio_read(struct net_device *netdev, int phy_id, int reg)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-        int ret;
-        if (phy_id != R815x_PHY_ID)
-                return -EINVAL;
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return -ENODEV;
-        ret = ocp_reg_read(dev, BASE_MII + reg * 2);
-        usb_autopm_put_interface(dev->intf);
-        return ret;
-}
-static
-void r815x_mdio_write(struct net_device *netdev, int phy_id, int reg, int val)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-        if (phy_id != R815x_PHY_ID)
-                return;
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return;
-        ocp_reg_write(dev, BASE_MII + reg * 2, val);
-        usb_autopm_put_interface(dev->intf);
-}
-static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 1;
-        return status;
-}
-static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 0;
-        return status;
-}
-static const struct driver_info r8152_info = {
-        .description =  "RTL8152 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8152_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-static const struct driver_info r8153_info = {
-        .description =  "RTL8153 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8153_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-static const struct usb_device_id products[] = {
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8152, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8152_info,
-},
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8153, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8153_info,
-},
-        { },            /* END */
-};
-MODULE_DEVICE_TABLE(usb, products);
-static struct usb_driver r815x_driver = {
-        .name =         "r815x",
-        .id_table =     products,
-        .probe =        usbnet_probe,
-        .disconnect =   usbnet_disconnect,
-        .suspend =      usbnet_suspend,
-        .resume =       usbnet_resume,
-        .reset_resume = usbnet_resume,
-        .supports_autosuspend = 1,
-        .disable_hub_initiated_lpm = 1,
-};
-module_usb_driver(r815x_driver);
-MODULE_AUTHOR("Hayes Wang");
-MODULE_DESCRIPTION("Realtek USB ECM device");
-MODULE_LICENSE("GPL");
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 3be786faaaec..0fa3b44f7342 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1762,11 +1762,20 @@ vmxnet3_netpoll(struct net_device *netdev)
 {
        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+        switch (adapter->intr.type) {
-                vmxnet3_disable_all_intrs(adapter);
+#ifdef CONFIG_PCI_MSI
+        case VMXNET3_IT_MSIX: {
-        vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
+                int i;
-        vmxnet3_enable_all_intrs(adapter);
+                for (i = 0; i < adapter->num_rx_queues; i++)
+                        vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+                break;
+        }
+#endif
+        case VMXNET3_IT_MSI:
+        default:
+                vmxnet3_intr(0, adapter->netdev);
+                break;
+        }
 }
 #endif  /* CONFIG_NET_POLL_CONTROLLER */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index b0f705c2378f..1236812c7be6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1318,6 +1318,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb)
                neigh_release(n);
+                if (reply == NULL)
+                        goto out;
                skb_reset_mac_header(reply);
                __skb_pull(reply, skb_network_offset(reply));
                reply->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1339,15 +1342,103 @@ out:
 }
 #if IS_ENABLED(CONFIG_IPV6)
+static struct sk_buff *vxlan_na_create(struct sk_buff *request,
+        struct neighbour *n, bool isrouter)
+{
+        struct net_device *dev = request->dev;
+        struct sk_buff *reply;
+        struct nd_msg *ns, *na;
+        struct ipv6hdr *pip6;
+        u8 *daddr;
+        int na_olen = 8; /* opt hdr + ETH_ALEN for target */
+        int ns_olen;
+        int i, len;
+        if (dev == NULL)
+                return NULL;
+        len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
+                sizeof(*na) + na_olen + dev->needed_tailroom;
+        reply = alloc_skb(len, GFP_ATOMIC);
+        if (reply == NULL)
+                return NULL;
+        reply->protocol = htons(ETH_P_IPV6);
+        reply->dev = dev;
+        skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
+        skb_push(reply, sizeof(struct ethhdr));
+        skb_set_mac_header(reply, 0);
+        ns = (struct nd_msg *)skb_transport_header(request);
+        daddr = eth_hdr(request)->h_source;
+        ns_olen = request->len - skb_transport_offset(request) - sizeof(*ns);
+        for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
+                if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
+                        daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+                        break;
+                }
+        }
+        /* Ethernet header */
+        ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+        ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
+        eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
+        reply->protocol = htons(ETH_P_IPV6);
+        skb_pull(reply, sizeof(struct ethhdr));
+        skb_set_network_header(reply, 0);
+        skb_put(reply, sizeof(struct ipv6hdr));
+        /* IPv6 header */
+        pip6 = ipv6_hdr(reply);
+        memset(pip6, 0, sizeof(struct ipv6hdr));
+        pip6->version = 6;
+        pip6->priority = ipv6_hdr(request)->priority;
+        pip6->nexthdr = IPPROTO_ICMPV6;
+        pip6->hop_limit = 255;
+        pip6->daddr = ipv6_hdr(request)->saddr;
+        pip6->saddr = *(struct in6_addr *)n->primary_key;
+        skb_pull(reply, sizeof(struct ipv6hdr));
+        skb_set_transport_header(reply, 0);
+        na = (struct nd_msg *)skb_put(reply, sizeof(*na) + na_olen);
+        /* Neighbor Advertisement */
+        memset(na, 0, sizeof(*na)+na_olen);
+        na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+        na->icmph.icmp6_router = isrouter;
+        na->icmph.icmp6_override = 1;
+        na->icmph.icmp6_solicited = 1;
+        na->target = ns->target;
+        ether_addr_copy(&na->opt[2], n->ha);
+        na->opt[0] = ND_OPT_TARGET_LL_ADDR;
+        na->opt[1] = na_olen >> 3;
+        na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
+                &pip6->daddr, sizeof(*na)+na_olen, IPPROTO_ICMPV6,
+                csum_partial(na, sizeof(*na)+na_olen, 0));
+        pip6->payload_len = htons(sizeof(*na)+na_olen);
+        skb_push(reply, sizeof(struct ipv6hdr));
+        reply->ip_summed = CHECKSUM_UNNECESSARY;
+        return reply;
+}
 static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
 {
        struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct neighbour *n;
+        struct nd_msg *msg;
-        union vxlan_addr ipa;
        const struct ipv6hdr *iphdr;
        const struct in6_addr *saddr, *daddr;
-        struct nd_msg *msg;
+        struct neighbour *n;
-        struct inet6_dev *in6_dev = NULL;
+        struct inet6_dev *in6_dev;
        in6_dev = __in6_dev_get(dev);
        if (!in6_dev)
@@ -1360,19 +1451,20 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
        saddr = &iphdr->saddr;
        daddr = &iphdr->daddr;
-        if (ipv6_addr_loopback(daddr) ||
-            ipv6_addr_is_multicast(daddr))
-                goto out;
        msg = (struct nd_msg *)skb_transport_header(skb);
        if (msg->icmph.icmp6_code != 0 ||
            msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
                goto out;
-        n = neigh_lookup(ipv6_stub->nd_tbl, daddr, dev);
+        if (ipv6_addr_loopback(daddr) ||
+            ipv6_addr_is_multicast(&msg->target))
+                goto out;
+        n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev);
        if (n) {
                struct vxlan_fdb *f;
+                struct sk_buff *reply;
                if (!(n->nud_state & NUD_CONNECTED)) {
                        neigh_release(n);
@@ -1386,13 +1478,23 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
                        goto out;
                }
-                ipv6_stub->ndisc_send_na(dev, n, saddr, &msg->target,
+                reply = vxlan_na_create(skb, n,
-                                         !!in6_dev->cnf.forwarding,
+                                        !!(f ? f->flags & NTF_ROUTER : 0));
-                                         true, false, false);
                neigh_release(n);
+                if (reply == NULL)
+                        goto out;
+                if (netif_rx_ni(reply) == NET_RX_DROP)
+                        dev->stats.rx_dropped++;
        } else if (vxlan->flags & VXLAN_F_L3MISS) {
-                ipa.sin6.sin6_addr = *daddr;
+                union vxlan_addr ipa = {
-                ipa.sa.sa_family = AF_INET6;
+                        .sin6.sin6_addr = msg->target,
+                        .sa.sa_family = AF_INET6,
+                };
                vxlan_ip_miss(dev, &ipa);
        }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 303ce27964c1..9078a6c5a74e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1548,6 +1548,7 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
                if (reg != last_val)
                        return true;
+                udelay(1);
                last_val = reg;
                if ((reg & 0x7E7FFFEF) == 0x00702400)
                        continue;
@@ -1560,8 +1561,6 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
                default:
                        return true;
                }
-                udelay(1);
        } while (count-- > 0);
        return false;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index f042a18c8495..55897d508a76 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2063,7 +2063,7 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
        ATH_TXBUF_RESET(bf);
-        if (tid) {
+        if (tid && ieee80211_is_data_present(hdr->frame_control)) {
                fragno = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
                seqno = tid->seq_next;
                hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
@@ -2186,7 +2186,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                txq->stopped = true;
        }
-        if (txctl->an)
+        if (txctl->an && ieee80211_is_data_present(hdr->frame_control))
                tid = ath_get_skb_tid(sc, txctl->an, skb);
        if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 119ee6eaf1c3..ddaa9efd053d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -1948,8 +1948,10 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
                if (pkt_pad == NULL)
                        return -ENOMEM;
                ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
-                if (unlikely(ret < 0))
+                if (unlikely(ret < 0)) {
+                        kfree_skb(pkt_pad);
                        return ret;
+                }
                memcpy(pkt_pad->data,
                       pkt->data + pkt->len - tail_chop,
                       tail_chop);
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 76cde6ce6551..18a895a949d4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -872,8 +872,11 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        lockdep_assert_held(&mvm->mutex);
-        /* Rssi update while not associated ?! */
+        /*
-        if (WARN_ON_ONCE(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT))
+         * Rssi update while not associated - can happen since the statistics
+         * are handled asynchronously
+         */
+        if (mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)
                return;
        /* No BT - reports should be disabled */
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index f47bcbe2945a..3872ead75488 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -359,13 +359,12 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 7265 Series */
        {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x5112, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5100, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x510A, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c
index 5e0eec4d71c7..5d9a8084665d 100644
--- a/drivers/net/wireless/mwifiex/11ac.c
+++ b/drivers/net/wireless/mwifiex/11ac.c
@@ -189,8 +189,7 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
                vht_cap->header.len  =
                                cpu_to_le16(sizeof(struct ieee80211_vht_cap));
                memcpy((u8 *)vht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *)bss_desc->bcn_vht_cap +
+                       (u8 *)bss_desc->bcn_vht_cap,
-                       sizeof(struct ieee_types_header),
                       le16_to_cpu(vht_cap->header.len));
                mwifiex_fill_vht_cap_tlv(priv, vht_cap, bss_desc->bss_band);
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 6261f8c53d44..7db1a89fdd95 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -308,8 +308,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
                ht_cap->header.len =
                                cpu_to_le16(sizeof(struct ieee80211_ht_cap));
                memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *) bss_desc->bcn_ht_cap +
+                       (u8 *)bss_desc->bcn_ht_cap,
-                       sizeof(struct ieee_types_header),
                       le16_to_cpu(ht_cap->header.len));
                mwifiex_fill_cap_info(priv, radio_type, ht_cap);
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 0a8a26e10f01..668547c2de84 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -2101,12 +2101,12 @@ mwifiex_save_curr_bcn(struct mwifiex_private *priv)
                         curr_bss->ht_info_offset);
        if (curr_bss->bcn_vht_cap)
-                curr_bss->bcn_ht_cap = (void *)(curr_bss->beacon_buf +
+                curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
-                                                curr_bss->vht_cap_offset);
+                                                 curr_bss->vht_cap_offset);
        if (curr_bss->bcn_vht_oper)
-                curr_bss->bcn_ht_oper = (void *)(curr_bss->beacon_buf +
+                curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
-                                                 curr_bss->vht_info_offset);
+                                                  curr_bss->vht_info_offset);
        if (curr_bss->bcn_bss_co_2040)
                curr_bss->bcn_bss_co_2040 =
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 7f8b5d156c8c..41d4a8167dc3 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -5460,14 +5460,15 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
        rt2800_bbp_write(rt2x00dev, 68, 0x0b);
-        rt2800_bbp_write(rt2x00dev, 69, 0x0d);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
-        rt2800_bbp_write(rt2x00dev, 70, 0x06);
        rt2800_bbp_write(rt2x00dev, 73, 0x13);
        rt2800_bbp_write(rt2x00dev, 75, 0x46);
        rt2800_bbp_write(rt2x00dev, 76, 0x28);
        rt2800_bbp_write(rt2x00dev, 77, 0x59);
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
        rt2800_bbp_write(rt2x00dev, 79, 0x13);
        rt2800_bbp_write(rt2x00dev, 80, 0x05);
        rt2800_bbp_write(rt2x00dev, 81, 0x33);
@@ -5510,7 +5511,6 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
        if (rt2x00_rt(rt2x00dev, RT5392)) {
                rt2800_bbp_write(rt2x00dev, 134, 0xd0);
                rt2800_bbp_write(rt2x00dev, 135, 0xf6);
-                rt2800_bbp_write(rt2x00dev, 148, 0x84);
        }
        rt2800_disable_unused_dac_adc(rt2x00dev);
diff --git a/drivers/net/wireless/ti/wl1251/rx.c b/drivers/net/wireless/ti/wl1251/rx.c
index 123c4bb50e0a..cde0eaf99714 100644
--- a/drivers/net/wireless/ti/wl1251/rx.c
+++ b/drivers/net/wireless/ti/wl1251/rx.c
@@ -180,7 +180,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
        wl1251_mem_read(wl, rx_packet_ring_addr, rx_buffer, length);
        /* The actual length doesn't include the target's alignment */
-        skb->len = desc->length  - PLCP_HEADER_LENGTH;
+        skb_trim(skb, desc->length - PLCP_HEADER_LENGTH);
        fc = (u16 *)skb->data;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 7669d49a67e2..301cc037fda8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -132,8 +132,7 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* If the skb is GSO then we'll also need an extra slot for the
         * metadata.
         */
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+        if (skb_is_gso(skb))
-            skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
                min_slots_needed++;
        /* If the skb can't possibly fit in the remaining slots
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e5284bca2d90..438d0c09b7e6 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -240,7 +240,7 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
        struct gnttab_copy *copy_gop;
        struct xenvif_rx_meta *meta;
        unsigned long bytes;
-        int gso_type;
+        int gso_type = XEN_NETIF_GSO_TYPE_NONE;
        /* Data must not cross a page boundary. */
        BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
@@ -299,12 +299,12 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
                }
                /* Leave a gap for the GSO descriptor. */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                if (skb_is_gso(skb)) {
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
-                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                        else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
-                else
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-                        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+                }
                if (*head && ((1 << gso_type) & vif->gso_mask))
                        vif->rx.req_cons++;
@@ -338,19 +338,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        int head = 1;
        int old_meta_prod;
        int gso_type;
-        int gso_size;
        old_meta_prod = npo->meta_prod;
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
+        gso_type = XEN_NETIF_GSO_TYPE_NONE;
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+        if (skb_is_gso(skb)) {
-                gso_size = skb_shinfo(skb)->gso_size;
+                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
-        } else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
-                gso_size = skb_shinfo(skb)->gso_size;
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-        } else {
-                gso_type = XEN_NETIF_GSO_TYPE_NONE;
-                gso_size = 0;
        }
        /* Set up a GSO prefix descriptor, if necessary */
@@ -358,7 +354,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
                req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                meta = npo->meta + npo->meta_prod++;
                meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
                meta->size = 0;
                meta->id = req->id;
        }
@@ -368,7 +364,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        if ((1 << gso_type) & vif->gso_mask) {
                meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
        } else {
                meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
                meta->gso_size = 0;
@@ -500,8 +496,9 @@ static void xenvif_rx_action(struct xenvif *vif)
                        size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
                        max_slots_needed += DIV_ROUND_UP(size, PAGE_SIZE);
                }
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+                if (skb_is_gso(skb) &&
-                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                   (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
                        max_slots_needed++;
                /* If the skb may not fit then bail out now */
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 00660cc502c5..38901665c770 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -162,8 +162,6 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
                avail = *r;
                pci_clip_resource_to_region(bus, &avail, region);
-                if (!resource_size(&avail))
-                        continue;
                /*
                 * "min" is typically PCIBIOS_MIN_IO or PCIBIOS_MIN_MEM to
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 6b05f6134b68..fdbc294821e6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1192,6 +1192,9 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
                return err;
        pci_fixup_device(pci_fixup_enable, dev);
+        if (dev->msi_enabled || dev->msix_enabled)
+                return 0;
        pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
        if (pin) {
                pci_read_config_word(dev, PCI_COMMAND, &cmd);
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 167f3d00c916..66977ebf13b3 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -183,9 +183,7 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        struct resource r = {0};
        int i, flags;
-        if (acpi_dev_resource_memory(res, &r)
+        if (acpi_dev_resource_address_space(res, &r)
-            || acpi_dev_resource_io(res, &r)
-            || acpi_dev_resource_address_space(res, &r)
            || acpi_dev_resource_ext_address_space(res, &r)) {
                pnp_add_resource(dev, &r);
                return AE_OK;
@@ -217,6 +215,17 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        }
        switch (res->type) {
+        case ACPI_RESOURCE_TYPE_MEMORY24:
+        case ACPI_RESOURCE_TYPE_MEMORY32:
+        case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
+                if (acpi_dev_resource_memory(res, &r))
+                        pnp_add_resource(dev, &r);
+                break;
+        case ACPI_RESOURCE_TYPE_IO:
+        case ACPI_RESOURCE_TYPE_FIXED_IO:
+                if (acpi_dev_resource_io(res, &r))
+                        pnp_add_resource(dev, &r);
+                break;
        case ACPI_RESOURCE_TYPE_DMA:
                dma = &res->data.dma;
                if (dma->channel_count > 0 && dma->channels[0] != (u8) -1)
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 1f375051483a..5642a9b250c2 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -325,7 +325,7 @@ static int beiscsi_eh_device_reset(struct scsi_cmnd *sc)
                if (!abrt_task->sc || abrt_task->state == ISCSI_TASK_FREE)
                        continue;
-                if (abrt_task->sc->device->lun != abrt_task->sc->device->lun)
+                if (sc->device->lun != abrt_task->sc->device->lun)
                        continue;
                /* Invalidate WRB Posted for this Task */
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index ed880891cb7c..e9279a8c1e1c 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -594,13 +594,13 @@ static void bnx2fc_free_mp_resc(struct bnx2fc_cmd *io_req)
                mp_req->mp_resp_bd = NULL;
        }
        if (mp_req->req_buf) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                     mp_req->req_buf,
                                     mp_req->req_buf_dma);
                mp_req->req_buf = NULL;
        }
        if (mp_req->resp_buf) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                     mp_req->resp_buf,
                                     mp_req->resp_buf_dma);
                mp_req->resp_buf = NULL;
@@ -622,7 +622,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
        mp_req->req_len = sizeof(struct fcp_cmnd);
        io_req->data_xfer_len = mp_req->req_len;
-        mp_req->req_buf = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        mp_req->req_buf = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                             &mp_req->req_buf_dma,
                                             GFP_ATOMIC);
        if (!mp_req->req_buf) {
@@ -631,7 +631,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
                return FAILED;
        }
-        mp_req->resp_buf = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        mp_req->resp_buf = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                              &mp_req->resp_buf_dma,
                                              GFP_ATOMIC);
        if (!mp_req->resp_buf) {
@@ -639,8 +639,8 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
                bnx2fc_free_mp_resc(io_req);
                return FAILED;
        }
-        memset(mp_req->req_buf, 0, PAGE_SIZE);
+        memset(mp_req->req_buf, 0, CNIC_PAGE_SIZE);
-        memset(mp_req->resp_buf, 0, PAGE_SIZE);
+        memset(mp_req->resp_buf, 0, CNIC_PAGE_SIZE);
        /* Allocate and map mp_req_bd and mp_resp_bd */
        sz = sizeof(struct fcoe_bd_ctx);
@@ -665,7 +665,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
        mp_req_bd = mp_req->mp_req_bd;
        mp_req_bd->buf_addr_lo = (u32)addr & 0xffffffff;
        mp_req_bd->buf_addr_hi = (u32)((u64)addr >> 32);
-        mp_req_bd->buf_len = PAGE_SIZE;
+        mp_req_bd->buf_len = CNIC_PAGE_SIZE;
        mp_req_bd->flags = 0;
        /*
@@ -677,7 +677,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
        addr = mp_req->resp_buf_dma;
        mp_resp_bd->buf_addr_lo = (u32)addr & 0xffffffff;
        mp_resp_bd->buf_addr_hi = (u32)((u64)addr >> 32);
-        mp_resp_bd->buf_len = PAGE_SIZE;
+        mp_resp_bd->buf_len = CNIC_PAGE_SIZE;
        mp_resp_bd->flags = 0;
        return SUCCESS;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c
index 4d93177dfb53..d9bae5672273 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c
@@ -673,7 +673,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map SQ */
        tgt->sq_mem_size = tgt->max_sqes * BNX2FC_SQ_WQE_SIZE;
-        tgt->sq_mem_size = (tgt->sq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->sq_mem_size = (tgt->sq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->sq = dma_alloc_coherent(&hba->pcidev->dev, tgt->sq_mem_size,
                                     &tgt->sq_dma, GFP_KERNEL);
@@ -686,7 +687,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map CQ */
        tgt->cq_mem_size = tgt->max_cqes * BNX2FC_CQ_WQE_SIZE;
-        tgt->cq_mem_size = (tgt->cq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->cq_mem_size = (tgt->cq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->cq = dma_alloc_coherent(&hba->pcidev->dev, tgt->cq_mem_size,
                                     &tgt->cq_dma, GFP_KERNEL);
@@ -699,7 +701,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map RQ and RQ PBL */
        tgt->rq_mem_size = tgt->max_rqes * BNX2FC_RQ_WQE_SIZE;
-        tgt->rq_mem_size = (tgt->rq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->rq_mem_size = (tgt->rq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->rq = dma_alloc_coherent(&hba->pcidev->dev, tgt->rq_mem_size,
                                        &tgt->rq_dma, GFP_KERNEL);
@@ -710,8 +713,9 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        }
        memset(tgt->rq, 0, tgt->rq_mem_size);
-        tgt->rq_pbl_size = (tgt->rq_mem_size / PAGE_SIZE) * sizeof(void *);
+        tgt->rq_pbl_size = (tgt->rq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
-        tgt->rq_pbl_size = (tgt->rq_pbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->rq_pbl_size = (tgt->rq_pbl_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->rq_pbl = dma_alloc_coherent(&hba->pcidev->dev, tgt->rq_pbl_size,
                                         &tgt->rq_pbl_dma, GFP_KERNEL);
@@ -722,7 +726,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        }
        memset(tgt->rq_pbl, 0, tgt->rq_pbl_size);
-        num_pages = tgt->rq_mem_size / PAGE_SIZE;
+        num_pages = tgt->rq_mem_size / CNIC_PAGE_SIZE;
        page = tgt->rq_dma;
        pbl = (u32 *)tgt->rq_pbl;
@@ -731,13 +735,13 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
                pbl++;
                *pbl = (u32)((u64)page >> 32);
                pbl++;
-                page += PAGE_SIZE;
+                page += CNIC_PAGE_SIZE;
        }
        /* Allocate and map XFERQ */
        tgt->xferq_mem_size = tgt->max_sqes * BNX2FC_XFERQ_WQE_SIZE;
-        tgt->xferq_mem_size = (tgt->xferq_mem_size + (PAGE_SIZE - 1)) &
+        tgt->xferq_mem_size = (tgt->xferq_mem_size + (CNIC_PAGE_SIZE - 1)) &
-                               PAGE_MASK;
+                               CNIC_PAGE_MASK;
        tgt->xferq = dma_alloc_coherent(&hba->pcidev->dev, tgt->xferq_mem_size,
                                        &tgt->xferq_dma, GFP_KERNEL);
@@ -750,8 +754,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map CONFQ & CONFQ PBL */
        tgt->confq_mem_size = tgt->max_sqes * BNX2FC_CONFQ_WQE_SIZE;
-        tgt->confq_mem_size = (tgt->confq_mem_size + (PAGE_SIZE - 1)) &
+        tgt->confq_mem_size = (tgt->confq_mem_size + (CNIC_PAGE_SIZE - 1)) &
-                               PAGE_MASK;
+                               CNIC_PAGE_MASK;
        tgt->confq = dma_alloc_coherent(&hba->pcidev->dev, tgt->confq_mem_size,
                                        &tgt->confq_dma, GFP_KERNEL);
@@ -763,9 +767,9 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        memset(tgt->confq, 0, tgt->confq_mem_size);
        tgt->confq_pbl_size =
-                (tgt->confq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (tgt->confq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        tgt->confq_pbl_size =
-                (tgt->confq_pbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (tgt->confq_pbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        tgt->confq_pbl = dma_alloc_coherent(&hba->pcidev->dev,
                                            tgt->confq_pbl_size,
@@ -777,7 +781,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        }
        memset(tgt->confq_pbl, 0, tgt->confq_pbl_size);
-        num_pages = tgt->confq_mem_size / PAGE_SIZE;
+        num_pages = tgt->confq_mem_size / CNIC_PAGE_SIZE;
        page = tgt->confq_dma;
        pbl = (u32 *)tgt->confq_pbl;
@@ -786,7 +790,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
                pbl++;
                *pbl = (u32)((u64)page >> 32);
                pbl++;
-                page += PAGE_SIZE;
+                page += CNIC_PAGE_SIZE;
        }
        /* Allocate and map ConnDB */
@@ -805,8 +809,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map LCQ */
        tgt->lcq_mem_size = (tgt->max_sqes + 8) * BNX2FC_SQ_WQE_SIZE;
-        tgt->lcq_mem_size = (tgt->lcq_mem_size + (PAGE_SIZE - 1)) &
+        tgt->lcq_mem_size = (tgt->lcq_mem_size + (CNIC_PAGE_SIZE - 1)) &
-                             PAGE_MASK;
+                             CNIC_PAGE_MASK;
        tgt->lcq = dma_alloc_coherent(&hba->pcidev->dev, tgt->lcq_mem_size,
                                      &tgt->lcq_dma, GFP_KERNEL);
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index e4cf23df4b4f..b87a1933f880 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -61,7 +61,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
         * yield integral num of page buffers
         */
        /* adjust SQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
        if (hba->max_sqes < num_elements_per_pg)
                hba->max_sqes = num_elements_per_pg;
        else if (hba->max_sqes % num_elements_per_pg)
@@ -69,7 +69,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
                                 ~(num_elements_per_pg - 1);
        /* adjust CQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_CQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_CQE_SIZE;
        if (hba->max_cqes < num_elements_per_pg)
                hba->max_cqes = num_elements_per_pg;
        else if (hba->max_cqes % num_elements_per_pg)
@@ -77,7 +77,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
                                 ~(num_elements_per_pg - 1);
        /* adjust RQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_RQ_WQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_RQ_WQE_SIZE;
        if (hba->max_rqes < num_elements_per_pg)
                hba->max_rqes = num_elements_per_pg;
        else if (hba->max_rqes % num_elements_per_pg)
@@ -959,7 +959,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
        /* SQ page table */
        memset(ep->qp.sq_pgtbl_virt, 0, ep->qp.sq_pgtbl_size);
-        num_pages = ep->qp.sq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.sq_mem_size / CNIC_PAGE_SIZE;
        page = ep->qp.sq_phys;
        if (cnic_dev_10g)
@@ -973,7 +973,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) ((u64) page >> 32);
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                } else {
                        /* PTE is written in big endian format for
                         * 5706/5708/5709 devices */
@@ -981,13 +981,13 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) page;
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                }
        }
        /* RQ page table */
        memset(ep->qp.rq_pgtbl_virt, 0, ep->qp.rq_pgtbl_size);
-        num_pages = ep->qp.rq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.rq_mem_size / CNIC_PAGE_SIZE;
        page = ep->qp.rq_phys;
        if (cnic_dev_10g)
@@ -1001,7 +1001,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) ((u64) page >> 32);
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                } else {
                        /* PTE is written in big endian format for
                         * 5706/5708/5709 devices */
@@ -1009,13 +1009,13 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) page;
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                }
        }
        /* CQ page table */
        memset(ep->qp.cq_pgtbl_virt, 0, ep->qp.cq_pgtbl_size);
-        num_pages = ep->qp.cq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.cq_mem_size / CNIC_PAGE_SIZE;
        page = ep->qp.cq_phys;
        if (cnic_dev_10g)
@@ -1029,7 +1029,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) ((u64) page >> 32);
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                } else {
                        /* PTE is written in big endian format for
                         * 5706/5708/5709 devices */
@@ -1037,7 +1037,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) page;
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                }
        }
 }
@@ -1064,11 +1064,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
        /* Allocate page table memory for SQ which is page aligned */
        ep->qp.sq_mem_size = hba->max_sqes * BNX2I_SQ_WQE_SIZE;
        ep->qp.sq_mem_size =
-                (ep->qp.sq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.sq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.sq_pgtbl_size =
-                (ep->qp.sq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.sq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        ep->qp.sq_pgtbl_size =
-                (ep->qp.sq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.sq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.sq_pgtbl_virt =
                dma_alloc_coherent(&hba->pcidev->dev, ep->qp.sq_pgtbl_size,
@@ -1101,11 +1101,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
        /* Allocate page table memory for CQ which is page aligned */
        ep->qp.cq_mem_size = hba->max_cqes * BNX2I_CQE_SIZE;
        ep->qp.cq_mem_size =
-                (ep->qp.cq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.cq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.cq_pgtbl_size =
-                (ep->qp.cq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.cq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        ep->qp.cq_pgtbl_size =
-                (ep->qp.cq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.cq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.cq_pgtbl_virt =
                dma_alloc_coherent(&hba->pcidev->dev, ep->qp.cq_pgtbl_size,
@@ -1144,11 +1144,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
        /* Allocate page table memory for RQ which is page aligned */
        ep->qp.rq_mem_size = hba->max_rqes * BNX2I_RQ_WQE_SIZE;
        ep->qp.rq_mem_size =
-                (ep->qp.rq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.rq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.rq_pgtbl_size =
-                (ep->qp.rq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.rq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        ep->qp.rq_pgtbl_size =
-                (ep->qp.rq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.rq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.rq_pgtbl_virt =
                dma_alloc_coherent(&hba->pcidev->dev, ep->qp.rq_pgtbl_size,
@@ -1270,7 +1270,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
        bnx2i_adjust_qp_size(hba);
        iscsi_init.flags =
-                ISCSI_PAGE_SIZE_4K << ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT;
+                (CNIC_PAGE_BITS - 8) << ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT;
        if (en_tcp_dack)
                iscsi_init.flags |= ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE;
        iscsi_init.reserved0 = 0;
@@ -1288,15 +1288,15 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
                        ((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16));
        iscsi_init.num_ccells_per_conn = hba->num_ccell;
        iscsi_init.num_tasks_per_conn = hba->max_sqes;
-        iscsi_init.sq_wqes_per_page = PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
+        iscsi_init.sq_wqes_per_page = CNIC_PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
        iscsi_init.sq_num_wqes = hba->max_sqes;
        iscsi_init.cq_log_wqes_per_page =
-                (u8) bnx2i_power_of2(PAGE_SIZE / BNX2I_CQE_SIZE);
+                (u8) bnx2i_power_of2(CNIC_PAGE_SIZE / BNX2I_CQE_SIZE);
        iscsi_init.cq_num_wqes = hba->max_cqes;
        iscsi_init.cq_num_pages = (hba->max_cqes * BNX2I_CQE_SIZE +
-                                   (PAGE_SIZE - 1)) / PAGE_SIZE;
+                                   (CNIC_PAGE_SIZE - 1)) / CNIC_PAGE_SIZE;
        iscsi_init.sq_num_pages = (hba->max_sqes * BNX2I_SQ_WQE_SIZE +
-                                   (PAGE_SIZE - 1)) / PAGE_SIZE;
+                                   (CNIC_PAGE_SIZE - 1)) / CNIC_PAGE_SIZE;
        iscsi_init.rq_buffer_size = BNX2I_RQ_WQE_SIZE;
        iscsi_init.rq_num_wqes = hba->max_rqes;
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
index 854dad7d5b03..c8b0aff5bbd4 100644
--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -525,7 +525,7 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
        struct iscsi_bd *mp_bdt;
        u64 addr;
-        hba->mp_bd_tbl = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        hba->mp_bd_tbl = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                            &hba->mp_bd_dma, GFP_KERNEL);
        if (!hba->mp_bd_tbl) {
                printk(KERN_ERR "unable to allocate Middle Path BDT\n");
@@ -533,11 +533,12 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
                goto out;
        }
-        hba->dummy_buffer = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        hba->dummy_buffer = dma_alloc_coherent(&hba->pcidev->dev,
+                                               CNIC_PAGE_SIZE,
                                               &hba->dummy_buf_dma, GFP_KERNEL);
        if (!hba->dummy_buffer) {
                printk(KERN_ERR "unable to alloc Middle Path Dummy Buffer\n");
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  hba->mp_bd_tbl, hba->mp_bd_dma);
                hba->mp_bd_tbl = NULL;
                rc = -1;
@@ -548,7 +549,7 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
        addr = (unsigned long) hba->dummy_buf_dma;
        mp_bdt->buffer_addr_lo = addr & 0xffffffff;
        mp_bdt->buffer_addr_hi = addr >> 32;
-        mp_bdt->buffer_length = PAGE_SIZE;
+        mp_bdt->buffer_length = CNIC_PAGE_SIZE;
        mp_bdt->flags = ISCSI_BD_LAST_IN_BD_CHAIN |
                        ISCSI_BD_FIRST_IN_BD_CHAIN;
 out:
@@ -565,12 +566,12 @@ out:
 static void bnx2i_free_mp_bdt(struct bnx2i_hba *hba)
 {
        if (hba->mp_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  hba->mp_bd_tbl, hba->mp_bd_dma);
                hba->mp_bd_tbl = NULL;
        }
        if (hba->dummy_buffer) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  hba->dummy_buffer, hba->dummy_buf_dma);
                hba->dummy_buffer = NULL;
        }
@@ -934,14 +935,14 @@ static void bnx2i_conn_free_login_resources(struct bnx2i_hba *hba,
                                            struct bnx2i_conn *bnx2i_conn)
 {
        if (bnx2i_conn->gen_pdu.resp_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  bnx2i_conn->gen_pdu.resp_bd_tbl,
                                  bnx2i_conn->gen_pdu.resp_bd_dma);
                bnx2i_conn->gen_pdu.resp_bd_tbl = NULL;
        }
        if (bnx2i_conn->gen_pdu.req_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  bnx2i_conn->gen_pdu.req_bd_tbl,
                                  bnx2i_conn->gen_pdu.req_bd_dma);
                bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
@@ -998,13 +999,13 @@ static int bnx2i_conn_alloc_login_resources(struct bnx2i_hba *hba,
        bnx2i_conn->gen_pdu.resp_wr_ptr = bnx2i_conn->gen_pdu.resp_buf;
        bnx2i_conn->gen_pdu.req_bd_tbl =
-                dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   &bnx2i_conn->gen_pdu.req_bd_dma, GFP_KERNEL);
        if (bnx2i_conn->gen_pdu.req_bd_tbl == NULL)
                goto login_req_bd_tbl_failure;
        bnx2i_conn->gen_pdu.resp_bd_tbl =
-                dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   &bnx2i_conn->gen_pdu.resp_bd_dma,
                                   GFP_KERNEL);
        if (bnx2i_conn->gen_pdu.resp_bd_tbl == NULL)
@@ -1013,7 +1014,7 @@ static int bnx2i_conn_alloc_login_resources(struct bnx2i_hba *hba,
        return 0;
 login_resp_bd_tbl_failure:
-        dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                          bnx2i_conn->gen_pdu.req_bd_tbl,
                          bnx2i_conn->gen_pdu.req_bd_dma);
        bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
index 4911310a38f5..22a9bb1abae1 100644
--- a/drivers/scsi/isci/host.h
+++ b/drivers/scsi/isci/host.h
@@ -311,9 +311,8 @@ static inline struct Scsi_Host *to_shost(struct isci_host *ihost)
 }
 #define for_each_isci_host(id, ihost, pdev) \
-        for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \
+        for (id = 0; id < SCI_MAX_CONTROLLERS && \
-             id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \
+             (ihost = to_pci_info(pdev)->hosts[id]); id++)
-             ihost = to_pci_info(pdev)->hosts[++id])
 static inline void wait_for_start(struct isci_host *ihost)
 {
diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c
index 85c77f6b802b..ac879745ef80 100644
--- a/drivers/scsi/isci/port_config.c
+++ b/drivers/scsi/isci/port_config.c
@@ -615,13 +615,6 @@ static void sci_apc_agent_link_up(struct isci_host *ihost,
                                          SCIC_SDS_APC_WAIT_LINK_UP_NOTIFICATION);
        } else {
                /* the phy is already the part of the port */
-                u32 port_state = iport->sm.current_state_id;
-                /* if the PORT'S state is resetting then the link up is from
-                 * port hard reset in this case, we need to tell the port
-                 * that link up is recieved
-                 */
-                BUG_ON(port_state != SCI_PORT_RESETTING);
                port_agent->phy_ready_mask |= 1 << phy_index;
                sci_port_link_up(iport, iphy);
        }
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 0d30ca849e8f..5d6fda72d659 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -801,7 +801,7 @@ int isci_task_I_T_nexus_reset(struct domain_device *dev)
                /* XXX: need to cleanup any ireqs targeting this
                 * domain_device
                 */
-                ret = TMF_RESP_FUNC_COMPLETE;
+                ret = -ENODEV;
                goto out;
        }
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index e1fe95ef23e1..266724b6b899 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2996,8 +2996,7 @@ struct qla_hw_data {
                                IS_QLA82XX(ha) || IS_QLA83XX(ha) || \
                                IS_QLA8044(ha))
 #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha))
-#define IS_NOPOLLING_TYPE(ha)   ((IS_QLA25XX(ha) || IS_QLA81XX(ha) || \
+#define IS_NOPOLLING_TYPE(ha)   (IS_QLA81XX(ha) && (ha)->flags.msix_enabled)
-                        IS_QLA83XX(ha)) && (ha)->flags.msix_enabled)
 #define IS_FAC_REQUIRED(ha)     (IS_QLA81XX(ha) || IS_QLA83XX(ha))
 #define IS_NOCACHE_VPD_TYPE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha))
 #define IS_ALOGIO_CAPABLE(ha)   (IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha))
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 9bc86b9e86b1..0a1dcb43d18b 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2880,6 +2880,7 @@ static int
 qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
 #define MIN_MSIX_COUNT  2
+#define ATIO_VECTOR     2
        int i, ret;
        struct msix_entry *entries;
        struct qla_msix_entry *qentry;
@@ -2936,34 +2937,47 @@ msix_failed:
        }
        /* Enable MSI-X vectors for the base queue */
-        for (i = 0; i < ha->msix_count; i++) {
+        for (i = 0; i < 2; i++) {
                qentry = &ha->msix_entries[i];
-                if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
+                if (IS_P3P_TYPE(ha))
-                        ret = request_irq(qentry->vector,
-                                qla83xx_msix_entries[i].handler,
-                                0, qla83xx_msix_entries[i].name, rsp);
-                } else if (IS_P3P_TYPE(ha)) {
                        ret = request_irq(qentry->vector,
                                qla82xx_msix_entries[i].handler,
                                0, qla82xx_msix_entries[i].name, rsp);
-                } else {
+                else
                        ret = request_irq(qentry->vector,
                                msix_entries[i].handler,
                                0, msix_entries[i].name, rsp);
-                }
+                if (ret)
-                if (ret) {
+                        goto msix_register_fail;
-                        ql_log(ql_log_fatal, vha, 0x00cb,
-                            "MSI-X: unable to register handler -- %x/%d.\n",
-                            qentry->vector, ret);
-                        qla24xx_disable_msix(ha);
-                        ha->mqenable = 0;
-                        goto msix_out;
-                }
                qentry->have_irq = 1;
                qentry->rsp = rsp;
                rsp->msix = qentry;
        }
+        /*
+         * If target mode is enable, also request the vector for the ATIO
+         * queue.
+         */
+        if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
+                qentry = &ha->msix_entries[ATIO_VECTOR];
+                ret = request_irq(qentry->vector,
+                        qla83xx_msix_entries[ATIO_VECTOR].handler,
+                        0, qla83xx_msix_entries[ATIO_VECTOR].name, rsp);
+                qentry->have_irq = 1;
+                qentry->rsp = rsp;
+                rsp->msix = qentry;
+        }
+msix_register_fail:
+        if (ret) {
+                ql_log(ql_log_fatal, vha, 0x00cb,
+                    "MSI-X: unable to register handler -- %x/%d.\n",
+                    qentry->vector, ret);
+                qla24xx_disable_msix(ha);
+                ha->mqenable = 0;
+                goto msix_out;
+        }
        /* Enable MSI-X vector for response queue update for queue 0 */
        if (IS_QLA83XX(ha)) {
                if (ha->msixbase && ha->mqiobase &&
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 17d740427240..9969fa1ef7c4 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1419,6 +1419,9 @@ static void storvsc_device_destroy(struct scsi_device *sdevice)
 {
        struct stor_mem_pools *memp = sdevice->hostdata;
+        if (!memp)
+                return;
        mempool_destroy(memp->request_mempool);
        kmem_cache_destroy(memp->request_pool);
        kfree(memp);
diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index cf86e729532b..dc697cee248a 100644
--- a/drivers/tty/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
@@ -433,13 +433,10 @@ static void sunhv_console_write_paged(struct console *con, const char *s, unsign
        unsigned long flags;
        int locked = 1;
-        local_irq_save(flags);
+        if (port->sysrq || oops_in_progress)
-        if (port->sysrq) {
+                locked = spin_trylock_irqsave(&port->lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&port->lock, flags);
-                locked = spin_trylock(&port->lock);
-        } else
-                spin_lock(&port->lock);
        while (n > 0) {
                unsigned long ra = __pa(con_write_page);
@@ -470,8 +467,7 @@ static void sunhv_console_write_paged(struct console *con, const char *s, unsign
        }
        if (locked)
-                spin_unlock(&port->lock);
+                spin_unlock_irqrestore(&port->lock, flags);
-        local_irq_restore(flags);
 }
 static inline void sunhv_console_putchar(struct uart_port *port, char c)
@@ -492,7 +488,10 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
        unsigned long flags;
        int i, locked = 1;
-        local_irq_save(flags);
+        if (port->sysrq || oops_in_progress)
+                locked = spin_trylock_irqsave(&port->lock, flags);
+        else
+                spin_lock_irqsave(&port->lock, flags);
        if (port->sysrq) {
                locked = 0;
        } else if (oops_in_progress) {
@@ -507,8 +506,7 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
        }
        if (locked)
-                spin_unlock(&port->lock);
+                spin_unlock_irqrestore(&port->lock, flags);
-        local_irq_restore(flags);
 }
 static struct console sunhv_console = {
diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
index 380fb5355cb2..5faa8e905e98 100644
--- a/drivers/tty/serial/sunsab.c
+++ b/drivers/tty/serial/sunsab.c
@@ -844,20 +844,16 @@ static void sunsab_console_write(struct console *con, const char *s, unsigned n)
        unsigned long flags;
        int locked = 1;
-        local_irq_save(flags);
+        if (up->port.sysrq || oops_in_progress)
-        if (up->port.sysrq) {
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&up->port.lock, flags);
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
        uart_console_write(&up->port, s, n, sunsab_console_putchar);
        sunsab_tec_wait(up);
        if (locked)
-                spin_unlock(&up->port.lock);
+                spin_unlock_irqrestore(&up->port.lock, flags);
-        local_irq_restore(flags);
 }
 static int sunsab_console_setup(struct console *con, char *options)
diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
index db79b76f5c8e..9a0f24f83720 100644
--- a/drivers/tty/serial/sunsu.c
+++ b/drivers/tty/serial/sunsu.c
@@ -1295,13 +1295,10 @@ static void sunsu_console_write(struct console *co, const char *s,
        unsigned int ier;
        int locked = 1;
-        local_irq_save(flags);
+        if (up->port.sysrq || oops_in_progress)
-        if (up->port.sysrq) {
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&up->port.lock, flags);
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
        /*
         *      First save the UER then disable the interrupts
@@ -1319,8 +1316,7 @@ static void sunsu_console_write(struct console *co, const char *s,
        serial_out(up, UART_IER, ier);
        if (locked)
-                spin_unlock(&up->port.lock);
+                spin_unlock_irqrestore(&up->port.lock, flags);
-        local_irq_restore(flags);
 }
 /*
diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
index 45a8c6aa5837..a2c40ed287d2 100644
--- a/drivers/tty/serial/sunzilog.c
+++ b/drivers/tty/serial/sunzilog.c
@@ -1195,20 +1195,16 @@ sunzilog_console_write(struct console *con, const char *s, unsigned int count)
        unsigned long flags;
        int locked = 1;
-        local_irq_save(flags);
+        if (up->port.sysrq || oops_in_progress)
-        if (up->port.sysrq) {
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&up->port.lock, flags);
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
        uart_console_write(&up->port, s, count, sunzilog_putchar);
        udelay(2);
        if (locked)
-                spin_unlock(&up->port.lock);
+                spin_unlock_irqrestore(&up->port.lock, flags);
-        local_irq_restore(flags);
 }
 static int __init sunzilog_console_setup(struct console *con, char *options)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index cf32f0393369..c0f3718b77a8 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -513,7 +513,7 @@ struct cifs_mnt_data {
 static inline unsigned int
 get_rfc1002_length(void *buf)
 {
-        return be32_to_cpu(*((__be32 *)buf));
+        return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
 }
 static inline void
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 53c15074bb36..834fce759d80 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2579,31 +2579,19 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
        struct cifsInodeInfo *cinode = CIFS_I(inode);
        struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
        ssize_t rc = -EACCES;
+        loff_t lock_pos = pos;
-        BUG_ON(iocb->ki_pos != pos);
+        if (file->f_flags & O_APPEND)
+                lock_pos = i_size_read(inode);
        /*
         * We need to hold the sem to be sure nobody modifies lock list
         * with a brlock that prevents writing.
         */
        down_read(&cinode->lock_sem);
-        if (!cifs_find_lock_conflict(cfile, pos, iov_length(iov, nr_segs),
+        if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
                                     server->vals->exclusive_lock_type, NULL,
-                                     CIFS_WRITE_OP)) {
+                                     CIFS_WRITE_OP))
-                mutex_lock(&inode->i_mutex);
+                rc = generic_file_aio_write(iocb, iov, nr_segs, pos);
-                rc = __generic_file_aio_write(iocb, iov, nr_segs,
-                                               &iocb->ki_pos);
-                mutex_unlock(&inode->i_mutex);
-        }
-        if (rc > 0) {
-                ssize_t err;
-                err = generic_write_sync(file, iocb->ki_pos - rc, rc);
-                if (err < 0)
-                        rc = err;
-        }
        up_read(&cinode->lock_sem);
        return rc;
 }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b37570952846..18cd5650a5fc 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -270,6 +270,26 @@ cifs_rqst_page_to_kvec(struct smb_rqst *rqst, unsigned int idx,
                iov->iov_len = rqst->rq_pagesz;
 }
+static unsigned long
+rqst_len(struct smb_rqst *rqst)
+{
+        unsigned int i;
+        struct kvec *iov = rqst->rq_iov;
+        unsigned long buflen = 0;
+        /* total up iov array first */
+        for (i = 0; i < rqst->rq_nvec; i++)
+                buflen += iov[i].iov_len;
+        /* add in the page array if there is one */
+        if (rqst->rq_npages) {
+                buflen += rqst->rq_pagesz * (rqst->rq_npages - 1);
+                buflen += rqst->rq_tailsz;
+        }
+        return buflen;
+}
 static int
 smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 {
@@ -277,6 +297,7 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
        struct kvec *iov = rqst->rq_iov;
        int n_vec = rqst->rq_nvec;
        unsigned int smb_buf_length = get_rfc1002_length(iov[0].iov_base);
+        unsigned long send_length;
        unsigned int i;
        size_t total_len = 0, sent;
        struct socket *ssocket = server->ssocket;
@@ -285,6 +306,14 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
        if (ssocket == NULL)
                return -ENOTSOCK;
+        /* sanity check send length */
+        send_length = rqst_len(rqst);
+        if (send_length != smb_buf_length + 4) {
+                WARN(1, "Send length mismatch(send_length=%lu smb_buf_length=%u)\n",
+                        send_length, smb_buf_length);
+                return -EIO;
+        }
        cifs_dbg(FYI, "Sending smb: smb_len=%u\n", smb_buf_length);
        dump_smb(iov[0].iov_base, iov[0].iov_len);
diff --git a/fs/file.c b/fs/file.c
index db25c2bdfe46..60a45e9f5323 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -683,35 +683,65 @@ EXPORT_SYMBOL(fget_raw);
 * The fput_needed flag returned by fget_light should be passed to the
 * corresponding fput_light.
 */
-struct file *__fget_light(unsigned int fd, fmode_t mask, int *fput_needed)
+static unsigned long __fget_light(unsigned int fd, fmode_t mask)
 {
        struct files_struct *files = current->files;
        struct file *file;
-        *fput_needed = 0;
        if (atomic_read(&files->count) == 1) {
                file = __fcheck_files(files, fd);
-                if (file && (file->f_mode & mask))
+                if (!file || unlikely(file->f_mode & mask))
-                        file = NULL;
+                        return 0;
+                return (unsigned long)file;
        } else {
                file = __fget(fd, mask);
-                if (file)
+                if (!file)
-                        *fput_needed = 1;
+                        return 0;
+                return FDPUT_FPUT | (unsigned long)file;
        }
-        return file;
 }
-struct file *fget_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget(unsigned int fd)
 {
-        return __fget_light(fd, FMODE_PATH, fput_needed);
+        return __fget_light(fd, FMODE_PATH);
 }
-EXPORT_SYMBOL(fget_light);
+EXPORT_SYMBOL(__fdget);
-struct file *fget_raw_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget_raw(unsigned int fd)
 {
-        return __fget_light(fd, 0, fput_needed);
+        return __fget_light(fd, 0);
+}
+unsigned long __fdget_pos(unsigned int fd)
+{
+        struct files_struct *files = current->files;
+        struct file *file;
+        unsigned long v;
+        if (atomic_read(&files->count) == 1) {
+                file = __fcheck_files(files, fd);
+                v = 0;
+        } else {
+                file = __fget(fd, 0);
+                v = FDPUT_FPUT;
+        }
+        if (!file)
+                return 0;
+        if (file->f_mode & FMODE_ATOMIC_POS) {
+                if (file_count(file) > 1) {
+                        v |= FDPUT_POS_UNLOCK;
+                        mutex_lock(&file->f_pos_lock);
+                }
+        }
+        return v | (unsigned long)file;
 }
+/*
+ * We only lock f_pos if we have threads or if the file might be
+ * shared with another process. In both cases we'll have an elevated
+ * file count (done either by fdget() or by fork()).
+ */
 void set_close_on_exec(unsigned int fd, int flag)
 {
        struct files_struct *files = current->files;
diff --git a/fs/file_table.c b/fs/file_table.c
index 5fff9030be34..5b24008ea4f6 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -135,6 +135,7 @@ struct file *get_empty_filp(void)
        atomic_long_set(&f->f_count, 1);
        rwlock_init(&f->f_owner.lock);
        spin_lock_init(&f->f_lock);
+        mutex_init(&f->f_pos_lock);
        eventpoll_init_file(f);
        /* f->f_version: 0 */
        return f;
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 968ce411db53..32602c667b4a 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -103,6 +103,8 @@ static int hfsplus_cat_build_record(hfsplus_cat_entry *entry,
                folder = &entry->folder;
                memset(folder, 0, sizeof(*folder));
                folder->type = cpu_to_be16(HFSPLUS_FOLDER);
+                if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags))
+                        folder->flags |= cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT);
                folder->id = cpu_to_be32(inode->i_ino);
                HFSPLUS_I(inode)->create_date =
                        folder->create_date =
@@ -203,6 +205,36 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
        return hfs_brec_find(fd, hfs_find_rec_by_key);
 }
+static void hfsplus_subfolders_inc(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Increment subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 */
+                HFSPLUS_I(dir)->subfolders++;
+        }
+}
+static void hfsplus_subfolders_dec(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Decrement subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 *
+                 * Check for zero. Some subfolders may have been created
+                 * by an implementation ignorant of this counter.
+                 */
+                if (HFSPLUS_I(dir)->subfolders)
+                        HFSPLUS_I(dir)->subfolders--;
+        }
+}
 int hfsplus_create_cat(u32 cnid, struct inode *dir,
                struct qstr *str, struct inode *inode)
 {
@@ -247,6 +279,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
                goto err1;
        dir->i_size++;
+        if (S_ISDIR(inode->i_mode))
+                hfsplus_subfolders_inc(dir);
        dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
        hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
@@ -336,6 +370,8 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                goto out;
        dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(dir);
        dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
        hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
@@ -380,6 +416,7 @@ int hfsplus_rename_cat(u32 cnid,
        hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                src_fd.entrylength);
+        type = be16_to_cpu(entry.type);
        /* create new dir entry with the data from the old entry */
        hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);
@@ -394,6 +431,8 @@ int hfsplus_rename_cat(u32 cnid,
        if (err)
                goto out;
        dst_dir->i_size++;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_inc(dst_dir);
        dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;
        /* finally remove the old entry */
@@ -405,6 +444,8 @@ int hfsplus_rename_cat(u32 cnid,
        if (err)
                goto out;
        src_dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(src_dir);
        src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;
        /* remove old thread entry */
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 08846425b67f..62d571eb69ba 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -242,6 +242,7 @@ struct hfsplus_inode_info {
         */
        sector_t fs_blocks;
        u8 userflags;           /* BSD user file flags */
+        u32 subfolders;         /* Subfolder count (HFSX only) */
        struct list_head open_dir_list;
        loff_t phys_size;
diff --git a/fs/hfsplus/hfsplus_raw.h b/fs/hfsplus/hfsplus_raw.h
index 8ffb3a8ffe75..5a126828d85e 100644
--- a/fs/hfsplus/hfsplus_raw.h
+++ b/fs/hfsplus/hfsplus_raw.h
@@ -261,7 +261,7 @@ struct hfsplus_cat_folder {
        struct DInfo user_info;
        struct DXInfo finder_info;
        __be32 text_encoding;
-        u32 reserved;
+        __be32 subfolders;      /* Subfolder count in HFSX. Reserved in HFS+. */
 } __packed;
 /* HFS file info (stolen from hfs.h) */
@@ -301,11 +301,13 @@ struct hfsplus_cat_file {
        struct hfsplus_fork_raw rsrc_fork;
 } __packed;
-/* File attribute bits */
+/* File and folder flag bits */
 #define HFSPLUS_FILE_LOCKED             0x0001
 #define HFSPLUS_FILE_THREAD_EXISTS      0x0002
 #define HFSPLUS_XATTR_EXISTS            0x0004
 #define HFSPLUS_ACL_EXISTS              0x0008
+#define HFSPLUS_HAS_FOLDER_COUNT        0x0010  /* Folder has subfolder count
+                                                 * (HFSX only) */
 /* HFS+ catalog thread (part of a cat_entry) */
 struct hfsplus_cat_thread {
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index fa929f325f87..a4f45bd88a63 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -375,6 +375,7 @@ struct inode *hfsplus_new_inode(struct super_block *sb, umode_t mode)
        hip->extent_state = 0;
        hip->flags = 0;
        hip->userflags = 0;
+        hip->subfolders = 0;
        memset(hip->first_extents, 0, sizeof(hfsplus_extent_rec));
        memset(hip->cached_extents, 0, sizeof(hfsplus_extent_rec));
        hip->alloc_blocks = 0;
@@ -494,6 +495,10 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
                inode->i_ctime = hfsp_mt2ut(folder->attribute_mod_date);
                HFSPLUS_I(inode)->create_date = folder->create_date;
                HFSPLUS_I(inode)->fs_blocks = 0;
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        HFSPLUS_I(inode)->subfolders =
+                                be32_to_cpu(folder->subfolders);
+                }
                inode->i_op = &hfsplus_dir_inode_operations;
                inode->i_fop = &hfsplus_dir_operations;
        } else if (type == HFSPLUS_FILE) {
@@ -566,6 +571,10 @@ int hfsplus_cat_write_inode(struct inode *inode)
                folder->content_mod_date = hfsp_ut2mt(inode->i_mtime);
                folder->attribute_mod_date = hfsp_ut2mt(inode->i_ctime);
                folder->valence = cpu_to_be32(inode->i_size - 2);
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        folder->subfolders =
+                                cpu_to_be32(HFSPLUS_I(inode)->subfolders);
+                }
                hfs_bnode_write(fd.bnode, &entry, fd.entryoffset,
                                         sizeof(struct hfsplus_cat_folder));
        } else if (HFSPLUS_IS_RSRC(inode)) {
diff --git a/fs/namei.c b/fs/namei.c
index 385f7817bfcc..2f730ef9b4b3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1884,7 +1884,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
                nd->path = f.file->f_path;
                if (flags & LOOKUP_RCU) {
-                        if (f.need_put)
+                        if (f.flags & FDPUT_FPUT)
                                *fp = f.file;
                        nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
                        rcu_read_lock();
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8450262bcf2a..51632c40e896 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2393,8 +2393,8 @@ out_dio:
        if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
            ((file->f_flags & O_DIRECT) && !direct_io)) {
-                ret = filemap_fdatawrite_range(file->f_mapping, pos,
+                ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
-                                               pos + count - 1);
+                                               *ppos + count - 1);
                if (ret < 0)
                        written = ret;
@@ -2407,8 +2407,8 @@ out_dio:
                }
                if (!ret)
-                        ret = filemap_fdatawait_range(file->f_mapping, pos,
+                        ret = filemap_fdatawait_range(file->f_mapping, *ppos,
-                                                      pos + count - 1);
+                                                      *ppos + count - 1);
        }
        /*
diff --git a/fs/open.c b/fs/open.c
index 4b3e1edf2fe4..b9ed8b25c108 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -705,6 +705,10 @@ static int do_dentry_open(struct file *f,
                return 0;
        }
+        /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
+        if (S_ISREG(inode->i_mode))
+                f->f_mode |= FMODE_ATOMIC_POS;
        f->f_op = fops_get(inode->i_fop);
        if (unlikely(WARN_ON(!f->f_op))) {
                error = -ENODEV;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 51507065263b..b9760628e1fd 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1824,6 +1824,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
        if (rc)
                goto out_mmput;
+        rc = -ENOENT;
        down_read(&mm->mmap_sem);
        vma = find_exact_vma(mm, vm_start, vm_end);
        if (vma && vma->vm_file) {
diff --git a/fs/read_write.c b/fs/read_write.c
index edc5746a902a..54e19b9392dc 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -264,10 +264,22 @@ loff_t vfs_llseek(struct file *file, loff_t offset, int whence)
 }
 EXPORT_SYMBOL(vfs_llseek);
+static inline struct fd fdget_pos(int fd)
+{
+        return __to_fd(__fdget_pos(fd));
+}
+static inline void fdput_pos(struct fd f)
+{
+        if (f.flags & FDPUT_POS_UNLOCK)
+                mutex_unlock(&f.file->f_pos_lock);
+        fdput(f);
+}
 SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
 {
        off_t retval;
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        if (!f.file)
                return -EBADF;
@@ -278,7 +290,7 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
                if (res != (loff_t)retval)
                        retval = -EOVERFLOW;    /* LFS: should only happen on 32 bit platforms */
        }
-        fdput(f);
+        fdput_pos(f);
        return retval;
 }
@@ -498,7 +510,7 @@ static inline void file_pos_write(struct file *file, loff_t pos)
 SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -506,7 +518,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
                ret = vfs_read(f.file, buf, count, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        return ret;
 }
@@ -514,7 +526,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -522,7 +534,7 @@ SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                ret = vfs_write(f.file, buf, count, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        return ret;
@@ -797,7 +809,7 @@ EXPORT_SYMBOL(vfs_writev);
 SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -805,7 +817,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                ret = vfs_readv(f.file, vec, vlen, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        if (ret > 0)
@@ -817,7 +829,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
 SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -825,7 +837,7 @@ SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                ret = vfs_writev(f.file, vec, vlen, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        if (ret > 0)
@@ -968,7 +980,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
                const struct compat_iovec __user *,vec,
                compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret;
        loff_t pos;
@@ -978,7 +990,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
        ret = compat_readv(f.file, vec, vlen, &pos);
        if (ret >= 0)
                f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
        return ret;
 }
@@ -1035,7 +1047,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
                const struct compat_iovec __user *, vec,
                compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret;
        loff_t pos;
@@ -1045,7 +1057,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
        ret = compat_writev(f.file, vec, vlen, &pos);
        if (ret >= 0)
                f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
        return ret;
 }
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index be85127bfed3..f27000f55a83 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -171,6 +171,11 @@ static inline int kvm_vgic_set_addr(struct kvm *kvm, unsigned long type, u64 add
        return 0;
 }
+static inline int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr, bool write)
+{
+        return -ENXIO;
+}
 static inline int kvm_vgic_init(struct kvm *kvm)
 {
        return 0;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index aa865a9a4c4f..ec1464df4c60 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -43,6 +43,7 @@ struct mq_attr;
 struct mqstat;
 struct audit_watch;
 struct audit_tree;
+struct sk_buff;
 struct audit_krule {
        int                     vers_ops;
@@ -463,7 +464,7 @@ extern int audit_filter_user(int type);
 extern int audit_filter_type(int type);
 extern int audit_rule_change(int type, __u32 portid, int seq,
                                void *data, size_t datasz);
-extern int audit_list_rules_send(__u32 portid, int seq);
+extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
 extern u32 audit_enabled;
 #else /* CONFIG_AUDIT */
diff --git a/include/linux/file.h b/include/linux/file.h
index cbacf4faf447..4d69123377a2 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -28,33 +28,36 @@ static inline void fput_light(struct file *file, int fput_needed)
 struct fd {
        struct file *file;
-        int need_put;
+        unsigned int flags;
 };
+#define FDPUT_FPUT       1
+#define FDPUT_POS_UNLOCK 2
 static inline void fdput(struct fd fd)
 {
-        if (fd.need_put)
+        if (fd.flags & FDPUT_FPUT)
                fput(fd.file);
 }
 extern struct file *fget(unsigned int fd);
-extern struct file *fget_light(unsigned int fd, int *fput_needed);
+extern struct file *fget_raw(unsigned int fd);
+extern unsigned long __fdget(unsigned int fd);
+extern unsigned long __fdget_raw(unsigned int fd);
+extern unsigned long __fdget_pos(unsigned int fd);
-static inline struct fd fdget(unsigned int fd)
+static inline struct fd __to_fd(unsigned long v)
 {
-        int b;
+        return (struct fd){(struct file *)(v & ~3),v & 3};
-        struct file *f = fget_light(fd, &b);
-        return (struct fd){f,b};
 }
-extern struct file *fget_raw(unsigned int fd);
+static inline struct fd fdget(unsigned int fd)
-extern struct file *fget_raw_light(unsigned int fd, int *fput_needed);
+{
+        return __to_fd(__fdget(fd));
+}
 static inline struct fd fdget_raw(unsigned int fd)
 {
-        int b;
+        return __to_fd(__fdget_raw(fd));
-        struct file *f = fget_raw_light(fd, &b);
-        return (struct fd){f,b};
 }
 extern int f_dupfd(unsigned int from, struct file *file, unsigned flags);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 60829565e552..23b2a35d712e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -123,6 +123,9 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 /* File is opened with O_PATH; almost nothing can be done with it */
 #define FMODE_PATH              ((__force fmode_t)0x4000)
+/* File needs atomic accesses to f_pos */
+#define FMODE_ATOMIC_POS        ((__force fmode_t)0x8000)
 /* File was opened by fanotify and shouldn't generate fanotify events */
 #define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
@@ -780,13 +783,14 @@ struct file {
        const struct file_operations    *f_op;
        /*
-         * Protects f_ep_links, f_flags, f_pos vs i_size in lseek SEEK_CUR.
+         * Protects f_ep_links, f_flags.
         * Must not be taken from IRQ context.
         */
        spinlock_t              f_lock;
        atomic_long_t           f_count;
        unsigned int            f_flags;
        fmode_t                 f_mode;
+        struct mutex            f_pos_lock;
        loff_t                  f_pos;
        struct fown_struct      f_owner;
        const struct cred       *f_cred;
@@ -808,7 +812,7 @@ struct file {
 #ifdef CONFIG_DEBUG_WRITECOUNT
        unsigned long f_mnt_write_state;
 #endif
-};
+} __attribute__((aligned(4)));  /* lest something weird decides that 2 is OK */
 struct file_handle {
        __u32 handle_bytes;
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 4e4cc28623ad..4cdb3a17bcb5 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -495,10 +495,6 @@ enum {
        FILTER_TRACE_FN,
 };
-#define EVENT_STORAGE_SIZE 128
-extern struct mutex event_storage_mutex;
-extern char event_storage[EVENT_STORAGE_SIZE];
 extern int trace_event_raw_init(struct ftrace_event_call *call);
 extern int trace_define_field(struct ftrace_event_call *call, const char *type,
                              const char *name, int offset, int size,
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 0437439bc047..39b81dc7d01a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -123,6 +123,10 @@ struct vm_area_struct;
                         __GFP_NOMEMALLOC | __GFP_NORETRY | __GFP_NOWARN | \
                         __GFP_NO_KSWAPD)
+/*
+ * GFP_THISNODE does not perform any reclaim, you most likely want to
+ * use __GFP_THISNODE to allocate from a given node without fallback!
+ */
 #ifdef CONFIG_NUMA
 #define GFP_THISNODE    (__GFP_THISNODE | __GFP_NOWARN | __GFP_NORETRY)
 #else
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 5f2052c83154..9b61b9bf81ac 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -590,10 +590,10 @@ static inline bool zone_is_empty(struct zone *zone)
 /*
 * The NUMA zonelists are doubled because we need zonelists that restrict the
- * allocations to a single node for GFP_THISNODE.
+ * allocations to a single node for __GFP_THISNODE.
 *
 * [0]  : Zonelist with fallback
- * [1]  : No fallback (GFP_THISNODE)
+ * [1]  : No fallback (__GFP_THISNODE)
 */
 #define MAX_ZONELISTS 2
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 1da693d51255..b66c2110cb1f 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -250,8 +250,7 @@ struct rmap_walk_control {
        int (*rmap_one)(struct page *page, struct vm_area_struct *vma,
                                        unsigned long addr, void *arg);
        int (*done)(struct page *page);
-        int (*file_nonlinear)(struct page *, struct address_space *,
+        int (*file_nonlinear)(struct page *, struct address_space *, void *arg);
-                                        struct vm_area_struct *vma);
        struct anon_vma *(*anon_lock)(struct page *page);
        bool (*invalid_vma)(struct vm_area_struct *vma, void *arg);
 };
diff --git a/include/linux/security.h b/include/linux/security.h
index 5623a7f965b7..2fc42d191f79 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1040,6 +1040,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
 *      Allocate a security structure to the xp->security field; the security
 *      field is initialized to NULL when the xfrm_policy is allocated.
 *      Return 0 if operation was successful (memory to allocate, legal context)
+ *      @gfp is to specify the context for the allocation
 * @xfrm_policy_clone_security:
 *      @old_ctx contains an existing xfrm_sec_ctx.
 *      @new_ctxp contains a new xfrm_sec_ctx being cloned from old.
@@ -1683,7 +1684,7 @@ struct security_operations {
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
        int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp,
-                        struct xfrm_user_sec_ctx *sec_ctx);
+                        struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
        int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
        void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
        int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
@@ -2859,7 +2860,8 @@ static inline void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
-int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx);
+int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                               struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
 int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
 void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
 int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
@@ -2877,7 +2879,9 @@ void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);
 #else   /* CONFIG_SECURITY_NETWORK_XFRM */
-static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
+static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                                             struct xfrm_user_sec_ctx *sec_ctx,
+                                             gfp_t gfp)
 {
        return 0;
 }
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 9260abdd67df..b5b2df60299e 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -410,7 +410,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
 *
 * %GFP_NOWAIT - Allocation will not sleep.
 *
- * %GFP_THISNODE - Allocate node-local memory only.
+ * %__GFP_THISNODE - Allocate node-local memory only.
 *
 * %GFP_DMA - Allocation suitable for DMA.
 *   Should only be used for kmalloc() caches. Otherwise, use a
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index c3fa80745996..2c14d9cdd57a 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -88,6 +88,7 @@
 #define cdc_ncm_data_intf_is_mbim(x)  ((x)->desc.bInterfaceProtocol == USB_CDC_MBIM_PROTO_NTB)
 struct cdc_ncm_ctx {
+        struct usb_cdc_ncm_ntb_parameters ncm_parm;
        struct hrtimer tx_timer;
        struct tasklet_struct bh;
diff --git a/include/net/sock.h b/include/net/sock.h
index 5c3f7c3624aa..b9586a137cad 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1488,6 +1488,11 @@ static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
 */
 #define sock_owned_by_user(sk)  ((sk)->sk_lock.owned)
+static inline void sock_release_ownership(struct sock *sk)
+{
+        sk->sk_lock.owned = 0;
+}
 /*
 * Macro so as to not evaluate some arguments when
 * lockdep is not enabled.
@@ -2186,7 +2191,6 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
 {
 #define FLAGS_TS_OR_DROPS ((1UL << SOCK_RXQ_OVFL)                       | \
                           (1UL << SOCK_RCVTSTAMP)                      | \
-                           (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)       | \
                           (1UL << SOCK_TIMESTAMPING_SOFTWARE)          | \
                           (1UL << SOCK_TIMESTAMPING_RAW_HARDWARE)      | \
                           (1UL << SOCK_TIMESTAMPING_SYS_HARDWARE))
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 8c4dd63134d4..743accec6c76 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -480,20 +480,21 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 #ifdef CONFIG_SYN_COOKIES
 #include <linux/ktime.h>
-/* Syncookies use a monotonic timer which increments every 64 seconds.
+/* Syncookies use a monotonic timer which increments every 60 seconds.
 * This counter is used both as a hash input and partially encoded into
 * the cookie value.  A cookie is only validated further if the delta
 * between the current counter value and the encoded one is less than this,
- * i.e. a sent cookie is valid only at most for 128 seconds (or less if
+ * i.e. a sent cookie is valid only at most for 2*60 seconds (or less if
 * the counter advances immediately after a cookie is generated).
 */
 #define MAX_SYNCOOKIE_AGE 2
 static inline u32 tcp_cookie_time(void)
 {
-        struct timespec now;
+        u64 val = get_jiffies_64();
-        getnstimeofday(&now);
-        return now.tv_sec >> 6; /* 64 seconds granularity */
+        do_div(val, 60 * HZ);
+        return val;
 }
 u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 1a8b28db3775..1ee19a24cc5f 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -310,15 +310,12 @@ static struct trace_event_functions ftrace_event_type_funcs_##call = {	\
 #undef __array
 #define __array(type, item, len)                                        \
        do {                                                            \
-                mutex_lock(&event_storage_mutex);                       \
+                char *type_str = #type"["__stringify(len)"]";           \
                BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);                 \
-                snprintf(event_storage, sizeof(event_storage),          \
+                ret = trace_define_field(event_call, type_str, #item,   \
-                         "%s[%d]", #type, len);                         \
-                ret = trace_define_field(event_call, event_storage, #item, \
                                 offsetof(typeof(field), item),         \
                                 sizeof(field.item),                    \
                                 is_signed_type(type), FILTER_OTHER);   \
-                mutex_unlock(&event_storage_mutex);                     \
                if (ret)                                                \
                        return ret;                                     \
        } while (0);
diff --git a/init/main.c b/init/main.c
index eb03090cdced..9c7fd4c9249f 100644
--- a/init/main.c
+++ b/init/main.c
@@ -561,7 +561,6 @@ asmlinkage void __init start_kernel(void)
        init_timers();
        hrtimers_init();
        softirq_init();
-        acpi_early_init();
        timekeeping_init();
        time_init();
        sched_clock_postinit();
@@ -613,6 +612,7 @@ asmlinkage void __init start_kernel(void)
        calibrate_delay();
        pidmap_init();
        anon_vma_init();
+        acpi_early_init();
 #ifdef CONFIG_X86
        if (efi_enabled(EFI_RUNTIME_SERVICES))
                efi_enter_virtual_mode();
diff --git a/ipc/msg.c b/ipc/msg.c
index 245db1140ad6..649853105a5d 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -901,6 +901,8 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl
                return -EINVAL;
        if (msgflg & MSG_COPY) {
+                if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
+                        return -EINVAL;
                copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
                if (IS_ERR(copy))
                        return PTR_ERR(copy);
diff --git a/kernel/audit.c b/kernel/audit.c
index 34c5a2310fbf..3392d3e0254a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -182,7 +182,7 @@ struct audit_buffer {
 struct audit_reply {
        __u32 portid;
-        pid_t pid;
+        struct net *net;        
        struct sk_buff *skb;
 };
@@ -500,7 +500,7 @@ int audit_send_list(void *_dest)
 {
        struct audit_netlink_list *dest = _dest;
        struct sk_buff *skb;
-        struct net *net = get_net_ns_by_pid(dest->pid);
+        struct net *net = dest->net;
        struct audit_net *aunet = net_generic(net, audit_net_id);
        /* wait for parent to finish and send an ACK */
@@ -510,6 +510,7 @@ int audit_send_list(void *_dest)
        while ((skb = __skb_dequeue(&dest->q)) != NULL)
                netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
+        put_net(net);
        kfree(dest);
        return 0;
@@ -543,7 +544,7 @@ out_kfree_skb:
 static int audit_send_reply_thread(void *arg)
 {
        struct audit_reply *reply = (struct audit_reply *)arg;
-        struct net *net = get_net_ns_by_pid(reply->pid);
+        struct net *net = reply->net;
        struct audit_net *aunet = net_generic(net, audit_net_id);
        mutex_lock(&audit_cmd_mutex);
@@ -552,12 +553,13 @@ static int audit_send_reply_thread(void *arg)
        /* Ignore failure. It'll only happen if the sender goes away,
           because our timeout is set to infinite. */
        netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
+        put_net(net);
        kfree(reply);
        return 0;
 }
 /**
 * audit_send_reply - send an audit reply message via netlink
- * @portid: netlink port to which to send reply
+ * @request_skb: skb of request we are replying to (used to target the reply)
 * @seq: sequence number
 * @type: audit message type
 * @done: done (last) flag
@@ -568,9 +570,11 @@ static int audit_send_reply_thread(void *arg)
 * Allocates an skb, builds the netlink message, and sends it to the port id.
 * No failure notifications.
 */
-static void audit_send_reply(__u32 portid, int seq, int type, int done,
+static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
                             int multi, const void *payload, int size)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
        struct sk_buff *skb;
        struct task_struct *tsk;
        struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
@@ -583,8 +587,8 @@ static void audit_send_reply(__u32 portid, int seq, int type, int done,
        if (!skb)
                goto out;
+        reply->net = get_net(net);
        reply->portid = portid;
-        reply->pid = task_pid_vnr(current);
        reply->skb = skb;
        tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
@@ -673,8 +677,7 @@ static int audit_get_feature(struct sk_buff *skb)
        seq = nlmsg_hdr(skb)->nlmsg_seq;
-        audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
+        audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af));
-                         &af, sizeof(af));
        return 0;
 }
@@ -794,8 +797,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                s.backlog               = skb_queue_len(&audit_skb_queue);
                s.version               = AUDIT_VERSION_LATEST;
                s.backlog_wait_time     = audit_backlog_wait_time;
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
+                audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
-                                 &s, sizeof(s));
                break;
        }
        case AUDIT_SET: {
@@ -905,7 +907,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                           seq, data, nlmsg_len(nlh));
                break;
        case AUDIT_LIST_RULES:
-                err = audit_list_rules_send(NETLINK_CB(skb).portid, seq);
+                err = audit_list_rules_send(skb, seq);
                break;
        case AUDIT_TRIM:
                audit_trim_trees();
@@ -970,8 +972,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                        memcpy(sig_data->ctx, ctx, len);
                        security_release_secctx(ctx, len);
                }
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
+                audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
-                                0, 0, sig_data, sizeof(*sig_data) + len);
+                                 sig_data, sizeof(*sig_data) + len);
                kfree(sig_data);
                break;
        case AUDIT_TTY_GET: {
@@ -983,8 +985,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                s.log_passwd = tsk->signal->audit_tty_log_passwd;
                spin_unlock(&tsk->sighand->siglock);
-                audit_send_reply(NETLINK_CB(skb).portid, seq,
+                audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
-                                 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
                break;
        }
        case AUDIT_TTY_SET: {
diff --git a/kernel/audit.h b/kernel/audit.h
index 57cc64d67718..8df132214606 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -247,7 +247,7 @@ extern void		    audit_panic(const char *message);
 struct audit_netlink_list {
        __u32 portid;
-        pid_t pid;
+        struct net *net;
        struct sk_buff_head q;
 };
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 14a78cca384e..92062fd6cc8c 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -29,6 +29,8 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/security.h>
+#include <net/net_namespace.h>
+#include <net/sock.h>
 #include "audit.h"
 /*
@@ -1065,11 +1067,13 @@ int audit_rule_change(int type, __u32 portid, int seq, void *data,
 /**
 * audit_list_rules_send - list the audit rules
- * @portid: target portid for netlink audit messages
+ * @request_skb: skb of request we are replying to (used to target the reply)
 * @seq: netlink audit message sequence (serial) number
 */
-int audit_list_rules_send(__u32 portid, int seq)
+int audit_list_rules_send(struct sk_buff *request_skb, int seq)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
        struct task_struct *tsk;
        struct audit_netlink_list *dest;
        int err = 0;
@@ -1083,8 +1087,8 @@ int audit_list_rules_send(__u32 portid, int seq)
        dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
        if (!dest)
                return -ENOMEM;
+        dest->net = get_net(net);
        dest->portid = portid;
-        dest->pid = task_pid_vnr(current);
        skb_queue_head_init(&dest->q);
        mutex_lock(&audit_filter_mutex);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 105f273b6f86..0c753ddd223b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4112,17 +4112,17 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        err = percpu_ref_init(&css->refcnt, css_release);
        if (err)
-                goto err_free;
+                goto err_free_css;
        init_css(css, ss, cgrp);
        err = cgroup_populate_dir(cgrp, 1 << ss->subsys_id);
        if (err)
-                goto err_free;
+                goto err_free_percpu_ref;
        err = online_css(css);
        if (err)
-                goto err_free;
+                goto err_clear_dir;
        dget(cgrp->dentry);
        css_get(css->parent);
@@ -4138,8 +4138,11 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        return 0;
-err_free:
+err_clear_dir:
+        cgroup_clear_dir(css->cgroup, 1 << css->ss->subsys_id);
+err_free_percpu_ref:
        percpu_ref_cancel_init(&css->refcnt);
+err_free_css:
        ss->css_free(css);
        return err;
 }
diff --git a/kernel/futex.c b/kernel/futex.c
index 44a1261cb9ff..08ec814ad9d2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -234,6 +234,7 @@ static const struct futex_q futex_q_init = {
 * waiting on a futex.
 */
 struct futex_hash_bucket {
+        atomic_t waiters;
        spinlock_t lock;
        struct plist_head chain;
 } ____cacheline_aligned_in_smp;
@@ -253,22 +254,37 @@ static inline void futex_get_mm(union futex_key *key)
        smp_mb__after_atomic_inc();
 }
-static inline bool hb_waiters_pending(struct futex_hash_bucket *hb)
+/*
+ * Reflects a new waiter being added to the waitqueue.
+ */
+static inline void hb_waiters_inc(struct futex_hash_bucket *hb)
 {
 #ifdef CONFIG_SMP
+        atomic_inc(&hb->waiters);
        /*
-         * Tasks trying to enter the critical region are most likely
+         * Full barrier (A), see the ordering comment above.
-         * potential waiters that will be added to the plist. Ensure
-         * that wakers won't miss to-be-slept tasks in the window between
-         * the wait call and the actual plist_add.
         */
-        if (spin_is_locked(&hb->lock))
+        smp_mb__after_atomic_inc();
-                return true;
+#endif
-        smp_rmb(); /* Make sure we check the lock state first */
+}
+/*
+ * Reflects a waiter being removed from the waitqueue by wakeup
+ * paths.
+ */
+static inline void hb_waiters_dec(struct futex_hash_bucket *hb)
+{
+#ifdef CONFIG_SMP
+        atomic_dec(&hb->waiters);
+#endif
+}
-        return !plist_head_empty(&hb->chain);
+static inline int hb_waiters_pending(struct futex_hash_bucket *hb)
+{
+#ifdef CONFIG_SMP
+        return atomic_read(&hb->waiters);
 #else
-        return true;
+        return 1;
 #endif
 }
@@ -954,6 +970,7 @@ static void __unqueue_futex(struct futex_q *q)
        hb = container_of(q->lock_ptr, struct futex_hash_bucket, lock);
        plist_del(&q->list, &hb->chain);
+        hb_waiters_dec(hb);
 }
 /*
@@ -1257,7 +1274,9 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
         */
        if (likely(&hb1->chain != &hb2->chain)) {
                plist_del(&q->list, &hb1->chain);
+                hb_waiters_dec(hb1);
                plist_add(&q->list, &hb2->chain);
+                hb_waiters_inc(hb2);
                q->lock_ptr = &hb2->lock;
        }
        get_futex_key_refs(key2);
@@ -1600,6 +1619,17 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
        struct futex_hash_bucket *hb;
        hb = hash_futex(&q->key);
+        /*
+         * Increment the counter before taking the lock so that
+         * a potential waker won't miss a to-be-slept task that is
+         * waiting for the spinlock. This is safe as all queue_lock()
+         * users end up calling queue_me(). Similarly, for housekeeping,
+         * decrement the counter at queue_unlock() when some error has
+         * occurred and we don't end up adding the task to the list.
+         */
+        hb_waiters_inc(hb);
        q->lock_ptr = &hb->lock;
        spin_lock(&hb->lock); /* implies MB (A) */
@@ -1611,6 +1641,7 @@ queue_unlock(struct futex_hash_bucket *hb)
        __releases(&hb->lock)
 {
        spin_unlock(&hb->lock);
+        hb_waiters_dec(hb);
 }
 /**
@@ -2342,6 +2373,7 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                 * Unqueue the futex_q and determine which it was.
                 */
                plist_del(&q->list, &hb->chain);
+                hb_waiters_dec(hb);
                /* Handle spurious wakeups gracefully */
                ret = -EWOULDBLOCK;
@@ -2875,6 +2907,7 @@ static int __init futex_init(void)
                futex_cmpxchg_enabled = 1;
        for (i = 0; i < futex_hashsize; i++) {
+                atomic_set(&futex_queues[i].waiters, 0);
                plist_head_init(&futex_queues[i].chain);
                spin_lock_init(&futex_queues[i].lock);
        }
diff --git a/kernel/profile.c b/kernel/profile.c
index 6631e1ef55ab..ebdd9c1a86b4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -549,14 +549,14 @@ static int create_hash_tables(void)
                struct page *page;
                page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                0);
                if (!page)
                        goto out_cleanup;
                per_cpu(cpu_profile_hits, cpu)[1]
                                = (struct profile_hit *)page_address(page);
                page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                0);
                if (!page)
                        goto out_cleanup;
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index 43c2bcc35761..b30a2924ef14 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -301,14 +301,14 @@ u64 sched_clock_cpu(int cpu)
        if (unlikely(!sched_clock_running))
                return 0ull;
-        preempt_disable();
+        preempt_disable_notrace();
        scd = cpu_sdc(cpu);
        if (cpu != smp_processor_id())
                clock = sched_clock_remote(scd);
        else
                clock = sched_clock_local(scd);
-        preempt_enable();
+        preempt_enable_notrace();
        return clock;
 }
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 6edbef296ece..f5c6635b806c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3338,6 +3338,15 @@ recheck:
                                return -EPERM;
                }
+                 /*
+                  * Can't set/change SCHED_DEADLINE policy at all for now
+                  * (safest behavior); in the future we would like to allow
+                  * unprivileged DL tasks to increase their relative deadline
+                  * or reduce their runtime (both ways reducing utilization)
+                  */
+                if (dl_policy(policy))
+                        return -EPERM;
                /*
                 * Treat SCHED_IDLE as nice 20. Only allow a switch to
                 * SCHED_NORMAL if the RLIMIT_NICE would normally permit it.
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 84571e09c907..01fbae5b97b7 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -293,7 +293,7 @@ int stop_two_cpus(unsigned int cpu1, unsigned int cpu2, cpu_stop_fn_t fn, void *
         */
        smp_call_function_single(min(cpu1, cpu2),
                                 &irq_cpu_stop_queue_work,
-                                 &call_args, 0);
+                                 &call_args, 1);
        lg_local_unlock(&stop_cpus_lock);
        preempt_enable();
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index f3989ceb5cd5..7b16d40bd64d 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -27,12 +27,6 @@
 DEFINE_MUTEX(event_mutex);
-DEFINE_MUTEX(event_storage_mutex);
-EXPORT_SYMBOL_GPL(event_storage_mutex);
-char event_storage[EVENT_STORAGE_SIZE];
-EXPORT_SYMBOL_GPL(event_storage);
 LIST_HEAD(ftrace_events);
 static LIST_HEAD(ftrace_common_fields);
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index 7c3e3e72e2b6..ee0a5098ac43 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -95,15 +95,12 @@ static void __always_unused ____ftrace_check_##name(void)		\
 #undef __array
 #define __array(type, item, len)                                        \
        do {                                                            \
+                char *type_str = #type"["__stringify(len)"]";           \
                BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);                 \
-                mutex_lock(&event_storage_mutex);                       \
+                ret = trace_define_field(event_call, type_str, #item,   \
-                snprintf(event_storage, sizeof(event_storage),          \
-                         "%s[%d]", #type, len);                         \
-                ret = trace_define_field(event_call, event_storage, #item, \
                                 offsetof(typeof(field), item),         \
                                 sizeof(field.item),                    \
                                 is_signed_type(type), filter_type);    \
-                mutex_unlock(&event_storage_mutex);                     \
                if (ret)                                                \
                        return ret;                                     \
        } while (0);
diff --git a/lib/fonts/Kconfig b/lib/fonts/Kconfig
index 4dc1b990aa23..34fd931b54b5 100644
--- a/lib/fonts/Kconfig
+++ b/lib/fonts/Kconfig
@@ -9,7 +9,7 @@ if FONT_SUPPORT
 config FONTS
        bool "Select compiled-in fonts"
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
        help
          Say Y here if you would like to use fonts other than the default
          your frame buffer console usually use.
@@ -22,7 +22,7 @@ config FONTS
 config FONT_8x8
        bool "VGA 8x8 font" if FONTS
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
        default y if !SPARC && !FONTS
        help
          This is the "high resolution" font for the VGA frame buffer (the one
@@ -45,7 +45,7 @@ config FONT_8x16
 config FONT_6x11
        bool "Mac console 6x11 font (not supported by all drivers)" if FONTS
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
        default y if !SPARC && !FONTS && MAC
        help
          Small console font with Macintosh-style high-half glyphs.  Some Mac
diff --git a/mm/Kconfig b/mm/Kconfig
index 2d9f1504d75e..2888024e0b0a 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -575,5 +575,5 @@ config PGTABLE_MAPPING
          then you should select this. This causes zsmalloc to use page table
          mapping rather than copying for object mapping.
-          You can check speed with zsmalloc benchmark[1].
+          You can check speed with zsmalloc benchmark:
-          [1] https://github.com/spartacus06/zsmalloc
+          https://github.com/spartacus06/zsmapbench
diff --git a/mm/compaction.c b/mm/compaction.c
index b48c5259ea33..918577595ea8 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -251,7 +251,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 {
        int nr_scanned = 0, total_isolated = 0;
        struct page *cursor, *valid_page = NULL;
-        unsigned long nr_strict_required = end_pfn - blockpfn;
        unsigned long flags;
        bool locked = false;
@@ -264,11 +263,12 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                nr_scanned++;
                if (!pfn_valid_within(blockpfn))
-                        continue;
+                        goto isolate_fail;
                if (!valid_page)
                        valid_page = page;
                if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
                /*
                 * The zone lock must be held to isolate freepages.
@@ -289,12 +289,10 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                /* Recheck this is a buddy page under lock */
                if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
                /* Found a free page, break it into order-0 pages */
                isolated = split_free_page(page);
-                if (!isolated && strict)
-                        break;
                total_isolated += isolated;
                for (i = 0; i < isolated; i++) {
                        list_add(&page->lru, freelist);
@@ -305,7 +303,15 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                if (isolated) {
                        blockpfn += isolated - 1;
                        cursor += isolated - 1;
+                        continue;
                }
+isolate_fail:
+                if (strict)
+                        break;
+                else
+                        continue;
        }
        trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated);
@@ -315,7 +321,7 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
         * pages requested were isolated. If there were any failures, 0 is
         * returned and CMA will fail.
         */
-        if (strict && nr_strict_required > total_isolated)
+        if (strict && blockpfn < end_pfn)
                total_isolated = 0;
        if (locked)
diff --git a/mm/fremap.c b/mm/fremap.c
index bbc4d660221a..34feba60a17e 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -23,28 +23,44 @@
 #include "internal.h"
+static int mm_counter(struct page *page)
+{
+        return PageAnon(page) ? MM_ANONPAGES : MM_FILEPAGES;
+}
 static void zap_pte(struct mm_struct *mm, struct vm_area_struct *vma,
                        unsigned long addr, pte_t *ptep)
 {
        pte_t pte = *ptep;
+        struct page *page;
+        swp_entry_t entry;
        if (pte_present(pte)) {
-                struct page *page;
                flush_cache_page(vma, addr, pte_pfn(pte));
                pte = ptep_clear_flush(vma, addr, ptep);
                page = vm_normal_page(vma, addr, pte);
                if (page) {
                        if (pte_dirty(pte))
                                set_page_dirty(page);
+                        update_hiwater_rss(mm);
+                        dec_mm_counter(mm, mm_counter(page));
                        page_remove_rmap(page);
                        page_cache_release(page);
+                }
+        } else {        /* zap_pte() is not called when pte_none() */
+                if (!pte_file(pte)) {
                        update_hiwater_rss(mm);
-                        dec_mm_counter(mm, MM_FILEPAGES);
+                        entry = pte_to_swp_entry(pte);
+                        if (non_swap_entry(entry)) {
+                                if (is_migration_entry(entry)) {
+                                        page = migration_entry_to_page(entry);
+                                        dec_mm_counter(mm, mm_counter(page));
+                                }
+                        } else {
+                                free_swap_and_cache(entry);
+                                dec_mm_counter(mm, MM_SWAPENTS);
+                        }
                }
-        } else {
-                if (!pte_file(pte))
-                        free_swap_and_cache(pte_to_swp_entry(pte));
                pte_clear_not_present_full(mm, addr, ptep, 0);
        }
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 482a33d89134..bed48809e5d0 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -178,6 +178,37 @@ out:
 }
 /*
+ * Congratulations to trinity for discovering this bug.
+ * mm/fremap.c's remap_file_pages() accepts any range within a single vma to
+ * convert that vma to VM_NONLINEAR; and generic_file_remap_pages() will then
+ * replace the specified range by file ptes throughout (maybe populated after).
+ * If page migration finds a page within that range, while it's still located
+ * by vma_interval_tree rather than lost to i_mmap_nonlinear list, no problem:
+ * zap_pte() clears the temporary migration entry before mmap_sem is dropped.
+ * But if the migrating page is in a part of the vma outside the range to be
+ * remapped, then it will not be cleared, and remove_migration_ptes() needs to
+ * deal with it.  Fortunately, this part of the vma is of course still linear,
+ * so we just need to use linear location on the nonlinear list.
+ */
+static int remove_linear_migration_ptes_from_nonlinear(struct page *page,
+                struct address_space *mapping, void *arg)
+{
+        struct vm_area_struct *vma;
+        /* hugetlbfs does not support remap_pages, so no huge pgoff worries */
+        pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+        unsigned long addr;
+        list_for_each_entry(vma,
+                &mapping->i_mmap_nonlinear, shared.nonlinear) {
+                addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
+                if (addr >= vma->vm_start && addr < vma->vm_end)
+                        remove_migration_pte(page, vma, addr, arg);
+        }
+        return SWAP_AGAIN;
+}
+/*
 * Get rid of all migration entries and replace them by
 * references to the indicated page.
 */
@@ -186,6 +217,7 @@ static void remove_migration_ptes(struct page *old, struct page *new)
        struct rmap_walk_control rwc = {
                .rmap_one = remove_migration_pte,
                .arg = old,
+                .file_nonlinear = remove_linear_migration_ptes_from_nonlinear,
        };
        rmap_walk(new, &rwc);
@@ -1158,7 +1190,7 @@ static struct page *new_page_node(struct page *p, unsigned long private,
                                        pm->node);
        else
                return alloc_pages_exact_node(pm->node,
-                                GFP_HIGHUSER_MOVABLE | GFP_THISNODE, 0);
+                                GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 0);
 }
 /*
@@ -1544,9 +1576,9 @@ static struct page *alloc_misplaced_dst_page(struct page *page,
        struct page *newpage;
        newpage = alloc_pages_exact_node(nid,
-                                         (GFP_HIGHUSER_MOVABLE | GFP_THISNODE |
+                                         (GFP_HIGHUSER_MOVABLE |
-                                          __GFP_NOMEMALLOC | __GFP_NORETRY |
+                                          __GFP_THISNODE | __GFP_NOMEMALLOC |
-                                          __GFP_NOWARN) &
+                                          __GFP_NORETRY | __GFP_NOWARN) &
                                         ~GFP_IOFS, 0);
        return newpage;
@@ -1747,7 +1779,8 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                goto out_dropref;
        new_page = alloc_pages_node(node,
-                (GFP_TRANSHUGE | GFP_THISNODE) & ~__GFP_WAIT, HPAGE_PMD_ORDER);
+                (GFP_TRANSHUGE | __GFP_THISNODE) & ~__GFP_WAIT,
+                HPAGE_PMD_ORDER);
        if (!new_page)
                goto out_fail;
diff --git a/mm/rmap.c b/mm/rmap.c
index d9d42316a99a..8fc049f9a5a6 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1360,8 +1360,9 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
 }
 static int try_to_unmap_nonlinear(struct page *page,
-                struct address_space *mapping, struct vm_area_struct *vma)
+                struct address_space *mapping, void *arg)
 {
+        struct vm_area_struct *vma;
        int ret = SWAP_AGAIN;
        unsigned long cursor;
        unsigned long max_nl_cursor = 0;
@@ -1663,7 +1664,7 @@ static int rmap_walk_file(struct page *page, struct rmap_walk_control *rwc)
        if (list_empty(&mapping->i_mmap_nonlinear))
                goto done;
-        ret = rwc->file_nonlinear(page, mapping, vma);
+        ret = rwc->file_nonlinear(page, mapping, rwc->arg);
 done:
        mutex_unlock(&mapping->i_mmap_mutex);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index de51c48c4393..4b65aa492fb6 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -538,6 +538,9 @@ static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev
        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
        struct net_device *real_dev = vlan->real_dev;
+        if (saddr == NULL)
+                saddr = dev->dev_addr;
        return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
 }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index ef66365b7354..93067ecdb9a2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1127,9 +1127,10 @@ static void br_multicast_query_received(struct net_bridge *br,
                                        struct net_bridge_port *port,
                                        struct bridge_mcast_querier *querier,
                                        int saddr,
+                                        bool is_general_query,
                                        unsigned long max_delay)
 {
-        if (saddr)
+        if (saddr && is_general_query)
                br_multicast_update_querier_timer(br, querier, max_delay);
        else if (timer_pending(&querier->timer))
                return;
@@ -1181,8 +1182,16 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
        }
+        /* RFC2236+RFC3376 (IGMPv2+IGMPv3) require the multicast link layer
+         * all-systems destination addresses (224.0.0.1) for general queries
+         */
+        if (!group && iph->daddr != htonl(INADDR_ALLHOSTS_GROUP)) {
+                err = -EINVAL;
+                goto out;
+        }
        br_multicast_query_received(br, port, &br->ip4_querier, !!iph->saddr,
-                                    max_delay);
+                                    !group, max_delay);
        if (!group)
                goto out;
@@ -1228,6 +1237,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
        unsigned long max_delay;
        unsigned long now = jiffies;
        const struct in6_addr *group = NULL;
+        bool is_general_query;
        int err = 0;
        spin_lock(&br->multicast_lock);
@@ -1235,6 +1245,12 @@ static int br_ip6_multicast_query(struct net_bridge *br,
            (port && port->state == BR_STATE_DISABLED))
                goto out;
+        /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
+        if (!(ipv6_addr_type(&ip6h->saddr) & IPV6_ADDR_LINKLOCAL)) {
+                err = -EINVAL;
+                goto out;
+        }
        if (skb->len == sizeof(*mld)) {
                if (!pskb_may_pull(skb, sizeof(*mld))) {
                        err = -EINVAL;
@@ -1256,8 +1272,19 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
        }
+        is_general_query = group && ipv6_addr_any(group);
+        /* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
+         * all-nodes destination address (ff02::1) for general queries
+         */
+        if (is_general_query && !ipv6_addr_is_ll_all_nodes(&ip6h->daddr)) {
+                err = -EINVAL;
+                goto out;
+        }
        br_multicast_query_received(br, port, &br->ip6_querier,
-                                    !ipv6_addr_any(&ip6h->saddr), max_delay);
+                                    !ipv6_addr_any(&ip6h->saddr),
+                                    is_general_query, max_delay);
        if (!group)
                goto out;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a664f7829a6d..df9e6b1a9759 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -742,7 +742,7 @@ static bool pkt_is_ns(struct sk_buff *skb)
        struct nd_msg *msg;
        struct ipv6hdr *hdr;
-        if (skb->protocol != htons(ETH_P_ARP))
+        if (skb->protocol != htons(ETH_P_IPV6))
                return false;
        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)))
                return false;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1a0dac2ef9ad..120eecc0f5a4 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2121,12 +2121,13 @@ EXPORT_SYMBOL(rtmsg_ifinfo);
 static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
                                   struct net_device *dev,
                                   u8 *addr, u32 pid, u32 seq,
-                                   int type, unsigned int flags)
+                                   int type, unsigned int flags,
+                                   int nlflags)
 {
        struct nlmsghdr *nlh;
        struct ndmsg *ndm;
-        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), nlflags);
        if (!nlh)
                return -EMSGSIZE;
@@ -2164,7 +2165,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, int type)
        if (!skb)
                goto errout;
-        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF);
+        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF, 0);
        if (err < 0) {
                kfree_skb(skb);
                goto errout;
@@ -2389,7 +2390,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb,
                err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
                                              portid, seq,
-                                              RTM_NEWNEIGH, NTF_SELF);
+                                              RTM_NEWNEIGH, NTF_SELF,
+                                              NLM_F_MULTI);
                if (err < 0)
                        return err;
 skip:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5d6236d9fdce..869c7afe3b07 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2838,81 +2838,84 @@ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 /**
 *      skb_segment - Perform protocol segmentation on skb.
- *      @skb: buffer to segment
+ *      @head_skb: buffer to segment
 *      @features: features for the output path (see dev->features)
 *
 *      This function performs segmentation on the given skb.  It returns
 *      a pointer to the first in a list of new skbs for the segments.
 *      In case of error it returns ERR_PTR(err).
 */
-struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+struct sk_buff *skb_segment(struct sk_buff *head_skb,
+                            netdev_features_t features)
 {
        struct sk_buff *segs = NULL;
        struct sk_buff *tail = NULL;
-        struct sk_buff *fskb = skb_shinfo(skb)->frag_list;
+        struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
-        skb_frag_t *skb_frag = skb_shinfo(skb)->frags;
+        skb_frag_t *frag = skb_shinfo(head_skb)->frags;
-        unsigned int mss = skb_shinfo(skb)->gso_size;
+        unsigned int mss = skb_shinfo(head_skb)->gso_size;
-        unsigned int doffset = skb->data - skb_mac_header(skb);
+        unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
+        struct sk_buff *frag_skb = head_skb;
        unsigned int offset = doffset;
-        unsigned int tnl_hlen = skb_tnl_header_len(skb);
+        unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
        unsigned int headroom;
        unsigned int len;
        __be16 proto;
        bool csum;
        int sg = !!(features & NETIF_F_SG);
-        int nfrags = skb_shinfo(skb)->nr_frags;
+        int nfrags = skb_shinfo(head_skb)->nr_frags;
        int err = -ENOMEM;
        int i = 0;
        int pos;
-        proto = skb_network_protocol(skb);
+        proto = skb_network_protocol(head_skb);
        if (unlikely(!proto))
                return ERR_PTR(-EINVAL);
        csum = !!can_checksum_protocol(features, proto);
-        __skb_push(skb, doffset);
+        __skb_push(head_skb, doffset);
-        headroom = skb_headroom(skb);
+        headroom = skb_headroom(head_skb);
-        pos = skb_headlen(skb);
+        pos = skb_headlen(head_skb);
        do {
                struct sk_buff *nskb;
-                skb_frag_t *frag;
+                skb_frag_t *nskb_frag;
                int hsize;
                int size;
-                len = skb->len - offset;
+                len = head_skb->len - offset;
                if (len > mss)
                        len = mss;
-                hsize = skb_headlen(skb) - offset;
+                hsize = skb_headlen(head_skb) - offset;
                if (hsize < 0)
                        hsize = 0;
                if (hsize > len || !sg)
                        hsize = len;
-                if (!hsize && i >= nfrags && skb_headlen(fskb) &&
+                if (!hsize && i >= nfrags && skb_headlen(list_skb) &&
-                    (skb_headlen(fskb) == len || sg)) {
+                    (skb_headlen(list_skb) == len || sg)) {
-                        BUG_ON(skb_headlen(fskb) > len);
+                        BUG_ON(skb_headlen(list_skb) > len);
                        i = 0;
-                        nfrags = skb_shinfo(fskb)->nr_frags;
+                        nfrags = skb_shinfo(list_skb)->nr_frags;
-                        skb_frag = skb_shinfo(fskb)->frags;
+                        frag = skb_shinfo(list_skb)->frags;
-                        pos += skb_headlen(fskb);
+                        frag_skb = list_skb;
+                        pos += skb_headlen(list_skb);
                        while (pos < offset + len) {
                                BUG_ON(i >= nfrags);
-                                size = skb_frag_size(skb_frag);
+                                size = skb_frag_size(frag);
                                if (pos + size > offset + len)
                                        break;
                                i++;
                                pos += size;
-                                skb_frag++;
+                                frag++;
                        }
-                        nskb = skb_clone(fskb, GFP_ATOMIC);
+                        nskb = skb_clone(list_skb, GFP_ATOMIC);
-                        fskb = fskb->next;
+                        list_skb = list_skb->next;
                        if (unlikely(!nskb))
                                goto err;
@@ -2933,7 +2936,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                        __skb_push(nskb, doffset);
                } else {
                        nskb = __alloc_skb(hsize + doffset + headroom,
-                                           GFP_ATOMIC, skb_alloc_rx_flag(skb),
+                                           GFP_ATOMIC, skb_alloc_rx_flag(head_skb),
                                           NUMA_NO_NODE);
                        if (unlikely(!nskb))
@@ -2949,12 +2952,12 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                        segs = nskb;
                tail = nskb;
-                __copy_skb_header(nskb, skb);
+                __copy_skb_header(nskb, head_skb);
-                nskb->mac_len = skb->mac_len;
+                nskb->mac_len = head_skb->mac_len;
                skb_headers_offset_update(nskb, skb_headroom(nskb) - headroom);
-                skb_copy_from_linear_data_offset(skb, -tnl_hlen,
+                skb_copy_from_linear_data_offset(head_skb, -tnl_hlen,
                                                 nskb->data - tnl_hlen,
                                                 doffset + tnl_hlen);
@@ -2963,30 +2966,32 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                if (!sg) {
                        nskb->ip_summed = CHECKSUM_NONE;
-                        nskb->csum = skb_copy_and_csum_bits(skb, offset,
+                        nskb->csum = skb_copy_and_csum_bits(head_skb, offset,
                                                            skb_put(nskb, len),
                                                            len, 0);
                        continue;
                }
-                frag = skb_shinfo(nskb)->frags;
+                nskb_frag = skb_shinfo(nskb)->frags;
-                skb_copy_from_linear_data_offset(skb, offset,
+                skb_copy_from_linear_data_offset(head_skb, offset,
                                                 skb_put(nskb, hsize), hsize);
-                skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
+                skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags &
+                        SKBTX_SHARED_FRAG;
                while (pos < offset + len) {
                        if (i >= nfrags) {
-                                BUG_ON(skb_headlen(fskb));
+                                BUG_ON(skb_headlen(list_skb));
                                i = 0;
-                                nfrags = skb_shinfo(fskb)->nr_frags;
+                                nfrags = skb_shinfo(list_skb)->nr_frags;
-                                skb_frag = skb_shinfo(fskb)->frags;
+                                frag = skb_shinfo(list_skb)->frags;
+                                frag_skb = list_skb;
                                BUG_ON(!nfrags);
-                                fskb = fskb->next;
+                                list_skb = list_skb->next;
                        }
                        if (unlikely(skb_shinfo(nskb)->nr_frags >=
@@ -2997,27 +3002,30 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                goto err;
                        }
-                        *frag = *skb_frag;
+                        if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))
-                        __skb_frag_ref(frag);
+                                goto err;
-                        size = skb_frag_size(frag);
+                        *nskb_frag = *frag;
+                        __skb_frag_ref(nskb_frag);
+                        size = skb_frag_size(nskb_frag);
                        if (pos < offset) {
-                                frag->page_offset += offset - pos;
+                                nskb_frag->page_offset += offset - pos;
-                                skb_frag_size_sub(frag, offset - pos);
+                                skb_frag_size_sub(nskb_frag, offset - pos);
                        }
                        skb_shinfo(nskb)->nr_frags++;
                        if (pos + size <= offset + len) {
                                i++;
-                                skb_frag++;
+                                frag++;
                                pos += size;
                        } else {
-                                skb_frag_size_sub(frag, pos + size - (offset + len));
+                                skb_frag_size_sub(nskb_frag, pos + size - (offset + len));
                                goto skip_fraglist;
                        }
-                        frag++;
+                        nskb_frag++;
                }
 skip_fraglist:
@@ -3031,7 +3039,7 @@ perform_csum_check:
                                                  nskb->len - doffset, 0);
                        nskb->ip_summed = CHECKSUM_NONE;
                }
-        } while ((offset += len) < skb->len);
+        } while ((offset += len) < head_skb->len);
        return segs;
diff --git a/net/core/sock.c b/net/core/sock.c
index 5b6a9431b017..c0fc6bdad1e3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2357,10 +2357,13 @@ void release_sock(struct sock *sk)
        if (sk->sk_backlog.tail)
                __release_sock(sk);
+        /* Warning : release_cb() might need to release sk ownership,
+         * ie call sock_release_ownership(sk) before us.
+         */
        if (sk->sk_prot->release_cb)
                sk->sk_prot->release_cb(sk);
-        sk->sk_lock.owned = 0;
+        sock_release_ownership(sk);
        if (waitqueue_active(&sk->sk_lock.wq))
                wake_up(&sk->sk_lock.wq);
        spin_unlock_bh(&sk->sk_lock.slock);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index bb075fc9a14f..3b01959bf4bb 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -208,7 +208,7 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f, bool force)
        }
        work = frag_mem_limit(nf) - nf->low_thresh;
-        while (work > 0) {
+        while (work > 0 || force) {
                spin_lock(&nf->lru_lock);
                if (list_empty(&nf->lru_list)) {
@@ -278,9 +278,10 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
        atomic_inc(&qp->refcnt);
        hlist_add_head(&qp->list, &hb->chain);
+        inet_frag_lru_add(nf, qp);
        spin_unlock(&hb->chain_lock);
        read_unlock(&f->lock);
-        inet_frag_lru_add(nf, qp);
        return qp;
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b9b3472975ba..28863570dd60 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2255,13 +2255,14 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
 }
 static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
-                            u32 portid, u32 seq, struct mfc_cache *c, int cmd)
+                            u32 portid, u32 seq, struct mfc_cache *c, int cmd,
+                            int flags)
 {
        struct nlmsghdr *nlh;
        struct rtmsg *rtm;
        int err;
-        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
        if (nlh == NULL)
                return -EMSGSIZE;
@@ -2329,7 +2330,7 @@ static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc,
        if (skb == NULL)
                goto errout;
-        err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd);
+        err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
        if (err < 0)
                goto errout;
@@ -2368,7 +2369,8 @@ static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
                                if (ipmr_fill_mroute(mrt, skb,
                                                     NETLINK_CB(cb->skb).portid,
                                                     cb->nlh->nlmsg_seq,
-                                                     mfc, RTM_NEWROUTE) < 0)
+                                                     mfc, RTM_NEWROUTE,
+                                                     NLM_F_MULTI) < 0)
                                        goto done;
 next_entry:
                                e++;
@@ -2382,7 +2384,8 @@ next_entry:
                        if (ipmr_fill_mroute(mrt, skb,
                                             NETLINK_CB(cb->skb).portid,
                                             cb->nlh->nlmsg_seq,
-                                             mfc, RTM_NEWROUTE) < 0) {
+                                             mfc, RTM_NEWROUTE,
+                                             NLM_F_MULTI) < 0) {
                                spin_unlock_bh(&mfc_unres_lock);
                                goto done;
                        }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f0eb4e337ec8..17a11e65e57f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -767,6 +767,17 @@ void tcp_release_cb(struct sock *sk)
        if (flags & (1UL << TCP_TSQ_DEFERRED))
                tcp_tsq_handler(sk);
+        /* Here begins the tricky part :
+         * We are called from release_sock() with :
+         * 1) BH disabled
+         * 2) sk_lock.slock spinlock held
+         * 3) socket owned by us (sk->sk_lock.owned == 1)
+         *
+         * But following code is meant to be called from BH handlers,
+         * so we should keep BH disabled, but early release socket ownership
+         */
+        sock_release_ownership(sk);
        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
                tcp_write_timer_handler(sk);
                __sock_put(sk);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index fdbfeca36d63..344e972426df 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1103,8 +1103,11 @@ retry:
         * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
         * an implementation must not create a temporary address with a zero
         * Preferred Lifetime.
+         * Use age calculation as in addrconf_verify to avoid unnecessary
+         * temporary addresses being generated.
         */
-        if (tmp_prefered_lft <= regen_advance) {
+        age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
+        if (tmp_prefered_lft <= regen_advance + age) {
                in6_ifa_put(ifp);
                in6_dev_put(idev);
                ret = -1;
diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c
index cf77f3abfd06..447a7fbd1bb6 100644
--- a/net/ipv6/exthdrs_offload.c
+++ b/net/ipv6/exthdrs_offload.c
@@ -25,11 +25,11 @@ int __init ipv6_exthdrs_offload_init(void)
        int ret;
        ret = inet6_add_offload(&rthdr_offload, IPPROTO_ROUTING);
-        if (!ret)
+        if (ret)
                goto out;
        ret = inet6_add_offload(&dstopt_offload, IPPROTO_DSTOPTS);
-        if (!ret)
+        if (ret)
                goto out_rt;
 out:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 16f91a2e7888..64d6073731d3 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1101,21 +1101,19 @@ static void ip6_append_data_mtu(unsigned int *mtu,
                                unsigned int fragheaderlen,
                                struct sk_buff *skb,
                                struct rt6_info *rt,
-                                bool pmtuprobe)
+                                unsigned int orig_mtu)
 {
        if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
                if (skb == NULL) {
                        /* first fragment, reserve header_len */
-                        *mtu = *mtu - rt->dst.header_len;
+                        *mtu = orig_mtu - rt->dst.header_len;
                } else {
                        /*
                         * this fragment is not first, the headers
                         * space is regarded as data space.
                         */
-                        *mtu = min(*mtu, pmtuprobe ?
+                        *mtu = orig_mtu;
-                                   rt->dst.dev->mtu :
-                                   dst_mtu(rt->dst.path));
                }
                *maxfraglen = ((*mtu - fragheaderlen) & ~7)
                              + fragheaderlen - sizeof(struct frag_hdr);
@@ -1132,7 +1130,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct inet_cork *cork;
        struct sk_buff *skb, *skb_prev = NULL;
-        unsigned int maxfraglen, fragheaderlen, mtu;
+        unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
        int exthdrlen;
        int dst_exthdrlen;
        int hh_len;
@@ -1214,6 +1212,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                dst_exthdrlen = 0;
                mtu = cork->fragsize;
        }
+        orig_mtu = mtu;
        hh_len = LL_RESERVED_SPACE(rt->dst.dev);
@@ -1311,8 +1310,7 @@ alloc_new_skb:
                        if (skb == NULL || skb_prev == NULL)
                                ip6_append_data_mtu(&mtu, &maxfraglen,
                                                    fragheaderlen, skb, rt,
-                                                    np->pmtudisc >=
+                                                    orig_mtu);
-                                                    IPV6_PMTUDISC_PROBE);
                        skb_prev = skb;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0eb4038a4d63..8737400af0a0 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2349,13 +2349,14 @@ int ip6mr_get_route(struct net *net,
 }
 static int ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
-                             u32 portid, u32 seq, struct mfc6_cache *c, int cmd)
+                             u32 portid, u32 seq, struct mfc6_cache *c, int cmd,
+                             int flags)
 {
        struct nlmsghdr *nlh;
        struct rtmsg *rtm;
        int err;
-        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
        if (nlh == NULL)
                return -EMSGSIZE;
@@ -2423,7 +2424,7 @@ static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
        if (skb == NULL)
                goto errout;
-        err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd);
+        err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
        if (err < 0)
                goto errout;
@@ -2462,7 +2463,8 @@ static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
                                if (ip6mr_fill_mroute(mrt, skb,
                                                      NETLINK_CB(cb->skb).portid,
                                                      cb->nlh->nlmsg_seq,
-                                                      mfc, RTM_NEWROUTE) < 0)
+                                                      mfc, RTM_NEWROUTE,
+                                                      NLM_F_MULTI) < 0)
                                        goto done;
 next_entry:
                                e++;
@@ -2476,7 +2478,8 @@ next_entry:
                        if (ip6mr_fill_mroute(mrt, skb,
                                              NETLINK_CB(cb->skb).portid,
                                              cb->nlh->nlmsg_seq,
-                                              mfc, RTM_NEWROUTE) < 0) {
+                                              mfc, RTM_NEWROUTE,
+                                              NLM_F_MULTI) < 0) {
                                spin_unlock_bh(&mfc_unres_lock);
                                goto done;
                        }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 11dac21e6586..fba54a407bb2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1513,7 +1513,7 @@ int ip6_route_add(struct fib6_config *cfg)
        if (!table)
                goto out;
-        rt = ip6_dst_alloc(net, NULL, DST_NOCOUNT, table);
+        rt = ip6_dst_alloc(net, NULL, (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT, table);
        if (!rt) {
                err = -ENOMEM;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1a04c1329362..79326978517a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -433,12 +433,13 @@ static inline int verify_sec_ctx_len(const void *p)
        return 0;
 }
-static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx)
+static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx,
+                                                                     gfp_t gfp)
 {
        struct xfrm_user_sec_ctx *uctx = NULL;
        int ctx_size = sec_ctx->sadb_x_ctx_len;
-        uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL);
+        uctx = kmalloc((sizeof(*uctx)+ctx_size), gfp);
        if (!uctx)
                return NULL;
@@ -1124,7 +1125,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
        sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
        if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
                if (!uctx)
                        goto out;
@@ -2231,14 +2232,14 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
        sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
        if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
                if (!uctx) {
                        err = -ENOBUFS;
                        goto out;
                }
-                err = security_xfrm_policy_alloc(&xp->security, uctx);
+                err = security_xfrm_policy_alloc(&xp->security, uctx, GFP_KERNEL);
                kfree(uctx);
                if (err)
@@ -2335,12 +2336,12 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
        sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
        if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
                if (!uctx)
                        return -ENOMEM;
-                err = security_xfrm_policy_alloc(&pol_ctx, uctx);
+                err = security_xfrm_policy_alloc(&pol_ctx, uctx, GFP_KERNEL);
                kfree(uctx);
                if (err)
                        return err;
@@ -3239,8 +3240,8 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                }
                if ((*dir = verify_sec_ctx_len(p)))
                        goto out;
-                uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_ATOMIC);
-                *dir = security_xfrm_policy_alloc(&xp->security, uctx);
+                *dir = security_xfrm_policy_alloc(&xp->security, uctx, GFP_ATOMIC);
                kfree(uctx);
                if (*dir)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 735d0f60c83a..85d9d94c0a3c 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -112,7 +112,6 @@ struct l2tp_net {
        spinlock_t l2tp_session_hlist_lock;
 };
-static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
@@ -1863,7 +1862,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_delete);
 /* We come here whenever a session's send_seq, cookie_len or
 * l2specific_len parameters are set.
 */
-static void l2tp_session_set_header_len(struct l2tp_session *session, int version)
+void l2tp_session_set_header_len(struct l2tp_session *session, int version)
 {
        if (version == L2TP_HDR_VER_2) {
                session->hdr_len = 6;
@@ -1876,6 +1875,7 @@ static void l2tp_session_set_header_len(struct l2tp_session *session, int versio
        }
 }
+EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
 {
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 1f01ba3435bc..3f93ccd6ba97 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -263,6 +263,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                      int length, int (*payload_hook)(struct sk_buff *skb));
 int l2tp_session_queue_purge(struct l2tp_session *session);
 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb);
+void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb,
                  int hdr_len);
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 4cfd722e9153..bd7387adea9e 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -578,8 +578,10 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
        if (info->attrs[L2TP_ATTR_RECV_SEQ])
                session->recv_seq = nla_get_u8(info->attrs[L2TP_ATTR_RECV_SEQ]);
-        if (info->attrs[L2TP_ATTR_SEND_SEQ])
+        if (info->attrs[L2TP_ATTR_SEND_SEQ]) {
                session->send_seq = nla_get_u8(info->attrs[L2TP_ATTR_SEND_SEQ]);
+                l2tp_session_set_header_len(session, session->tunnel->version);
+        }
        if (info->attrs[L2TP_ATTR_LNS_MODE])
                session->lns_mode = nla_get_u8(info->attrs[L2TP_ATTR_LNS_MODE]);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index be5fadf34739..5990919356a5 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -254,12 +254,14 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
                po = pppox_sk(sk);
                ppp_input(&po->chan, skb);
        } else {
-                l2tp_info(session, PPPOL2TP_MSG_DATA, "%s: socket not bound\n",
+                l2tp_dbg(session, PPPOL2TP_MSG_DATA,
-                          session->name);
+                         "%s: recv %d byte data frame, passing to L2TP socket\n",
+                         session->name, data_len);
-                /* Not bound. Nothing we can do, so discard. */
+                if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_long_inc(&session->stats.rx_errors);
+                        atomic_long_inc(&session->stats.rx_errors);
-                kfree_skb(skb);
+                        kfree_skb(skb);
+                }
        }
        return;
@@ -1312,6 +1314,7 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                        po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
                                PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
                }
+                l2tp_session_set_header_len(session, session->tunnel->version);
                l2tp_info(session, PPPOL2TP_MSG_CONTROL,
                          "%s: set send_seq=%d\n",
                          session->name, session->send_seq);
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index f43613a97dd6..0c1ecfdf9a12 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -100,6 +100,12 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
                }
                max_bw = max(max_bw, width);
        }
+        /* use the configured bandwidth in case of monitor interface */
+        sdata = rcu_dereference(local->monitor_sdata);
+        if (sdata && rcu_access_pointer(sdata->vif.chanctx_conf) == conf)
+                max_bw = max(max_bw, conf->def.width);
        rcu_read_unlock();
        return max_bw;
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 2802f9d9279d..ad8b377b4b9f 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(struct sta_info *sta)
                                      sdata->vif.addr);
        nullfunc->frame_control = fc;
        nullfunc->duration_id = 0;
+        nullfunc->seq_ctrl = 0;
        /* no address resolution for this frame -> set addr 1 immediately */
        memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
        memset(skb_put(skb, 2), 0, 2); /* append QoS control field */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a023b432143b..137a192e64bc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1206,6 +1206,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
        memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
        memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
        memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
+        nullfunc->seq_ctrl = 0;
        skb->priority = tid;
        skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index e9a48baf8551..8601b320b443 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1174,7 +1174,7 @@ static void ovs_dp_reset_user_features(struct sk_buff *skb, struct genl_info *in
        struct datapath *dp;
        dp = lookup_datapath(sock_net(skb->sk), info->userhdr, info->attrs);
-        if (!dp)
+        if (IS_ERR(dp))
                return;
        WARN(dp->user_features, "Dropping previously announced user features\n");
@@ -1762,11 +1762,12 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
        int bucket = cb->args[0], skip = cb->args[1];
        int i, j = 0;
+        rcu_read_lock();
        dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
-        if (!dp)
+        if (!dp) {
+                rcu_read_unlock();
                return -ENODEV;
+        }
-        rcu_read_lock();
        for (i = bucket; i < DP_VPORT_HASH_BUCKETS; i++) {
                struct vport *vport;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 16f4b46161d4..dda451f4429c 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -73,6 +73,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, struct sk_buff *skb)
        if ((flow->key.eth.type == htons(ETH_P_IP) ||
             flow->key.eth.type == htons(ETH_P_IPV6)) &&
+            flow->key.ip.frag != OVS_FRAG_TYPE_LATER &&
            flow->key.ip.proto == IPPROTO_TCP &&
            likely(skb->len >= skb_transport_offset(skb) + sizeof(struct tcphdr))) {
                tcp_flags = TCP_FLAGS_BE16(tcp_hdr(skb));
@@ -91,7 +92,7 @@ static void stats_read(struct flow_stats *stats,
                       unsigned long *used, __be16 *tcp_flags)
 {
        spin_lock(&stats->lock);
-        if (time_after(stats->used, *used))
+        if (!*used || time_after(stats->used, *used))
                *used = stats->used;
        *tcp_flags |= stats->tcp_flags;
        ovs_stats->n_packets += stats->packet_count;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 1313145e3b86..a07d55e75698 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -273,11 +273,12 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 void qdisc_list_add(struct Qdisc *q)
 {
-        struct Qdisc *root = qdisc_dev(q)->qdisc;
+        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
+                struct Qdisc *root = qdisc_dev(q)->qdisc;
-        WARN_ON_ONCE(root == &noop_qdisc);
+                WARN_ON_ONCE(root == &noop_qdisc);
-        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS))
                list_add_tail(&q->list, &root->list);
+        }
 }
 EXPORT_SYMBOL(qdisc_list_add);
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 08ef7a42c0e4..21e251766eb1 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -601,6 +601,7 @@ static int fq_resize(struct Qdisc *sch, u32 log)
 {
        struct fq_sched_data *q = qdisc_priv(sch);
        struct rb_root *array;
+        void *old_fq_root;
        u32 idx;
        if (q->fq_root && log == q->fq_trees_log)
@@ -615,13 +616,19 @@ static int fq_resize(struct Qdisc *sch, u32 log)
        for (idx = 0; idx < (1U << log); idx++)
                array[idx] = RB_ROOT;
-        if (q->fq_root) {
+        sch_tree_lock(sch);
-                fq_rehash(q, q->fq_root, q->fq_trees_log, array, log);
-                fq_free(q->fq_root);
+        old_fq_root = q->fq_root;
-        }
+        if (old_fq_root)
+                fq_rehash(q, old_fq_root, q->fq_trees_log, array, log);
        q->fq_root = array;
        q->fq_trees_log = log;
+        sch_tree_unlock(sch);
+        fq_free(old_fq_root);
        return 0;
 }
@@ -697,9 +704,11 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                q->flow_refill_delay = usecs_to_jiffies(usecs_delay);
        }
-        if (!err)
+        if (!err) {
+                sch_tree_unlock(sch);
                err = fq_resize(sch, fq_log);
+                sch_tree_lock(sch);
+        }
        while (sch->q.qlen > sch->limit) {
                struct sk_buff *skb = fq_dequeue(sch);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 632090b961c3..3a1767ef3201 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1421,8 +1421,8 @@ static void sctp_chunk_destroy(struct sctp_chunk *chunk)
        BUG_ON(!list_empty(&chunk->list));
        list_del_init(&chunk->transmitted_list);
-        /* Free the chunk skb data and the SCTP_chunk stub itself. */
+        consume_skb(chunk->skb);
-        dev_kfree_skb(chunk->skb);
+        consume_skb(chunk->auth_chunk);
        SCTP_DBG_OBJCNT_DEC(chunk);
        kmem_cache_free(sctp_chunk_cachep, chunk);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index ae65b6b5973a..01e002430c85 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -760,7 +760,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                /* Make sure that we and the peer are AUTH capable */
                if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
-                        kfree_skb(chunk->auth_chunk);
                        sctp_association_free(new_asoc);
                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                }
@@ -775,10 +774,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                auth.transport = chunk->transport;
                ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
-                /* We can now safely free the auth_chunk clone */
-                kfree_skb(chunk->auth_chunk);
                if (ret != SCTP_IERROR_NO_ERROR) {
                        sctp_association_free(new_asoc);
                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
diff --git a/net/socket.c b/net/socket.c
index 879933aaed4c..a19ae1968d37 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -450,16 +450,17 @@ EXPORT_SYMBOL(sockfd_lookup);
 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
 {
-        struct file *file;
+        struct fd f = fdget(fd);
        struct socket *sock;
        *err = -EBADF;
-        file = fget_light(fd, fput_needed);
+        if (f.file) {
-        if (file) {
+                sock = sock_from_file(f.file, err);
-                sock = sock_from_file(file, err);
+                if (likely(sock)) {
-                if (sock)
+                        *fput_needed = f.flags;
                        return sock;
-                fput_light(file, *fput_needed);
+                }
+                fdput(f);
        }
        return NULL;
 }
@@ -1985,6 +1986,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
 {
        if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
                return -EFAULT;
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
        return 0;
diff --git a/net/tipc/config.c b/net/tipc/config.c
index e74eef2e7490..e6d721692ae0 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -376,7 +376,6 @@ static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
        struct tipc_cfg_msg_hdr *req_hdr;
        struct tipc_cfg_msg_hdr *rep_hdr;
        struct sk_buff *rep_buf;
-        int ret;
        /* Validate configuration message header (ignore invalid message) */
        req_hdr = (struct tipc_cfg_msg_hdr *)buf;
@@ -398,12 +397,8 @@ static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
                memcpy(rep_hdr, req_hdr, sizeof(*rep_hdr));
                rep_hdr->tcm_len = htonl(rep_buf->len);
                rep_hdr->tcm_flags &= htons(~TCM_F_REQUEST);
+                tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
-                ret = tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
+                                  rep_buf->len);
-                                        rep_buf->len);
-                if (ret < 0)
-                        pr_err("Sending cfg reply message failed, no memory\n");
                kfree_skb(rep_buf);
        }
 }
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index e4bc8a296744..1fabf160501f 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -58,7 +58,6 @@ unsigned int tipc_k_signal(Handler routine, unsigned long argument)
        spin_lock_bh(&qitem_lock);
        if (!handler_enabled) {
-                pr_err("Signal request ignored by handler\n");
                spin_unlock_bh(&qitem_lock);
                return -ENOPROTOOPT;
        }
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 48302be175ce..042e8e3cabc0 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -941,17 +941,48 @@ int tipc_nametbl_init(void)
        return 0;
 }
+/**
+ * tipc_purge_publications - remove all publications for a given type
+ *
+ * tipc_nametbl_lock must be held when calling this function
+ */
+static void tipc_purge_publications(struct name_seq *seq)
+{
+        struct publication *publ, *safe;
+        struct sub_seq *sseq;
+        struct name_info *info;
+        if (!seq->sseqs) {
+                nameseq_delete_empty(seq);
+                return;
+        }
+        sseq = seq->sseqs;
+        info = sseq->info;
+        list_for_each_entry_safe(publ, safe, &info->zone_list, zone_list) {
+                tipc_nametbl_remove_publ(publ->type, publ->lower, publ->node,
+                                         publ->ref, publ->key);
+        }
+}
 void tipc_nametbl_stop(void)
 {
        u32 i;
+        struct name_seq *seq;
+        struct hlist_head *seq_head;
+        struct hlist_node *safe;
-        /* Verify name table is empty, then release it */
+        /* Verify name table is empty and purge any lingering
+         * publications, then release the name table
+         */
        write_lock_bh(&tipc_nametbl_lock);
        for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
                if (hlist_empty(&table.types[i]))
                        continue;
-                pr_err("nametbl_stop(): orphaned hash chain detected\n");
+                seq_head = &table.types[i];
-                break;
+                hlist_for_each_entry_safe(seq, safe, seq_head, ns_list) {
+                        tipc_purge_publications(seq);
+                }
+                continue;
        }
        kfree(table.types);
        table.types = NULL;
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 373979789a73..646a930eefbf 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -87,7 +87,6 @@ static void tipc_clean_outqueues(struct tipc_conn *con);
 static void tipc_conn_kref_release(struct kref *kref)
 {
        struct tipc_conn *con = container_of(kref, struct tipc_conn, kref);
-        struct tipc_server *s = con->server;
        if (con->sock) {
                tipc_sock_release_local(con->sock);
@@ -95,10 +94,6 @@ static void tipc_conn_kref_release(struct kref *kref)
        }
        tipc_clean_outqueues(con);
-        if (con->conid)
-                s->tipc_conn_shutdown(con->conid, con->usr_data);
        kfree(con);
 }
@@ -181,6 +176,9 @@ static void tipc_close_conn(struct tipc_conn *con)
        struct tipc_server *s = con->server;
        if (test_and_clear_bit(CF_CONNECTED, &con->flags)) {
+                if (con->conid)
+                        s->tipc_conn_shutdown(con->conid, con->usr_data);
                spin_lock_bh(&s->idr_lock);
                idr_remove(&s->conn_idr, con->conid);
                s->idr_in_use--;
@@ -429,10 +427,12 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid,
        list_add_tail(&e->list, &con->outqueue);
        spin_unlock_bh(&con->outqueue_lock);
-        if (test_bit(CF_CONNECTED, &con->flags))
+        if (test_bit(CF_CONNECTED, &con->flags)) {
                if (!queue_work(s->send_wq, &con->swork))
                        conn_put(con);
+        } else {
+                conn_put(con);
+        }
        return 0;
 }
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index a4cf274455aa..0ed0eaa62f29 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -997,7 +997,7 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long timeo)
        for (;;) {
                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-                if (skb_queue_empty(&sk->sk_receive_queue)) {
+                if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                        if (sock->state == SS_DISCONNECTING) {
                                err = -ENOTCONN;
                                break;
@@ -1623,7 +1623,7 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
        for (;;) {
                prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                          TASK_INTERRUPTIBLE);
-                if (skb_queue_empty(&sk->sk_receive_queue)) {
+                if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                        release_sock(sk);
                        timeo = schedule_timeout(timeo);
                        lock_sock(sk);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 7cb0bd5b1176..642437231ad5 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -96,20 +96,16 @@ static void subscr_send_event(struct tipc_subscription *sub, u32 found_lower,
 {
        struct tipc_subscriber *subscriber = sub->subscriber;
        struct kvec msg_sect;
-        int ret;
        msg_sect.iov_base = (void *)&sub->evt;
        msg_sect.iov_len = sizeof(struct tipc_event);
        sub->evt.event = htohl(event, sub->swap);
        sub->evt.found_lower = htohl(found_lower, sub->swap);
        sub->evt.found_upper = htohl(found_upper, sub->swap);
        sub->evt.port.ref = htohl(port_ref, sub->swap);
        sub->evt.port.node = htohl(node, sub->swap);
-        ret = tipc_conn_sendmsg(&topsrv, subscriber->conid, NULL,
+        tipc_conn_sendmsg(&topsrv, subscriber->conid, NULL, msg_sect.iov_base,
-                                msg_sect.iov_base, msg_sect.iov_len);
+                          msg_sect.iov_len);
-        if (ret < 0)
-                pr_err("Sending subscription event failed, no memory\n");
 }
 /**
@@ -153,14 +149,6 @@ static void subscr_timeout(struct tipc_subscription *sub)
        /* The spin lock per subscriber is used to protect its members */
        spin_lock_bh(&subscriber->lock);
-        /* Validate if the connection related to the subscriber is
-         * closed (in case subscriber is terminating)
-         */
-        if (subscriber->conid == 0) {
-                spin_unlock_bh(&subscriber->lock);
-                return;
-        }
        /* Validate timeout (in case subscription is being cancelled) */
        if (sub->timeout == TIPC_WAIT_FOREVER) {
                spin_unlock_bh(&subscriber->lock);
@@ -215,9 +203,6 @@ static void subscr_release(struct tipc_subscriber *subscriber)
        spin_lock_bh(&subscriber->lock);
-        /* Invalidate subscriber reference */
-        subscriber->conid = 0;
        /* Destroy any existing subscriptions for subscriber */
        list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
                                 subscription_list) {
@@ -278,9 +263,9 @@ static void subscr_cancel(struct tipc_subscr *s,
 *
 * Called with subscriber lock held.
 */
-static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
+static int subscr_subscribe(struct tipc_subscr *s,
-                                             struct tipc_subscriber *subscriber)
+                            struct tipc_subscriber *subscriber,
-{
+                            struct tipc_subscription **sub_p) {
        struct tipc_subscription *sub;
        int swap;
@@ -291,23 +276,21 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
        if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
                s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
                subscr_cancel(s, subscriber);
-                return NULL;
+                return 0;
        }
        /* Refuse subscription if global limit exceeded */
        if (atomic_read(&subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
                pr_warn("Subscription rejected, limit reached (%u)\n",
                        TIPC_MAX_SUBSCRIPTIONS);
-                subscr_terminate(subscriber);
+                return -EINVAL;
-                return NULL;
        }
        /* Allocate subscription object */
        sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
        if (!sub) {
                pr_warn("Subscription rejected, no memory\n");
-                subscr_terminate(subscriber);
+                return -ENOMEM;
-                return NULL;
        }
        /* Initialize subscription object */
@@ -321,8 +304,7 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
            (sub->seq.lower > sub->seq.upper)) {
                pr_warn("Subscription rejected, illegal request\n");
                kfree(sub);
-                subscr_terminate(subscriber);
+                return -EINVAL;
-                return NULL;
        }
        INIT_LIST_HEAD(&sub->nameseq_list);
        list_add(&sub->subscription_list, &subscriber->subscription_list);
@@ -335,8 +317,8 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
                             (Handler)subscr_timeout, (unsigned long)sub);
                k_start_timer(&sub->timer, sub->timeout);
        }
+        *sub_p = sub;
-        return sub;
+        return 0;
 }
 /* Handle one termination request for the subscriber */
@@ -350,10 +332,14 @@ static void subscr_conn_msg_event(int conid, struct sockaddr_tipc *addr,
                                  void *usr_data, void *buf, size_t len)
 {
        struct tipc_subscriber *subscriber = usr_data;
-        struct tipc_subscription *sub;
+        struct tipc_subscription *sub = NULL;
        spin_lock_bh(&subscriber->lock);
-        sub = subscr_subscribe((struct tipc_subscr *)buf, subscriber);
+        if (subscr_subscribe((struct tipc_subscr *)buf, subscriber, &sub) < 0) {
+                spin_unlock_bh(&subscriber->lock);
+                subscr_terminate(subscriber);
+                return;
+        }
        if (sub)
                tipc_nametbl_subscribe(sub);
        spin_unlock_bh(&subscriber->lock);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 29fc8bee9702..ce6ec6c2f4de 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -163,9 +163,8 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
 static inline unsigned int unix_hash_fold(__wsum n)
 {
-        unsigned int hash = (__force unsigned int)n;
+        unsigned int hash = (__force unsigned int)csum_fold(n);
-        hash ^= hash>>16;
        hash ^= hash>>8;
        return hash&(UNIX_HASH_SIZE-1);
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 010892b81a06..a3bf18d11609 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -788,8 +788,6 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
        default:
                break;
        }
-        wdev->beacon_interval = 0;
 }
 static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c274179d60a2..2f7ddc3a59b4 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1221,7 +1221,7 @@ static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs
                return 0;
        uctx = nla_data(rt);
-        return security_xfrm_policy_alloc(&pol->security, uctx);
+        return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL);
 }
 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
@@ -1626,7 +1626,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                if (rt) {
                        struct xfrm_user_sec_ctx *uctx = nla_data(rt);
-                        err = security_xfrm_policy_alloc(&ctx, uctx);
+                        err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
                        if (err)
                                return err;
                }
@@ -1928,7 +1928,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                if (rt) {
                        struct xfrm_user_sec_ctx *uctx = nla_data(rt);
-                        err = security_xfrm_policy_alloc(&ctx, uctx);
+                        err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
                        if (err)
                                return err;
                }
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 276e84b8a8e5..10085de886fe 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -330,7 +330,8 @@ static void write_src(void)
                                printf("\tPTR\t_text + %#llx\n",
                                        table[i].addr - _text);
                        else
-                                printf("\tPTR\t%#llx\n", table[i].addr);
+                                printf("\tPTR\t_text - %#llx\n",
+                                        _text - table[i].addr);
                } else {
                        printf("\tPTR\t%#llx\n", table[i].addr);
                }
diff --git a/security/capability.c b/security/capability.c
index 8b4f24ae4338..21e2b9cae685 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -757,7 +757,8 @@ static void cap_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 static int cap_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp,
-                                          struct xfrm_user_sec_ctx *sec_ctx)
+                                          struct xfrm_user_sec_ctx *sec_ctx,
+                                          gfp_t gfp)
 {
        return 0;
 }
diff --git a/security/security.c b/security/security.c
index 15b6928592ef..919cad93ac82 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1317,9 +1317,11 @@ void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
-int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
+int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                               struct xfrm_user_sec_ctx *sec_ctx,
+                               gfp_t gfp)
 {
-        return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx);
+        return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx, gfp);
 }
 EXPORT_SYMBOL(security_xfrm_policy_alloc);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4b34847208cc..b332e2cc0954 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -668,7 +668,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                if (flags[i] == SBLABEL_MNT)
                        continue;
                rc = security_context_to_sid(mount_options[i],
-                                             strlen(mount_options[i]), &sid);
+                                             strlen(mount_options[i]), &sid, GFP_KERNEL);
                if (rc) {
                        printk(KERN_WARNING "SELinux: security_context_to_sid"
                               "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2489,7 +2489,8 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
                if (flags[i] == SBLABEL_MNT)
                        continue;
                len = strlen(mount_options[i]);
-                rc = security_context_to_sid(mount_options[i], len, &sid);
+                rc = security_context_to_sid(mount_options[i], len, &sid,
+                                             GFP_KERNEL);
                if (rc) {
                        printk(KERN_WARNING "SELinux: security_context_to_sid"
                               "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2893,7 +2894,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
        if (rc)
                return rc;
-        rc = security_context_to_sid(value, size, &newsid);
+        rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
        if (rc == -EINVAL) {
                if (!capable(CAP_MAC_ADMIN)) {
                        struct audit_buffer *ab;
@@ -3050,7 +3051,7 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
        if (!value || !size)
                return -EACCES;
-        rc = security_context_to_sid((void *)value, size, &newsid);
+        rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
        if (rc)
                return rc;
@@ -5529,7 +5530,7 @@ static int selinux_setprocattr(struct task_struct *p,
                        str[size-1] = 0;
                        size--;
                }
-                error = security_context_to_sid(value, size, &sid);
+                error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
                if (error == -EINVAL && !strcmp(name, "fscreate")) {
                        if (!capable(CAP_MAC_ADMIN)) {
                                struct audit_buffer *ab;
@@ -5638,7 +5639,7 @@ static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 {
-        return security_context_to_sid(secdata, seclen, secid);
+        return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
 }
 static void selinux_release_secctx(char *secdata, u32 seclen)
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 8ed8daf7f1ee..ce7852cf526b 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -134,7 +134,7 @@ int security_sid_to_context(u32 sid, char **scontext,
 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len);
 int security_context_to_sid(const char *scontext, u32 scontext_len,
-        u32 *out_sid);
+                            u32 *out_sid, gfp_t gfp);
 int security_context_to_sid_default(const char *scontext, u32 scontext_len,
                                    u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 48c3cc94c168..9f0584710c85 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -10,7 +10,8 @@
 #include <net/flow.h>
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
-                              struct xfrm_user_sec_ctx *uctx);
+                              struct xfrm_user_sec_ctx *uctx,
+                              gfp_t gfp);
 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
                              struct xfrm_sec_ctx **new_ctxp);
 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 5122affe06a8..d60c0ee66387 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -576,7 +576,7 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
        if (length)
                goto out;
-        length = security_context_to_sid(buf, size, &sid);
+        length = security_context_to_sid(buf, size, &sid, GFP_KERNEL);
        if (length)
                goto out;
@@ -731,11 +731,13 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                goto out;
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
@@ -817,11 +819,13 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
                objname = namebuf;
        }
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
@@ -878,11 +882,13 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                goto out;
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
@@ -934,7 +940,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s", con, user) != 2)
                goto out;
-        length = security_context_to_sid(con, strlen(con) + 1, &sid);
+        length = security_context_to_sid(con, strlen(con) + 1, &sid, GFP_KERNEL);
        if (length)
                goto out;
@@ -994,11 +1000,13 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                goto out;
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 5d0144ee8ed6..4bca49414a40 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1289,16 +1289,18 @@ out:
 * @scontext: security context
 * @scontext_len: length in bytes
 * @sid: security identifier, SID
+ * @gfp: context for the allocation
 *
 * Obtains a SID associated with the security context that
 * has the string representation specified by @scontext.
 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
 * memory is available, or 0 on success.
 */
-int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid)
+int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,
+                            gfp_t gfp)
 {
        return security_context_to_sid_core(scontext, scontext_len,
-                                            sid, SECSID_NULL, GFP_KERNEL, 0);
+                                            sid, SECSID_NULL, gfp, 0);
 }
 /**
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 0462cb3ff0a7..98b042630a9e 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -78,7 +78,8 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
 * xfrm_user_sec_ctx context.
 */
 static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
-                                   struct xfrm_user_sec_ctx *uctx)
+                                   struct xfrm_user_sec_ctx *uctx,
+                                   gfp_t gfp)
 {
        int rc;
        const struct task_security_struct *tsec = current_security();
@@ -94,7 +95,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
        if (str_len >= PAGE_SIZE)
                return -ENOMEM;
-        ctx = kmalloc(sizeof(*ctx) + str_len + 1, GFP_KERNEL);
+        ctx = kmalloc(sizeof(*ctx) + str_len + 1, gfp);
        if (!ctx)
                return -ENOMEM;
@@ -103,7 +104,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
        ctx->ctx_len = str_len;
        memcpy(ctx->ctx_str, &uctx[1], str_len);
        ctx->ctx_str[str_len] = '\0';
-        rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid);
+        rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid, gfp);
        if (rc)
                goto err;
@@ -282,9 +283,10 @@ int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
 * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
 */
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
-                              struct xfrm_user_sec_ctx *uctx)
+                              struct xfrm_user_sec_ctx *uctx,
+                              gfp_t gfp)
 {
-        return selinux_xfrm_alloc_user(ctxp, uctx);
+        return selinux_xfrm_alloc_user(ctxp, uctx, gfp);
 }
 /*
@@ -332,7 +334,7 @@ int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 int selinux_xfrm_state_alloc(struct xfrm_state *x,
                             struct xfrm_user_sec_ctx *uctx)
 {
-        return selinux_xfrm_alloc_user(&x->security, uctx);
+        return selinux_xfrm_alloc_user(&x->security, uctx, GFP_KERNEL);
 }
 /*
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 7a20897d33db..7403f348ed14 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -133,7 +133,7 @@ static int snd_compr_open(struct inode *inode, struct file *f)
                kfree(data);
        }
        snd_card_unref(compr->card);
-        return 0;
+        return ret;
 }
 static int snd_compr_free(struct inode *inode, struct file *f)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 850296a1e0ff..8d0a84436674 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3616,6 +3616,19 @@ static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec,
        }
 }
+static void alc_no_shutup(struct hda_codec *codec)
+{
+}
+static void alc_fixup_no_shutup(struct hda_codec *codec,
+                                const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                struct alc_spec *spec = codec->spec;
+                spec->shutup = alc_no_shutup;
+        }
+}
 static void alc_fixup_headset_mode_alc668(struct hda_codec *codec,
                                const struct hda_fixup *fix, int action)
 {
@@ -3844,6 +3857,7 @@ enum {
        ALC269_FIXUP_HP_GPIO_LED,
        ALC269_FIXUP_INV_DMIC,
        ALC269_FIXUP_LENOVO_DOCK,
+        ALC269_FIXUP_NO_SHUTUP,
        ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
        ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
        ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -4020,6 +4034,10 @@ static const struct hda_fixup alc269_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc_fixup_inv_dmic_0x12,
        },
+        [ALC269_FIXUP_NO_SHUTUP] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_no_shutup,
+        },
        [ALC269_FIXUP_LENOVO_DOCK] = {
                .type = HDA_FIXUP_PINS,
                .v.pins = (const struct hda_pintbl[]) {
@@ -4405,6 +4423,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
        SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
        SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index ed6f199f8a38..4cf3200e988b 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -238,11 +238,21 @@ void set_cs4245_adc_params(struct oxygen *chip,
        cs4245_write_spi(chip, CS4245_MCLK_FREQ);
 }
+static inline unsigned int shift_bits(unsigned int value,
+                                      unsigned int shift_from,
+                                      unsigned int shift_to,
+                                      unsigned int mask)
+{
+        if (shift_from < shift_to)
+                return (value << (shift_to - shift_from)) & mask;
+        else
+                return (value >> (shift_from - shift_to)) & mask;
+}
 unsigned int adjust_dg_dac_routing(struct oxygen *chip,
                                          unsigned int play_routing)
 {
        struct dg *data = chip->model_data;
-        unsigned int routing = 0;
        switch (data->output_sel) {
        case PLAYBACK_DST_HP:
@@ -252,15 +262,23 @@ unsigned int adjust_dg_dac_routing(struct oxygen *chip,
                        OXYGEN_PLAY_MUTE67, OXYGEN_PLAY_MUTE_MASK);
                break;
        case PLAYBACK_DST_MULTICH:
-                routing = (0 << OXYGEN_PLAY_DAC0_SOURCE_SHIFT) |
-                          (2 << OXYGEN_PLAY_DAC1_SOURCE_SHIFT) |
-                          (1 << OXYGEN_PLAY_DAC2_SOURCE_SHIFT) |
-                          (0 << OXYGEN_PLAY_DAC3_SOURCE_SHIFT);
                oxygen_write8_masked(chip, OXYGEN_PLAY_ROUTING,
                        OXYGEN_PLAY_MUTE01, OXYGEN_PLAY_MUTE_MASK);
                break;
        }
-        return routing;
+        return (play_routing & OXYGEN_PLAY_DAC0_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC0_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_MASK);
 }
 void dump_cs4245_registers(struct oxygen *chip,
diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
index 187062061152..6c0da2baa154 100644
--- a/sound/soc/codecs/cs42l51.c
+++ b/sound/soc/codecs/cs42l51.c
@@ -106,9 +106,8 @@ static int cs42l51_set_chan_mix(struct snd_kcontrol *kcontrol,
 static const DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -5150, 50, 0);
 static const DECLARE_TLV_DB_SCALE(tone_tlv, -1050, 150, 0);
-/* This is a lie. after -102 db, it stays at -102 */
-/* maybe a range would be better */
+static const DECLARE_TLV_DB_SCALE(aout_tlv, -10200, 50, 0);
-static const DECLARE_TLV_DB_SCALE(aout_tlv, -11550, 50, 0);
 static const DECLARE_TLV_DB_SCALE(boost_tlv, 1600, 1600, 0);
 static const char *chan_mix[] = {
@@ -122,7 +121,7 @@ static SOC_ENUM_SINGLE_EXT_DECL(cs42l51_chan_mix, chan_mix);
 static const struct snd_kcontrol_new cs42l51_snd_controls[] = {
        SOC_DOUBLE_R_SX_TLV("PCM Playback Volume",
                        CS42L51_PCMA_VOL, CS42L51_PCMB_VOL,
-                        6, 0x19, 0x7F, adc_pcm_tlv),
+                        0, 0x19, 0x7F, adc_pcm_tlv),
        SOC_DOUBLE_R("PCM Playback Switch",
                        CS42L51_PCMA_VOL, CS42L51_PCMB_VOL, 7, 1, 1),
        SOC_DOUBLE_R_SX_TLV("Analog Playback Volume",
@@ -130,7 +129,7 @@ static const struct snd_kcontrol_new cs42l51_snd_controls[] = {
                        0, 0x34, 0xE4, aout_tlv),
        SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume",
                        CS42L51_ADCA_VOL, CS42L51_ADCB_VOL,
-                        6, 0x19, 0x7F, adc_pcm_tlv),
+                        0, 0x19, 0x7F, adc_pcm_tlv),
        SOC_DOUBLE_R("ADC Mixer Switch",
                        CS42L51_ADCA_VOL, CS42L51_ADCB_VOL, 7, 1, 1),
        SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0),
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index ff454000ef7d..f0ca6bee6771 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -341,7 +341,7 @@ static const char * const right_swap_text[] = {
 static const unsigned int swap_values[] = { 0, 1, 3 };
 static const struct soc_enum adca_swap_enum =
-        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 1,
+        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 3,
                              ARRAY_SIZE(left_swap_text),
                              left_swap_text,
                              swap_values);
@@ -350,7 +350,7 @@ static const struct snd_kcontrol_new adca_mixer =
        SOC_DAPM_ENUM("Route", adca_swap_enum);
 static const struct soc_enum pcma_swap_enum =
-        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 1,
+        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 3,
                              ARRAY_SIZE(left_swap_text),
                              left_swap_text,
                              swap_values);
@@ -359,7 +359,7 @@ static const struct snd_kcontrol_new pcma_mixer =
        SOC_DAPM_ENUM("Route", pcma_swap_enum);
 static const struct soc_enum adcb_swap_enum =
-        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 1,
+        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 3,
                              ARRAY_SIZE(right_swap_text),
                              right_swap_text,
                              swap_values);
@@ -368,7 +368,7 @@ static const struct snd_kcontrol_new adcb_mixer =
        SOC_DAPM_ENUM("Route", adcb_swap_enum);
 static const struct soc_enum pcmb_swap_enum =
-        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 1,
+        SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 3,
                              ARRAY_SIZE(right_swap_text),
                              right_swap_text,
                              swap_values);
diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c
index b2906c60254e..0ee60a19a263 100644
--- a/sound/soc/codecs/cs42l73.c
+++ b/sound/soc/codecs/cs42l73.c
@@ -319,7 +319,7 @@ static const char * const cs42l73_mono_mix_texts[] = {
 static const unsigned int cs42l73_mono_mix_values[] = { 0, 1, 2 };
 static const struct soc_enum spk_asp_enum =
-        SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 1,
+        SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 3,
                              ARRAY_SIZE(cs42l73_mono_mix_texts),
                              cs42l73_mono_mix_texts,
                              cs42l73_mono_mix_values);
@@ -337,7 +337,7 @@ static const struct snd_kcontrol_new spk_xsp_mixer =
        SOC_DAPM_ENUM("Route", spk_xsp_enum);
 static const struct soc_enum esl_asp_enum =
-        SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 5,
+        SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 3,
                              ARRAY_SIZE(cs42l73_mono_mix_texts),
                              cs42l73_mono_mix_texts,
                              cs42l73_mono_mix_values);
@@ -346,7 +346,7 @@ static const struct snd_kcontrol_new esl_asp_mixer =
        SOC_DAPM_ENUM("Route", esl_asp_enum);
 static const struct soc_enum esl_xsp_enum =
-        SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 7,
+        SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 3,
                              ARRAY_SIZE(cs42l73_mono_mix_texts),
                              cs42l73_mono_mix_texts,
                              cs42l73_mono_mix_values);
diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
index 1967f44e7cd4..710a079a7377 100644
--- a/sound/soc/sh/fsi.c
+++ b/sound/soc/sh/fsi.c
@@ -1711,9 +1711,9 @@ static int fsi_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
        /* set master/slave audio interface */
        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
        case SND_SOC_DAIFMT_CBM_CFM:
-                fsi->clk_master = 1;
                break;
        case SND_SOC_DAIFMT_CBS_CFS:
+                fsi->clk_master = 1; /* codec is slave, cpu is master */
                break;
        default:
                return -EINVAL;
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 6a1b45df8101..d836e8a9fdce 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -510,10 +510,10 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
        /* set master/slave audio interface */
        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
        case SND_SOC_DAIFMT_CBM_CFM:
-                rdai->clk_master = 1;
+                rdai->clk_master = 0;
                break;
        case SND_SOC_DAIFMT_CBS_CFS:
-                rdai->clk_master = 0;
+                rdai->clk_master = 1; /* codec is slave, cpu is master */
                break;
        default:
                return -EINVAL;
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 330eaf007d89..2cedf09f6d96 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -2050,7 +2050,6 @@ int soc_dpcm_runtime_update(struct snd_soc_card *card)
                paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list);
                if (paths < 0) {
-                        dpcm_path_put(&list);
                        dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                        fe->dai_link->name,  "playback");
                        mutex_unlock(&card->mutex);
@@ -2080,7 +2079,6 @@ capture:
                paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list);
                if (paths < 0) {
-                        dpcm_path_put(&list);
                        dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                        fe->dai_link->name,  "capture");
                        mutex_unlock(&card->mutex);
@@ -2145,7 +2143,6 @@ static int dpcm_fe_dai_open(struct snd_pcm_substream *fe_substream)
        fe->dpcm[stream].runtime = fe_substream->runtime;
        if (dpcm_path_get(fe, stream, &list) <= 0) {
-                dpcm_path_put(&list);
                dev_dbg(fe->dev, "ASoC: %s no valid %s route\n",
                        fe->dai_link->name, stream ? "capture" : "playback");
        }
diff --git a/sound/soc/tegra/tegra20_ac97.c b/sound/soc/tegra/tegra20_ac97.c
index cf5e1cfe818d..0a59e2383ef3 100644
--- a/sound/soc/tegra/tegra20_ac97.c
+++ b/sound/soc/tegra/tegra20_ac97.c
@@ -306,7 +306,7 @@ static const struct regmap_config tegra20_ac97_regmap_config = {
        .readable_reg = tegra20_ac97_wr_rd_reg,
        .volatile_reg = tegra20_ac97_volatile_reg,
        .precious_reg = tegra20_ac97_precious_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 static int tegra20_ac97_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/tegra/tegra20_das.c b/sound/soc/tegra/tegra20_das.c
index e72392927bd2..a634f13b3ffc 100644
--- a/sound/soc/tegra/tegra20_das.c
+++ b/sound/soc/tegra/tegra20_das.c
@@ -128,7 +128,7 @@ static const struct regmap_config tegra20_das_regmap_config = {
        .max_register = LAST_REG(DAC_INPUT_DATA_CLK_SEL),
        .writeable_reg = tegra20_das_wr_rd_reg,
        .readable_reg = tegra20_das_wr_rd_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 static int tegra20_das_probe(struct platform_device *pdev)
diff --git a/sound/soc/tegra/tegra20_i2s.c b/sound/soc/tegra/tegra20_i2s.c
index 42c1f6bfaf2e..79a9932ffe6e 100644
--- a/sound/soc/tegra/tegra20_i2s.c
+++ b/sound/soc/tegra/tegra20_i2s.c
@@ -333,7 +333,7 @@ static const struct regmap_config tegra20_i2s_regmap_config = {
        .readable_reg = tegra20_i2s_wr_rd_reg,
        .volatile_reg = tegra20_i2s_volatile_reg,
        .precious_reg = tegra20_i2s_precious_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 static int tegra20_i2s_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/tegra/tegra20_spdif.c b/sound/soc/tegra/tegra20_spdif.c
index 8c7c1028e579..a0ce92400faf 100644
--- a/sound/soc/tegra/tegra20_spdif.c
+++ b/sound/soc/tegra/tegra20_spdif.c
@@ -259,7 +259,7 @@ static const struct regmap_config tegra20_spdif_regmap_config = {
        .readable_reg = tegra20_spdif_wr_rd_reg,
        .volatile_reg = tegra20_spdif_volatile_reg,
        .precious_reg = tegra20_spdif_precious_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 static int tegra20_spdif_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index d6f4c9940e0c..0db68f49f4d9 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -471,7 +471,7 @@ static const struct regmap_config tegra30_ahub_apbif_regmap_config = {
        .readable_reg = tegra30_ahub_apbif_wr_rd_reg,
        .volatile_reg = tegra30_ahub_apbif_volatile_reg,
        .precious_reg = tegra30_ahub_apbif_precious_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 static bool tegra30_ahub_ahub_wr_rd_reg(struct device *dev, unsigned int reg)
@@ -490,7 +490,7 @@ static const struct regmap_config tegra30_ahub_ahub_regmap_config = {
        .max_register = LAST_REG(AUDIO_RX),
        .writeable_reg = tegra30_ahub_ahub_wr_rd_reg,
        .readable_reg = tegra30_ahub_ahub_wr_rd_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 static struct tegra30_ahub_soc_data soc_data_tegra30 = {
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index 49ad9366add8..f146c41dd3ec 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -357,7 +357,7 @@ static const struct regmap_config tegra30_i2s_regmap_config = {
        .writeable_reg = tegra30_i2s_wr_rd_reg,
        .readable_reg = tegra30_i2s_wr_rd_reg,
        .volatile_reg = tegra30_i2s_volatile_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 static const struct tegra30_i2s_soc_data tegra30_i2s_config = {
diff --git a/tools/net/Makefile b/tools/net/Makefile
index 004cd74734b6..ee577ea03ba5 100644
--- a/tools/net/Makefile
+++ b/tools/net/Makefile
@@ -12,7 +12,7 @@ YACC = bison
 all : bpf_jit_disasm bpf_dbg bpf_asm
-bpf_jit_disasm : CFLAGS = -Wall -O2
+bpf_jit_disasm : CFLAGS = -Wall -O2 -DPACKAGE='bpf_jit_disasm'
 bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl
 bpf_jit_disasm : bpf_jit_disasm.o
diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index d4c83c60b9b2..97d86d828190 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -1593,6 +1593,7 @@ static void init_params(struct params *p, const char *name, int argc, const char
        p->data_rand_walk               = true;
        p->nr_loops                     = -1;
        p->init_random                  = true;
+        p->run_all                      = argc == 1;
 }
 static int run_bench_numa(const char *name, const char **argv)
diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c
index e47f90cc7b98..8a987d252780 100644
--- a/tools/perf/builtin-bench.c
+++ b/tools/perf/builtin-bench.c
@@ -76,7 +76,7 @@ static struct collection collections[] = {
 /* Iterate over all benchmarks within a collection: */
 #define for_each_bench(coll, bench) \
-        for (bench = coll->benchmarks; bench->name; bench++)
+        for (bench = coll->benchmarks; bench && bench->name; bench++)
 static void dump_benchmarks(struct collection *coll)
 {
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 6aa6fb6f7bd9..f954c26de231 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -825,7 +825,6 @@ static size_t syscall_arg__scnprintf_signum(char *bf, size_t size, struct syscal
        P_SIGNUM(PIPE);
        P_SIGNUM(ALRM);
        P_SIGNUM(TERM);
-        P_SIGNUM(STKFLT);
        P_SIGNUM(CHLD);
        P_SIGNUM(CONT);
        P_SIGNUM(STOP);
@@ -841,6 +840,15 @@ static size_t syscall_arg__scnprintf_signum(char *bf, size_t size, struct syscal
        P_SIGNUM(IO);
        P_SIGNUM(PWR);
        P_SIGNUM(SYS);
+#ifdef SIGEMT
+        P_SIGNUM(EMT);
+#endif
+#ifdef SIGSTKFLT
+        P_SIGNUM(STKFLT);
+#endif
+#ifdef SIGSWI
+        P_SIGNUM(SWI);
+#endif
        default: break;
        }
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index c872991e0f65..620a1983b76b 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1213,7 +1213,7 @@ static void ip__resolve_ams(struct machine *machine, struct thread *thread,
                 */
                thread__find_addr_location(thread, machine, m, MAP__FUNCTION,
                                ip, &al);
-                if (al.sym)
+                if (al.map)
                        goto found;
        }
 found:
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 3e9f336740fa..516d19fb999b 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -151,15 +151,15 @@ Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
                gelf_getshdr(sec, shp);
                str = elf_strptr(elf, ep->e_shstrndx, shp->sh_name);
-                if (!strcmp(name, str)) {
+                if (str && !strcmp(name, str)) {
                        if (idx)
                                *idx = cnt;
-                        break;
+                        return sec;
                }
                ++cnt;
        }
-        return sec;
+        return NULL;
 }
 #define elf_section__for_each_rel(reldata, pos, pos_mem, idx, nr_entries) \
diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index d66418237d21..aa290c0de6f5 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -201,6 +201,7 @@ int main(int argc, char **argv)
        msgque.msq_id = msgget(msgque.key, IPC_CREAT | IPC_EXCL | 0666);
        if (msgque.msq_id == -1) {
+                err = -errno;
                printf("Can't create queue\n");
                goto err_out;
        }