Merge remote-tracking branch 'origin/master' into next

Merge upstream to get the audit fixes

191 files changed, 2102 insertions, 1477 deletions

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 4609e81dbc37..8ccbf27aead4 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -596,9 +596,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         is selected automatically. Check
                         Documentation/kdump/kdump.txt for further details.
 
-        crashkernel_low=size[KMG]
-                        [KNL, x86] parts under 4G.
-
         crashkernel=range1:size1[,range2:size2,...][@offset]
                         [KNL] Same as above, but depends on the memory
                         in the running system. The syntax of range is
@@ -606,6 +603,26 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         a memory unit (amount[KMG]). See also
                         Documentation/kdump/kdump.txt for an example.
 
+        crashkernel=size[KMG],high
+                        [KNL, x86_64] range could be above 4G. Allow kernel
+                        to allocate physical memory region from top, so could
+                        be above 4G if system have more than 4G ram installed.
+                        Otherwise memory region will be allocated below 4G, if
+                        available.
+                        It will be ignored if crashkernel=X is specified.
+        crashkernel=size[KMG],low
+                        [KNL, x86_64] range under 4G. When crashkernel=X,high
+                        is passed, kernel could allocate physical memory region
+                        above 4G, that cause second kernel crash on system
+                        that require some amount of low memory, e.g. swiotlb
+                        requires at least 64M+32K low memory.  Kernel would
+                        try to allocate 72M below 4G automatically.
+                        This one let user to specify own low range under 4G
+                        for second kernel instead.
+                        0: to disable low allocation.
+                        It will be ignored when crashkernel=X,high is not used
+                        or memory reserved is below 4G.
+
         cs89x0_dma=     [HW,NET]
                         Format: <dma>
 
@@ -788,6 +805,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         edd=            [EDD]
                         Format: {"off" | "on" | "skip[mbr]"}
 
+        efi_no_storage_paranoia [EFI; X86]
+                        Using this parameter you can use more than 50% of
+                        your efi variable storage. Use this parameter only if
+                        you are really sure that your UEFI does sane gc and
+                        fulfills the spec otherwise your board may brick.
+
         eisa_irq_edge=  [PARISC,HW]
                         See header of drivers/parisc/eisa.c.
 
diff --git a/Makefile b/Makefile
index 9cf6783c2ec3..46263d808876 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 9
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc8
 NAME = Unicycling Gorilla
 
 # *DOCUMENTATION*
@@ -513,7 +513,8 @@ ifeq ($(KBUILD_EXTMOD),)
 # Carefully list dependencies so we do not try to build scripts twice
 # in parallel
 PHONY += scripts
-scripts: scripts_basic include/config/auto.conf include/config/tristate.conf
+scripts: scripts_basic include/config/auto.conf include/config/tristate.conf \
+         asm-generic
         $(Q)$(MAKE) $(build)=$(@)
 
 # Objects we will link into vmlinux / subdirs we need to visit
diff --git a/arch/arm/include/asm/glue-cache.h b/arch/arm/include/asm/glue-cache.h
index cca9f15704ed..ea289e1435e7 100644
--- a/arch/arm/include/asm/glue-cache.h
+++ b/arch/arm/include/asm/glue-cache.h
@@ -19,14 +19,6 @@
 #undef _CACHE
 #undef MULTI_CACHE
 
-#if defined(CONFIG_CPU_CACHE_V3)
-# ifdef _CACHE
-#  define MULTI_CACHE 1
-# else
-#  define _CACHE v3
-# endif
-#endif
-
 #if defined(CONFIG_CPU_CACHE_V4)
 # ifdef _CACHE
 #  define MULTI_CACHE 1
diff --git a/arch/arm/include/asm/hardware/iop3xx.h b/arch/arm/include/asm/hardware/iop3xx.h
index 02fe2fbe2477..ed94b1a366ae 100644
--- a/arch/arm/include/asm/hardware/iop3xx.h
+++ b/arch/arm/include/asm/hardware/iop3xx.h
@@ -37,7 +37,7 @@ extern int iop3xx_get_init_atu(void);
  * IOP3XX processor registers
  */
 #define IOP3XX_PERIPHERAL_PHYS_BASE     0xffffe000
-#define IOP3XX_PERIPHERAL_VIRT_BASE     0xfeffe000
+#define IOP3XX_PERIPHERAL_VIRT_BASE     0xfedfe000
 #define IOP3XX_PERIPHERAL_SIZE          0x00002000
 #define IOP3XX_PERIPHERAL_UPPER_PA (IOP3XX_PERIPHERAL_PHYS_BASE +\
                                         IOP3XX_PERIPHERAL_SIZE - 1)
diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
index 6ef8afd1b64c..86b8fe398b95 100644
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -111,7 +111,7 @@
 #define L_PTE_S2_MT_WRITETHROUGH (_AT(pteval_t, 0xa) << 2) /* MemAttr[3:0] */
 #define L_PTE_S2_MT_WRITEBACK    (_AT(pteval_t, 0xf) << 2) /* MemAttr[3:0] */
 #define L_PTE_S2_RDONLY          (_AT(pteval_t, 1) << 6)   /* HAP[1]   */
-#define L_PTE_S2_RDWR            (_AT(pteval_t, 2) << 6)   /* HAP[2:1] */
+#define L_PTE_S2_RDWR            (_AT(pteval_t, 3) << 6)   /* HAP[2:1] */
 
 /*
  * Hyp-mode PL2 PTE definitions for LPAE.
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index 9e9c041358ca..ab865e65a84c 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -14,7 +14,6 @@
 
 #include <asm/glue.h>
 
-#define TLB_V3_PAGE     (1 << 0)
 #define TLB_V4_U_PAGE   (1 << 1)
 #define TLB_V4_D_PAGE   (1 << 2)
 #define TLB_V4_I_PAGE   (1 << 3)
@@ -22,7 +21,6 @@
 #define TLB_V6_D_PAGE   (1 << 5)
 #define TLB_V6_I_PAGE   (1 << 6)
 
-#define TLB_V3_FULL     (1 << 8)
 #define TLB_V4_U_FULL   (1 << 9)
 #define TLB_V4_D_FULL   (1 << 10)
 #define TLB_V4_I_FULL   (1 << 11)
@@ -52,7 +50,6 @@
  *      =============
  *
  *      We have the following to choose from:
- *        v3    - ARMv3
  *        v4    - ARMv4 without write buffer
  *        v4wb  - ARMv4 with write buffer without I TLB flush entry instruction
  *        v4wbi - ARMv4 with write buffer with I TLB flush entry instruction
@@ -330,7 +327,6 @@ static inline void local_flush_tlb_all(void)
         if (tlb_flag(TLB_WB))
                 dsb();
 
-        tlb_op(TLB_V3_FULL, "c6, c0, 0", zero);
         tlb_op(TLB_V4_U_FULL | TLB_V6_U_FULL, "c8, c7, 0", zero);
         tlb_op(TLB_V4_D_FULL | TLB_V6_D_FULL, "c8, c6, 0", zero);
         tlb_op(TLB_V4_I_FULL | TLB_V6_I_FULL, "c8, c5, 0", zero);
@@ -351,9 +347,8 @@ static inline void local_flush_tlb_mm(struct mm_struct *mm)
         if (tlb_flag(TLB_WB))
                 dsb();
 
-        if (possible_tlb_flags & (TLB_V3_FULL|TLB_V4_U_FULL|TLB_V4_D_FULL|TLB_V4_I_FULL)) {
+        if (possible_tlb_flags & (TLB_V4_U_FULL|TLB_V4_D_FULL|TLB_V4_I_FULL)) {
                 if (cpumask_test_cpu(get_cpu(), mm_cpumask(mm))) {
-                        tlb_op(TLB_V3_FULL, "c6, c0, 0", zero);
                         tlb_op(TLB_V4_U_FULL, "c8, c7, 0", zero);
                         tlb_op(TLB_V4_D_FULL, "c8, c6, 0", zero);
                         tlb_op(TLB_V4_I_FULL, "c8, c5, 0", zero);
@@ -385,9 +380,8 @@ local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
         if (tlb_flag(TLB_WB))
                 dsb();
 
-        if (possible_tlb_flags & (TLB_V3_PAGE|TLB_V4_U_PAGE|TLB_V4_D_PAGE|TLB_V4_I_PAGE|TLB_V4_I_FULL) &&
+        if (possible_tlb_flags & (TLB_V4_U_PAGE|TLB_V4_D_PAGE|TLB_V4_I_PAGE|TLB_V4_I_FULL) &&
             cpumask_test_cpu(smp_processor_id(), mm_cpumask(vma->vm_mm))) {
-                tlb_op(TLB_V3_PAGE, "c6, c0, 0", uaddr);
                 tlb_op(TLB_V4_U_PAGE, "c8, c7, 1", uaddr);
                 tlb_op(TLB_V4_D_PAGE, "c8, c6, 1", uaddr);
                 tlb_op(TLB_V4_I_PAGE, "c8, c5, 1", uaddr);
@@ -418,7 +412,6 @@ static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
         if (tlb_flag(TLB_WB))
                 dsb();
 
-        tlb_op(TLB_V3_PAGE, "c6, c0, 0", kaddr);
         tlb_op(TLB_V4_U_PAGE, "c8, c7, 1", kaddr);
         tlb_op(TLB_V4_D_PAGE, "c8, c6, 1", kaddr);
         tlb_op(TLB_V4_I_PAGE, "c8, c5, 1", kaddr);
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 5dc1aa6f0f7d..1fd749ee4a1b 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -1043,7 +1043,7 @@ static int dbg_cpu_pm_notify(struct notifier_block *self, unsigned long action,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __cpuinitdata dbg_cpu_pm_nb = {
+static struct notifier_block dbg_cpu_pm_nb = {
         .notifier_call = dbg_cpu_pm_notify,
 };
 
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 146157dfe27c..8c3094d0f7b7 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -253,7 +253,10 @@ validate_event(struct pmu_hw_events *hw_events,
         struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
         struct pmu *leader_pmu = event->group_leader->pmu;
 
-        if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
+        if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
+                return 1;
+
+        if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
                 return 1;
 
         return armpmu->get_event_idx(hw_events, event) >= 0;
diff --git a/arch/arm/kernel/sched_clock.c b/arch/arm/kernel/sched_clock.c
index bd6f56b9ec21..59d2adb764a9 100644
--- a/arch/arm/kernel/sched_clock.c
+++ b/arch/arm/kernel/sched_clock.c
@@ -45,12 +45,12 @@ static u32 notrace jiffy_sched_clock_read(void)
 
 static u32 __read_mostly (*read_sched_clock)(void) = jiffy_sched_clock_read;
 
-static inline u64 cyc_to_ns(u64 cyc, u32 mult, u32 shift)
+static inline u64 notrace cyc_to_ns(u64 cyc, u32 mult, u32 shift)
 {
         return (cyc * mult) >> shift;
 }
 
-static unsigned long long cyc_to_sched_clock(u32 cyc, u32 mask)
+static unsigned long long notrace cyc_to_sched_clock(u32 cyc, u32 mask)
 {
         u64 epoch_ns;
         u32 epoch_cyc;
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index d343a6c3a6d1..234e339196c0 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -56,7 +56,6 @@
 #include <asm/virt.h>
 
 #include "atags.h"
-#include "tcm.h"
 
 
 #if defined(CONFIG_FPE_NWFPE) || defined(CONFIG_FPE_FASTFPE)
@@ -798,8 +797,6 @@ void __init setup_arch(char **cmdline_p)
 
         reserve_crashkernel();
 
-        tcm_init();
-
 #ifdef CONFIG_MULTI_IRQ_HANDLER
         handle_arch_irq = mdesc->handle_irq;
 #endif
diff --git a/arch/arm/kernel/tcm.c b/arch/arm/kernel/tcm.c
index 30ae6bb4a310..f50f19e5c138 100644
--- a/arch/arm/kernel/tcm.c
+++ b/arch/arm/kernel/tcm.c
@@ -17,7 +17,6 @@
 #include <asm/mach/map.h>
 #include <asm/memory.h>
 #include <asm/system_info.h>
-#include "tcm.h"
 
 static struct gen_pool *tcm_pool;
 static bool dtcm_present;
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 5a936988eb24..c1fe498983ac 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -201,6 +201,7 @@ int kvm_dev_ioctl_check_extension(long ext)
                 break;
         case KVM_CAP_ARM_SET_DEVICE_ADDR:
                 r = 1;
+                break;
         case KVM_CAP_NR_VCPUS:
                 r = num_online_cpus();
                 break;
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 4ea9a982269c..7bed7556077a 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -79,11 +79,11 @@ static bool access_dcsw(struct kvm_vcpu *vcpu,
         u32 val;
         int cpu;
 
-        cpu = get_cpu();
-
         if (!p->is_write)
                 return read_from_write_only(vcpu, p);
 
+        cpu = get_cpu();
+
         cpumask_setall(&vcpu->arch.require_dcache_flush);
         cpumask_clear_cpu(cpu, &vcpu->arch.require_dcache_flush);
 
diff --git a/arch/arm/mach-highbank/hotplug.c b/arch/arm/mach-highbank/hotplug.c
index f30c52843396..890cae23c12a 100644
--- a/arch/arm/mach-highbank/hotplug.c
+++ b/arch/arm/mach-highbank/hotplug.c
@@ -28,13 +28,11 @@ extern void secondary_startup(void);
  */
 void __ref highbank_cpu_die(unsigned int cpu)
 {
-        flush_cache_all();
-
         highbank_set_cpu_jump(cpu, phys_to_virt(0));
-        highbank_set_core_pwr();
 
-        cpu_do_idle();
+        flush_cache_louis();
+        highbank_set_core_pwr();
 
-        /* We should never return from idle */
-        panic("highbank: cpu %d unexpectedly exit from shutdown\n", cpu);
+        while (1)
+                cpu_do_idle();
 }
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 025d17328730..4045c4931a30 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -43,7 +43,7 @@ config CPU_ARM740T
         depends on !MMU
         select CPU_32v4T
         select CPU_ABRT_LV4T
-        select CPU_CACHE_V3     # although the core is v4t
+        select CPU_CACHE_V4
         select CPU_CP15_MPU
         select CPU_PABRT_LEGACY
         help
@@ -469,9 +469,6 @@ config CPU_PABRT_V7
         bool
 
 # The cache model
-config CPU_CACHE_V3
-        bool
-
 config CPU_CACHE_V4
         bool
 
diff --git a/arch/arm/mm/Makefile b/arch/arm/mm/Makefile
index 4e333fa2756f..9e51be96f635 100644
--- a/arch/arm/mm/Makefile
+++ b/arch/arm/mm/Makefile
@@ -33,7 +33,6 @@ obj-$(CONFIG_CPU_PABRT_LEGACY)	+= pabort-legacy.o
 obj-$(CONFIG_CPU_PABRT_V6)      += pabort-v6.o
 obj-$(CONFIG_CPU_PABRT_V7)      += pabort-v7.o
 
-obj-$(CONFIG_CPU_CACHE_V3)      += cache-v3.o
 obj-$(CONFIG_CPU_CACHE_V4)      += cache-v4.o
 obj-$(CONFIG_CPU_CACHE_V4WT)    += cache-v4wt.o
 obj-$(CONFIG_CPU_CACHE_V4WB)    += cache-v4wb.o
diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
index dd3d59122cc3..48bc3c0a87ce 100644
--- a/arch/arm/mm/cache-feroceon-l2.c
+++ b/arch/arm/mm/cache-feroceon-l2.c
@@ -343,6 +343,7 @@ void __init feroceon_l2_init(int __l2_wt_override)
         outer_cache.inv_range = feroceon_l2_inv_range;
         outer_cache.clean_range = feroceon_l2_clean_range;
         outer_cache.flush_range = feroceon_l2_flush_range;
+        outer_cache.inv_all = l2_inv_all;
 
         enable_l2();
 
diff --git a/arch/arm/mm/cache-v3.S b/arch/arm/mm/cache-v3.S
deleted file mode 100644
index 8a3fadece8d3..000000000000
--- a/arch/arm/mm/cache-v3.S
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- *  linux/arch/arm/mm/cache-v3.S
- *
- *  Copyright (C) 1997-2002 Russell king
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/linkage.h>
-#include <linux/init.h>
-#include <asm/page.h>
-#include "proc-macros.S"
-
-/*
- *      flush_icache_all()
- *
- *      Unconditionally clean and invalidate the entire icache.
- */
-ENTRY(v3_flush_icache_all)
-        mov     pc, lr
-ENDPROC(v3_flush_icache_all)
-
-/*
- *      flush_user_cache_all()
- *
- *      Invalidate all cache entries in a particular address
- *      space.
- *
- *      - mm    - mm_struct describing address space
- */
-ENTRY(v3_flush_user_cache_all)
-        /* FALLTHROUGH */
-/*
- *      flush_kern_cache_all()
- *
- *      Clean and invalidate the entire cache.
- */
-ENTRY(v3_flush_kern_cache_all)
-        /* FALLTHROUGH */
-
-/*
- *      flush_user_cache_range(start, end, flags)
- *
- *      Invalidate a range of cache entries in the specified
- *      address space.
- *
- *      - start - start address (may not be aligned)
- *      - end   - end address (exclusive, may not be aligned)
- *      - flags - vma_area_struct flags describing address space
- */
-ENTRY(v3_flush_user_cache_range)
-        mov     ip, #0
-        mcreq   p15, 0, ip, c7, c0, 0           @ flush ID cache
-        mov     pc, lr
-
-/*
- *      coherent_kern_range(start, end)
- *
- *      Ensure coherency between the Icache and the Dcache in the
- *      region described by start.  If you have non-snooping
- *      Harvard caches, you need to implement this function.
- *
- *      - start  - virtual start address
- *      - end    - virtual end address
- */
-ENTRY(v3_coherent_kern_range)
-        /* FALLTHROUGH */
-
-/*
- *      coherent_user_range(start, end)
- *
- *      Ensure coherency between the Icache and the Dcache in the
- *      region described by start.  If you have non-snooping
- *      Harvard caches, you need to implement this function.
- *
- *      - start  - virtual start address
- *      - end    - virtual end address
- */
-ENTRY(v3_coherent_user_range)
-        mov     r0, #0
-        mov     pc, lr
-
-/*
- *      flush_kern_dcache_area(void *page, size_t size)
- *
- *      Ensure no D cache aliasing occurs, either with itself or
- *      the I cache
- *
- *      - addr  - kernel address
- *      - size  - region size
- */
-ENTRY(v3_flush_kern_dcache_area)
-        /* FALLTHROUGH */
-
-/*
- *      dma_flush_range(start, end)
- *
- *      Clean and invalidate the specified virtual address range.
- *
- *      - start  - virtual start address
- *      - end    - virtual end address
- */
-ENTRY(v3_dma_flush_range)
-        mov     r0, #0
-        mcr     p15, 0, r0, c7, c0, 0           @ flush ID cache
-        mov     pc, lr
-
-/*
- *      dma_unmap_area(start, size, dir)
- *      - start - kernel virtual start address
- *      - size  - size of region
- *      - dir   - DMA direction
- */
-ENTRY(v3_dma_unmap_area)
-        teq     r2, #DMA_TO_DEVICE
-        bne     v3_dma_flush_range
-        /* FALLTHROUGH */
-
-/*
- *      dma_map_area(start, size, dir)
- *      - start - kernel virtual start address
- *      - size  - size of region
- *      - dir   - DMA direction
- */
-ENTRY(v3_dma_map_area)
-        mov     pc, lr
-ENDPROC(v3_dma_unmap_area)
-ENDPROC(v3_dma_map_area)
-
-        .globl  v3_flush_kern_cache_louis
-        .equ    v3_flush_kern_cache_louis, v3_flush_kern_cache_all
-
-        __INITDATA
-
-        @ define struct cpu_cache_fns (see <asm/cacheflush.h> and proc-macros.S)
-        define_cache_functions v3
diff --git a/arch/arm/mm/cache-v4.S b/arch/arm/mm/cache-v4.S
index 43e5d77be677..a7ba68f59f0c 100644
--- a/arch/arm/mm/cache-v4.S
+++ b/arch/arm/mm/cache-v4.S
@@ -58,7 +58,7 @@ ENTRY(v4_flush_kern_cache_all)
 ENTRY(v4_flush_user_cache_range)
 #ifdef CONFIG_CPU_CP15
         mov     ip, #0
-        mcreq   p15, 0, ip, c7, c7, 0           @ flush ID cache
+        mcr     p15, 0, ip, c7, c7, 0           @ flush ID cache
         mov     pc, lr
 #else
         /* FALLTHROUGH */
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 78978945492a..a84ff763ac39 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -34,6 +34,7 @@
 #include <asm/mach/pci.h>
 
 #include "mm.h"
+#include "tcm.h"
 
 /*
  * empty_zero_page is a special page that is used for
@@ -1277,6 +1278,7 @@ void __init paging_init(struct machine_desc *mdesc)
         dma_contiguous_remap();
         devicemaps_init(mdesc);
         kmap_init();
+        tcm_init();
 
         top_pmd = pmd_off_k(0xffff0000);
 
diff --git a/arch/arm/mm/proc-arm740.S b/arch/arm/mm/proc-arm740.S
index dc5de5d53f20..fde2d2a794cf 100644
--- a/arch/arm/mm/proc-arm740.S
+++ b/arch/arm/mm/proc-arm740.S
@@ -77,24 +77,27 @@ __arm740_setup:
         mcr     p15, 0, r0, c6, c0              @ set area 0, default
 
         ldr     r0, =(CONFIG_DRAM_BASE & 0xFFFFF000) @ base[31:12] of RAM
-        ldr     r1, =(CONFIG_DRAM_SIZE >> 12)   @ size of RAM (must be >= 4KB)
-        mov     r2, #10                         @ 11 is the minimum (4KB)
-1:      add     r2, r2, #1                      @ area size *= 2
-        mov     r1, r1, lsr #1
+        ldr     r3, =(CONFIG_DRAM_SIZE >> 12)   @ size of RAM (must be >= 4KB)
+        mov     r4, #10                         @ 11 is the minimum (4KB)
+1:      add     r4, r4, #1                      @ area size *= 2
+        movs    r3, r3, lsr #1
         bne     1b                              @ count not zero r-shift
-        orr     r0, r0, r2, lsl #1              @ the area register value
+        orr     r0, r0, r4, lsl #1              @ the area register value
         orr     r0, r0, #1                      @ set enable bit
         mcr     p15, 0, r0, c6, c1              @ set area 1, RAM
 
         ldr     r0, =(CONFIG_FLASH_MEM_BASE & 0xFFFFF000) @ base[31:12] of FLASH
-        ldr     r1, =(CONFIG_FLASH_SIZE >> 12)  @ size of FLASH (must be >= 4KB)
-        mov     r2, #10                         @ 11 is the minimum (4KB)
-1:      add     r2, r2, #1                      @ area size *= 2
-        mov     r1, r1, lsr #1
+        ldr     r3, =(CONFIG_FLASH_SIZE >> 12)  @ size of FLASH (must be >= 4KB)
+        cmp     r3, #0
+        moveq   r0, #0
+        beq     2f
+        mov     r4, #10                         @ 11 is the minimum (4KB)
+1:      add     r4, r4, #1                      @ area size *= 2
+        movs    r3, r3, lsr #1
         bne     1b                              @ count not zero r-shift
-        orr     r0, r0, r2, lsl #1              @ the area register value
+        orr     r0, r0, r4, lsl #1              @ the area register value
         orr     r0, r0, #1                      @ set enable bit
-        mcr     p15, 0, r0, c6, c2              @ set area 2, ROM/FLASH
+2:      mcr     p15, 0, r0, c6, c2              @ set area 2, ROM/FLASH
 
         mov     r0, #0x06
         mcr     p15, 0, r0, c2, c0              @ Region 1&2 cacheable
@@ -137,13 +140,14 @@ __arm740_proc_info:
         .long   0x41807400
         .long   0xfffffff0
         .long   0
+        .long   0
         b       __arm740_setup
         .long   cpu_arch_name
         .long   cpu_elf_name
-        .long   HWCAP_SWP | HWCAP_HALF | HWCAP_26BIT
+        .long   HWCAP_SWP | HWCAP_HALF | HWCAP_THUMB | HWCAP_26BIT
         .long   cpu_arm740_name
         .long   arm740_processor_functions
         .long   0
         .long   0
-        .long   v3_cache_fns                    @ cache model
+        .long   v4_cache_fns                    @ cache model
         .size   __arm740_proc_info, . - __arm740_proc_info
diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
index 2c3b9421ab5e..2556cf1c2da1 100644
--- a/arch/arm/mm/proc-arm920.S
+++ b/arch/arm/mm/proc-arm920.S
@@ -387,7 +387,7 @@ ENTRY(cpu_arm920_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm920_suspend_size
 .equ    cpu_arm920_suspend_size, 4 * 3
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_arm920_do_suspend)
         stmfd   sp!, {r4 - r6, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ PID
diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
index f1803f7e2972..344c8a548cc0 100644
--- a/arch/arm/mm/proc-arm926.S
+++ b/arch/arm/mm/proc-arm926.S
@@ -402,7 +402,7 @@ ENTRY(cpu_arm926_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm926_suspend_size
 .equ    cpu_arm926_suspend_size, 4 * 3
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_arm926_do_suspend)
         stmfd   sp!, {r4 - r6, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ PID
diff --git a/arch/arm/mm/proc-mohawk.S b/arch/arm/mm/proc-mohawk.S
index 82f9cdc751d6..0b60dd3d742a 100644
--- a/arch/arm/mm/proc-mohawk.S
+++ b/arch/arm/mm/proc-mohawk.S
@@ -350,7 +350,7 @@ ENTRY(cpu_mohawk_set_pte_ext)
 
 .globl  cpu_mohawk_suspend_size
 .equ    cpu_mohawk_suspend_size, 4 * 6
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_mohawk_do_suspend)
         stmfd   sp!, {r4 - r9, lr}
         mrc     p14, 0, r4, c6, c0, 0   @ clock configuration, for turbo mode
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index 3aa0da11fd84..d92dfd081429 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -172,7 +172,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
 
 .globl  cpu_sa1100_suspend_size
 .equ    cpu_sa1100_suspend_size, 4 * 3
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_sa1100_do_suspend)
         stmfd   sp!, {r4 - r6, lr}
         mrc     p15, 0, r4, c3, c0, 0           @ domain ID
diff --git a/arch/arm/mm/proc-syms.c b/arch/arm/mm/proc-syms.c
index 3e6210b4d6d4..054b491ff764 100644
--- a/arch/arm/mm/proc-syms.c
+++ b/arch/arm/mm/proc-syms.c
@@ -17,7 +17,9 @@
 
 #ifndef MULTI_CPU
 EXPORT_SYMBOL(cpu_dcache_clean_area);
+#ifdef CONFIG_MMU
 EXPORT_SYMBOL(cpu_set_pte_ext);
+#endif
 #else
 EXPORT_SYMBOL(processor);
 #endif
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index bcaaa8de9325..5c07ee4fe3eb 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -138,7 +138,7 @@ ENTRY(cpu_v6_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
 .globl  cpu_v6_suspend_size
 .equ    cpu_v6_suspend_size, 4 * 6
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_v6_do_suspend)
         stmfd   sp!, {r4 - r9, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ FCSE/PID
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index eb93d6487f35..e8efd83b6f25 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -413,7 +413,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
 
 .globl  cpu_xsc3_suspend_size
 .equ    cpu_xsc3_suspend_size, 4 * 6
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_xsc3_do_suspend)
         stmfd   sp!, {r4 - r9, lr}
         mrc     p14, 0, r4, c6, c0, 0   @ clock configuration, for turbo mode
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 25510361aa18..e766f889bfd6 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -528,7 +528,7 @@ ENTRY(cpu_xscale_set_pte_ext)
 
 .globl  cpu_xscale_suspend_size
 .equ    cpu_xscale_suspend_size, 4 * 6
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_xscale_do_suspend)
         stmfd   sp!, {r4 - r9, lr}
         mrc     p14, 0, r4, c6, c0, 0   @ clock configuration, for turbo mode
diff --git a/arch/arm/kernel/tcm.h b/arch/arm/mm/tcm.h
index 8015ad434a40..8015ad434a40 100644
--- a/arch/arm/kernel/tcm.h
+++ b/arch/arm/mm/tcm.h
diff --git a/arch/avr32/include/asm/io.h b/arch/avr32/include/asm/io.h
index cf60d0a9f176..fc6483f83ccc 100644
--- a/arch/avr32/include/asm/io.h
+++ b/arch/avr32/include/asm/io.h
@@ -165,6 +165,10 @@ BUILDIO_IOPORT(l, u32)
 #define readw_be                        __raw_readw
 #define readl_be                        __raw_readl
 
+#define writeb_relaxed                  writeb
+#define writew_relaxed                  writew
+#define writel_relaxed                  writel
+
 #define writeb_be                       __raw_writeb
 #define writew_be                       __raw_writew
 #define writel_be                       __raw_writel
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 256c5bf0adb7..04d69c4a5ac2 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -304,7 +304,7 @@ syscall_exit_work:
         subi    r12,r12,TI_FLAGS
 
 4:      /* Anything else left to do? */
-        SET_DEFAULT_THREAD_PPR(r3, r9)          /* Set thread.ppr = 3 */
+        SET_DEFAULT_THREAD_PPR(r3, r10)         /* Set thread.ppr = 3 */
         andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
         beq     .ret_from_except_lite
 
@@ -657,7 +657,7 @@ resume_kernel:
         /* Clear _TIF_EMULATE_STACK_STORE flag */
         lis     r11,_TIF_EMULATE_STACK_STORE@h
         addi    r5,r9,TI_FLAGS
-        ldarx   r4,0,r5
+0:      ldarx   r4,0,r5
         andc    r4,r4,r11
         stdcx.  r4,0,r5
         bne-    0b
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 834805cf13cb..c0dea6f23567 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -555,10 +555,12 @@ static inline void tm_recheckpoint_new_task(struct task_struct *new)
                 new->thread.regs->msr |=
                         (MSR_FP | new->thread.fpexc_mode);
         }
+#ifdef CONFIG_ALTIVEC
         if (msr & MSR_VEC) {
                 do_load_up_transact_altivec(&new->thread);
                 new->thread.regs->msr |= MSR_VEC;
         }
+#endif
         /* We may as well turn on VSX too since all the state is restored now */
         if (msr & MSR_VSX)
                 new->thread.regs->msr |= MSR_VSX;
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 3acb28e245b4..95068bf569ad 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -866,10 +866,12 @@ static long restore_tm_user_regs(struct pt_regs *regs,
                 do_load_up_transact_fpu(&current->thread);
                 regs->msr |= (MSR_FP | current->thread.fpexc_mode);
         }
+#ifdef CONFIG_ALTIVEC
         if (msr & MSR_VEC) {
                 do_load_up_transact_altivec(&current->thread);
                 regs->msr |= MSR_VEC;
         }
+#endif
 
         return 0;
 }
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 995f8543cb57..c1794286098c 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -522,10 +522,12 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
                 do_load_up_transact_fpu(&current->thread);
                 regs->msr |= (MSR_FP | current->thread.fpexc_mode);
         }
+#ifdef CONFIG_ALTIVEC
         if (msr & MSR_VEC) {
                 do_load_up_transact_altivec(&current->thread);
                 regs->msr |= MSR_VEC;
         }
+#endif
 
         return err;
 }
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index 84dbace657ce..2da67e7a16d5 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -309,6 +309,7 @@ _GLOBAL(tm_recheckpoint)
         or      r5, r6, r5                      /* Set MSR.FP+.VSX/.VEC */
         mtmsr   r5
 
+#ifdef CONFIG_ALTIVEC
         /* FP and VEC registers:  These are recheckpointed from thread.fpr[]
          * and thread.vr[] respectively.  The thread.transact_fpr[] version
          * is more modern, and will be loaded subsequently by any FPUnavailable
@@ -323,6 +324,7 @@ _GLOBAL(tm_recheckpoint)
         REST_32VRS(0, r5, r3)                   /* r5 scratch, r3 THREAD ptr */
         ld      r5, THREAD_VRSAVE(r3)
         mtspr   SPRN_VRSAVE, r5
+#endif
 
 dont_restore_vec:
         andi.   r0, r4, MSR_FP
diff --git a/arch/powerpc/kvm/e500.h b/arch/powerpc/kvm/e500.h
index 41cefd43655f..33db48a8ce24 100644
--- a/arch/powerpc/kvm/e500.h
+++ b/arch/powerpc/kvm/e500.h
@@ -26,17 +26,20 @@
 #define E500_PID_NUM   3
 #define E500_TLB_NUM   2
 
-#define E500_TLB_VALID 1
-#define E500_TLB_BITMAP 2
+/* entry is mapped somewhere in host TLB */
+#define E500_TLB_VALID          (1 << 0)
+/* TLB1 entry is mapped by host TLB1, tracked by bitmaps */
+#define E500_TLB_BITMAP         (1 << 1)
+/* TLB1 entry is mapped by host TLB0 */
 #define E500_TLB_TLB0           (1 << 2)
 
 struct tlbe_ref {
-        pfn_t pfn;
-        unsigned int flags; /* E500_TLB_* */
+        pfn_t pfn;              /* valid only for TLB0, except briefly */
+        unsigned int flags;     /* E500_TLB_* */
 };
 
 struct tlbe_priv {
-        struct tlbe_ref ref; /* TLB0 only -- TLB1 uses tlb_refs */
+        struct tlbe_ref ref;
 };
 
 #ifdef CONFIG_KVM_E500V2
@@ -63,17 +66,6 @@ struct kvmppc_vcpu_e500 {
 
         unsigned int gtlb_nv[E500_TLB_NUM];
 
-        /*
-         * information associated with each host TLB entry --
-         * TLB1 only for now.  If/when guest TLB1 entries can be
-         * mapped with host TLB0, this will be used for that too.
-         *
-         * We don't want to use this for guest TLB0 because then we'd
-         * have the overhead of doing the translation again even if
-         * the entry is still in the guest TLB (e.g. we swapped out
-         * and back, and our host TLB entries got evicted).
-         */
-        struct tlbe_ref *tlb_refs[E500_TLB_NUM];
         unsigned int host_tlb1_nv;
 
         u32 svr;
diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
index a222edfb9a9b..1c6a9d729df4 100644
--- a/arch/powerpc/kvm/e500_mmu_host.c
+++ b/arch/powerpc/kvm/e500_mmu_host.c
@@ -193,8 +193,11 @@ void inval_gtlbe_on_host(struct kvmppc_vcpu_e500 *vcpu_e500, int tlbsel,
         struct tlbe_ref *ref = &vcpu_e500->gtlb_priv[tlbsel][esel].ref;
 
         /* Don't bother with unmapped entries */
-        if (!(ref->flags & E500_TLB_VALID))
-                return;
+        if (!(ref->flags & E500_TLB_VALID)) {
+                WARN(ref->flags & (E500_TLB_BITMAP | E500_TLB_TLB0),
+                     "%s: flags %x\n", __func__, ref->flags);
+                WARN_ON(tlbsel == 1 && vcpu_e500->g2h_tlb1_map[esel]);
+        }
 
         if (tlbsel == 1 && ref->flags & E500_TLB_BITMAP) {
                 u64 tmp = vcpu_e500->g2h_tlb1_map[esel];
@@ -248,7 +251,7 @@ static inline void kvmppc_e500_ref_setup(struct tlbe_ref *ref,
                                          pfn_t pfn)
 {
         ref->pfn = pfn;
-        ref->flags = E500_TLB_VALID;
+        ref->flags |= E500_TLB_VALID;
 
         if (tlbe_is_writable(gtlbe))
                 kvm_set_pfn_dirty(pfn);
@@ -257,6 +260,7 @@ static inline void kvmppc_e500_ref_setup(struct tlbe_ref *ref,
 static inline void kvmppc_e500_ref_release(struct tlbe_ref *ref)
 {
         if (ref->flags & E500_TLB_VALID) {
+                /* FIXME: don't log bogus pfn for TLB1 */
                 trace_kvm_booke206_ref_release(ref->pfn, ref->flags);
                 ref->flags = 0;
         }
@@ -274,36 +278,23 @@ static void clear_tlb1_bitmap(struct kvmppc_vcpu_e500 *vcpu_e500)
 
 static void clear_tlb_privs(struct kvmppc_vcpu_e500 *vcpu_e500)
 {
-        int tlbsel = 0;
-        int i;
-
-        for (i = 0; i < vcpu_e500->gtlb_params[tlbsel].entries; i++) {
-                struct tlbe_ref *ref =
-                        &vcpu_e500->gtlb_priv[tlbsel][i].ref;
-                kvmppc_e500_ref_release(ref);
-        }
-}
-
-static void clear_tlb_refs(struct kvmppc_vcpu_e500 *vcpu_e500)
-{
-        int stlbsel = 1;
+        int tlbsel;
         int i;
 
-        kvmppc_e500_tlbil_all(vcpu_e500);
-
-        for (i = 0; i < host_tlb_params[stlbsel].entries; i++) {
-                struct tlbe_ref *ref =
-                        &vcpu_e500->tlb_refs[stlbsel][i];
-                kvmppc_e500_ref_release(ref);
+        for (tlbsel = 0; tlbsel <= 1; tlbsel++) {
+                for (i = 0; i < vcpu_e500->gtlb_params[tlbsel].entries; i++) {
+                        struct tlbe_ref *ref =
+                                &vcpu_e500->gtlb_priv[tlbsel][i].ref;
+                        kvmppc_e500_ref_release(ref);
+                }
         }
-
-        clear_tlb_privs(vcpu_e500);
 }
 
 void kvmppc_core_flush_tlb(struct kvm_vcpu *vcpu)
 {
         struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu);
-        clear_tlb_refs(vcpu_e500);
+        kvmppc_e500_tlbil_all(vcpu_e500);
+        clear_tlb_privs(vcpu_e500);
         clear_tlb1_bitmap(vcpu_e500);
 }
 
@@ -458,8 +449,6 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
                 gvaddr &= ~((tsize_pages << PAGE_SHIFT) - 1);
         }
 
-        /* Drop old ref and setup new one. */
-        kvmppc_e500_ref_release(ref);
         kvmppc_e500_ref_setup(ref, gtlbe, pfn);
 
         kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize,
@@ -507,14 +496,15 @@ static int kvmppc_e500_tlb1_map_tlb1(struct kvmppc_vcpu_e500 *vcpu_e500,
         if (unlikely(vcpu_e500->host_tlb1_nv >= tlb1_max_shadow_size()))
                 vcpu_e500->host_tlb1_nv = 0;
 
-        vcpu_e500->tlb_refs[1][sesel] = *ref;
-        vcpu_e500->g2h_tlb1_map[esel] |= (u64)1 << sesel;
-        vcpu_e500->gtlb_priv[1][esel].ref.flags |= E500_TLB_BITMAP;
         if (vcpu_e500->h2g_tlb1_rmap[sesel]) {
-                unsigned int idx = vcpu_e500->h2g_tlb1_rmap[sesel];
+                unsigned int idx = vcpu_e500->h2g_tlb1_rmap[sesel] - 1;
                 vcpu_e500->g2h_tlb1_map[idx] &= ~(1ULL << sesel);
         }
-        vcpu_e500->h2g_tlb1_rmap[sesel] = esel;
+
+        vcpu_e500->gtlb_priv[1][esel].ref.flags |= E500_TLB_BITMAP;
+        vcpu_e500->g2h_tlb1_map[esel] |= (u64)1 << sesel;
+        vcpu_e500->h2g_tlb1_rmap[sesel] = esel + 1;
+        WARN_ON(!(ref->flags & E500_TLB_VALID));
 
         return sesel;
 }
@@ -526,13 +516,12 @@ static int kvmppc_e500_tlb1_map(struct kvmppc_vcpu_e500 *vcpu_e500,
                 u64 gvaddr, gfn_t gfn, struct kvm_book3e_206_tlb_entry *gtlbe,
                 struct kvm_book3e_206_tlb_entry *stlbe, int esel)
 {
-        struct tlbe_ref ref;
+        struct tlbe_ref *ref = &vcpu_e500->gtlb_priv[1][esel].ref;
         int sesel;
         int r;
 
-        ref.flags = 0;
         r = kvmppc_e500_shadow_map(vcpu_e500, gvaddr, gfn, gtlbe, 1, stlbe,
-                                   &ref);
+                                   ref);
         if (r)
                 return r;
 
@@ -544,7 +533,7 @@ static int kvmppc_e500_tlb1_map(struct kvmppc_vcpu_e500 *vcpu_e500,
         }
 
         /* Otherwise map into TLB1 */
-        sesel = kvmppc_e500_tlb1_map_tlb1(vcpu_e500, &ref, esel);
+        sesel = kvmppc_e500_tlb1_map_tlb1(vcpu_e500, ref, esel);
         write_stlbe(vcpu_e500, gtlbe, stlbe, 1, sesel);
 
         return 0;
@@ -565,7 +554,7 @@ void kvmppc_mmu_map(struct kvm_vcpu *vcpu, u64 eaddr, gpa_t gpaddr,
         case 0:
                 priv = &vcpu_e500->gtlb_priv[tlbsel][esel];
 
-                /* Triggers after clear_tlb_refs or on initial mapping */
+                /* Triggers after clear_tlb_privs or on initial mapping */
                 if (!(priv->ref.flags & E500_TLB_VALID)) {
                         kvmppc_e500_tlb0_map(vcpu_e500, esel, &stlbe);
                 } else {
@@ -665,35 +654,16 @@ int e500_mmu_host_init(struct kvmppc_vcpu_e500 *vcpu_e500)
                 host_tlb_params[0].entries / host_tlb_params[0].ways;
         host_tlb_params[1].sets = 1;
 
-        vcpu_e500->tlb_refs[0] =
-                kzalloc(sizeof(struct tlbe_ref) * host_tlb_params[0].entries,
-                        GFP_KERNEL);
-        if (!vcpu_e500->tlb_refs[0])
-                goto err;
-
-        vcpu_e500->tlb_refs[1] =
-                kzalloc(sizeof(struct tlbe_ref) * host_tlb_params[1].entries,
-                        GFP_KERNEL);
-        if (!vcpu_e500->tlb_refs[1])
-                goto err;
-
         vcpu_e500->h2g_tlb1_rmap = kzalloc(sizeof(unsigned int) *
                                            host_tlb_params[1].entries,
                                            GFP_KERNEL);
         if (!vcpu_e500->h2g_tlb1_rmap)
-                goto err;
+                return -EINVAL;
 
         return 0;
-
-err:
-        kfree(vcpu_e500->tlb_refs[0]);
-        kfree(vcpu_e500->tlb_refs[1]);
-        return -EINVAL;
 }
 
 void e500_mmu_host_uninit(struct kvmppc_vcpu_e500 *vcpu_e500)
 {
         kfree(vcpu_e500->h2g_tlb1_rmap);
-        kfree(vcpu_e500->tlb_refs[0]);
-        kfree(vcpu_e500->tlb_refs[1]);
 }
diff --git a/arch/powerpc/kvm/e500mc.c b/arch/powerpc/kvm/e500mc.c
index 1f89d26e65fb..2f4baa074b2e 100644
--- a/arch/powerpc/kvm/e500mc.c
+++ b/arch/powerpc/kvm/e500mc.c
@@ -108,6 +108,8 @@ void kvmppc_mmu_msr_notify(struct kvm_vcpu *vcpu, u32 old_msr)
 {
 }
 
+static DEFINE_PER_CPU(struct kvm_vcpu *, last_vcpu_on_cpu);
+
 void kvmppc_core_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
         struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu);
@@ -136,8 +138,11 @@ void kvmppc_core_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
         mtspr(SPRN_GDEAR, vcpu->arch.shared->dar);
         mtspr(SPRN_GESR, vcpu->arch.shared->esr);
 
-        if (vcpu->arch.oldpir != mfspr(SPRN_PIR))
+        if (vcpu->arch.oldpir != mfspr(SPRN_PIR) ||
+            __get_cpu_var(last_vcpu_on_cpu) != vcpu) {
                 kvmppc_e500_tlbil_all(vcpu_e500);
+                __get_cpu_var(last_vcpu_on_cpu) = vcpu;
+        }
 
         kvmppc_load_guest_fp(vcpu);
 }
diff --git a/arch/s390/include/asm/io.h b/arch/s390/include/asm/io.h
index 27cb32185ce1..379d96e2105e 100644
--- a/arch/s390/include/asm/io.h
+++ b/arch/s390/include/asm/io.h
@@ -50,10 +50,6 @@ void unxlate_dev_mem_ptr(unsigned long phys, void *addr);
 #define ioremap_nocache(addr, size)     ioremap(addr, size)
 #define ioremap_wc                      ioremap_nocache
 
-/* TODO: s390 cannot support io_remap_pfn_range... */
-#define io_remap_pfn_range(vma, vaddr, pfn, size, prot)                \
-        remap_pfn_range(vma, vaddr, pfn, size, prot)
-
 static inline void __iomem *ioremap(unsigned long offset, unsigned long size)
 {
         return (void __iomem *) offset;
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 4a5443118cfb..3cb47cf02530 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -57,6 +57,10 @@ extern unsigned long zero_page_mask;
          (((unsigned long)(vaddr)) &zero_page_mask))))
 #define __HAVE_COLOR_ZERO_PAGE
 
+/* TODO: s390 cannot support io_remap_pfn_range... */
+#define io_remap_pfn_range(vma, vaddr, pfn, size, prot)                \
+        remap_pfn_range(vma, vaddr, pfn, size, prot)
+
 #endif /* !__ASSEMBLY__ */
 
 /*
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index e26d430ce2fd..ff18e3cfb6b1 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -2,11 +2,16 @@
 
 
 generic-y += clkdev.h
+generic-y += cputime.h
 generic-y += div64.h
+generic-y += emergency-restart.h
 generic-y += exec.h
 generic-y += local64.h
+generic-y += mutex.h
 generic-y += irq_regs.h
 generic-y += local.h
 generic-y += module.h
+generic-y += serial.h
 generic-y += trace_clock.h
+generic-y += types.h
 generic-y += word-at-a-time.h
diff --git a/arch/sparc/include/asm/cputime.h b/arch/sparc/include/asm/cputime.h
deleted file mode 100644
index 1a642b81e019..000000000000
--- a/arch/sparc/include/asm/cputime.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __SPARC_CPUTIME_H
-#define __SPARC_CPUTIME_H
-
-#include <asm-generic/cputime.h>
-
-#endif /* __SPARC_CPUTIME_H */
diff --git a/arch/sparc/include/asm/emergency-restart.h b/arch/sparc/include/asm/emergency-restart.h
deleted file mode 100644
index 108d8c48e42e..000000000000
--- a/arch/sparc/include/asm/emergency-restart.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _ASM_EMERGENCY_RESTART_H
-#define _ASM_EMERGENCY_RESTART_H
-
-#include <asm-generic/emergency-restart.h>
-
-#endif /* _ASM_EMERGENCY_RESTART_H */
diff --git a/arch/sparc/include/asm/mutex.h b/arch/sparc/include/asm/mutex.h
deleted file mode 100644
index 458c1f7fbc18..000000000000
--- a/arch/sparc/include/asm/mutex.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Pull in the generic implementation for the mutex fastpath.
- *
- * TODO: implement optimized primitives instead, or leave the generic
- * implementation in place, or pick the atomic_xchg() based generic
- * implementation. (see asm-generic/mutex-xchg.h for details)
- */
-
-#include <asm-generic/mutex-dec.h>
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 08fcce90316b..7619f2f792af 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -915,6 +915,7 @@ static inline int io_remap_pfn_range(struct vm_area_struct *vma,
         return remap_pfn_range(vma, from, phys_base >> PAGE_SHIFT, size, prot);
 }
 
+#include <asm/tlbflush.h>
 #include <asm-generic/pgtable.h>
 
 /* We provide our own get_unmapped_area to cope with VA holes and
diff --git a/arch/sparc/include/asm/serial.h b/arch/sparc/include/asm/serial.h
deleted file mode 100644
index f90d61c28059..000000000000
--- a/arch/sparc/include/asm/serial.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __SPARC_SERIAL_H
-#define __SPARC_SERIAL_H
-
-#define BASE_BAUD ( 1843200 / 16 )
-
-#endif /* __SPARC_SERIAL_H */
diff --git a/arch/sparc/include/asm/smp_32.h b/arch/sparc/include/asm/smp_32.h
index b73da3c5f10a..3c8917f054de 100644
--- a/arch/sparc/include/asm/smp_32.h
+++ b/arch/sparc/include/asm/smp_32.h
@@ -36,7 +36,6 @@ typedef void (*smpfunc_t)(unsigned long, unsigned long, unsigned long,
                        unsigned long, unsigned long);
 
 void cpu_panic(void);
-extern void smp4m_irq_rotate(int cpu);
 
 /*
  *      General functions that each host system must provide.
@@ -46,7 +45,6 @@ void sun4m_init_smp(void);
 void sun4d_init_smp(void);
 
 void smp_callin(void);
-void smp_boot_cpus(void);
 void smp_store_cpu_info(int);
 
 void smp_resched_interrupt(void);
@@ -107,9 +105,6 @@ extern int hard_smp_processor_id(void);
 
 #define raw_smp_processor_id()          (current_thread_info()->cpu)
 
-#define prof_multiplier(__cpu)          cpu_data(__cpu).multiplier
-#define prof_counter(__cpu)             cpu_data(__cpu).counter
-
 void smp_setup_cpu_possible_map(void);
 
 #endif /* !(__ASSEMBLY__) */
diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
index cad36f56fa03..c7de3323819c 100644
--- a/arch/sparc/include/asm/switch_to_64.h
+++ b/arch/sparc/include/asm/switch_to_64.h
@@ -18,8 +18,7 @@ do {						\
          * and 2 stores in this critical code path.  -DaveM
          */
 #define switch_to(prev, next, last)                                     \
-do {    flush_tlb_pending();                                            \
-        save_and_clear_fpu();                                           \
+do {    save_and_clear_fpu();                                           \
         /* If you are tempted to conditionalize the following */        \
         /* so that ASI is only written if it changes, think again. */   \
         __asm__ __volatile__("wr %%g0, %0, %%asi"                       \
diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
index 2ef463494153..f0d6a9700f4c 100644
--- a/arch/sparc/include/asm/tlbflush_64.h
+++ b/arch/sparc/include/asm/tlbflush_64.h
@@ -11,24 +11,40 @@
 struct tlb_batch {
         struct mm_struct *mm;
         unsigned long tlb_nr;
+        unsigned long active;
         unsigned long vaddrs[TLB_BATCH_NR];
 };
 
 extern void flush_tsb_kernel_range(unsigned long start, unsigned long end);
 extern void flush_tsb_user(struct tlb_batch *tb);
+extern void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr);
 
 /* TLB flush operations. */
 
-extern void flush_tlb_pending(void);
+static inline void flush_tlb_mm(struct mm_struct *mm)
+{
+}
+
+static inline void flush_tlb_page(struct vm_area_struct *vma,
+                                  unsigned long vmaddr)
+{
+}
+
+static inline void flush_tlb_range(struct vm_area_struct *vma,
+                                   unsigned long start, unsigned long end)
+{
+}
+
+#define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
 
-#define flush_tlb_range(vma,start,end)  \
-        do { (void)(start); flush_tlb_pending(); } while (0)
-#define flush_tlb_page(vma,addr)        flush_tlb_pending()
-#define flush_tlb_mm(mm)                flush_tlb_pending()
+extern void flush_tlb_pending(void);
+extern void arch_enter_lazy_mmu_mode(void);
+extern void arch_leave_lazy_mmu_mode(void);
+#define arch_flush_lazy_mmu_mode()      do {} while (0)
 
 /* Local cpu only.  */
 extern void __flush_tlb_all(void);
-
+extern void __flush_tlb_page(unsigned long context, unsigned long vaddr);
 extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
 
 #ifndef CONFIG_SMP
@@ -38,15 +54,24 @@ do {	flush_tsb_kernel_range(start,end); \
         __flush_tlb_kernel_range(start,end); \
 } while (0)
 
+static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
+{
+        __flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
+}
+
 #else /* CONFIG_SMP */
 
 extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
+extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
 
 #define flush_tlb_kernel_range(start, end) \
 do {    flush_tsb_kernel_range(start,end); \
         smp_flush_tlb_kernel_range(start, end); \
 } while (0)
 
+#define global_flush_tlb_page(mm, vaddr) \
+        smp_flush_tlb_page(mm, vaddr)
+
 #endif /* ! CONFIG_SMP */
 
 #endif /* _SPARC64_TLBFLUSH_H */
diff --git a/arch/sparc/include/uapi/asm/Kbuild b/arch/sparc/include/uapi/asm/Kbuild
index ce175aff71b7..b5843ee09fb5 100644
--- a/arch/sparc/include/uapi/asm/Kbuild
+++ b/arch/sparc/include/uapi/asm/Kbuild
@@ -44,7 +44,6 @@ header-y += swab.h
 header-y += termbits.h
 header-y += termios.h
 header-y += traps.h
-header-y += types.h
 header-y += uctx.h
 header-y += unistd.h
 header-y += utrap.h
diff --git a/arch/sparc/include/uapi/asm/types.h b/arch/sparc/include/uapi/asm/types.h
deleted file mode 100644
index 383d156cde9c..000000000000
--- a/arch/sparc/include/uapi/asm/types.h
+++ /dev/null
@@ -1,17 +0,0 @@
-#ifndef _SPARC_TYPES_H
-#define _SPARC_TYPES_H
-/*
- * This file is never included by application software unless
- * explicitly requested (e.g., via linux/types.h) in which case the
- * application is Linux specific so (user-) name space pollution is
- * not a major issue.  However, for interoperability, libraries still
- * need to be careful to avoid a name clashes.
- */
-
-#if defined(__sparc__)
-
-#include <asm-generic/int-ll64.h>
-
-#endif /* defined(__sparc__) */
-
-#endif /* defined(_SPARC_TYPES_H) */
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 537eb66abd06..ca64d2a86ec0 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -849,7 +849,7 @@ void smp_tsb_sync(struct mm_struct *mm)
 }
 
 extern unsigned long xcall_flush_tlb_mm;
-extern unsigned long xcall_flush_tlb_pending;
+extern unsigned long xcall_flush_tlb_page;
 extern unsigned long xcall_flush_tlb_kernel_range;
 extern unsigned long xcall_fetch_glob_regs;
 extern unsigned long xcall_fetch_glob_pmu;
@@ -1074,23 +1074,56 @@ local_flush_and_out:
         put_cpu();
 }
 
+struct tlb_pending_info {
+        unsigned long ctx;
+        unsigned long nr;
+        unsigned long *vaddrs;
+};
+
+static void tlb_pending_func(void *info)
+{
+        struct tlb_pending_info *t = info;
+
+        __flush_tlb_pending(t->ctx, t->nr, t->vaddrs);
+}
+
 void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long *vaddrs)
 {
         u32 ctx = CTX_HWBITS(mm->context);
+        struct tlb_pending_info info;
         int cpu = get_cpu();
 
+        info.ctx = ctx;
+        info.nr = nr;
+        info.vaddrs = vaddrs;
+
         if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
                 cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
         else
-                smp_cross_call_masked(&xcall_flush_tlb_pending,
-                                      ctx, nr, (unsigned long) vaddrs,
-                                      mm_cpumask(mm));
+                smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
+                                       &info, 1);
 
         __flush_tlb_pending(ctx, nr, vaddrs);
 
         put_cpu();
 }
 
+void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
+{
+        unsigned long context = CTX_HWBITS(mm->context);
+        int cpu = get_cpu();
+
+        if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
+                cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
+        else
+                smp_cross_call_masked(&xcall_flush_tlb_page,
+                                      context, vaddr, 0,
+                                      mm_cpumask(mm));
+        __flush_tlb_page(context, vaddr);
+
+        put_cpu();
+}
+
 void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end)
 {
         start &= PAGE_MASK;
diff --git a/arch/sparc/lib/bitext.c b/arch/sparc/lib/bitext.c
index 48d00e72ce15..8ec4e9c0251a 100644
--- a/arch/sparc/lib/bitext.c
+++ b/arch/sparc/lib/bitext.c
@@ -119,11 +119,7 @@ void bit_map_clear(struct bit_map *t, int offset, int len)
 
 void bit_map_init(struct bit_map *t, unsigned long *map, int size)
 {
-
-        if ((size & 07) != 0)
-                BUG();
-        memset(map, 0, size>>3);
-
+        bitmap_zero(map, size);
         memset(t, 0, sizeof *t);
         spin_lock_init(&t->lock);
         t->map = map;
diff --git a/arch/sparc/mm/iommu.c b/arch/sparc/mm/iommu.c
index 0f4f7191fbba..28f96f27c768 100644
--- a/arch/sparc/mm/iommu.c
+++ b/arch/sparc/mm/iommu.c
@@ -34,7 +34,7 @@
 #define IOMMU_RNGE      IOMMU_RNGE_256MB
 #define IOMMU_START     0xF0000000
 #define IOMMU_WINSIZE   (256*1024*1024U)
-#define IOMMU_NPTES     (IOMMU_WINSIZE/PAGE_SIZE)       /* 64K PTEs, 265KB */
+#define IOMMU_NPTES     (IOMMU_WINSIZE/PAGE_SIZE)       /* 64K PTEs, 256KB */
 #define IOMMU_ORDER     6                               /* 4096 * (1<<6) */
 
 /* srmmu.c */
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index c38bb72e3e80..036c2797dece 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -280,7 +280,9 @@ static void __init srmmu_nocache_init(void)
                 SRMMU_NOCACHE_ALIGN_MAX, 0UL);
         memset(srmmu_nocache_pool, 0, srmmu_nocache_size);
 
-        srmmu_nocache_bitmap = __alloc_bootmem(bitmap_bits >> 3, SMP_CACHE_BYTES, 0UL);
+        srmmu_nocache_bitmap =
+                __alloc_bootmem(BITS_TO_LONGS(bitmap_bits) * sizeof(long),
+                                SMP_CACHE_BYTES, 0UL);
         bit_map_init(&srmmu_nocache_map, srmmu_nocache_bitmap, bitmap_bits);
 
         srmmu_swapper_pg_dir = __srmmu_get_nocache(SRMMU_PGD_TABLE_SIZE, SRMMU_PGD_TABLE_SIZE);
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index ba6ae7ffdc2c..272aa4f7657e 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -24,11 +24,17 @@ static DEFINE_PER_CPU(struct tlb_batch, tlb_batch);
 void flush_tlb_pending(void)
 {
         struct tlb_batch *tb = &get_cpu_var(tlb_batch);
+        struct mm_struct *mm = tb->mm;
 
-        if (tb->tlb_nr) {
-                flush_tsb_user(tb);
+        if (!tb->tlb_nr)
+                goto out;
 
-                if (CTX_VALID(tb->mm->context)) {
+        flush_tsb_user(tb);
+
+        if (CTX_VALID(mm->context)) {
+                if (tb->tlb_nr == 1) {
+                        global_flush_tlb_page(mm, tb->vaddrs[0]);
+                } else {
 #ifdef CONFIG_SMP
                         smp_flush_tlb_pending(tb->mm, tb->tlb_nr,
                                               &tb->vaddrs[0]);
@@ -37,12 +43,30 @@ void flush_tlb_pending(void)
                                             tb->tlb_nr, &tb->vaddrs[0]);
 #endif
                 }
-                tb->tlb_nr = 0;
         }
 
+        tb->tlb_nr = 0;
+
+out:
         put_cpu_var(tlb_batch);
 }
 
+void arch_enter_lazy_mmu_mode(void)
+{
+        struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
+
+        tb->active = 1;
+}
+
+void arch_leave_lazy_mmu_mode(void)
+{
+        struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
+
+        if (tb->tlb_nr)
+                flush_tlb_pending();
+        tb->active = 0;
+}
+
 static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
                               bool exec)
 {
@@ -60,6 +84,12 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
                 nr = 0;
         }
 
+        if (!tb->active) {
+                global_flush_tlb_page(mm, vaddr);
+                flush_tsb_user_page(mm, vaddr);
+                return;
+        }
+
         if (nr == 0)
                 tb->mm = mm;
 
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index 428982b9becf..2cc3bce5ee91 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -7,11 +7,10 @@
 #include <linux/preempt.h>
 #include <linux/slab.h>
 #include <asm/page.h>
-#include <asm/tlbflush.h>
-#include <asm/tlb.h>
-#include <asm/mmu_context.h>
 #include <asm/pgtable.h>
+#include <asm/mmu_context.h>
 #include <asm/tsb.h>
+#include <asm/tlb.h>
 #include <asm/oplib.h>
 
 extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
@@ -46,23 +45,27 @@ void flush_tsb_kernel_range(unsigned long start, unsigned long end)
         }
 }
 
-static void __flush_tsb_one(struct tlb_batch *tb, unsigned long hash_shift,
-                            unsigned long tsb, unsigned long nentries)
+static void __flush_tsb_one_entry(unsigned long tsb, unsigned long v,
+                                  unsigned long hash_shift,
+                                  unsigned long nentries)
 {
-        unsigned long i;
+        unsigned long tag, ent, hash;
 
-        for (i = 0; i < tb->tlb_nr; i++) {
-                unsigned long v = tb->vaddrs[i];
-                unsigned long tag, ent, hash;
+        v &= ~0x1UL;
+        hash = tsb_hash(v, hash_shift, nentries);
+        ent = tsb + (hash * sizeof(struct tsb));
+        tag = (v >> 22UL);
 
-                v &= ~0x1UL;
+        tsb_flush(ent, tag);
+}
 
-                hash = tsb_hash(v, hash_shift, nentries);
-                ent = tsb + (hash * sizeof(struct tsb));
-                tag = (v >> 22UL);
+static void __flush_tsb_one(struct tlb_batch *tb, unsigned long hash_shift,
+                            unsigned long tsb, unsigned long nentries)
+{
+        unsigned long i;
 
-                tsb_flush(ent, tag);
-        }
+        for (i = 0; i < tb->tlb_nr; i++)
+                __flush_tsb_one_entry(tsb, tb->vaddrs[i], hash_shift, nentries);
 }
 
 void flush_tsb_user(struct tlb_batch *tb)
@@ -90,6 +93,30 @@ void flush_tsb_user(struct tlb_batch *tb)
         spin_unlock_irqrestore(&mm->context.lock, flags);
 }
 
+void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr)
+{
+        unsigned long nentries, base, flags;
+
+        spin_lock_irqsave(&mm->context.lock, flags);
+
+        base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
+        nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
+        if (tlb_type == cheetah_plus || tlb_type == hypervisor)
+                base = __pa(base);
+        __flush_tsb_one_entry(base, vaddr, PAGE_SHIFT, nentries);
+
+#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
+        if (mm->context.tsb_block[MM_TSB_HUGE].tsb) {
+                base = (unsigned long) mm->context.tsb_block[MM_TSB_HUGE].tsb;
+                nentries = mm->context.tsb_block[MM_TSB_HUGE].tsb_nentries;
+                if (tlb_type == cheetah_plus || tlb_type == hypervisor)
+                        base = __pa(base);
+                __flush_tsb_one_entry(base, vaddr, HPAGE_SHIFT, nentries);
+        }
+#endif
+        spin_unlock_irqrestore(&mm->context.lock, flags);
+}
+
 #define HV_PGSZ_IDX_BASE        HV_PGSZ_IDX_8K
 #define HV_PGSZ_MASK_BASE       HV_PGSZ_MASK_8K
 
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index f8e13d421fcb..432aa0cb1b38 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -53,6 +53,33 @@ __flush_tlb_mm:		/* 18 insns */
         nop
 
         .align          32
+        .globl          __flush_tlb_page
+__flush_tlb_page:       /* 22 insns */
+        /* %o0 = context, %o1 = vaddr */
+        rdpr            %pstate, %g7
+        andn            %g7, PSTATE_IE, %g2
+        wrpr            %g2, %pstate
+        mov             SECONDARY_CONTEXT, %o4
+        ldxa            [%o4] ASI_DMMU, %g2
+        stxa            %o0, [%o4] ASI_DMMU
+        andcc           %o1, 1, %g0
+        andn            %o1, 1, %o3
+        be,pn           %icc, 1f
+         or             %o3, 0x10, %o3
+        stxa            %g0, [%o3] ASI_IMMU_DEMAP
+1:      stxa            %g0, [%o3] ASI_DMMU_DEMAP
+        membar          #Sync
+        stxa            %g2, [%o4] ASI_DMMU
+        sethi           %hi(KERNBASE), %o4
+        flush           %o4
+        retl
+         wrpr           %g7, 0x0, %pstate
+        nop
+        nop
+        nop
+        nop
+
+        .align          32
         .globl          __flush_tlb_pending
 __flush_tlb_pending:    /* 26 insns */
         /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
@@ -203,6 +230,31 @@ __cheetah_flush_tlb_mm: /* 19 insns */
         retl
          wrpr           %g7, 0x0, %pstate
 
+__cheetah_flush_tlb_page:       /* 22 insns */
+        /* %o0 = context, %o1 = vaddr */
+        rdpr            %pstate, %g7
+        andn            %g7, PSTATE_IE, %g2
+        wrpr            %g2, 0x0, %pstate
+        wrpr            %g0, 1, %tl
+        mov             PRIMARY_CONTEXT, %o4
+        ldxa            [%o4] ASI_DMMU, %g2
+        srlx            %g2, CTX_PGSZ1_NUC_SHIFT, %o3
+        sllx            %o3, CTX_PGSZ1_NUC_SHIFT, %o3
+        or              %o0, %o3, %o0   /* Preserve nucleus page size fields */
+        stxa            %o0, [%o4] ASI_DMMU
+        andcc           %o1, 1, %g0
+        be,pn           %icc, 1f
+         andn           %o1, 1, %o3
+        stxa            %g0, [%o3] ASI_IMMU_DEMAP
+1:      stxa            %g0, [%o3] ASI_DMMU_DEMAP       
+        membar          #Sync
+        stxa            %g2, [%o4] ASI_DMMU
+        sethi           %hi(KERNBASE), %o4
+        flush           %o4
+        wrpr            %g0, 0, %tl
+        retl
+         wrpr           %g7, 0x0, %pstate
+
 __cheetah_flush_tlb_pending:    /* 27 insns */
         /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
         rdpr            %pstate, %g7
@@ -269,6 +321,20 @@ __hypervisor_flush_tlb_mm: /* 10 insns */
         retl
          nop
 
+__hypervisor_flush_tlb_page: /* 11 insns */
+        /* %o0 = context, %o1 = vaddr */
+        mov             %o0, %g2
+        mov             %o1, %o0              /* ARG0: vaddr + IMMU-bit */
+        mov             %g2, %o1              /* ARG1: mmu context */
+        mov             HV_MMU_ALL, %o2       /* ARG2: flags */
+        srlx            %o0, PAGE_SHIFT, %o0
+        sllx            %o0, PAGE_SHIFT, %o0
+        ta              HV_MMU_UNMAP_ADDR_TRAP
+        brnz,pn         %o0, __hypervisor_tlb_tl0_error
+         mov            HV_MMU_UNMAP_ADDR_TRAP, %o1
+        retl
+         nop
+
 __hypervisor_flush_tlb_pending: /* 16 insns */
         /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
         sllx            %o1, 3, %g1
@@ -339,6 +405,13 @@ cheetah_patch_cachetlbops:
         call            tlb_patch_one
          mov            19, %o2
 
+        sethi           %hi(__flush_tlb_page), %o0
+        or              %o0, %lo(__flush_tlb_page), %o0
+        sethi           %hi(__cheetah_flush_tlb_page), %o1
+        or              %o1, %lo(__cheetah_flush_tlb_page), %o1
+        call            tlb_patch_one
+         mov            22, %o2
+
         sethi           %hi(__flush_tlb_pending), %o0
         or              %o0, %lo(__flush_tlb_pending), %o0
         sethi           %hi(__cheetah_flush_tlb_pending), %o1
@@ -397,10 +470,9 @@ xcall_flush_tlb_mm:	/* 21 insns */
         nop
         nop
 
-        .globl          xcall_flush_tlb_pending
-xcall_flush_tlb_pending:        /* 21 insns */
-        /* %g5=context, %g1=nr, %g7=vaddrs[] */
-        sllx            %g1, 3, %g1
+        .globl          xcall_flush_tlb_page
+xcall_flush_tlb_page:   /* 17 insns */
+        /* %g5=context, %g1=vaddr */
         mov             PRIMARY_CONTEXT, %g4
         ldxa            [%g4] ASI_DMMU, %g2
         srlx            %g2, CTX_PGSZ1_NUC_SHIFT, %g4
@@ -408,20 +480,16 @@ xcall_flush_tlb_pending:	/* 21 insns */
         or              %g5, %g4, %g5
         mov             PRIMARY_CONTEXT, %g4
         stxa            %g5, [%g4] ASI_DMMU
-1:      sub             %g1, (1 << 3), %g1
-        ldx             [%g7 + %g1], %g5
-        andcc           %g5, 0x1, %g0
+        andcc           %g1, 0x1, %g0
         be,pn           %icc, 2f
-
-         andn           %g5, 0x1, %g5
+         andn           %g1, 0x1, %g5
         stxa            %g0, [%g5] ASI_IMMU_DEMAP
 2:      stxa            %g0, [%g5] ASI_DMMU_DEMAP
         membar          #Sync
-        brnz,pt         %g1, 1b
-         nop
         stxa            %g2, [%g4] ASI_DMMU
         retry
         nop
+        nop
 
         .globl          xcall_flush_tlb_kernel_range
 xcall_flush_tlb_kernel_range:   /* 25 insns */
@@ -656,15 +724,13 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */
         membar          #Sync
         retry
 
-        .globl          __hypervisor_xcall_flush_tlb_pending
-__hypervisor_xcall_flush_tlb_pending: /* 21 insns */
-        /* %g5=ctx, %g1=nr, %g7=vaddrs[], %g2,%g3,%g4,g6=scratch */
-        sllx            %g1, 3, %g1
+        .globl          __hypervisor_xcall_flush_tlb_page
+__hypervisor_xcall_flush_tlb_page: /* 17 insns */
+        /* %g5=ctx, %g1=vaddr */
         mov             %o0, %g2
         mov             %o1, %g3
         mov             %o2, %g4
-1:      sub             %g1, (1 << 3), %g1
-        ldx             [%g7 + %g1], %o0        /* ARG0: virtual address */
+        mov             %g1, %o0                /* ARG0: virtual address */
         mov             %g5, %o1                /* ARG1: mmu context */
         mov             HV_MMU_ALL, %o2         /* ARG2: flags */
         srlx            %o0, PAGE_SHIFT, %o0
@@ -673,8 +739,6 @@ __hypervisor_xcall_flush_tlb_pending: /* 21 insns */
         mov             HV_MMU_UNMAP_ADDR_TRAP, %g6
         brnz,a,pn       %o0, __hypervisor_tlb_xcall_error
          mov            %o0, %g5
-        brnz,pt         %g1, 1b
-         nop
         mov             %g2, %o0
         mov             %g3, %o1
         mov             %g4, %o2
@@ -757,6 +821,13 @@ hypervisor_patch_cachetlbops:
         call            tlb_patch_one
          mov            10, %o2
 
+        sethi           %hi(__flush_tlb_page), %o0
+        or              %o0, %lo(__flush_tlb_page), %o0
+        sethi           %hi(__hypervisor_flush_tlb_page), %o1
+        or              %o1, %lo(__hypervisor_flush_tlb_page), %o1
+        call            tlb_patch_one
+         mov            11, %o2
+
         sethi           %hi(__flush_tlb_pending), %o0
         or              %o0, %lo(__flush_tlb_pending), %o0
         sethi           %hi(__hypervisor_flush_tlb_pending), %o1
@@ -788,12 +859,12 @@ hypervisor_patch_cachetlbops:
         call            tlb_patch_one
          mov            21, %o2
 
-        sethi           %hi(xcall_flush_tlb_pending), %o0
-        or              %o0, %lo(xcall_flush_tlb_pending), %o0
-        sethi           %hi(__hypervisor_xcall_flush_tlb_pending), %o1
-        or              %o1, %lo(__hypervisor_xcall_flush_tlb_pending), %o1
+        sethi           %hi(xcall_flush_tlb_page), %o0
+        or              %o0, %lo(xcall_flush_tlb_page), %o0
+        sethi           %hi(__hypervisor_xcall_flush_tlb_page), %o1
+        or              %o1, %lo(__hypervisor_xcall_flush_tlb_page), %o1
         call            tlb_patch_one
-         mov            21, %o2
+         mov            17, %o2
 
         sethi           %hi(xcall_flush_tlb_kernel_range), %o0
         or              %o0, %lo(xcall_flush_tlb_kernel_range), %o0
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 70c0f3da0476..15b5cef4aa38 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1549,6 +1549,7 @@ config X86_SMAP
 config EFI
         bool "EFI runtime service support"
         depends on ACPI
+        select UCS2_STRING
         ---help---
           This enables the kernel to use EFI runtime services that are
           available (such as the EFI variable services).
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index c205035a6b96..8615f7581820 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -251,6 +251,51 @@ static void find_bits(unsigned long mask, u8 *pos, u8 *size)
         *size = len;
 }
 
+static efi_status_t setup_efi_vars(struct boot_params *params)
+{
+        struct setup_data *data;
+        struct efi_var_bootdata *efidata;
+        u64 store_size, remaining_size, var_size;
+        efi_status_t status;
+
+        if (!sys_table->runtime->query_variable_info)
+                return EFI_UNSUPPORTED;
+
+        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
+
+        while (data && data->next)
+                data = (struct setup_data *)(unsigned long)data->next;
+
+        status = efi_call_phys4(sys_table->runtime->query_variable_info,
+                                EFI_VARIABLE_NON_VOLATILE |
+                                EFI_VARIABLE_BOOTSERVICE_ACCESS |
+                                EFI_VARIABLE_RUNTIME_ACCESS, &store_size,
+                                &remaining_size, &var_size);
+
+        if (status != EFI_SUCCESS)
+                return status;
+
+        status = efi_call_phys3(sys_table->boottime->allocate_pool,
+                                EFI_LOADER_DATA, sizeof(*efidata), &efidata);
+
+        if (status != EFI_SUCCESS)
+                return status;
+
+        efidata->data.type = SETUP_EFI_VARS;
+        efidata->data.len = sizeof(struct efi_var_bootdata) -
+                sizeof(struct setup_data);
+        efidata->data.next = 0;
+        efidata->store_size = store_size;
+        efidata->remaining_size = remaining_size;
+        efidata->max_var_size = var_size;
+
+        if (data)
+                data->next = (unsigned long)efidata;
+        else
+                params->hdr.setup_data = (unsigned long)efidata;
+
+}
+
 static efi_status_t setup_efi_pci(struct boot_params *params)
 {
         efi_pci_io_protocol *pci;
@@ -1157,6 +1202,8 @@ struct boot_params *efi_main(void *handle, efi_system_table_t *_table,
 
         setup_graphics(boot_params);
 
+        setup_efi_vars(boot_params);
+
         setup_efi_pci(boot_params);
 
         status = efi_call_phys3(sys_table->boottime->allocate_pool,
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 60c89f30c727..2fb5d5884e23 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -102,6 +102,13 @@ extern void efi_call_phys_epilog(void);
 extern void efi_unmap_memmap(void);
 extern void efi_memory_uc(u64 addr, unsigned long size);
 
+struct efi_var_bootdata {
+        struct setup_data data;
+        u64 store_size;
+        u64 remaining_size;
+        u64 max_var_size;
+};
+
 #ifdef CONFIG_EFI
 
 static inline bool efi_is_native(void)
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index c15ddaf90710..08744242b8d2 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -6,6 +6,7 @@
 #define SETUP_E820_EXT                  1
 #define SETUP_DTB                       2
 #define SETUP_PCI                       3
+#define SETUP_EFI_VARS                  4
 
 /* ram_size flags */
 #define RAMDISK_IMAGE_START_MASK        0x07FF
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index a7d26d83fb70..8f4be53ea04b 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -35,13 +35,6 @@ static bool __init ms_hyperv_platform(void)
         if (!boot_cpu_has(X86_FEATURE_HYPERVISOR))
                 return false;
 
-        /*
-         * Xen emulates Hyper-V to support enlightened Windows.
-         * Check to see first if we are on a Xen Hypervisor.
-         */
-        if (xen_cpuid_base())
-                return false;
-
         cpuid(HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS,
               &eax, &hyp_signature[0], &hyp_signature[1], &hyp_signature[2]);
 
@@ -82,12 +75,6 @@ static void __init ms_hyperv_init_platform(void)
 
         if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE)
                 clocksource_register_hz(&hyperv_cs, NSEC_PER_SEC/100);
-#if IS_ENABLED(CONFIG_HYPERV)
-        /*
-         * Setup the IDT for hypervisor callback.
-         */
-        alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR, hyperv_callback_vector);
-#endif
 }
 
 const __refconst struct hypervisor_x86 x86_hyper_ms_hyperv = {
@@ -103,6 +90,11 @@ static irq_handler_t vmbus_isr;
 
 void hv_register_vmbus_handler(int irq, irq_handler_t handler)
 {
+        /*
+         * Setup the IDT for hypervisor callback.
+         */
+        alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR, hyperv_callback_vector);
+
         vmbus_irq = irq;
         vmbus_isr = handler;
 }
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index dab7580c47ae..cc45deb791b0 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -153,8 +153,14 @@ static struct event_constraint intel_gen_event_constraints[] __read_mostly =
 };
 
 static struct extra_reg intel_snb_extra_regs[] __read_mostly = {
-        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffffffffull, RSP_0),
-        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffffffffull, RSP_1),
+        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0),
+        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1),
+        EVENT_EXTRA_END
+};
+
+static struct extra_reg intel_snbep_extra_regs[] __read_mostly = {
+        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0),
+        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1),
         EVENT_EXTRA_END
 };
 
@@ -2097,7 +2103,10 @@ __init int intel_pmu_init(void)
                 x86_pmu.event_constraints = intel_snb_event_constraints;
                 x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
                 x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
-                x86_pmu.extra_regs = intel_snb_extra_regs;
+                if (boot_cpu_data.x86_model == 45)
+                        x86_pmu.extra_regs = intel_snbep_extra_regs;
+                else
+                        x86_pmu.extra_regs = intel_snb_extra_regs;
                 /* all extra regs are per-cpu when HT is on */
                 x86_pmu.er_flags |= ERF_HAS_RSP_1;
                 x86_pmu.er_flags |= ERF_NO_HT_SHARING;
@@ -2123,7 +2132,10 @@ __init int intel_pmu_init(void)
                 x86_pmu.event_constraints = intel_ivb_event_constraints;
                 x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints;
                 x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
-                x86_pmu.extra_regs = intel_snb_extra_regs;
+                if (boot_cpu_data.x86_model == 62)
+                        x86_pmu.extra_regs = intel_snbep_extra_regs;
+                else
+                        x86_pmu.extra_regs = intel_snb_extra_regs;
                 /* all extra regs are per-cpu when HT is on */
                 x86_pmu.er_flags |= ERF_HAS_RSP_1;
                 x86_pmu.er_flags |= ERF_NO_HT_SHARING;
diff --git a/arch/x86/kernel/microcode_core_early.c b/arch/x86/kernel/microcode_core_early.c
index 577db8417d15..833d51d6ee06 100644
--- a/arch/x86/kernel/microcode_core_early.c
+++ b/arch/x86/kernel/microcode_core_early.c
@@ -45,9 +45,6 @@ static int __cpuinit x86_vendor(void)
         u32 eax = 0x00000000;
         u32 ebx, ecx = 0, edx;
 
-        if (!have_cpuid_p())
-                return X86_VENDOR_UNKNOWN;
-
         native_cpuid(&eax, &ebx, &ecx, &edx);
 
         if (CPUID_IS(CPUID_INTEL1, CPUID_INTEL2, CPUID_INTEL3, ebx, ecx, edx))
@@ -59,18 +56,45 @@ static int __cpuinit x86_vendor(void)
         return X86_VENDOR_UNKNOWN;
 }
 
+static int __cpuinit x86_family(void)
+{
+        u32 eax = 0x00000001;
+        u32 ebx, ecx = 0, edx;
+        int x86;
+
+        native_cpuid(&eax, &ebx, &ecx, &edx);
+
+        x86 = (eax >> 8) & 0xf;
+        if (x86 == 15)
+                x86 += (eax >> 20) & 0xff;
+
+        return x86;
+}
+
 void __init load_ucode_bsp(void)
 {
-        int vendor = x86_vendor();
+        int vendor, x86;
+
+        if (!have_cpuid_p())
+                return;
 
-        if (vendor == X86_VENDOR_INTEL)
+        vendor = x86_vendor();
+        x86 = x86_family();
+
+        if (vendor == X86_VENDOR_INTEL && x86 >= 6)
                 load_ucode_intel_bsp();
 }
 
 void __cpuinit load_ucode_ap(void)
 {
-        int vendor = x86_vendor();
+        int vendor, x86;
+
+        if (!have_cpuid_p())
+                return;
+
+        vendor = x86_vendor();
+        x86 = x86_family();
 
-        if (vendor == X86_VENDOR_INTEL)
+        if (vendor == X86_VENDOR_INTEL && x86 >= 6)
                 load_ucode_intel_ap();
 }
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 90d8cc930f5e..fae9134a2de9 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -507,11 +507,14 @@ static void __init memblock_x86_reserve_range_setup_data(void)
 /*
  * Keep the crash kernel below this limit.  On 32 bits earlier kernels
  * would limit the kernel to the low 512 MiB due to mapping restrictions.
+ * On 64bit, old kexec-tools need to under 896MiB.
  */
 #ifdef CONFIG_X86_32
-# define CRASH_KERNEL_ADDR_MAX  (512 << 20)
+# define CRASH_KERNEL_ADDR_LOW_MAX      (512 << 20)
+# define CRASH_KERNEL_ADDR_HIGH_MAX     (512 << 20)
 #else
-# define CRASH_KERNEL_ADDR_MAX  MAXMEM
+# define CRASH_KERNEL_ADDR_LOW_MAX      (896UL<<20)
+# define CRASH_KERNEL_ADDR_HIGH_MAX     MAXMEM
 #endif
 
 static void __init reserve_crashkernel_low(void)
@@ -521,19 +524,35 @@ static void __init reserve_crashkernel_low(void)
         unsigned long long low_base = 0, low_size = 0;
         unsigned long total_low_mem;
         unsigned long long base;
+        bool auto_set = false;
         int ret;
 
         total_low_mem = memblock_mem_size(1UL<<(32-PAGE_SHIFT));
+        /* crashkernel=Y,low */
         ret = parse_crashkernel_low(boot_command_line, total_low_mem,
                                                 &low_size, &base);
-        if (ret != 0 || low_size <= 0)
-                return;
+        if (ret != 0) {
+                /*
+                 * two parts from lib/swiotlb.c:
+                 *      swiotlb size: user specified with swiotlb= or default.
+                 *      swiotlb overflow buffer: now is hardcoded to 32k.
+                 *              We round it to 8M for other buffers that
+                 *              may need to stay low too.
+                 */
+                low_size = swiotlb_size_or_default() + (8UL<<20);
+                auto_set = true;
+        } else {
+                /* passed with crashkernel=0,low ? */
+                if (!low_size)
+                        return;
+        }
 
         low_base = memblock_find_in_range(low_size, (1ULL<<32),
                                         low_size, alignment);
 
         if (!low_base) {
-                pr_info("crashkernel low reservation failed - No suitable area found.\n");
+                if (!auto_set)
+                        pr_info("crashkernel low reservation failed - No suitable area found.\n");
 
                 return;
         }
@@ -554,14 +573,22 @@ static void __init reserve_crashkernel(void)
         const unsigned long long alignment = 16<<20;    /* 16M */
         unsigned long long total_mem;
         unsigned long long crash_size, crash_base;
+        bool high = false;
         int ret;
 
         total_mem = memblock_phys_mem_size();
 
+        /* crashkernel=XM */
         ret = parse_crashkernel(boot_command_line, total_mem,
                         &crash_size, &crash_base);
-        if (ret != 0 || crash_size <= 0)
-                return;
+        if (ret != 0 || crash_size <= 0) {
+                /* crashkernel=X,high */
+                ret = parse_crashkernel_high(boot_command_line, total_mem,
+                                &crash_size, &crash_base);
+                if (ret != 0 || crash_size <= 0)
+                        return;
+                high = true;
+        }
 
         /* 0 means: find the address automatically */
         if (crash_base <= 0) {
@@ -569,7 +596,9 @@ static void __init reserve_crashkernel(void)
                  *  kexec want bzImage is below CRASH_KERNEL_ADDR_MAX
                  */
                 crash_base = memblock_find_in_range(alignment,
-                               CRASH_KERNEL_ADDR_MAX, crash_size, alignment);
+                                        high ? CRASH_KERNEL_ADDR_HIGH_MAX :
+                                               CRASH_KERNEL_ADDR_LOW_MAX,
+                                        crash_size, alignment);
 
                 if (!crash_base) {
                         pr_info("crashkernel reservation failed - No suitable area found.\n");
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 5f2ecaf3f9d8..e4a86a677ce1 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -41,6 +41,7 @@
 #include <linux/io.h>
 #include <linux/reboot.h>
 #include <linux/bcd.h>
+#include <linux/ucs2_string.h>
 
 #include <asm/setup.h>
 #include <asm/efi.h>
@@ -51,6 +52,13 @@
 
 #define EFI_DEBUG       1
 
+/*
+ * There's some additional metadata associated with each
+ * variable. Intel's reference implementation is 60 bytes - bump that
+ * to account for potential alignment constraints
+ */
+#define VAR_METADATA_SIZE 64
+
 struct efi __read_mostly efi = {
         .mps        = EFI_INVALID_TABLE_ADDR,
         .acpi       = EFI_INVALID_TABLE_ADDR,
@@ -69,6 +77,13 @@ struct efi_memory_map memmap;
 static struct efi efi_phys __initdata;
 static efi_system_table_t efi_systab __initdata;
 
+static u64 efi_var_store_size;
+static u64 efi_var_remaining_size;
+static u64 efi_var_max_var_size;
+static u64 boot_used_size;
+static u64 boot_var_size;
+static u64 active_size;
+
 unsigned long x86_efi_facility;
 
 /*
@@ -98,6 +113,15 @@ static int __init setup_add_efi_memmap(char *arg)
 }
 early_param("add_efi_memmap", setup_add_efi_memmap);
 
+static bool efi_no_storage_paranoia;
+
+static int __init setup_storage_paranoia(char *arg)
+{
+        efi_no_storage_paranoia = true;
+        return 0;
+}
+early_param("efi_no_storage_paranoia", setup_storage_paranoia);
+
 
 static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 {
@@ -162,8 +186,53 @@ static efi_status_t virt_efi_get_next_variable(unsigned long *name_size,
                                                efi_char16_t *name,
                                                efi_guid_t *vendor)
 {
-        return efi_call_virt3(get_next_variable,
-                              name_size, name, vendor);
+        efi_status_t status;
+        static bool finished = false;
+        static u64 var_size;
+
+        status = efi_call_virt3(get_next_variable,
+                                name_size, name, vendor);
+
+        if (status == EFI_NOT_FOUND) {
+                finished = true;
+                if (var_size < boot_used_size) {
+                        boot_var_size = boot_used_size - var_size;
+                        active_size += boot_var_size;
+                } else {
+                        printk(KERN_WARNING FW_BUG  "efi: Inconsistent initial sizes\n");
+                }
+        }
+
+        if (boot_used_size && !finished) {
+                unsigned long size;
+                u32 attr;
+                efi_status_t s;
+                void *tmp;
+
+                s = virt_efi_get_variable(name, vendor, &attr, &size, NULL);
+
+                if (s != EFI_BUFFER_TOO_SMALL || !size)
+                        return status;
+
+                tmp = kmalloc(size, GFP_ATOMIC);
+
+                if (!tmp)
+                        return status;
+
+                s = virt_efi_get_variable(name, vendor, &attr, &size, tmp);
+
+                if (s == EFI_SUCCESS && (attr & EFI_VARIABLE_NON_VOLATILE)) {
+                        var_size += size;
+                        var_size += ucs2_strsize(name, 1024);
+                        active_size += size;
+                        active_size += VAR_METADATA_SIZE;
+                        active_size += ucs2_strsize(name, 1024);
+                }
+
+                kfree(tmp);
+        }
+
+        return status;
 }
 
 static efi_status_t virt_efi_set_variable(efi_char16_t *name,
@@ -172,9 +241,34 @@ static efi_status_t virt_efi_set_variable(efi_char16_t *name,
                                           unsigned long data_size,
                                           void *data)
 {
-        return efi_call_virt5(set_variable,
-                              name, vendor, attr,
-                              data_size, data);
+        efi_status_t status;
+        u32 orig_attr = 0;
+        unsigned long orig_size = 0;
+
+        status = virt_efi_get_variable(name, vendor, &orig_attr, &orig_size,
+                                       NULL);
+
+        if (status != EFI_BUFFER_TOO_SMALL)
+                orig_size = 0;
+
+        status = efi_call_virt5(set_variable,
+                                name, vendor, attr,
+                                data_size, data);
+
+        if (status == EFI_SUCCESS) {
+                if (orig_size) {
+                        active_size -= orig_size;
+                        active_size -= ucs2_strsize(name, 1024);
+                        active_size -= VAR_METADATA_SIZE;
+                }
+                if (data_size) {
+                        active_size += data_size;
+                        active_size += ucs2_strsize(name, 1024);
+                        active_size += VAR_METADATA_SIZE;
+                }
+        }
+
+        return status;
 }
 
 static efi_status_t virt_efi_query_variable_info(u32 attr,
@@ -682,6 +776,9 @@ void __init efi_init(void)
         char vendor[100] = "unknown";
         int i = 0;
         void *tmp;
+        struct setup_data *data;
+        struct efi_var_bootdata *efi_var_data;
+        u64 pa_data;
 
 #ifdef CONFIG_X86_32
         if (boot_params.efi_info.efi_systab_hi ||
@@ -699,6 +796,22 @@ void __init efi_init(void)
         if (efi_systab_init(efi_phys.systab))
                 return;
 
+        pa_data = boot_params.hdr.setup_data;
+        while (pa_data) {
+                data = early_ioremap(pa_data, sizeof(*efi_var_data));
+                if (data->type == SETUP_EFI_VARS) {
+                        efi_var_data = (struct efi_var_bootdata *)data;
+
+                        efi_var_store_size = efi_var_data->store_size;
+                        efi_var_remaining_size = efi_var_data->remaining_size;
+                        efi_var_max_var_size = efi_var_data->max_var_size;
+                }
+                pa_data = data->next;
+                early_iounmap(data, sizeof(*efi_var_data));
+        }
+
+        boot_used_size = efi_var_store_size - efi_var_remaining_size;
+
         set_bit(EFI_SYSTEM_TABLES, &x86_efi_facility);
 
         /*
@@ -999,3 +1112,48 @@ u64 efi_mem_attributes(unsigned long phys_addr)
         }
         return 0;
 }
+
+/*
+ * Some firmware has serious problems when using more than 50% of the EFI
+ * variable store, i.e. it triggers bugs that can brick machines. Ensure that
+ * we never use more than this safe limit.
+ *
+ * Return EFI_SUCCESS if it is safe to write 'size' bytes to the variable
+ * store.
+ */
+efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
+{
+        efi_status_t status;
+        u64 storage_size, remaining_size, max_size;
+
+        status = efi.query_variable_info(attributes, &storage_size,
+                                         &remaining_size, &max_size);
+        if (status != EFI_SUCCESS)
+                return status;
+
+        if (!max_size && remaining_size > size)
+                printk_once(KERN_ERR FW_BUG "Broken EFI implementation"
+                            " is returning MaxVariableSize=0\n");
+        /*
+         * Some firmware implementations refuse to boot if there's insufficient
+         * space in the variable store. We account for that by refusing the
+         * write if permitting it would reduce the available space to under
+         * 50%. However, some firmware won't reclaim variable space until
+         * after the used (not merely the actively used) space drops below
+         * a threshold. We can approximate that case with the value calculated
+         * above. If both the firmware and our calculations indicate that the
+         * available space would drop below 50%, refuse the write.
+         */
+
+        if (!storage_size || size > remaining_size ||
+            (max_size && size > max_size))
+                return EFI_OUT_OF_RESOURCES;
+
+        if (!efi_no_storage_paranoia &&
+            ((active_size + size + VAR_METADATA_SIZE > storage_size / 2) &&
+             (remaining_size - size < storage_size / 2)))
+                return EFI_OUT_OF_RESOURCES;
+
+        return EFI_SUCCESS;
+}
+EXPORT_SYMBOL_GPL(efi_query_variable_store);
diff --git a/block/blk-core.c b/block/blk-core.c
index 074b758efc42..7c288358a745 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -39,6 +39,7 @@
 
 EXPORT_TRACEPOINT_SYMBOL_GPL(block_bio_remap);
 EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_remap);
+EXPORT_TRACEPOINT_SYMBOL_GPL(block_bio_complete);
 EXPORT_TRACEPOINT_SYMBOL_GPL(block_unplug);
 
 DEFINE_IDA(blk_queue_ida);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index f556f8a8b3f9..b7b7a88d9f68 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1742,9 +1742,10 @@ static int rbd_img_request_submit(struct rbd_img_request *img_request)
         struct rbd_device *rbd_dev = img_request->rbd_dev;
         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
         struct rbd_obj_request *obj_request;
+        struct rbd_obj_request *next_obj_request;
 
         dout("%s: img %p\n", __func__, img_request);
-        for_each_obj_request(img_request, obj_request) {
+        for_each_obj_request_safe(img_request, obj_request, next_obj_request) {
                 int ret;
 
                 obj_request->callback = rbd_img_obj_callback;
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index e3f9a99b8522..d784650d14f0 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -373,26 +373,14 @@ static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
         struct hpet_dev *devp;
         unsigned long addr;
 
-        if (((vma->vm_end - vma->vm_start) != PAGE_SIZE) || vma->vm_pgoff)
-                return -EINVAL;
-
         devp = file->private_data;
         addr = devp->hd_hpets->hp_hpet_phys;
 
         if (addr & (PAGE_SIZE - 1))
                 return -ENOSYS;
 
-        vma->vm_flags |= VM_IO;
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-
-        if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
-                                        PAGE_SIZE, vma->vm_page_prot)) {
-                printk(KERN_ERR "%s: io_remap_pfn_range failed\n",
-                        __func__);
-                return -EAGAIN;
-        }
-
-        return 0;
+        return vm_iomap_memory(vma, addr, PAGE_SIZE);
 #else
         return -ENOSYS;
 #endif
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 6e13f262139a..88cfc61329d2 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -310,8 +310,6 @@ static void atc_complete_all(struct at_dma_chan *atchan)
 
         dev_vdbg(chan2dev(&atchan->chan_common), "complete all\n");
 
-        BUG_ON(atc_chan_is_enabled(atchan));
-
         /*
          * Submit queued descriptors ASAP, i.e. before we go through
          * the completed ones.
@@ -368,6 +366,9 @@ static void atc_advance_work(struct at_dma_chan *atchan)
 {
         dev_vdbg(chan2dev(&atchan->chan_common), "advance_work\n");
 
+        if (atc_chan_is_enabled(atchan))
+                return;
+
         if (list_empty(&atchan->active_list) ||
             list_is_singular(&atchan->active_list)) {
                 atc_complete_all(atchan);
@@ -1078,9 +1079,7 @@ static void atc_issue_pending(struct dma_chan *chan)
                 return;
 
         spin_lock_irqsave(&atchan->lock, flags);
-        if (!atc_chan_is_enabled(atchan)) {
-                atc_advance_work(atchan);
-        }
+        atc_advance_work(atchan);
         spin_unlock_irqrestore(&atchan->lock, flags);
 }
 
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 42c759a4d047..3e532002e4d1 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -39,6 +39,7 @@ config FIRMWARE_MEMMAP
 config EFI_VARS
         tristate "EFI Variable Support via sysfs"
         depends on EFI
+        select UCS2_STRING
         default n
         help
           If you say Y here, you are able to get EFI (Extensible Firmware
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 7acafb80fd4c..182ce9471175 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -80,6 +80,7 @@
 #include <linux/slab.h>
 #include <linux/pstore.h>
 #include <linux/ctype.h>
+#include <linux/ucs2_string.h>
 
 #include <linux/fs.h>
 #include <linux/ramfs.h>
@@ -172,51 +173,6 @@ static void efivar_update_sysfs_entries(struct work_struct *);
 static DECLARE_WORK(efivar_work, efivar_update_sysfs_entries);
 static bool efivar_wq_enabled = true;
 
-/* Return the number of unicode characters in data */
-static unsigned long
-utf16_strnlen(efi_char16_t *s, size_t maxlength)
-{
-        unsigned long length = 0;
-
-        while (*s++ != 0 && length < maxlength)
-                length++;
-        return length;
-}
-
-static inline unsigned long
-utf16_strlen(efi_char16_t *s)
-{
-        return utf16_strnlen(s, ~0UL);
-}
-
-/*
- * Return the number of bytes is the length of this string
- * Note: this is NOT the same as the number of unicode characters
- */
-static inline unsigned long
-utf16_strsize(efi_char16_t *data, unsigned long maxlength)
-{
-        return utf16_strnlen(data, maxlength/sizeof(efi_char16_t)) * sizeof(efi_char16_t);
-}
-
-static inline int
-utf16_strncmp(const efi_char16_t *a, const efi_char16_t *b, size_t len)
-{
-        while (1) {
-                if (len == 0)
-                        return 0;
-                if (*a < *b)
-                        return -1;
-                if (*a > *b)
-                        return 1;
-                if (*a == 0) /* implies *b == 0 */
-                        return 0;
-                a++;
-                b++;
-                len--;
-        }
-}
-
 static bool
 validate_device_path(struct efi_variable *var, int match, u8 *buffer,
                      unsigned long len)
@@ -268,7 +224,7 @@ validate_load_option(struct efi_variable *var, int match, u8 *buffer,
         u16 filepathlength;
         int i, desclength = 0, namelen;
 
-        namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName));
+        namelen = ucs2_strnlen(var->VariableName, sizeof(var->VariableName));
 
         /* Either "Boot" or "Driver" followed by four digits of hex */
         for (i = match; i < match+4; i++) {
@@ -291,7 +247,7 @@ validate_load_option(struct efi_variable *var, int match, u8 *buffer,
          * There's no stored length for the description, so it has to be
          * found by hand
          */
-        desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2;
+        desclength = ucs2_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2;
 
         /* Each boot entry must have a descriptor */
         if (!desclength)
@@ -436,24 +392,12 @@ static efi_status_t
 check_var_size_locked(struct efivars *efivars, u32 attributes,
                         unsigned long size)
 {
-        u64 storage_size, remaining_size, max_size;
-        efi_status_t status;
         const struct efivar_operations *fops = efivars->ops;
 
-        if (!efivars->ops->query_variable_info)
+        if (!efivars->ops->query_variable_store)
                 return EFI_UNSUPPORTED;
 
-        status = fops->query_variable_info(attributes, &storage_size,
-                                           &remaining_size, &max_size);
-
-        if (status != EFI_SUCCESS)
-                return status;
-
-        if (!storage_size || size > remaining_size || size > max_size ||
-            (remaining_size - size) < (storage_size / 2))
-                return EFI_OUT_OF_RESOURCES;
-
-        return status;
+        return fops->query_variable_store(attributes, size);
 }
 
 
@@ -593,7 +537,7 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
         spin_lock_irq(&efivars->lock);
 
         status = check_var_size_locked(efivars, new_var->Attributes,
-               new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
+               new_var->DataSize + ucs2_strsize(new_var->VariableName, 1024));
 
         if (status == EFI_SUCCESS || status == EFI_UNSUPPORTED)
                 status = efivars->ops->set_variable(new_var->VariableName,
@@ -771,7 +715,7 @@ static ssize_t efivarfs_file_write(struct file *file,
          * QueryVariableInfo() isn't supported by the firmware.
          */
 
-        varsize = datasize + utf16_strsize(var->var.VariableName, 1024);
+        varsize = datasize + ucs2_strsize(var->var.VariableName, 1024);
         status = check_var_size(efivars, attributes, varsize);
 
         if (status != EFI_SUCCESS) {
@@ -1223,7 +1167,7 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
 
                 inode = NULL;
 
-                len = utf16_strlen(entry->var.VariableName);
+                len = ucs2_strlen(entry->var.VariableName);
 
                 /* name, plus '-', plus GUID, plus NUL*/
                 name = kmalloc(len + 1 + GUID_LEN + 1, GFP_ATOMIC);
@@ -1481,8 +1425,8 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 
                 if (efi_guidcmp(entry->var.VendorGuid, vendor))
                         continue;
-                if (utf16_strncmp(entry->var.VariableName, efi_name,
-                                  utf16_strlen(efi_name))) {
+                if (ucs2_strncmp(entry->var.VariableName, efi_name,
+                                  ucs2_strlen(efi_name))) {
                         /*
                          * Check if an old format,
                          * which doesn't support holding
@@ -1494,8 +1438,8 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
                         for (i = 0; i < DUMP_NAME_LEN; i++)
                                 efi_name_old[i] = name_old[i];
 
-                        if (utf16_strncmp(entry->var.VariableName, efi_name_old,
-                                          utf16_strlen(efi_name_old)))
+                        if (ucs2_strncmp(entry->var.VariableName, efi_name_old,
+                                          ucs2_strlen(efi_name_old)))
                                 continue;
                 }
 
@@ -1573,8 +1517,8 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
          * Does this variable already exist?
          */
         list_for_each_entry_safe(search_efivar, n, &efivars->list, list) {
-                strsize1 = utf16_strsize(search_efivar->var.VariableName, 1024);
-                strsize2 = utf16_strsize(new_var->VariableName, 1024);
+                strsize1 = ucs2_strsize(search_efivar->var.VariableName, 1024);
+                strsize2 = ucs2_strsize(new_var->VariableName, 1024);
                 if (strsize1 == strsize2 &&
                         !memcmp(&(search_efivar->var.VariableName),
                                 new_var->VariableName, strsize1) &&
@@ -1590,7 +1534,7 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
         }
 
         status = check_var_size_locked(efivars, new_var->Attributes,
-               new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
+               new_var->DataSize + ucs2_strsize(new_var->VariableName, 1024));
 
         if (status && status != EFI_UNSUPPORTED) {
                 spin_unlock_irq(&efivars->lock);
@@ -1614,7 +1558,7 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
 
         /* Create the entry in sysfs.  Locking is not required here */
         status = efivar_create_sysfs_entry(efivars,
-                                           utf16_strsize(new_var->VariableName,
+                                           ucs2_strsize(new_var->VariableName,
                                                          1024),
                                            new_var->VariableName,
                                            &new_var->VendorGuid);
@@ -1644,8 +1588,8 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
          * Does this variable already exist?
          */
         list_for_each_entry_safe(search_efivar, n, &efivars->list, list) {
-                strsize1 = utf16_strsize(search_efivar->var.VariableName, 1024);
-                strsize2 = utf16_strsize(del_var->VariableName, 1024);
+                strsize1 = ucs2_strsize(search_efivar->var.VariableName, 1024);
+                strsize2 = ucs2_strsize(del_var->VariableName, 1024);
                 if (strsize1 == strsize2 &&
                         !memcmp(&(search_efivar->var.VariableName),
                                 del_var->VariableName, strsize1) &&
@@ -1691,9 +1635,9 @@ static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor)
         unsigned long strsize1, strsize2;
         bool found = false;
 
-        strsize1 = utf16_strsize(variable_name, 1024);
+        strsize1 = ucs2_strsize(variable_name, 1024);
         list_for_each_entry_safe(entry, n, &efivars->list, list) {
-                strsize2 = utf16_strsize(entry->var.VariableName, 1024);
+                strsize2 = ucs2_strsize(entry->var.VariableName, 1024);
                 if (strsize1 == strsize2 &&
                         !memcmp(variable_name, &(entry->var.VariableName),
                                 strsize2) &&
@@ -2131,7 +2075,7 @@ efivars_init(void)
         ops.get_variable = efi.get_variable;
         ops.set_variable = efi.set_variable;
         ops.get_next_variable = efi.get_next_variable;
-        ops.query_variable_info = efi.query_variable_info;
+        ops.query_variable_store = efi_query_variable_store;
 
         error = register_efivars(&__efivars, &ops, efi_kobj);
         if (error)
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 5d6675013864..1a38dd7dfe4e 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -465,6 +465,7 @@ static const struct x86_cpu_id intel_idle_ids[] = {
         ICPU(0x3c, idle_cpu_hsw),
         ICPU(0x3f, idle_cpu_hsw),
         ICPU(0x45, idle_cpu_hsw),
+        ICPU(0x46, idle_cpu_hsw),
         {}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_idle_ids);
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 1daa97913b7d..0bfd8cf25200 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -359,7 +359,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
                 case 0x802: /* Intuos4 General Pen */
                 case 0x804: /* Intuos4 Marker Pen */
                 case 0x40802: /* Intuos4 Classic Pen */
-                case 0x18803: /* DTH2242 Grip Pen */
+                case 0x18802: /* DTH2242 Grip Pen */
                 case 0x022:
                         wacom->tool[idx] = BTN_TOOL_PEN;
                         break;
@@ -1912,7 +1912,7 @@ static const struct wacom_features wacom_features_0xBB =
         { "Wacom Intuos4 12x19",  WACOM_PKGLEN_INTUOS,    97536, 60960, 2047,
           63, INTUOS4L, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0xBC =
-        { "Wacom Intuos4 WL",     WACOM_PKGLEN_INTUOS,    40840, 25400, 2047,
+        { "Wacom Intuos4 WL",     WACOM_PKGLEN_INTUOS,    40640, 25400, 2047,
           63, INTUOS4, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0x26 =
         { "Wacom Intuos5 touch S", WACOM_PKGLEN_INTUOS,  31496, 19685, 2047,
@@ -2144,7 +2144,7 @@ const struct usb_device_id wacom_ids[] = {
         { USB_DEVICE_WACOM(0x44) },
         { USB_DEVICE_WACOM(0x45) },
         { USB_DEVICE_WACOM(0x59) },
-        { USB_DEVICE_WACOM(0x5D) },
+        { USB_DEVICE_DETAILED(0x5D, USB_CLASS_HID, 0, 0) },
         { USB_DEVICE_WACOM(0xB0) },
         { USB_DEVICE_WACOM(0xB1) },
         { USB_DEVICE_WACOM(0xB2) },
@@ -2209,7 +2209,7 @@ const struct usb_device_id wacom_ids[] = {
         { USB_DEVICE_WACOM(0x47) },
         { USB_DEVICE_WACOM(0xF4) },
         { USB_DEVICE_WACOM(0xF8) },
-        { USB_DEVICE_WACOM(0xF6) },
+        { USB_DEVICE_DETAILED(0xF6, USB_CLASS_HID, 0, 0) },
         { USB_DEVICE_WACOM(0xFA) },
         { USB_DEVICE_LENOVO(0x6004) },
         { }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index a32e0d5aa45f..fc6aebf1e4b2 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -236,7 +236,8 @@ static int gic_retrigger(struct irq_data *d)
         if (gic_arch_extn.irq_retrigger)
                 return gic_arch_extn.irq_retrigger(d);
 
-        return -ENXIO;
+        /* the genirq layer expects 0 if we can't retrigger in hardware */
+        return 0;
 }
 
 #ifdef CONFIG_SMP
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 7e469260fe5e..9a0bdad9ad8f 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -611,6 +611,7 @@ static void dec_pending(struct dm_io *io, int error)
                         queue_io(md, bio);
                 } else {
                         /* done with normal IO or empty flush */
+                        trace_block_bio_complete(md->queue, bio, io_error);
                         bio_endio(bio, io_error);
                 }
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 24909eb13fec..f4e87bfc7567 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -184,6 +184,8 @@ static void return_io(struct bio *return_bi)
                 return_bi = bi->bi_next;
                 bi->bi_next = NULL;
                 bi->bi_size = 0;
+                trace_block_bio_complete(bdev_get_queue(bi->bi_bdev),
+                                         bi, 0);
                 bio_endio(bi, 0);
                 bi = return_bi;
         }
@@ -3914,6 +3916,8 @@ static void raid5_align_endio(struct bio *bi, int error)
         rdev_dec_pending(rdev, conf->mddev);
 
         if (!error && uptodate) {
+                trace_block_bio_complete(bdev_get_queue(raid_bi->bi_bdev),
+                                         raid_bi, 0);
                 bio_endio(raid_bi, 0);
                 if (atomic_dec_and_test(&conf->active_aligned_reads))
                         wake_up(&conf->wait_for_stripe);
@@ -4382,6 +4386,8 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                 if ( rw == WRITE )
                         md_write_end(mddev);
 
+                trace_block_bio_complete(bdev_get_queue(bi->bi_bdev),
+                                         bi, 0);
                 bio_endio(bi, 0);
         }
 }
@@ -4758,8 +4764,11 @@ static int  retry_aligned_read(struct r5conf *conf, struct bio *raid_bio)
                 handled++;
         }
         remaining = raid5_dec_bi_active_stripes(raid_bio);
-        if (remaining == 0)
+        if (remaining == 0) {
+                trace_block_bio_complete(bdev_get_queue(raid_bio->bi_bdev),
+                                         raid_bio, 0);
                 bio_endio(raid_bio, 0);
+        }
         if (atomic_dec_and_test(&conf->active_aligned_reads))
                 wake_up(&conf->wait_for_stripe);
         return handled;
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 92ab30ab00dc..dc571ebc1aa0 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -1123,33 +1123,6 @@ static unsigned long mtdchar_get_unmapped_area(struct file *file,
 }
 #endif
 
-static inline unsigned long get_vm_size(struct vm_area_struct *vma)
-{
-        return vma->vm_end - vma->vm_start;
-}
-
-static inline resource_size_t get_vm_offset(struct vm_area_struct *vma)
-{
-        return (resource_size_t) vma->vm_pgoff << PAGE_SHIFT;
-}
-
-/*
- * Set a new vm offset.
- *
- * Verify that the incoming offset really works as a page offset,
- * and that the offset and size fit in a resource_size_t.
- */
-static inline int set_vm_offset(struct vm_area_struct *vma, resource_size_t off)
-{
-        pgoff_t pgoff = off >> PAGE_SHIFT;
-        if (off != (resource_size_t) pgoff << PAGE_SHIFT)
-                return -EINVAL;
-        if (off + get_vm_size(vma) - 1 < off)
-                return -EINVAL;
-        vma->vm_pgoff = pgoff;
-        return 0;
-}
-
 /*
  * set up a mapping for shared memory segments
  */
@@ -1159,45 +1132,17 @@ static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
         struct mtd_file_info *mfi = file->private_data;
         struct mtd_info *mtd = mfi->mtd;
         struct map_info *map = mtd->priv;
-        resource_size_t start, off;
-        unsigned long len, vma_len;
 
         /* This is broken because it assumes the MTD device is map-based
            and that mtd->priv is a valid struct map_info.  It should be
            replaced with something that uses the mtd_get_unmapped_area()
            operation properly. */
         if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) {
-                off = get_vm_offset(vma);
-                start = map->phys;
-                len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
-                start &= PAGE_MASK;
-                vma_len = get_vm_size(vma);
-
-                /* Overflow in off+len? */
-                if (vma_len + off < off)
-                        return -EINVAL;
-                /* Does it fit in the mapping? */
-                if (vma_len + off > len)
-                        return -EINVAL;
-
-                off += start;
-                /* Did that overflow? */
-                if (off < start)
-                        return -EINVAL;
-                if (set_vm_offset(vma, off) < 0)
-                        return -EINVAL;
-                vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
-
 #ifdef pgprot_noncached
-                if (file->f_flags & O_DSYNC || off >= __pa(high_memory))
+                if (file->f_flags & O_DSYNC || map->phys >= __pa(high_memory))
                         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 #endif
-                if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
-                                       vma->vm_end - vma->vm_start,
-                                       vma->vm_page_prot))
-                        return -EAGAIN;
-
-                return 0;
+                return vm_iomap_memory(vma, map->phys, map->size);
         }
         return -ENOSYS;
 #else
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 07401a3e256b..dbbea0eec134 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -846,8 +846,10 @@ static void bond_mc_swap(struct bonding *bond, struct slave *new_active,
                 if (bond->dev->flags & IFF_ALLMULTI)
                         dev_set_allmulti(old_active->dev, -1);
 
+                netif_addr_lock_bh(bond->dev);
                 netdev_for_each_mc_addr(ha, bond->dev)
                         dev_mc_del(old_active->dev, ha->addr);
+                netif_addr_unlock_bh(bond->dev);
         }
 
         if (new_active) {
@@ -858,8 +860,10 @@ static void bond_mc_swap(struct bonding *bond, struct slave *new_active,
                 if (bond->dev->flags & IFF_ALLMULTI)
                         dev_set_allmulti(new_active->dev, 1);
 
+                netif_addr_lock_bh(bond->dev);
                 netdev_for_each_mc_addr(ha, bond->dev)
                         dev_mc_add(new_active->dev, ha->addr);
+                netif_addr_unlock_bh(bond->dev);
         }
 }
 
@@ -1901,11 +1905,29 @@ err_dest_symlinks:
         bond_destroy_slave_symlinks(bond_dev, slave_dev);
 
 err_detach:
+        if (!USES_PRIMARY(bond->params.mode)) {
+                netif_addr_lock_bh(bond_dev);
+                bond_mc_list_flush(bond_dev, slave_dev);
+                netif_addr_unlock_bh(bond_dev);
+        }
+        bond_del_vlans_from_slave(bond, slave_dev);
         write_lock_bh(&bond->lock);
         bond_detach_slave(bond, new_slave);
+        if (bond->primary_slave == new_slave)
+                bond->primary_slave = NULL;
         write_unlock_bh(&bond->lock);
+        if (bond->curr_active_slave == new_slave) {
+                read_lock(&bond->lock);
+                write_lock_bh(&bond->curr_slave_lock);
+                bond_change_active_slave(bond, NULL);
+                bond_select_active_slave(bond);
+                write_unlock_bh(&bond->curr_slave_lock);
+                read_unlock(&bond->lock);
+        }
+        slave_disable_netpoll(new_slave);
 
 err_close:
+        slave_dev->priv_flags &= ~IFF_BONDING;
         dev_close(slave_dev);
 
 err_unset_master:
@@ -3168,11 +3190,20 @@ static int bond_slave_netdev_event(unsigned long event,
                                    struct net_device *slave_dev)
 {
         struct slave *slave = bond_slave_get_rtnl(slave_dev);
-        struct bonding *bond = slave->bond;
-        struct net_device *bond_dev = slave->bond->dev;
+        struct bonding *bond;
+        struct net_device *bond_dev;
         u32 old_speed;
         u8 old_duplex;
 
+        /* A netdev event can be generated while enslaving a device
+         * before netdev_rx_handler_register is called in which case
+         * slave will be NULL
+         */
+        if (!slave)
+                return NOTIFY_DONE;
+        bond_dev = slave->bond->dev;
+        bond = slave->bond;
+
         switch (event) {
         case NETDEV_UNREGISTER:
                 if (bond->setup_by_slave)
@@ -3286,20 +3317,22 @@ static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
  */
 static int bond_xmit_hash_policy_l23(struct sk_buff *skb, int count)
 {
-        struct ethhdr *data = (struct ethhdr *)skb->data;
-        struct iphdr *iph;
-        struct ipv6hdr *ipv6h;
+        const struct ethhdr *data;
+        const struct iphdr *iph;
+        const struct ipv6hdr *ipv6h;
         u32 v6hash;
-        __be32 *s, *d;
+        const __be32 *s, *d;
 
         if (skb->protocol == htons(ETH_P_IP) &&
-            skb_network_header_len(skb) >= sizeof(*iph)) {
+            pskb_network_may_pull(skb, sizeof(*iph))) {
                 iph = ip_hdr(skb);
+                data = (struct ethhdr *)skb->data;
                 return ((ntohl(iph->saddr ^ iph->daddr) & 0xffff) ^
                         (data->h_dest[5] ^ data->h_source[5])) % count;
         } else if (skb->protocol == htons(ETH_P_IPV6) &&
-                   skb_network_header_len(skb) >= sizeof(*ipv6h)) {
+                   pskb_network_may_pull(skb, sizeof(*ipv6h))) {
                 ipv6h = ipv6_hdr(skb);
+                data = (struct ethhdr *)skb->data;
                 s = &ipv6h->saddr.s6_addr32[0];
                 d = &ipv6h->daddr.s6_addr32[0];
                 v6hash = (s[1] ^ d[1]) ^ (s[2] ^ d[2]) ^ (s[3] ^ d[3]);
@@ -3318,33 +3351,36 @@ static int bond_xmit_hash_policy_l23(struct sk_buff *skb, int count)
 static int bond_xmit_hash_policy_l34(struct sk_buff *skb, int count)
 {
         u32 layer4_xor = 0;
-        struct iphdr *iph;
-        struct ipv6hdr *ipv6h;
-        __be32 *s, *d;
-        __be16 *layer4hdr;
+        const struct iphdr *iph;
+        const struct ipv6hdr *ipv6h;
+        const __be32 *s, *d;
+        const __be16 *l4 = NULL;
+        __be16 _l4[2];
+        int noff = skb_network_offset(skb);
+        int poff;
 
         if (skb->protocol == htons(ETH_P_IP) &&
-            skb_network_header_len(skb) >= sizeof(*iph)) {
+            pskb_may_pull(skb, noff + sizeof(*iph))) {
                 iph = ip_hdr(skb);
-                if (!ip_is_fragment(iph) &&
-                    (iph->protocol == IPPROTO_TCP ||
-                     iph->protocol == IPPROTO_UDP) &&
-                    (skb_headlen(skb) - skb_network_offset(skb) >=
-                     iph->ihl * sizeof(u32) + sizeof(*layer4hdr) * 2)) {
-                        layer4hdr = (__be16 *)((u32 *)iph + iph->ihl);
-                        layer4_xor = ntohs(*layer4hdr ^ *(layer4hdr + 1));
+                poff = proto_ports_offset(iph->protocol);
+
+                if (!ip_is_fragment(iph) && poff >= 0) {
+                        l4 = skb_header_pointer(skb, noff + (iph->ihl << 2) + poff,
+                                                sizeof(_l4), &_l4);
+                        if (l4)
+                                layer4_xor = ntohs(l4[0] ^ l4[1]);
                 }
                 return (layer4_xor ^
                         ((ntohl(iph->saddr ^ iph->daddr)) & 0xffff)) % count;
         } else if (skb->protocol == htons(ETH_P_IPV6) &&
-                   skb_network_header_len(skb) >= sizeof(*ipv6h)) {
+                   pskb_may_pull(skb, noff + sizeof(*ipv6h))) {
                 ipv6h = ipv6_hdr(skb);
-                if ((ipv6h->nexthdr == IPPROTO_TCP ||
-                     ipv6h->nexthdr == IPPROTO_UDP) &&
-                    (skb_headlen(skb) - skb_network_offset(skb) >=
-                     sizeof(*ipv6h) + sizeof(*layer4hdr) * 2)) {
-                        layer4hdr = (__be16 *)(ipv6h + 1);
-                        layer4_xor = ntohs(*layer4hdr ^ *(layer4hdr + 1));
+                poff = proto_ports_offset(ipv6h->nexthdr);
+                if (poff >= 0) {
+                        l4 = skb_header_pointer(skb, noff + sizeof(*ipv6h) + poff,
+                                                sizeof(_l4), &_l4);
+                        if (l4)
+                                layer4_xor = ntohs(l4[0] ^ l4[1]);
                 }
                 s = &ipv6h->saddr.s6_addr32[0];
                 d = &ipv6h->daddr.s6_addr32[0];
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index f32b9fc6a983..9aa0c64c33c8 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -929,6 +929,7 @@ static int mcp251x_open(struct net_device *net)
         struct mcp251x_priv *priv = netdev_priv(net);
         struct spi_device *spi = priv->spi;
         struct mcp251x_platform_data *pdata = spi->dev.platform_data;
+        unsigned long flags;
         int ret;
 
         ret = open_candev(net);
@@ -945,9 +946,14 @@ static int mcp251x_open(struct net_device *net)
         priv->tx_skb = NULL;
         priv->tx_len = 0;
 
+        flags = IRQF_ONESHOT;
+        if (pdata->irq_flags)
+                flags |= pdata->irq_flags;
+        else
+                flags |= IRQF_TRIGGER_FALLING;
+
         ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
-                  pdata->irq_flags ? pdata->irq_flags : IRQF_TRIGGER_FALLING,
-                  DEVICE_NAME, priv);
+                                   flags, DEVICE_NAME, priv);
         if (ret) {
                 dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
                 if (pdata->transceiver_enable)
diff --git a/drivers/net/can/sja1000/sja1000_of_platform.c b/drivers/net/can/sja1000/sja1000_of_platform.c
index 6433b81256cd..8e0c4a001939 100644
--- a/drivers/net/can/sja1000/sja1000_of_platform.c
+++ b/drivers/net/can/sja1000/sja1000_of_platform.c
@@ -96,8 +96,8 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
         struct net_device *dev;
         struct sja1000_priv *priv;
         struct resource res;
-        const u32 *prop;
-        int err, irq, res_size, prop_size;
+        u32 prop;
+        int err, irq, res_size;
         void __iomem *base;
 
         err = of_address_to_resource(np, 0, &res);
@@ -138,27 +138,27 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
         priv->read_reg = sja1000_ofp_read_reg;
         priv->write_reg = sja1000_ofp_write_reg;
 
-        prop = of_get_property(np, "nxp,external-clock-frequency", &prop_size);
-        if (prop && (prop_size ==  sizeof(u32)))
-                priv->can.clock.freq = *prop / 2;
+        err = of_property_read_u32(np, "nxp,external-clock-frequency", &prop);
+        if (!err)
+                priv->can.clock.freq = prop / 2;
         else
                 priv->can.clock.freq = SJA1000_OFP_CAN_CLOCK; /* default */
 
-        prop = of_get_property(np, "nxp,tx-output-mode", &prop_size);
-        if (prop && (prop_size == sizeof(u32)))
-                priv->ocr |= *prop & OCR_MODE_MASK;
+        err = of_property_read_u32(np, "nxp,tx-output-mode", &prop);
+        if (!err)
+                priv->ocr |= prop & OCR_MODE_MASK;
         else
                 priv->ocr |= OCR_MODE_NORMAL; /* default */
 
-        prop = of_get_property(np, "nxp,tx-output-config", &prop_size);
-        if (prop && (prop_size == sizeof(u32)))
-                priv->ocr |= (*prop << OCR_TX_SHIFT) & OCR_TX_MASK;
+        err = of_property_read_u32(np, "nxp,tx-output-config", &prop);
+        if (!err)
+                priv->ocr |= (prop << OCR_TX_SHIFT) & OCR_TX_MASK;
         else
                 priv->ocr |= OCR_TX0_PULLDOWN; /* default */
 
-        prop = of_get_property(np, "nxp,clock-out-frequency", &prop_size);
-        if (prop && (prop_size == sizeof(u32)) && *prop) {
-                u32 divider = priv->can.clock.freq * 2 / *prop;
+        err = of_property_read_u32(np, "nxp,clock-out-frequency", &prop);
+        if (!err && prop) {
+                u32 divider = priv->can.clock.freq * 2 / prop;
 
                 if (divider > 1)
                         priv->cdr |= divider / 2 - 1;
@@ -168,8 +168,7 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
                 priv->cdr |= CDR_CLK_OFF; /* default */
         }
 
-        prop = of_get_property(np, "nxp,no-comparator-bypass", NULL);
-        if (!prop)
+        if (!of_property_read_bool(np, "nxp,no-comparator-bypass"))
                 priv->cdr |= CDR_CBP; /* default */
 
         priv->irq_flags = IRQF_SHARED;
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
index cab306a9888e..e1d26433d619 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -828,7 +828,7 @@ static int ax_probe(struct platform_device *pdev)
         struct ei_device *ei_local;
         struct ax_device *ax;
         struct resource *irq, *mem, *mem2;
-        resource_size_t mem_size, mem2_size = 0;
+        unsigned long mem_size, mem2_size = 0;
         int ret = 0;
 
         dev = ax__alloc_ei_netdev(sizeof(struct ax_device));
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 4046f97378c2..57619dd4a92b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2614,6 +2614,9 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                         }
                 }
 
+                /* initialize FW coalescing state machines in RAM */
+                bnx2x_update_coalesce(bp);
+
                 /* setup the leading queue */
                 rc = bnx2x_setup_leading(bp);
                 if (rc) {
@@ -4580,11 +4583,11 @@ static void storm_memset_hc_disable(struct bnx2x *bp, u8 port,
         u32 enable_flag = disable ? 0 : (1 << HC_INDEX_DATA_HC_ENABLED_SHIFT);
         u32 addr = BAR_CSTRORM_INTMEM +
                    CSTORM_STATUS_BLOCK_DATA_FLAGS_OFFSET(fw_sb_id, sb_index);
-        u16 flags = REG_RD16(bp, addr);
+        u8 flags = REG_RD8(bp, addr);
         /* clear and set */
         flags &= ~HC_INDEX_DATA_HC_ENABLED;
         flags |= enable_flag;
-        REG_WR16(bp, addr, flags);
+        REG_WR8(bp, addr, flags);
         DP(NETIF_MSG_IFUP,
            "port %x fw_sb_id %d sb_index %d disable %d\n",
            port, fw_sb_id, sb_index, disable);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 8e58da909f5c..c50696b396f1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -9878,6 +9878,10 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
                                 REG_RD(bp, NIG_REG_NIG_INT_STS_CLR_0);
                         }
                 }
+                if (!CHIP_IS_E1x(bp))
+                        /* block FW from writing to host */
+                        REG_WR(bp, PGLUE_B_REG_INTERNAL_PFID_ENABLE_MASTER, 0);
+
                 /* wait until BRB is empty */
                 tmp_reg = REG_RD(bp, BRB1_REG_NUM_OF_FULL_BLOCKS);
                 while (timer_count) {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 08e54f3d288b..2886c9b63f90 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -759,8 +759,9 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
 
         if (vlan_tx_tag_present(skb)) {
                 vlan_tag = be_get_tx_vlan_tag(adapter, skb);
-                __vlan_put_tag(skb, vlan_tag);
-                skb->vlan_tci = 0;
+                skb = __vlan_put_tag(skb, vlan_tag);
+                if (skb)
+                        skb->vlan_tci = 0;
         }
 
         return skb;
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index f292c3aa423f..73195f643c9c 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -1002,6 +1002,7 @@ static void fec_enet_adjust_link(struct net_device *ndev)
         } else {
                 if (fep->link) {
                         fec_stop(ndev);
+                        fep->link = phy_dev->link;
                         status_change = 1;
                 }
         }
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index 25151401c2ab..ab577a763a20 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -284,18 +284,10 @@ struct igb_q_vector {
 enum e1000_ring_flags_t {
         IGB_RING_FLAG_RX_SCTP_CSUM,
         IGB_RING_FLAG_RX_LB_VLAN_BSWAP,
-        IGB_RING_FLAG_RX_BUILD_SKB_ENABLED,
         IGB_RING_FLAG_TX_CTX_IDX,
         IGB_RING_FLAG_TX_DETECT_HANG
 };
 
-#define ring_uses_build_skb(ring) \
-        test_bit(IGB_RING_FLAG_RX_BUILD_SKB_ENABLED, &(ring)->flags)
-#define set_ring_build_skb_enabled(ring) \
-        set_bit(IGB_RING_FLAG_RX_BUILD_SKB_ENABLED, &(ring)->flags)
-#define clear_ring_build_skb_enabled(ring) \
-        clear_bit(IGB_RING_FLAG_RX_BUILD_SKB_ENABLED, &(ring)->flags)
-
 #define IGB_TXD_DCMD (E1000_ADVTXD_DCMD_EOP | E1000_ADVTXD_DCMD_RS)
 
 #define IGB_RX_DESC(R, i)           \
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 8496adfc6a68..64f75291e3a5 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3350,20 +3350,6 @@ void igb_configure_rx_ring(struct igb_adapter *adapter,
         wr32(E1000_RXDCTL(reg_idx), rxdctl);
 }
 
-static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
-                                  struct igb_ring *rx_ring)
-{
-#define IGB_MAX_BUILD_SKB_SIZE \
-        (SKB_WITH_OVERHEAD(IGB_RX_BUFSZ) - \
-         (NET_SKB_PAD + NET_IP_ALIGN + IGB_TS_HDR_LEN))
-
-        /* set build_skb flag */
-        if (adapter->max_frame_size <= IGB_MAX_BUILD_SKB_SIZE)
-                set_ring_build_skb_enabled(rx_ring);
-        else
-                clear_ring_build_skb_enabled(rx_ring);
-}
-
 /**
  * igb_configure_rx - Configure receive Unit after Reset
  * @adapter: board private structure
@@ -3383,11 +3369,8 @@ static void igb_configure_rx(struct igb_adapter *adapter)
 
         /* Setup the HW Rx Head and Tail Descriptor Pointers and
          * the Base and Length of the Rx Descriptor Ring */
-        for (i = 0; i < adapter->num_rx_queues; i++) {
-                struct igb_ring *rx_ring = adapter->rx_ring[i];
-                igb_set_rx_buffer_len(adapter, rx_ring);
-                igb_configure_rx_ring(adapter, rx_ring);
-        }
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                igb_configure_rx_ring(adapter, adapter->rx_ring[i]);
 }
 
 /**
@@ -6203,78 +6186,6 @@ static bool igb_add_rx_frag(struct igb_ring *rx_ring,
         return igb_can_reuse_rx_page(rx_buffer, page, truesize);
 }
 
-static struct sk_buff *igb_build_rx_buffer(struct igb_ring *rx_ring,
-                                           union e1000_adv_rx_desc *rx_desc)
-{
-        struct igb_rx_buffer *rx_buffer;
-        struct sk_buff *skb;
-        struct page *page;
-        void *page_addr;
-        unsigned int size = le16_to_cpu(rx_desc->wb.upper.length);
-#if (PAGE_SIZE < 8192)
-        unsigned int truesize = IGB_RX_BUFSZ;
-#else
-        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
-                                SKB_DATA_ALIGN(NET_SKB_PAD +
-                                               NET_IP_ALIGN +
-                                               size);
-#endif
-
-        /* If we spanned a buffer we have a huge mess so test for it */
-        BUG_ON(unlikely(!igb_test_staterr(rx_desc, E1000_RXD_STAT_EOP)));
-
-        rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
-        page = rx_buffer->page;
-        prefetchw(page);
-
-        page_addr = page_address(page) + rx_buffer->page_offset;
-
-        /* prefetch first cache line of first page */
-        prefetch(page_addr + NET_SKB_PAD + NET_IP_ALIGN);
-#if L1_CACHE_BYTES < 128
-        prefetch(page_addr + L1_CACHE_BYTES + NET_SKB_PAD + NET_IP_ALIGN);
-#endif
-
-        /* build an skb to around the page buffer */
-        skb = build_skb(page_addr, truesize);
-        if (unlikely(!skb)) {
-                rx_ring->rx_stats.alloc_failed++;
-                return NULL;
-        }
-
-        /* we are reusing so sync this buffer for CPU use */
-        dma_sync_single_range_for_cpu(rx_ring->dev,
-                                      rx_buffer->dma,
-                                      rx_buffer->page_offset,
-                                      IGB_RX_BUFSZ,
-                                      DMA_FROM_DEVICE);
-
-        /* update pointers within the skb to store the data */
-        skb_reserve(skb, NET_IP_ALIGN + NET_SKB_PAD);
-        __skb_put(skb, size);
-
-        /* pull timestamp out of packet data */
-        if (igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP)) {
-                igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb);
-                __skb_pull(skb, IGB_TS_HDR_LEN);
-        }
-
-        if (igb_can_reuse_rx_page(rx_buffer, page, truesize)) {
-                /* hand second half of page back to the ring */
-                igb_reuse_rx_page(rx_ring, rx_buffer);
-        } else {
-                /* we are not reusing the buffer so unmap it */
-                dma_unmap_page(rx_ring->dev, rx_buffer->dma,
-                               PAGE_SIZE, DMA_FROM_DEVICE);
-        }
-
-        /* clear contents of buffer_info */
-        rx_buffer->dma = 0;
-        rx_buffer->page = NULL;
-
-        return skb;
-}
-
 static struct sk_buff *igb_fetch_rx_buffer(struct igb_ring *rx_ring,
                                            union e1000_adv_rx_desc *rx_desc,
                                            struct sk_buff *skb)
@@ -6690,10 +6601,7 @@ static bool igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)
                 rmb();
 
                 /* retrieve a buffer from the ring */
-                if (ring_uses_build_skb(rx_ring))
-                        skb = igb_build_rx_buffer(rx_ring, rx_desc);
-                else
-                        skb = igb_fetch_rx_buffer(rx_ring, rx_desc, skb);
+                skb = igb_fetch_rx_buffer(rx_ring, rx_desc, skb);
 
                 /* exit if we failed to retrieve a buffer */
                 if (!skb)
@@ -6780,14 +6688,6 @@ static bool igb_alloc_mapped_page(struct igb_ring *rx_ring,
         return true;
 }
 
-static inline unsigned int igb_rx_offset(struct igb_ring *rx_ring)
-{
-        if (ring_uses_build_skb(rx_ring))
-                return NET_SKB_PAD + NET_IP_ALIGN;
-        else
-                return 0;
-}
-
 /**
  * igb_alloc_rx_buffers - Replace used receive buffers; packet split
  * @adapter: address of board private structure
@@ -6814,9 +6714,7 @@ void igb_alloc_rx_buffers(struct igb_ring *rx_ring, u16 cleaned_count)
                  * Refresh the desc even if buffer_addrs didn't change
                  * because each write-back erases this info.
                  */
-                rx_desc->read.pkt_addr = cpu_to_le64(bi->dma +
-                                                     bi->page_offset +
-                                                     igb_rx_offset(rx_ring));
+                rx_desc->read.pkt_addr = cpu_to_le64(bi->dma + bi->page_offset);
 
                 rx_desc++;
                 bi++;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index d44b4d21268c..97e33669c0b9 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -1049,6 +1049,12 @@ int ixgbe_ndo_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
         if ((vf >= adapter->num_vfs) || (vlan > 4095) || (qos > 7))
                 return -EINVAL;
         if (vlan || qos) {
+                if (adapter->vfinfo[vf].pf_vlan)
+                        err = ixgbe_set_vf_vlan(adapter, false,
+                                                adapter->vfinfo[vf].pf_vlan,
+                                                vf);
+                if (err)
+                        goto out;
                 err = ixgbe_set_vf_vlan(adapter, true, vlan, vf);
                 if (err)
                         goto out;
diff --git a/drivers/net/ethernet/marvell/Kconfig b/drivers/net/ethernet/marvell/Kconfig
index edfba9370922..434e33c527df 100644
--- a/drivers/net/ethernet/marvell/Kconfig
+++ b/drivers/net/ethernet/marvell/Kconfig
@@ -33,6 +33,7 @@ config MV643XX_ETH
 
 config MVMDIO
         tristate "Marvell MDIO interface support"
+        select PHYLIB
         ---help---
           This driver supports the MDIO interface found in the network
           interface units of the Marvell EBU SoCs (Kirkwood, Orion5x,
@@ -45,7 +46,6 @@ config MVMDIO
 config MVNETA
         tristate "Marvell Armada 370/XP network interface support"
         depends on MACH_ARMADA_370_XP
-        select PHYLIB
         select MVMDIO
         ---help---
           This driver supports the network interface units in the
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 1e628ce57201..a47a097c21e1 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -374,7 +374,6 @@ static int rxq_number = 8;
 static int txq_number = 8;
 
 static int rxq_def;
-static int txq_def;
 
 #define MVNETA_DRIVER_NAME "mvneta"
 #define MVNETA_DRIVER_VERSION "1.0"
@@ -1475,7 +1474,8 @@ error:
 static int mvneta_tx(struct sk_buff *skb, struct net_device *dev)
 {
         struct mvneta_port *pp = netdev_priv(dev);
-        struct mvneta_tx_queue *txq = &pp->txqs[txq_def];
+        u16 txq_id = skb_get_queue_mapping(skb);
+        struct mvneta_tx_queue *txq = &pp->txqs[txq_id];
         struct mvneta_tx_desc *tx_desc;
         struct netdev_queue *nq;
         int frags = 0;
@@ -1485,7 +1485,7 @@ static int mvneta_tx(struct sk_buff *skb, struct net_device *dev)
                 goto out;
 
         frags = skb_shinfo(skb)->nr_frags + 1;
-        nq    = netdev_get_tx_queue(dev, txq_def);
+        nq    = netdev_get_tx_queue(dev, txq_id);
 
         /* Get a descriptor for the first part of the packet */
         tx_desc = mvneta_txq_next_desc_get(txq);
@@ -2689,7 +2689,7 @@ static int mvneta_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        dev = alloc_etherdev_mq(sizeof(struct mvneta_port), 8);
+        dev = alloc_etherdev_mqs(sizeof(struct mvneta_port), txq_number, rxq_number);
         if (!dev)
                 return -ENOMEM;
 
@@ -2844,4 +2844,3 @@ module_param(rxq_number, int, S_IRUGO);
 module_param(txq_number, int, S_IRUGO);
 
 module_param(rxq_def, int, S_IRUGO);
-module_param(txq_def, int, S_IRUGO);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index cd5ae8813cb3..edd63f1230f3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -1500,6 +1500,12 @@ int qlcnic_83xx_loopback_test(struct net_device *netdev, u8 mode)
                 }
         } while ((adapter->ahw->linkup && ahw->has_link_events) != 1);
 
+        /* Make sure carrier is off and queue is stopped during loopback */
+        if (netif_running(netdev)) {
+                netif_carrier_off(netdev);
+                netif_stop_queue(netdev);
+        }
+
         ret = qlcnic_do_lb_test(adapter, mode);
 
         qlcnic_83xx_clear_lb_mode(adapter, mode);
@@ -2780,6 +2786,7 @@ static u64 *qlcnic_83xx_fill_stats(struct qlcnic_adapter *adapter,
 void qlcnic_83xx_get_stats(struct qlcnic_adapter *adapter, u64 *data)
 {
         struct qlcnic_cmd_args cmd;
+        struct net_device *netdev = adapter->netdev;
         int ret = 0;
 
         qlcnic_alloc_mbx_args(&cmd, adapter, QLCNIC_CMD_GET_STATISTICS);
@@ -2789,7 +2796,7 @@ void qlcnic_83xx_get_stats(struct qlcnic_adapter *adapter, u64 *data)
         data = qlcnic_83xx_fill_stats(adapter, &cmd, data,
                                       QLC_83XX_STAT_TX, &ret);
         if (ret) {
-                dev_info(&adapter->pdev->dev, "Error getting MAC stats\n");
+                netdev_err(netdev, "Error getting Tx stats\n");
                 goto out;
         }
         /* Get MAC stats */
@@ -2799,8 +2806,7 @@ void qlcnic_83xx_get_stats(struct qlcnic_adapter *adapter, u64 *data)
         data = qlcnic_83xx_fill_stats(adapter, &cmd, data,
                                       QLC_83XX_STAT_MAC, &ret);
         if (ret) {
-                dev_info(&adapter->pdev->dev,
-                         "Error getting Rx stats\n");
+                netdev_err(netdev, "Error getting MAC stats\n");
                 goto out;
         }
         /* Get Rx stats */
@@ -2810,8 +2816,7 @@ void qlcnic_83xx_get_stats(struct qlcnic_adapter *adapter, u64 *data)
         data = qlcnic_83xx_fill_stats(adapter, &cmd, data,
                                       QLC_83XX_STAT_RX, &ret);
         if (ret)
-                dev_info(&adapter->pdev->dev,
-                         "Error getting Tx stats\n");
+                netdev_err(netdev, "Error getting Rx stats\n");
 out:
         qlcnic_free_mbx_args(&cmd);
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 0e630061bff3..5fa847fe388a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -358,8 +358,7 @@ set_flags:
                 memcpy(&first_desc->eth_addr, skb->data, ETH_ALEN);
         }
         opcode = TX_ETHER_PKT;
-        if ((adapter->netdev->features & (NETIF_F_TSO | NETIF_F_TSO6)) &&
-            skb_shinfo(skb)->gso_size > 0) {
+        if (skb_is_gso(skb)) {
                 hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 first_desc->mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
                 first_desc->total_hdr_length = hdr_len;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index 987fb6f8adc3..5ef328af61d0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -200,10 +200,10 @@ beacon_err:
         }
 
         err = qlcnic_config_led(adapter, b_state, b_rate);
-        if (!err)
+        if (!err) {
                 err = len;
-        else
                 ahw->beacon_state = b_state;
+        }
 
         if (test_and_clear_bit(__QLCNIC_DIAG_RES_ALLOC, &adapter->state))
                 qlcnic_diag_free_res(adapter->netdev, max_sds_rings);
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index a131d7b5d2fe..7e8d68263963 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -18,7 +18,7 @@
  */
 #define DRV_NAME        "qlge"
 #define DRV_STRING      "QLogic 10 Gigabit PCI-E Ethernet Driver "
-#define DRV_VERSION     "v1.00.00.31"
+#define DRV_VERSION     "v1.00.00.32"
 
 #define WQ_ADDR_ALIGN   0x3     /* 4 byte alignment */
 
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
index 6f316ab23257..0780e039b271 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
@@ -379,13 +379,13 @@ static int ql_get_settings(struct net_device *ndev,
 
         ecmd->supported = SUPPORTED_10000baseT_Full;
         ecmd->advertising = ADVERTISED_10000baseT_Full;
-        ecmd->autoneg = AUTONEG_ENABLE;
         ecmd->transceiver = XCVR_EXTERNAL;
         if ((qdev->link_status & STS_LINK_TYPE_MASK) ==
                                 STS_LINK_TYPE_10GBASET) {
                 ecmd->supported |= (SUPPORTED_TP | SUPPORTED_Autoneg);
                 ecmd->advertising |= (ADVERTISED_TP | ADVERTISED_Autoneg);
                 ecmd->port = PORT_TP;
+                ecmd->autoneg = AUTONEG_ENABLE;
         } else {
                 ecmd->supported |= SUPPORTED_FIBRE;
                 ecmd->advertising |= ADVERTISED_FIBRE;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index b13ab544a7eb..8033555e53c2 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -1434,11 +1434,13 @@ map_error:
 }
 
 /* Categorizing receive firmware frame errors */
-static void ql_categorize_rx_err(struct ql_adapter *qdev, u8 rx_err)
+static void ql_categorize_rx_err(struct ql_adapter *qdev, u8 rx_err,
+                                 struct rx_ring *rx_ring)
 {
         struct nic_stats *stats = &qdev->nic_stats;
 
         stats->rx_err_count++;
+        rx_ring->rx_errors++;
 
         switch (rx_err & IB_MAC_IOCB_RSP_ERR_MASK) {
         case IB_MAC_IOCB_RSP_ERR_CODE_ERR:
@@ -1474,6 +1476,12 @@ static void ql_process_mac_rx_gro_page(struct ql_adapter *qdev,
         struct bq_desc *lbq_desc = ql_get_curr_lchunk(qdev, rx_ring);
         struct napi_struct *napi = &rx_ring->napi;
 
+        /* Frame error, so drop the packet. */
+        if (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_ERR_MASK) {
+                ql_categorize_rx_err(qdev, ib_mac_rsp->flags2, rx_ring);
+                put_page(lbq_desc->p.pg_chunk.page);
+                return;
+        }
         napi->dev = qdev->ndev;
 
         skb = napi_get_frags(napi);
@@ -1529,6 +1537,12 @@ static void ql_process_mac_rx_page(struct ql_adapter *qdev,
         addr = lbq_desc->p.pg_chunk.va;
         prefetch(addr);
 
+        /* Frame error, so drop the packet. */
+        if (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_ERR_MASK) {
+                ql_categorize_rx_err(qdev, ib_mac_rsp->flags2, rx_ring);
+                goto err_out;
+        }
+
         /* The max framesize filter on this chip is set higher than
          * MTU since FCoE uses 2k frames.
          */
@@ -1614,6 +1628,13 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev,
         memcpy(skb_put(new_skb, length), skb->data, length);
         skb = new_skb;
 
+        /* Frame error, so drop the packet. */
+        if (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_ERR_MASK) {
+                ql_categorize_rx_err(qdev, ib_mac_rsp->flags2, rx_ring);
+                dev_kfree_skb_any(skb);
+                return;
+        }
+
         /* loopback self test for ethtool */
         if (test_bit(QL_SELFTEST, &qdev->flags)) {
                 ql_check_lb_frame(qdev, skb);
@@ -1919,6 +1940,13 @@ static void ql_process_mac_split_rx_intr(struct ql_adapter *qdev,
                 return;
         }
 
+        /* Frame error, so drop the packet. */
+        if (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_ERR_MASK) {
+                ql_categorize_rx_err(qdev, ib_mac_rsp->flags2, rx_ring);
+                dev_kfree_skb_any(skb);
+                return;
+        }
+
         /* The max framesize filter on this chip is set higher than
          * MTU since FCoE uses 2k frames.
          */
@@ -2000,12 +2028,6 @@ static unsigned long ql_process_mac_rx_intr(struct ql_adapter *qdev,
 
         QL_DUMP_IB_MAC_RSP(ib_mac_rsp);
 
-        /* Frame error, so drop the packet. */
-        if (ib_mac_rsp->flags2 & IB_MAC_IOCB_RSP_ERR_MASK) {
-                ql_categorize_rx_err(qdev, ib_mac_rsp->flags2);
-                return (unsigned long)length;
-        }
-
         if (ib_mac_rsp->flags4 & IB_MAC_IOCB_RSP_HV) {
                 /* The data and headers are split into
                  * separate buffers.
diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
index 0c74a702d461..50617c5a0bdb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
@@ -149,6 +149,7 @@ void dwmac_mmc_intr_all_mask(void __iomem *ioaddr)
 {
         writel(MMC_DEFAULT_MASK, ioaddr + MMC_RX_INTR_MASK);
         writel(MMC_DEFAULT_MASK, ioaddr + MMC_TX_INTR_MASK);
+        writel(MMC_DEFAULT_MASK, ioaddr + MMC_RX_IPC_INTR_MASK);
 }
 
 /* This reads the MAC core counters (if actaully supported).
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 80cad06e5eb2..4781d3d8e182 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1380,7 +1380,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                         memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN);
 
                 if (data->dual_emac) {
-                        if (of_property_read_u32(node, "dual_emac_res_vlan",
+                        if (of_property_read_u32(slave_node, "dual_emac_res_vlan",
                                                  &prop)) {
                                 pr_err("Missing dual_emac_res_vlan in DT.\n");
                                 slave_data->dual_emac_res_vlan = i+1;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b7c457adc0dc..729ed533bb33 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1594,7 +1594,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 if (tun->flags & TUN_TAP_MQ &&
                     (tun->numqueues + tun->numdisabled > 1))
-                        return err;
+                        return -EBUSY;
         }
         else {
                 char *name;
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 16c842997291..6bd91676d2cb 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -134,7 +134,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
                 goto error;
 
         if (skb) {
-                if (skb->len <= sizeof(ETH_HLEN))
+                if (skb->len <= ETH_HLEN)
                         goto error;
 
                 /* mapping VLANs to MBIM sessions:
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 968d5d50751d..2a3579f67910 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/ethtool.h>
+#include <linux/etherdevice.h>
 #include <linux/mii.h>
 #include <linux/usb.h>
 #include <linux/usb/cdc.h>
@@ -52,6 +53,96 @@ struct qmi_wwan_state {
         struct usb_interface *data;
 };
 
+/* default ethernet address used by the modem */
+static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
+
+/* Make up an ethernet header if the packet doesn't have one.
+ *
+ * A firmware bug common among several devices cause them to send raw
+ * IP packets under some circumstances.  There is no way for the
+ * driver/host to know when this will happen.  And even when the bug
+ * hits, some packets will still arrive with an intact header.
+ *
+ * The supported devices are only capably of sending IPv4, IPv6 and
+ * ARP packets on a point-to-point link. Any packet with an ethernet
+ * header will have either our address or a broadcast/multicast
+ * address as destination.  ARP packets will always have a header.
+ *
+ * This means that this function will reliably add the appropriate
+ * header iff necessary, provided our hardware address does not start
+ * with 4 or 6.
+ *
+ * Another common firmware bug results in all packets being addressed
+ * to 00:a0:c6:00:00:00 despite the host address being different.
+ * This function will also fixup such packets.
+ */
+static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        __be16 proto;
+
+        /* usbnet rx_complete guarantees that skb->len is at least
+         * hard_header_len, so we can inspect the dest address without
+         * checking skb->len
+         */
+        switch (skb->data[0] & 0xf0) {
+        case 0x40:
+                proto = htons(ETH_P_IP);
+                break;
+        case 0x60:
+                proto = htons(ETH_P_IPV6);
+                break;
+        case 0x00:
+                if (is_multicast_ether_addr(skb->data))
+                        return 1;
+                /* possibly bogus destination - rewrite just in case */
+                skb_reset_mac_header(skb);
+                goto fix_dest;
+        default:
+                /* pass along other packets without modifications */
+                return 1;
+        }
+        if (skb_headroom(skb) < ETH_HLEN)
+                return 0;
+        skb_push(skb, ETH_HLEN);
+        skb_reset_mac_header(skb);
+        eth_hdr(skb)->h_proto = proto;
+        memset(eth_hdr(skb)->h_source, 0, ETH_ALEN);
+fix_dest:
+        memcpy(eth_hdr(skb)->h_dest, dev->net->dev_addr, ETH_ALEN);
+        return 1;
+}
+
+/* very simplistic detection of IPv4 or IPv6 headers */
+static bool possibly_iphdr(const char *data)
+{
+        return (data[0] & 0xd0) == 0x40;
+}
+
+/* disallow addresses which may be confused with IP headers */
+static int qmi_wwan_mac_addr(struct net_device *dev, void *p)
+{
+        int ret;
+        struct sockaddr *addr = p;
+
+        ret = eth_prepare_mac_addr_change(dev, p);
+        if (ret < 0)
+                return ret;
+        if (possibly_iphdr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+        eth_commit_mac_addr_change(dev, p);
+        return 0;
+}
+
+static const struct net_device_ops qmi_wwan_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = usbnet_change_mtu,
+        .ndo_set_mac_address    = qmi_wwan_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 /* using a counter to merge subdriver requests with our own into a combined state */
 static int qmi_wwan_manage_power(struct usbnet *dev, int on)
 {
@@ -229,6 +320,18 @@ next_desc:
                 usb_driver_release_interface(driver, info->data);
         }
 
+        /* Never use the same address on both ends of the link, even
+         * if the buggy firmware told us to.
+         */
+        if (!compare_ether_addr(dev->net->dev_addr, default_modem_addr))
+                eth_hw_addr_random(dev->net);
+
+        /* make MAC addr easily distinguishable from an IP header */
+        if (possibly_iphdr(dev->net->dev_addr)) {
+                dev->net->dev_addr[0] |= 0x02;  /* set local assignment bit */
+                dev->net->dev_addr[0] &= 0xbf;  /* clear "IP" bit */
+        }
+        dev->net->netdev_ops = &qmi_wwan_netdev_ops;
 err:
         return status;
 }
@@ -307,6 +410,7 @@ static const struct driver_info	qmi_wwan_info = {
         .bind           = qmi_wwan_bind,
         .unbind         = qmi_wwan_unbind,
         .manage_power   = qmi_wwan_manage_power,
+        .rx_fixup       = qmi_wwan_rx_fixup,
 };
 
 #define HUAWEI_VENDOR_ID        0x12D1
diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
index 28fd99203f64..bdee2ed67219 100644
--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
@@ -519,7 +519,7 @@ static const u32 ar9580_1p0_mac_core[][2] = {
         {0x00008258, 0x00000000},
         {0x0000825c, 0x40000000},
         {0x00008260, 0x00080922},
-        {0x00008264, 0x9bc00010},
+        {0x00008264, 0x9d400010},
         {0x00008268, 0xffffffff},
         {0x0000826c, 0x0000ffff},
         {0x00008270, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/dfs_pattern_detector.c b/drivers/net/wireless/ath/ath9k/dfs_pattern_detector.c
index 467b60014b7b..73fe8d6db566 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_pattern_detector.c
@@ -143,14 +143,14 @@ channel_detector_create(struct dfs_pattern_detector *dpd, u16 freq)
         u32 sz, i;
         struct channel_detector *cd;
 
-        cd = kmalloc(sizeof(*cd), GFP_KERNEL);
+        cd = kmalloc(sizeof(*cd), GFP_ATOMIC);
         if (cd == NULL)
                 goto fail;
 
         INIT_LIST_HEAD(&cd->head);
         cd->freq = freq;
         sz = sizeof(cd->detectors) * dpd->num_radar_types;
-        cd->detectors = kzalloc(sz, GFP_KERNEL);
+        cd->detectors = kzalloc(sz, GFP_ATOMIC);
         if (cd->detectors == NULL)
                 goto fail;
 
diff --git a/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c b/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
index 91b8dceeadb1..5e48c5515b8c 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
@@ -218,7 +218,7 @@ static bool pulse_queue_enqueue(struct pri_detector *pde, u64 ts)
 {
         struct pulse_elem *p = pool_get_pulse_elem();
         if (p == NULL) {
-                p = kmalloc(sizeof(*p), GFP_KERNEL);
+                p = kmalloc(sizeof(*p), GFP_ATOMIC);
                 if (p == NULL) {
                         DFS_POOL_STAT_INC(pulse_alloc_error);
                         return false;
@@ -299,7 +299,7 @@ static bool pseq_handler_create_sequences(struct pri_detector *pde,
                 ps.deadline_ts = ps.first_ts + ps.dur;
                 new_ps = pool_get_pseq_elem();
                 if (new_ps == NULL) {
-                        new_ps = kmalloc(sizeof(*new_ps), GFP_KERNEL);
+                        new_ps = kmalloc(sizeof(*new_ps), GFP_ATOMIC);
                         if (new_ps == NULL) {
                                 DFS_POOL_STAT_INC(pseq_alloc_error);
                                 return false;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 716058b67557..a47f5e05fc04 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -796,7 +796,7 @@ static int ath9k_init_firmware_version(struct ath9k_htc_priv *priv)
          * required version.
          */
         if (priv->fw_version_major != MAJOR_VERSION_REQ ||
-            priv->fw_version_minor != MINOR_VERSION_REQ) {
+            priv->fw_version_minor < MINOR_VERSION_REQ) {
                 dev_err(priv->dev, "ath9k_htc: Please upgrade to FW version %d.%d\n",
                         MAJOR_VERSION_REQ, MINOR_VERSION_REQ);
                 return -EINVAL;
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index e8486c1e091a..b70f220bc4b3 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -5165,7 +5165,8 @@ static void b43_nphy_pmu_spur_avoid(struct b43_wldev *dev, bool avoid)
 #endif
 #ifdef CONFIG_B43_SSB
         case B43_BUS_SSB:
-                /* FIXME */
+                ssb_pmu_spuravoid_pllupdate(&dev->dev->sdev->bus->chipco,
+                                            avoid);
                 break;
 #endif
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index ec46ffff5409..78da3eff75e8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -4128,10 +4128,6 @@ static const struct ieee80211_iface_limit brcmf_iface_limits[] = {
         },
         {
                 .max = 1,
-                .types = BIT(NL80211_IFTYPE_P2P_DEVICE)
-        },
-        {
-                .max = 1,
                 .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
                          BIT(NL80211_IFTYPE_P2P_GO)
         },
@@ -4187,8 +4183,7 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
                                  BIT(NL80211_IFTYPE_ADHOC) |
                                  BIT(NL80211_IFTYPE_AP) |
                                  BIT(NL80211_IFTYPE_P2P_CLIENT) |
-                                 BIT(NL80211_IFTYPE_P2P_GO) |
-                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
+                                 BIT(NL80211_IFTYPE_P2P_GO);
         wiphy->iface_combinations = brcmf_iface_combos;
         wiphy->n_iface_combinations = ARRAY_SIZE(brcmf_iface_combos);
         wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index c6451c61407a..e2340b231aa1 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -274,6 +274,130 @@ static void brcms_set_basic_rate(struct brcm_rateset *rs, u16 rate, bool is_br)
         }
 }
 
+/**
+ * This function frees the WL per-device resources.
+ *
+ * This function frees resources owned by the WL device pointed to
+ * by the wl parameter.
+ *
+ * precondition: can both be called locked and unlocked
+ *
+ */
+static void brcms_free(struct brcms_info *wl)
+{
+        struct brcms_timer *t, *next;
+
+        /* free ucode data */
+        if (wl->fw.fw_cnt)
+                brcms_ucode_data_free(&wl->ucode);
+        if (wl->irq)
+                free_irq(wl->irq, wl);
+
+        /* kill dpc */
+        tasklet_kill(&wl->tasklet);
+
+        if (wl->pub) {
+                brcms_debugfs_detach(wl->pub);
+                brcms_c_module_unregister(wl->pub, "linux", wl);
+        }
+
+        /* free common resources */
+        if (wl->wlc) {
+                brcms_c_detach(wl->wlc);
+                wl->wlc = NULL;
+                wl->pub = NULL;
+        }
+
+        /* virtual interface deletion is deferred so we cannot spinwait */
+
+        /* wait for all pending callbacks to complete */
+        while (atomic_read(&wl->callbacks) > 0)
+                schedule();
+
+        /* free timers */
+        for (t = wl->timers; t; t = next) {
+                next = t->next;
+#ifdef DEBUG
+                kfree(t->name);
+#endif
+                kfree(t);
+        }
+}
+
+/*
+* called from both kernel as from this kernel module (error flow on attach)
+* precondition: perimeter lock is not acquired.
+*/
+static void brcms_remove(struct bcma_device *pdev)
+{
+        struct ieee80211_hw *hw = bcma_get_drvdata(pdev);
+        struct brcms_info *wl = hw->priv;
+
+        if (wl->wlc) {
+                wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, false);
+                wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
+                ieee80211_unregister_hw(hw);
+        }
+
+        brcms_free(wl);
+
+        bcma_set_drvdata(pdev, NULL);
+        ieee80211_free_hw(hw);
+}
+
+/*
+ * Precondition: Since this function is called in brcms_pci_probe() context,
+ * no locking is required.
+ */
+static void brcms_release_fw(struct brcms_info *wl)
+{
+        int i;
+        for (i = 0; i < MAX_FW_IMAGES; i++) {
+                release_firmware(wl->fw.fw_bin[i]);
+                release_firmware(wl->fw.fw_hdr[i]);
+        }
+}
+
+/*
+ * Precondition: Since this function is called in brcms_pci_probe() context,
+ * no locking is required.
+ */
+static int brcms_request_fw(struct brcms_info *wl, struct bcma_device *pdev)
+{
+        int status;
+        struct device *device = &pdev->dev;
+        char fw_name[100];
+        int i;
+
+        memset(&wl->fw, 0, sizeof(struct brcms_firmware));
+        for (i = 0; i < MAX_FW_IMAGES; i++) {
+                if (brcms_firmwares[i] == NULL)
+                        break;
+                sprintf(fw_name, "%s-%d.fw", brcms_firmwares[i],
+                        UCODE_LOADER_API_VER);
+                status = request_firmware(&wl->fw.fw_bin[i], fw_name, device);
+                if (status) {
+                        wiphy_err(wl->wiphy, "%s: fail to load firmware %s\n",
+                                  KBUILD_MODNAME, fw_name);
+                        return status;
+                }
+                sprintf(fw_name, "%s_hdr-%d.fw", brcms_firmwares[i],
+                        UCODE_LOADER_API_VER);
+                status = request_firmware(&wl->fw.fw_hdr[i], fw_name, device);
+                if (status) {
+                        wiphy_err(wl->wiphy, "%s: fail to load firmware %s\n",
+                                  KBUILD_MODNAME, fw_name);
+                        return status;
+                }
+                wl->fw.hdr_num_entries[i] =
+                    wl->fw.fw_hdr[i]->size / (sizeof(struct firmware_hdr));
+        }
+        wl->fw.fw_cnt = i;
+        status = brcms_ucode_data_init(wl, &wl->ucode);
+        brcms_release_fw(wl);
+        return status;
+}
+
 static void brcms_ops_tx(struct ieee80211_hw *hw,
                          struct ieee80211_tx_control *control,
                          struct sk_buff *skb)
@@ -306,6 +430,14 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
         if (!blocked)
                 wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
 
+        if (!wl->ucode.bcm43xx_bomminor) {
+                err = brcms_request_fw(wl, wl->wlc->hw->d11core);
+                if (err) {
+                        brcms_remove(wl->wlc->hw->d11core);
+                        return -ENOENT;
+                }
+        }
+
         spin_lock_bh(&wl->lock);
         /* avoid acknowledging frames before a non-monitor device is added */
         wl->mute_tx = true;
@@ -793,128 +925,6 @@ void brcms_dpc(unsigned long data)
         wake_up(&wl->tx_flush_wq);
 }
 
-/*
- * Precondition: Since this function is called in brcms_pci_probe() context,
- * no locking is required.
- */
-static int brcms_request_fw(struct brcms_info *wl, struct bcma_device *pdev)
-{
-        int status;
-        struct device *device = &pdev->dev;
-        char fw_name[100];
-        int i;
-
-        memset(&wl->fw, 0, sizeof(struct brcms_firmware));
-        for (i = 0; i < MAX_FW_IMAGES; i++) {
-                if (brcms_firmwares[i] == NULL)
-                        break;
-                sprintf(fw_name, "%s-%d.fw", brcms_firmwares[i],
-                        UCODE_LOADER_API_VER);
-                status = request_firmware(&wl->fw.fw_bin[i], fw_name, device);
-                if (status) {
-                        wiphy_err(wl->wiphy, "%s: fail to load firmware %s\n",
-                                  KBUILD_MODNAME, fw_name);
-                        return status;
-                }
-                sprintf(fw_name, "%s_hdr-%d.fw", brcms_firmwares[i],
-                        UCODE_LOADER_API_VER);
-                status = request_firmware(&wl->fw.fw_hdr[i], fw_name, device);
-                if (status) {
-                        wiphy_err(wl->wiphy, "%s: fail to load firmware %s\n",
-                                  KBUILD_MODNAME, fw_name);
-                        return status;
-                }
-                wl->fw.hdr_num_entries[i] =
-                    wl->fw.fw_hdr[i]->size / (sizeof(struct firmware_hdr));
-        }
-        wl->fw.fw_cnt = i;
-        return brcms_ucode_data_init(wl, &wl->ucode);
-}
-
-/*
- * Precondition: Since this function is called in brcms_pci_probe() context,
- * no locking is required.
- */
-static void brcms_release_fw(struct brcms_info *wl)
-{
-        int i;
-        for (i = 0; i < MAX_FW_IMAGES; i++) {
-                release_firmware(wl->fw.fw_bin[i]);
-                release_firmware(wl->fw.fw_hdr[i]);
-        }
-}
-
-/**
- * This function frees the WL per-device resources.
- *
- * This function frees resources owned by the WL device pointed to
- * by the wl parameter.
- *
- * precondition: can both be called locked and unlocked
- *
- */
-static void brcms_free(struct brcms_info *wl)
-{
-        struct brcms_timer *t, *next;
-
-        /* free ucode data */
-        if (wl->fw.fw_cnt)
-                brcms_ucode_data_free(&wl->ucode);
-        if (wl->irq)
-                free_irq(wl->irq, wl);
-
-        /* kill dpc */
-        tasklet_kill(&wl->tasklet);
-
-        if (wl->pub) {
-                brcms_debugfs_detach(wl->pub);
-                brcms_c_module_unregister(wl->pub, "linux", wl);
-        }
-
-        /* free common resources */
-        if (wl->wlc) {
-                brcms_c_detach(wl->wlc);
-                wl->wlc = NULL;
-                wl->pub = NULL;
-        }
-
-        /* virtual interface deletion is deferred so we cannot spinwait */
-
-        /* wait for all pending callbacks to complete */
-        while (atomic_read(&wl->callbacks) > 0)
-                schedule();
-
-        /* free timers */
-        for (t = wl->timers; t; t = next) {
-                next = t->next;
-#ifdef DEBUG
-                kfree(t->name);
-#endif
-                kfree(t);
-        }
-}
-
-/*
-* called from both kernel as from this kernel module (error flow on attach)
-* precondition: perimeter lock is not acquired.
-*/
-static void brcms_remove(struct bcma_device *pdev)
-{
-        struct ieee80211_hw *hw = bcma_get_drvdata(pdev);
-        struct brcms_info *wl = hw->priv;
-
-        if (wl->wlc) {
-                wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, false);
-                wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
-                ieee80211_unregister_hw(hw);
-        }
-
-        brcms_free(wl);
-
-        bcma_set_drvdata(pdev, NULL);
-        ieee80211_free_hw(hw);
-}
-
 static irqreturn_t brcms_isr(int irq, void *dev_id)
 {
         struct brcms_info *wl;
@@ -1047,18 +1057,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
         spin_lock_init(&wl->lock);
         spin_lock_init(&wl->isr_lock);
 
-        /* prepare ucode */
-        if (brcms_request_fw(wl, pdev) < 0) {
-                wiphy_err(wl->wiphy, "%s: Failed to find firmware usually in "
-                          "%s\n", KBUILD_MODNAME, "/lib/firmware/brcm");
-                brcms_release_fw(wl);
-                brcms_remove(pdev);
-                return NULL;
-        }
-
         /* common load-time initialization */
         wl->wlc = brcms_c_attach((void *)wl, pdev, unit, false, &err);
-        brcms_release_fw(wl);
         if (!wl->wlc) {
                 wiphy_err(wl->wiphy, "%s: attach() failed with code %d\n",
                           KBUILD_MODNAME, err);
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 45cacf79f3a7..1a779bbfb87d 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -134,7 +134,6 @@ static const struct key_entry hp_wmi_keymap[] = {
         { KE_KEY, 0x2142, { KEY_MEDIA } },
         { KE_KEY, 0x213b, { KEY_INFO } },
         { KE_KEY, 0x2169, { KEY_DIRECTION } },
-        { KE_KEY, 0x216a, { KEY_SETUP } },
         { KE_KEY, 0x231b, { KEY_HELP } },
         { KE_END, 0 }
 };
@@ -925,9 +924,6 @@ static int __init hp_wmi_init(void)
                 err = hp_wmi_input_setup();
                 if (err)
                         return err;
-                
-                //Enable magic for hotkeys that run on the SMBus
-                ec_write(0xe6,0x6e);
         }
 
         if (bios_capable) {
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 9a907567f41e..edec135b1685 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -1964,9 +1964,6 @@ struct tp_nvram_state {
 /* kthread for the hotkey poller */
 static struct task_struct *tpacpi_hotkey_task;
 
-/* Acquired while the poller kthread is running, use to sync start/stop */
-static struct mutex hotkey_thread_mutex;
-
 /*
  * Acquire mutex to write poller control variables as an
  * atomic block.
@@ -2462,8 +2459,6 @@ static int hotkey_kthread(void *data)
         unsigned int poll_freq;
         bool was_frozen;
 
-        mutex_lock(&hotkey_thread_mutex);
-
         if (tpacpi_lifecycle == TPACPI_LIFE_EXITING)
                 goto exit;
 
@@ -2523,7 +2518,6 @@ static int hotkey_kthread(void *data)
         }
 
 exit:
-        mutex_unlock(&hotkey_thread_mutex);
         return 0;
 }
 
@@ -2533,9 +2527,6 @@ static void hotkey_poll_stop_sync(void)
         if (tpacpi_hotkey_task) {
                 kthread_stop(tpacpi_hotkey_task);
                 tpacpi_hotkey_task = NULL;
-                mutex_lock(&hotkey_thread_mutex);
-                /* at this point, the thread did exit */
-                mutex_unlock(&hotkey_thread_mutex);
         }
 }
 
@@ -3234,7 +3225,6 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
         mutex_init(&hotkey_mutex);
 
 #ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
-        mutex_init(&hotkey_thread_mutex);
         mutex_init(&hotkey_thread_data_mutex);
 #endif
 
diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c
index 1a9d1e3ce64c..c1441ed282eb 100644
--- a/drivers/sbus/char/bbc_i2c.c
+++ b/drivers/sbus/char/bbc_i2c.c
@@ -282,7 +282,7 @@ static irqreturn_t bbc_i2c_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static void __init reset_one_i2c(struct bbc_i2c_bus *bp)
+static void reset_one_i2c(struct bbc_i2c_bus *bp)
 {
         writeb(I2C_PCF_PIN, bp->i2c_control_regs + 0x0);
         writeb(bp->own, bp->i2c_control_regs + 0x1);
@@ -291,7 +291,7 @@ static void __init reset_one_i2c(struct bbc_i2c_bus *bp)
         writeb(I2C_PCF_IDLE, bp->i2c_control_regs + 0x0);
 }
 
-static struct bbc_i2c_bus * __init attach_one_i2c(struct platform_device *op, int index)
+static struct bbc_i2c_bus * attach_one_i2c(struct platform_device *op, int index)
 {
         struct bbc_i2c_bus *bp;
         struct device_node *dp;
diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
index 4c0f6d883dd3..7b0bce936762 100644
--- a/drivers/ssb/driver_chipcommon_pmu.c
+++ b/drivers/ssb/driver_chipcommon_pmu.c
@@ -675,3 +675,32 @@ u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
                 return 0;
         }
 }
+
+void ssb_pmu_spuravoid_pllupdate(struct ssb_chipcommon *cc, int spuravoid)
+{
+        u32 pmu_ctl = 0;
+
+        switch (cc->dev->bus->chip_id) {
+        case 0x4322:
+                ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL0, 0x11100070);
+                ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL1, 0x1014140a);
+                ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL5, 0x88888854);
+                if (spuravoid == 1)
+                        ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL2, 0x05201828);
+                else
+                        ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL2, 0x05001828);
+                pmu_ctl = SSB_CHIPCO_PMU_CTL_PLL_UPD;
+                break;
+        case 43222:
+                /* TODO: BCM43222 requires updating PLLs too */
+                return;
+        default:
+                ssb_printk(KERN_ERR PFX
+                           "Unknown spuravoidance settings for chip 0x%04X, not changing PLL\n",
+                           cc->dev->bus->chip_id);
+                return;
+        }
+
+        chipco_set32(cc, SSB_CHIPCO_PMU_CTL, pmu_ctl);
+}
+EXPORT_SYMBOL_GPL(ssb_pmu_spuravoid_pllupdate);
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 7c254084b6a0..86291dcd964a 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1373,15 +1373,12 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
 {
         struct fb_info *info = file_fb_info(file);
         struct fb_ops *fb;
-        unsigned long off;
+        unsigned long mmio_pgoff;
         unsigned long start;
         u32 len;
 
         if (!info)
                 return -ENODEV;
-        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
-                return -EINVAL;
-        off = vma->vm_pgoff << PAGE_SHIFT;
         fb = info->fbops;
         if (!fb)
                 return -ENODEV;
@@ -1393,32 +1390,24 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
                 return res;
         }
 
-        /* frame buffer memory */
+        /*
+         * Ugh. This can be either the frame buffer mapping, or
+         * if pgoff points past it, the mmio mapping.
+         */
         start = info->fix.smem_start;
-        len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len);
-        if (off >= len) {
-                /* memory mapped io */
-                off -= len;
-                if (info->var.accel_flags) {
-                        mutex_unlock(&info->mm_lock);
-                        return -EINVAL;
-                }
+        len = info->fix.smem_len;
+        mmio_pgoff = PAGE_ALIGN((start & ~PAGE_MASK) + len) >> PAGE_SHIFT;
+        if (vma->vm_pgoff >= mmio_pgoff) {
+                vma->vm_pgoff -= mmio_pgoff;
                 start = info->fix.mmio_start;
-                len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);
+                len = info->fix.mmio_len;
         }
         mutex_unlock(&info->mm_lock);
-        start &= PAGE_MASK;
-        if ((vma->vm_end - vma->vm_start + off) > len)
-                return -EINVAL;
-        off += start;
-        vma->vm_pgoff = off >> PAGE_SHIFT;
-        /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by io_remap_pfn_range()*/
+
         vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-        fb_pgprotect(file, vma, off);
-        if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
-                             vma->vm_end - vma->vm_start, vma->vm_page_prot))
-                return -EAGAIN;
-        return 0;
+        fb_pgprotect(file, vma, start);
+
+        return vm_iomap_memory(vma, start, len);
 }
 
 static int
diff --git a/drivers/video/mmp/core.c b/drivers/video/mmp/core.c
index 9ed83419038b..84de2632857a 100644
--- a/drivers/video/mmp/core.c
+++ b/drivers/video/mmp/core.c
@@ -252,7 +252,5 @@ void mmp_unregister_path(struct mmp_path *path)
 
         kfree(path);
         mutex_unlock(&disp_lock);
-
-        dev_info(path->dev, "de-register %s\n", path->name);
 }
 EXPORT_SYMBOL_GPL(mmp_unregister_path);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 3939829f6c5c..86af964c2425 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1137,6 +1137,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
                         goto whole;
                 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
                         goto whole;
+                return 0;
         }
 
         /* Do not dump I/O mapped devices or special mappings */
diff --git a/fs/bio.c b/fs/bio.c
index bb5768f59b32..b96fc6ce4855 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1428,8 +1428,6 @@ void bio_endio(struct bio *bio, int error)
         else if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
                 error = -EIO;
 
-        trace_block_bio_complete(bio, error);
-
         if (bio->bi_end_io)
                 bio->bi_end_io(bio, error);
 }
diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index a94f0f779d5e..fe0a76213d9e 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -533,7 +533,7 @@ void hfsplus_file_truncate(struct inode *inode)
                 struct address_space *mapping = inode->i_mapping;
                 struct page *page;
                 void *fsdata;
-                u32 size = inode->i_size;
+                loff_t size = inode->i_size;
 
                 res = pagecache_write_begin(NULL, mapping, size, 0,
                                                 AOP_FLAG_UNINTERRUPTIBLE,
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 84e3d856e91d..523464e62849 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -110,7 +110,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
          * way when do_mmap_pgoff unwinds (may be important on powerpc
          * and ia64).
          */
-        vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND | VM_DONTDUMP;
+        vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
         vma->vm_ops = &hugetlb_vm_ops;
 
         if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
diff --git a/fs/proc/array.c b/fs/proc/array.c
index f7ed9ee46eb9..cbd0f1b324b9 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -143,6 +143,7 @@ static const char * const task_state_array[] = {
         "x (dead)",             /*  64 */
         "K (wakekill)",         /* 128 */
         "W (waking)",           /* 256 */
+        "P (parked)",           /* 512 */
 };
 
 static inline const char *get_task_state(struct task_struct *tsk)
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 0ea61e07a91c..7c2e030e72f1 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -12,7 +12,6 @@
 
 struct blk_trace {
         int trace_state;
-        bool rq_based;
         struct rchan *rchan;
         unsigned long __percpu *sequence;
         unsigned char __percpu *msg_data;
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 9bf2f1fcae27..3d7df3d32c66 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -333,6 +333,7 @@ typedef efi_status_t efi_query_capsule_caps_t(efi_capsule_header_t **capsules,
                                               unsigned long count,
                                               u64 *max_size,
                                               int *reset_type);
+typedef efi_status_t efi_query_variable_store_t(u32 attributes, unsigned long size);
 
 /*
  *  EFI Configuration Table and GUID definitions
@@ -575,9 +576,15 @@ extern void efi_enter_virtual_mode (void);	/* switch EFI to virtual mode, if pos
 #ifdef CONFIG_X86
 extern void efi_late_init(void);
 extern void efi_free_boot_services(void);
+extern efi_status_t efi_query_variable_store(u32 attributes, unsigned long size);
 #else
 static inline void efi_late_init(void) {}
 static inline void efi_free_boot_services(void) {}
+
+static inline efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
+{
+        return EFI_SUCCESS;
+}
 #endif
 extern void __iomem *efi_lookup_mapped_addr(u64 phys_addr);
 extern u64 efi_get_iobase (void);
@@ -731,7 +738,7 @@ struct efivar_operations {
         efi_get_variable_t *get_variable;
         efi_get_next_variable_t *get_next_variable;
         efi_set_variable_t *set_variable;
-        efi_query_variable_info_t *query_variable_info;
+        efi_query_variable_store_t *query_variable_store;
 };
 
 struct efivars {
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index d2e6927bbaae..d78d28a733b1 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -200,6 +200,8 @@ extern size_t vmcoreinfo_max_size;
 
 int __init parse_crashkernel(char *cmdline, unsigned long long system_ram,
                 unsigned long long *crash_size, unsigned long long *crash_base);
+int parse_crashkernel_high(char *cmdline, unsigned long long system_ram,
+                unsigned long long *crash_size, unsigned long long *crash_base);
 int parse_crashkernel_low(char *cmdline, unsigned long long system_ram,
                 unsigned long long *crash_size, unsigned long long *crash_base);
 int crash_shrink_memory(unsigned long new_size);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index e19ff30ad0a2..e2091b88d24c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1611,6 +1611,8 @@ int vm_insert_pfn(struct vm_area_struct *vma, unsigned long addr,
                         unsigned long pfn);
 int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
                         unsigned long pfn);
+int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len);
+
 
 struct page *follow_page_mask(struct vm_area_struct *vma,
                               unsigned long address, unsigned int foll_flags,
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index 01d25e6fc792..0214c4c146fa 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -291,6 +291,7 @@ ip_set_hash_destroy(struct ip_set *set)
 #define type_pf_data_tlist      TOKEN(TYPE, PF, _data_tlist)
 #define type_pf_data_next       TOKEN(TYPE, PF, _data_next)
 #define type_pf_data_flags      TOKEN(TYPE, PF, _data_flags)
+#define type_pf_data_reset_flags TOKEN(TYPE, PF, _data_reset_flags)
 #ifdef IP_SET_HASH_WITH_NETS
 #define type_pf_data_match      TOKEN(TYPE, PF, _data_match)
 #else
@@ -385,9 +386,9 @@ type_pf_resize(struct ip_set *set, bool retried)
         struct ip_set_hash *h = set->data;
         struct htable *t, *orig = h->table;
         u8 htable_bits = orig->htable_bits;
-        const struct type_pf_elem *data;
+        struct type_pf_elem *data;
         struct hbucket *n, *m;
-        u32 i, j;
+        u32 i, j, flags = 0;
         int ret;
 
 retry:
@@ -412,9 +413,16 @@ retry:
                 n = hbucket(orig, i);
                 for (j = 0; j < n->pos; j++) {
                         data = ahash_data(n, j);
+#ifdef IP_SET_HASH_WITH_NETS
+                        flags = 0;
+                        type_pf_data_reset_flags(data, &flags);
+#endif
                         m = hbucket(t, HKEY(data, h->initval, htable_bits));
-                        ret = type_pf_elem_add(m, data, AHASH_MAX(h), 0);
+                        ret = type_pf_elem_add(m, data, AHASH_MAX(h), flags);
                         if (ret < 0) {
+#ifdef IP_SET_HASH_WITH_NETS
+                                type_pf_data_flags(data, flags);
+#endif
                                 read_unlock_bh(&set->lock);
                                 ahash_destroy(t);
                                 if (ret == -EAGAIN)
@@ -836,9 +844,9 @@ type_pf_tresize(struct ip_set *set, bool retried)
         struct ip_set_hash *h = set->data;
         struct htable *t, *orig = h->table;
         u8 htable_bits = orig->htable_bits;
-        const struct type_pf_elem *data;
+        struct type_pf_elem *data;
         struct hbucket *n, *m;
-        u32 i, j;
+        u32 i, j, flags = 0;
         int ret;
 
         /* Try to cleanup once */
@@ -873,10 +881,17 @@ retry:
                 n = hbucket(orig, i);
                 for (j = 0; j < n->pos; j++) {
                         data = ahash_tdata(n, j);
+#ifdef IP_SET_HASH_WITH_NETS
+                        flags = 0;
+                        type_pf_data_reset_flags(data, &flags);
+#endif
                         m = hbucket(t, HKEY(data, h->initval, htable_bits));
-                        ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), 0,
-                                                ip_set_timeout_get(type_pf_data_timeout(data)));
+                        ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), flags,
+                                ip_set_timeout_get(type_pf_data_timeout(data)));
                         if (ret < 0) {
+#ifdef IP_SET_HASH_WITH_NETS
+                                type_pf_data_flags(data, flags);
+#endif
                                 read_unlock_bh(&set->lock);
                                 ahash_destroy(t);
                                 if (ret == -EAGAIN)
@@ -1187,6 +1202,7 @@ type_pf_gc_init(struct ip_set *set)
 #undef type_pf_data_tlist
 #undef type_pf_data_next
 #undef type_pf_data_flags
+#undef type_pf_data_reset_flags
 #undef type_pf_data_match
 
 #undef type_pf_elem
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d35d2b6ddbfb..e692a022527b 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -163,9 +163,10 @@ print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 #define TASK_DEAD               64
 #define TASK_WAKEKILL           128
 #define TASK_WAKING             256
-#define TASK_STATE_MAX          512
+#define TASK_PARKED             512
+#define TASK_STATE_MAX          1024
 
-#define TASK_STATE_TO_CHAR_STR "RSDTtZXxKW"
+#define TASK_STATE_TO_CHAR_STR "RSDTtZXxKWP"
 
 extern char ___assert_task_state[1 - 2*!!(
                 sizeof(TASK_STATE_TO_CHAR_STR)-1 != ilog2(TASK_STATE_MAX)+1)];
diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
index 9e492be5244b..6fcfe99bd999 100644
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -219,6 +219,7 @@
 #define SSB_CHIPCO_PMU_CTL                      0x0600 /* PMU control */
 #define  SSB_CHIPCO_PMU_CTL_ILP_DIV             0xFFFF0000 /* ILP div mask */
 #define  SSB_CHIPCO_PMU_CTL_ILP_DIV_SHIFT       16
+#define  SSB_CHIPCO_PMU_CTL_PLL_UPD             0x00000400
 #define  SSB_CHIPCO_PMU_CTL_NOILPONW            0x00000200 /* No ILP on wait */
 #define  SSB_CHIPCO_PMU_CTL_HTREQEN             0x00000100 /* HT req enable */
 #define  SSB_CHIPCO_PMU_CTL_ALPREQEN            0x00000080 /* ALP req enable */
@@ -667,5 +668,6 @@ enum ssb_pmu_ldo_volt_id {
 void ssb_pmu_set_ldo_voltage(struct ssb_chipcommon *cc,
                              enum ssb_pmu_ldo_volt_id id, u32 voltage);
 void ssb_pmu_set_ldo_paref(struct ssb_chipcommon *cc, bool on);
+void ssb_pmu_spuravoid_pllupdate(struct ssb_chipcommon *cc, int spuravoid);
 
 #endif /* LINUX_SSB_CHIPCO_H_ */
diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
index 2de42f9401d2..a5ffd32642fd 100644
--- a/include/linux/swiotlb.h
+++ b/include/linux/swiotlb.h
@@ -25,6 +25,7 @@ extern int swiotlb_force;
 extern void swiotlb_init(int verbose);
 int swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose);
 extern unsigned long swiotlb_nr_tbl(void);
+unsigned long swiotlb_size_or_default(void);
 extern int swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs);
 
 /*
diff --git a/include/linux/ucs2_string.h b/include/linux/ucs2_string.h
new file mode 100644
index 000000000000..cbb20afdbc01
--- /dev/null
+++ b/include/linux/ucs2_string.h
@@ -0,0 +1,14 @@
+#ifndef _LINUX_UCS2_STRING_H_
+#define _LINUX_UCS2_STRING_H_
+
+#include <linux/types.h>        /* for size_t */
+#include <linux/stddef.h>       /* for NULL */
+
+typedef u16 ucs2_char_t;
+
+unsigned long ucs2_strnlen(const ucs2_char_t *s, size_t maxlength);
+unsigned long ucs2_strlen(const ucs2_char_t *s);
+unsigned long ucs2_strsize(const ucs2_char_t *data, unsigned long maxlength);
+int ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len);
+
+#endif /* _LINUX_UCS2_STRING_H_ */
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 40be2a0d8ae1..84a6440f1f19 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -199,6 +199,7 @@ extern bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
 /* Device notifier */
 extern int register_inet6addr_notifier(struct notifier_block *nb);
 extern int unregister_inet6addr_notifier(struct notifier_block *nb);
+extern int inet6addr_notifier_call_chain(unsigned long val, void *v);
 
 extern void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
                                          struct ipv6_devconf *devconf);
diff --git a/include/net/irda/irlmp.h b/include/net/irda/irlmp.h
index f74109144d3f..f132924cc9da 100644
--- a/include/net/irda/irlmp.h
+++ b/include/net/irda/irlmp.h
@@ -256,7 +256,8 @@ static inline __u32 irlmp_get_daddr(const struct lsap_cb *self)
         return (self && self->lap) ? self->lap->daddr : 0;
 }
 
-extern const char *irlmp_reasons[];
+const char *irlmp_reason_str(LM_REASON reason);
+
 extern int sysctl_discovery_timeout;
 extern int sysctl_discovery_slots;
 extern int sysctl_discovery;
diff --git a/include/net/scm.h b/include/net/scm.h
index 975cca01048b..b11708105681 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -56,8 +56,8 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
         scm->pid  = get_pid(pid);
         scm->cred = cred ? get_cred(cred) : NULL;
         scm->creds.pid = pid_vnr(pid);
-        scm->creds.uid = cred ? cred->euid : INVALID_UID;
-        scm->creds.gid = cred ? cred->egid : INVALID_GID;
+        scm->creds.uid = cred ? cred->uid : INVALID_UID;
+        scm->creds.gid = cred ? cred->gid : INVALID_GID;
 }
 
 static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index 9961726523d0..9c1467357b03 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -257,6 +257,7 @@ TRACE_EVENT(block_bio_bounce,
 
 /**
  * block_bio_complete - completed all work on the block operation
+ * @q: queue holding the block operation
  * @bio: block operation completed
  * @error: io error value
  *
@@ -265,9 +266,9 @@ TRACE_EVENT(block_bio_bounce,
  */
 TRACE_EVENT(block_bio_complete,
 
-        TP_PROTO(struct bio *bio, int error),
+        TP_PROTO(struct request_queue *q, struct bio *bio, int error),
 
-        TP_ARGS(bio, error),
+        TP_ARGS(q, bio, error),
 
         TP_STRUCT__entry(
                 __field( dev_t,         dev             )
@@ -278,8 +279,7 @@ TRACE_EVENT(block_bio_complete,
         ),
 
         TP_fast_assign(
-                __entry->dev            = bio->bi_bdev ?
-                                          bio->bi_bdev->bd_dev : 0;
+                __entry->dev            = bio->bi_bdev->bd_dev;
                 __entry->sector         = bio->bi_sector;
                 __entry->nr_sector      = bio->bi_size >> 9;
                 __entry->error          = error;
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 5a8671e8a67f..e5586caff67a 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -147,7 +147,7 @@ TRACE_EVENT(sched_switch,
                   __print_flags(__entry->prev_state & (TASK_STATE_MAX-1), "|",
                                 { 1, "S"} , { 2, "D" }, { 4, "T" }, { 8, "t" },
                                 { 16, "Z" }, { 32, "X" }, { 64, "x" },
-                                { 128, "W" }) : "R",
+                                { 128, "K" }, { 256, "W" }, { 512, "P" }) : "R",
                 __entry->prev_state & TASK_STATE_MAX ? "+" : "",
                 __entry->next_comm, __entry->next_pid, __entry->next_prio)
 );
diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h
index 4c43b4448792..706d035fa748 100644
--- a/include/uapi/linux/fuse.h
+++ b/include/uapi/linux/fuse.h
@@ -95,15 +95,10 @@
 #ifndef _LINUX_FUSE_H
 #define _LINUX_FUSE_H
 
-#ifdef __linux__
+#ifdef __KERNEL__
 #include <linux/types.h>
 #else
 #include <stdint.h>
-#define __u64 uint64_t
-#define __s64 int64_t
-#define __u32 uint32_t
-#define __s32 int32_t
-#define __u16 uint16_t
 #endif
 
 /*
@@ -139,42 +134,42 @@
    userspace works under 64bit kernels */
 
 struct fuse_attr {
-        __u64   ino;
-        __u64   size;
-        __u64   blocks;
-        __u64   atime;
-        __u64   mtime;
-        __u64   ctime;
-        __u32   atimensec;
-        __u32   mtimensec;
-        __u32   ctimensec;
-        __u32   mode;
-        __u32   nlink;
-        __u32   uid;
-        __u32   gid;
-        __u32   rdev;
-        __u32   blksize;
-        __u32   padding;
+        uint64_t        ino;
+        uint64_t        size;
+        uint64_t        blocks;
+        uint64_t        atime;
+        uint64_t        mtime;
+        uint64_t        ctime;
+        uint32_t        atimensec;
+        uint32_t        mtimensec;
+        uint32_t        ctimensec;
+        uint32_t        mode;
+        uint32_t        nlink;
+        uint32_t        uid;
+        uint32_t        gid;
+        uint32_t        rdev;
+        uint32_t        blksize;
+        uint32_t        padding;
 };
 
 struct fuse_kstatfs {
-        __u64   blocks;
-        __u64   bfree;
-        __u64   bavail;
-        __u64   files;
-        __u64   ffree;
-        __u32   bsize;
-        __u32   namelen;
-        __u32   frsize;
-        __u32   padding;
-        __u32   spare[6];
+        uint64_t        blocks;
+        uint64_t        bfree;
+        uint64_t        bavail;
+        uint64_t        files;
+        uint64_t        ffree;
+        uint32_t        bsize;
+        uint32_t        namelen;
+        uint32_t        frsize;
+        uint32_t        padding;
+        uint32_t        spare[6];
 };
 
 struct fuse_file_lock {
-        __u64   start;
-        __u64   end;
-        __u32   type;
-        __u32   pid; /* tgid */
+        uint64_t        start;
+        uint64_t        end;
+        uint32_t        type;
+        uint32_t        pid; /* tgid */
 };
 
 /**
@@ -364,143 +359,143 @@ enum fuse_notify_code {
 #define FUSE_COMPAT_ENTRY_OUT_SIZE 120
 
 struct fuse_entry_out {
-        __u64   nodeid;         /* Inode ID */
-        __u64   generation;     /* Inode generation: nodeid:gen must
-                                   be unique for the fs's lifetime */
-        __u64   entry_valid;    /* Cache timeout for the name */
-        __u64   attr_valid;     /* Cache timeout for the attributes */
-        __u32   entry_valid_nsec;
-        __u32   attr_valid_nsec;
+        uint64_t        nodeid;         /* Inode ID */
+        uint64_t        generation;     /* Inode generation: nodeid:gen must
+                                           be unique for the fs's lifetime */
+        uint64_t        entry_valid;    /* Cache timeout for the name */
+        uint64_t        attr_valid;     /* Cache timeout for the attributes */
+        uint32_t        entry_valid_nsec;
+        uint32_t        attr_valid_nsec;
         struct fuse_attr attr;
 };
 
 struct fuse_forget_in {
-        __u64   nlookup;
+        uint64_t        nlookup;
 };
 
 struct fuse_forget_one {
-        __u64   nodeid;
-        __u64   nlookup;
+        uint64_t        nodeid;
+        uint64_t        nlookup;
 };
 
 struct fuse_batch_forget_in {
-        __u32   count;
-        __u32   dummy;
+        uint32_t        count;
+        uint32_t        dummy;
 };
 
 struct fuse_getattr_in {
-        __u32   getattr_flags;
-        __u32   dummy;
-        __u64   fh;
+        uint32_t        getattr_flags;
+        uint32_t        dummy;
+        uint64_t        fh;
 };
 
 #define FUSE_COMPAT_ATTR_OUT_SIZE 96
 
 struct fuse_attr_out {
-        __u64   attr_valid;     /* Cache timeout for the attributes */
-        __u32   attr_valid_nsec;
-        __u32   dummy;
+        uint64_t        attr_valid;     /* Cache timeout for the attributes */
+        uint32_t        attr_valid_nsec;
+        uint32_t        dummy;
         struct fuse_attr attr;
 };
 
 #define FUSE_COMPAT_MKNOD_IN_SIZE 8
 
 struct fuse_mknod_in {
-        __u32   mode;
-        __u32   rdev;
-        __u32   umask;
-        __u32   padding;
+        uint32_t        mode;
+        uint32_t        rdev;
+        uint32_t        umask;
+        uint32_t        padding;
 };
 
 struct fuse_mkdir_in {
-        __u32   mode;
-        __u32   umask;
+        uint32_t        mode;
+        uint32_t        umask;
 };
 
 struct fuse_rename_in {
-        __u64   newdir;
+        uint64_t        newdir;
 };
 
 struct fuse_link_in {
-        __u64   oldnodeid;
+        uint64_t        oldnodeid;
 };
 
 struct fuse_setattr_in {
-        __u32   valid;
-        __u32   padding;
-        __u64   fh;
-        __u64   size;
-        __u64   lock_owner;
-        __u64   atime;
-        __u64   mtime;
-        __u64   unused2;
-        __u32   atimensec;
-        __u32   mtimensec;
-        __u32   unused3;
-        __u32   mode;
-        __u32   unused4;
-        __u32   uid;
-        __u32   gid;
-        __u32   unused5;
+        uint32_t        valid;
+        uint32_t        padding;
+        uint64_t        fh;
+        uint64_t        size;
+        uint64_t        lock_owner;
+        uint64_t        atime;
+        uint64_t        mtime;
+        uint64_t        unused2;
+        uint32_t        atimensec;
+        uint32_t        mtimensec;
+        uint32_t        unused3;
+        uint32_t        mode;
+        uint32_t        unused4;
+        uint32_t        uid;
+        uint32_t        gid;
+        uint32_t        unused5;
 };
 
 struct fuse_open_in {
-        __u32   flags;
-        __u32   unused;
+        uint32_t        flags;
+        uint32_t        unused;
 };
 
 struct fuse_create_in {
-        __u32   flags;
-        __u32   mode;
-        __u32   umask;
-        __u32   padding;
+        uint32_t        flags;
+        uint32_t        mode;
+        uint32_t        umask;
+        uint32_t        padding;
 };
 
 struct fuse_open_out {
-        __u64   fh;
-        __u32   open_flags;
-        __u32   padding;
+        uint64_t        fh;
+        uint32_t        open_flags;
+        uint32_t        padding;
 };
 
 struct fuse_release_in {
-        __u64   fh;
-        __u32   flags;
-        __u32   release_flags;
-        __u64   lock_owner;
+        uint64_t        fh;
+        uint32_t        flags;
+        uint32_t        release_flags;
+        uint64_t        lock_owner;
 };
 
 struct fuse_flush_in {
-        __u64   fh;
-        __u32   unused;
-        __u32   padding;
-        __u64   lock_owner;
+        uint64_t        fh;
+        uint32_t        unused;
+        uint32_t        padding;
+        uint64_t        lock_owner;
 };
 
 struct fuse_read_in {
-        __u64   fh;
-        __u64   offset;
-        __u32   size;
-        __u32   read_flags;
-        __u64   lock_owner;
-        __u32   flags;
-        __u32   padding;
+        uint64_t        fh;
+        uint64_t        offset;
+        uint32_t        size;
+        uint32_t        read_flags;
+        uint64_t        lock_owner;
+        uint32_t        flags;
+        uint32_t        padding;
 };
 
 #define FUSE_COMPAT_WRITE_IN_SIZE 24
 
 struct fuse_write_in {
-        __u64   fh;
-        __u64   offset;
-        __u32   size;
-        __u32   write_flags;
-        __u64   lock_owner;
-        __u32   flags;
-        __u32   padding;
+        uint64_t        fh;
+        uint64_t        offset;
+        uint32_t        size;
+        uint32_t        write_flags;
+        uint64_t        lock_owner;
+        uint32_t        flags;
+        uint32_t        padding;
 };
 
 struct fuse_write_out {
-        __u32   size;
-        __u32   padding;
+        uint32_t        size;
+        uint32_t        padding;
 };
 
 #define FUSE_COMPAT_STATFS_SIZE 48
@@ -510,32 +505,32 @@ struct fuse_statfs_out {
 };
 
 struct fuse_fsync_in {
-        __u64   fh;
-        __u32   fsync_flags;
-        __u32   padding;
+        uint64_t        fh;
+        uint32_t        fsync_flags;
+        uint32_t        padding;
 };
 
 struct fuse_setxattr_in {
-        __u32   size;
-        __u32   flags;
+        uint32_t        size;
+        uint32_t        flags;
 };
 
 struct fuse_getxattr_in {
-        __u32   size;
-        __u32   padding;
+        uint32_t        size;
+        uint32_t        padding;
 };
 
 struct fuse_getxattr_out {
-        __u32   size;
-        __u32   padding;
+        uint32_t        size;
+        uint32_t        padding;
 };
 
 struct fuse_lk_in {
-        __u64   fh;
-        __u64   owner;
+        uint64_t        fh;
+        uint64_t        owner;
         struct fuse_file_lock lk;
-        __u32   lk_flags;
-        __u32   padding;
+        uint32_t        lk_flags;
+        uint32_t        padding;
 };
 
 struct fuse_lk_out {
@@ -543,134 +538,135 @@ struct fuse_lk_out {
 };
 
 struct fuse_access_in {
-        __u32   mask;
-        __u32   padding;
+        uint32_t        mask;
+        uint32_t        padding;
 };
 
 struct fuse_init_in {
-        __u32   major;
-        __u32   minor;
-        __u32   max_readahead;
-        __u32   flags;
+        uint32_t        major;
+        uint32_t        minor;
+        uint32_t        max_readahead;
+        uint32_t        flags;
 };
 
 struct fuse_init_out {
-        __u32   major;
-        __u32   minor;
-        __u32   max_readahead;
-        __u32   flags;
-        __u16   max_background;
-        __u16   congestion_threshold;
-        __u32   max_write;
+        uint32_t        major;
+        uint32_t        minor;
+        uint32_t        max_readahead;
+        uint32_t        flags;
+        uint16_t        max_background;
+        uint16_t        congestion_threshold;
+        uint32_t        max_write;
 };
 
 #define CUSE_INIT_INFO_MAX 4096
 
 struct cuse_init_in {
-        __u32   major;
-        __u32   minor;
-        __u32   unused;
-        __u32   flags;
+        uint32_t        major;
+        uint32_t        minor;
+        uint32_t        unused;
+        uint32_t        flags;
 };
 
 struct cuse_init_out {
-        __u32   major;
-        __u32   minor;
-        __u32   unused;
-        __u32   flags;
-        __u32   max_read;
-        __u32   max_write;
-        __u32   dev_major;              /* chardev major */
-        __u32   dev_minor;              /* chardev minor */
-        __u32   spare[10];
+        uint32_t        major;
+        uint32_t        minor;
+        uint32_t        unused;
+        uint32_t        flags;
+        uint32_t        max_read;
+        uint32_t        max_write;
+        uint32_t        dev_major;              /* chardev major */
+        uint32_t        dev_minor;              /* chardev minor */
+        uint32_t        spare[10];
 };
 
 struct fuse_interrupt_in {
-        __u64   unique;
+        uint64_t        unique;
 };
 
 struct fuse_bmap_in {
-        __u64   block;
-        __u32   blocksize;
-        __u32   padding;
+        uint64_t        block;
+        uint32_t        blocksize;
+        uint32_t        padding;
 };
 
 struct fuse_bmap_out {
-        __u64   block;
+        uint64_t        block;
 };
 
 struct fuse_ioctl_in {
-        __u64   fh;
-        __u32   flags;
-        __u32   cmd;
-        __u64   arg;
-        __u32   in_size;
-        __u32   out_size;
+        uint64_t        fh;
+        uint32_t        flags;
+        uint32_t        cmd;
+        uint64_t        arg;
+        uint32_t        in_size;
+        uint32_t        out_size;
 };
 
 struct fuse_ioctl_iovec {
-        __u64   base;
-        __u64   len;
+        uint64_t        base;
+        uint64_t        len;
 };
 
 struct fuse_ioctl_out {
-        __s32   result;
-        __u32   flags;
-        __u32   in_iovs;
-        __u32   out_iovs;
+        int32_t         result;
+        uint32_t        flags;
+        uint32_t        in_iovs;
+        uint32_t        out_iovs;
 };
 
 struct fuse_poll_in {
-        __u64   fh;
-        __u64   kh;
-        __u32   flags;
-        __u32   events;
+        uint64_t        fh;
+        uint64_t        kh;
+        uint32_t        flags;
+        uint32_t        events;
 };
 
 struct fuse_poll_out {
-        __u32   revents;
-        __u32   padding;
+        uint32_t        revents;
+        uint32_t        padding;
 };
 
 struct fuse_notify_poll_wakeup_out {
-        __u64   kh;
+        uint64_t        kh;
 };
 
 struct fuse_fallocate_in {
-        __u64   fh;
-        __u64   offset;
-        __u64   length;
-        __u32   mode;
-        __u32   padding;
+        uint64_t        fh;
+        uint64_t        offset;
+        uint64_t        length;
+        uint32_t        mode;
+        uint32_t        padding;
 };
 
 struct fuse_in_header {
-        __u32   len;
-        __u32   opcode;
-        __u64   unique;
-        __u64   nodeid;
-        __u32   uid;
-        __u32   gid;
-        __u32   pid;
-        __u32   padding;
+        uint32_t        len;
+        uint32_t        opcode;
+        uint64_t        unique;
+        uint64_t        nodeid;
+        uint32_t        uid;
+        uint32_t        gid;
+        uint32_t        pid;
+        uint32_t        padding;
 };
 
 struct fuse_out_header {
-        __u32   len;
-        __s32   error;
-        __u64   unique;
+        uint32_t        len;
+        int32_t         error;
+        uint64_t        unique;
 };
 
 struct fuse_dirent {
-        __u64   ino;
-        __u64   off;
-        __u32   namelen;
-        __u32   type;
+        uint64_t        ino;
+        uint64_t        off;
+        uint32_t        namelen;
+        uint32_t        type;
         char name[];
 };
 
 #define FUSE_NAME_OFFSET offsetof(struct fuse_dirent, name)
-#define FUSE_DIRENT_ALIGN(x) (((x) + sizeof(__u64) - 1) & ~(sizeof(__u64) - 1))
+#define FUSE_DIRENT_ALIGN(x) \
+        (((x) + sizeof(uint64_t) - 1) & ~(sizeof(uint64_t) - 1))
 #define FUSE_DIRENT_SIZE(d) \
         FUSE_DIRENT_ALIGN(FUSE_NAME_OFFSET + (d)->namelen)
 
@@ -685,47 +681,47 @@ struct fuse_direntplus {
         FUSE_DIRENT_ALIGN(FUSE_NAME_OFFSET_DIRENTPLUS + (d)->dirent.namelen)
 
 struct fuse_notify_inval_inode_out {
-        __u64   ino;
-        __s64   off;
-        __s64   len;
+        uint64_t        ino;
+        int64_t         off;
+        int64_t         len;
 };
 
 struct fuse_notify_inval_entry_out {
-        __u64   parent;
-        __u32   namelen;
-        __u32   padding;
+        uint64_t        parent;
+        uint32_t        namelen;
+        uint32_t        padding;
 };
 
 struct fuse_notify_delete_out {
-        __u64   parent;
-        __u64   child;
-        __u32   namelen;
-        __u32   padding;
+        uint64_t        parent;
+        uint64_t        child;
+        uint32_t        namelen;
+        uint32_t        padding;
 };
 
 struct fuse_notify_store_out {
-        __u64   nodeid;
-        __u64   offset;
-        __u32   size;
-        __u32   padding;
+        uint64_t        nodeid;
+        uint64_t        offset;
+        uint32_t        size;
+        uint32_t        padding;
 };
 
 struct fuse_notify_retrieve_out {
-        __u64   notify_unique;
-        __u64   nodeid;
-        __u64   offset;
-        __u32   size;
-        __u32   padding;
+        uint64_t        notify_unique;
+        uint64_t        nodeid;
+        uint64_t        offset;
+        uint32_t        size;
+        uint32_t        padding;
 };
 
 /* Matches the size of fuse_write_in */
 struct fuse_notify_retrieve_in {
-        __u64   dummy1;
-        __u64   offset;
-        __u32   size;
-        __u32   dummy2;
-        __u64   dummy3;
-        __u64   dummy4;
+        uint64_t        dummy1;
+        uint64_t        offset;
+        uint32_t        size;
+        uint32_t        dummy2;
+        uint64_t        dummy3;
+        uint64_t        dummy4;
 };
 
 #endif /* _LINUX_FUSE_H */
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7e0962ed7f8a..4d3124b39277 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5331,7 +5331,7 @@ static void sw_perf_event_destroy(struct perf_event *event)
 
 static int perf_swevent_init(struct perf_event *event)
 {
-        int event_id = event->attr.config;
+        u64 event_id = event->attr.config;
 
         if (event->attr.type != PERF_TYPE_SOFTWARE)
                 return -ENOENT;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index cc47812d3feb..14be27feda49 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -63,6 +63,7 @@
 DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
 {
 
+        .lock = __RAW_SPIN_LOCK_UNLOCKED(hrtimer_bases.lock),
         .clock_base =
         {
                 {
@@ -1642,8 +1643,6 @@ static void __cpuinit init_hrtimers_cpu(int cpu)
         struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
         int i;
 
-        raw_spin_lock_init(&cpu_base->lock);
-
         for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
                 cpu_base->clock_base[i].cpu_base = cpu_base;
                 timerqueue_init_head(&cpu_base->clock_base[i].active);
diff --git a/kernel/kexec.c b/kernel/kexec.c
index bddd3d7a74b6..ffd4e111fd67 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -55,7 +55,7 @@ struct resource crashk_res = {
         .flags = IORESOURCE_BUSY | IORESOURCE_MEM
 };
 struct resource crashk_low_res = {
-        .name  = "Crash kernel low",
+        .name  = "Crash kernel",
         .start = 0,
         .end   = 0,
         .flags = IORESOURCE_BUSY | IORESOURCE_MEM
@@ -1368,35 +1368,114 @@ static int __init parse_crashkernel_simple(char 		*cmdline,
         return 0;
 }
 
+#define SUFFIX_HIGH 0
+#define SUFFIX_LOW  1
+#define SUFFIX_NULL 2
+static __initdata char *suffix_tbl[] = {
+        [SUFFIX_HIGH] = ",high",
+        [SUFFIX_LOW]  = ",low",
+        [SUFFIX_NULL] = NULL,
+};
+
 /*
- * That function is the entry point for command line parsing and should be
- * called from the arch-specific code.
+ * That function parses "suffix"  crashkernel command lines like
+ *
+ *      crashkernel=size,[high|low]
+ *
+ * It returns 0 on success and -EINVAL on failure.
  */
+static int __init parse_crashkernel_suffix(char *cmdline,
+                                           unsigned long long   *crash_size,
+                                           unsigned long long   *crash_base,
+                                           const char *suffix)
+{
+        char *cur = cmdline;
+
+        *crash_size = memparse(cmdline, &cur);
+        if (cmdline == cur) {
+                pr_warn("crashkernel: memory value expected\n");
+                return -EINVAL;
+        }
+
+        /* check with suffix */
+        if (strncmp(cur, suffix, strlen(suffix))) {
+                pr_warn("crashkernel: unrecognized char\n");
+                return -EINVAL;
+        }
+        cur += strlen(suffix);
+        if (*cur != ' ' && *cur != '\0') {
+                pr_warn("crashkernel: unrecognized char\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static __init char *get_last_crashkernel(char *cmdline,
+                             const char *name,
+                             const char *suffix)
+{
+        char *p = cmdline, *ck_cmdline = NULL;
+
+        /* find crashkernel and use the last one if there are more */
+        p = strstr(p, name);
+        while (p) {
+                char *end_p = strchr(p, ' ');
+                char *q;
+
+                if (!end_p)
+                        end_p = p + strlen(p);
+
+                if (!suffix) {
+                        int i;
+
+                        /* skip the one with any known suffix */
+                        for (i = 0; suffix_tbl[i]; i++) {
+                                q = end_p - strlen(suffix_tbl[i]);
+                                if (!strncmp(q, suffix_tbl[i],
+                                             strlen(suffix_tbl[i])))
+                                        goto next;
+                        }
+                        ck_cmdline = p;
+                } else {
+                        q = end_p - strlen(suffix);
+                        if (!strncmp(q, suffix, strlen(suffix)))
+                                ck_cmdline = p;
+                }
+next:
+                p = strstr(p+1, name);
+        }
+
+        if (!ck_cmdline)
+                return NULL;
+
+        return ck_cmdline;
+}
+
 static int __init __parse_crashkernel(char *cmdline,
                              unsigned long long system_ram,
                              unsigned long long *crash_size,
                              unsigned long long *crash_base,
-                                const char *name)
+                             const char *name,
+                             const char *suffix)
 {
-        char    *p = cmdline, *ck_cmdline = NULL;
         char    *first_colon, *first_space;
+        char    *ck_cmdline;
 
         BUG_ON(!crash_size || !crash_base);
         *crash_size = 0;
         *crash_base = 0;
 
-        /* find crashkernel and use the last one if there are more */
-        p = strstr(p, name);
-        while (p) {
-                ck_cmdline = p;
-                p = strstr(p+1, name);
-        }
+        ck_cmdline = get_last_crashkernel(cmdline, name, suffix);
 
         if (!ck_cmdline)
                 return -EINVAL;
 
         ck_cmdline += strlen(name);
 
+        if (suffix)
+                return parse_crashkernel_suffix(ck_cmdline, crash_size,
+                                crash_base, suffix);
         /*
          * if the commandline contains a ':', then that's the extended
          * syntax -- if not, it must be the classic syntax
@@ -1413,13 +1492,26 @@ static int __init __parse_crashkernel(char *cmdline,
         return 0;
 }
 
+/*
+ * That function is the entry point for command line parsing and should be
+ * called from the arch-specific code.
+ */
 int __init parse_crashkernel(char *cmdline,
                              unsigned long long system_ram,
                              unsigned long long *crash_size,
                              unsigned long long *crash_base)
 {
         return __parse_crashkernel(cmdline, system_ram, crash_size, crash_base,
-                                        "crashkernel=");
+                                        "crashkernel=", NULL);
+}
+
+int __init parse_crashkernel_high(char *cmdline,
+                             unsigned long long system_ram,
+                             unsigned long long *crash_size,
+                             unsigned long long *crash_base)
+{
+        return __parse_crashkernel(cmdline, system_ram, crash_size, crash_base,
+                                "crashkernel=", suffix_tbl[SUFFIX_HIGH]);
 }
 
 int __init parse_crashkernel_low(char *cmdline,
@@ -1428,7 +1520,7 @@ int __init parse_crashkernel_low(char *cmdline,
                              unsigned long long *crash_base)
 {
         return __parse_crashkernel(cmdline, system_ram, crash_size, crash_base,
-                                        "crashkernel_low=");
+                                "crashkernel=", suffix_tbl[SUFFIX_LOW]);
 }
 
 static void update_vmcoreinfo_note(void)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index e35be53f6613..3fed7f0cbcdf 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -794,16 +794,16 @@ out:
 }
 
 #ifdef CONFIG_SYSCTL
-/* This should be called with kprobe_mutex locked */
 static void __kprobes optimize_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
         unsigned int i;
 
+        mutex_lock(&kprobe_mutex);
         /* If optimization is already allowed, just return */
         if (kprobes_allow_optimization)
-                return;
+                goto out;
 
         kprobes_allow_optimization = true;
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
@@ -813,18 +813,22 @@ static void __kprobes optimize_all_kprobes(void)
                                 optimize_kprobe(p);
         }
         printk(KERN_INFO "Kprobes globally optimized\n");
+out:
+        mutex_unlock(&kprobe_mutex);
 }
 
-/* This should be called with kprobe_mutex locked */
 static void __kprobes unoptimize_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
         unsigned int i;
 
+        mutex_lock(&kprobe_mutex);
         /* If optimization is already prohibited, just return */
-        if (!kprobes_allow_optimization)
+        if (!kprobes_allow_optimization) {
+                mutex_unlock(&kprobe_mutex);
                 return;
+        }
 
         kprobes_allow_optimization = false;
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
@@ -834,11 +838,14 @@ static void __kprobes unoptimize_all_kprobes(void)
                                 unoptimize_kprobe(p, false);
                 }
         }
+        mutex_unlock(&kprobe_mutex);
+
         /* Wait for unoptimizing completion */
         wait_for_kprobe_optimizer();
         printk(KERN_INFO "Kprobes globally unoptimized\n");
 }
 
+static DEFINE_MUTEX(kprobe_sysctl_mutex);
 int sysctl_kprobes_optimization;
 int proc_kprobes_optimization_handler(struct ctl_table *table, int write,
                                       void __user *buffer, size_t *length,
@@ -846,7 +853,7 @@ int proc_kprobes_optimization_handler(struct ctl_table *table, int write,
 {
         int ret;
 
-        mutex_lock(&kprobe_mutex);
+        mutex_lock(&kprobe_sysctl_mutex);
         sysctl_kprobes_optimization = kprobes_allow_optimization ? 1 : 0;
         ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
 
@@ -854,7 +861,7 @@ int proc_kprobes_optimization_handler(struct ctl_table *table, int write,
                 optimize_all_kprobes();
         else
                 unoptimize_all_kprobes();
-        mutex_unlock(&kprobe_mutex);
+        mutex_unlock(&kprobe_sysctl_mutex);
 
         return ret;
 }
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 691dc2ef9baf..9eb7fed0bbaa 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -124,12 +124,12 @@ void *kthread_data(struct task_struct *task)
 
 static void __kthread_parkme(struct kthread *self)
 {
-        __set_current_state(TASK_INTERRUPTIBLE);
+        __set_current_state(TASK_PARKED);
         while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
                 if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
                         complete(&self->parked);
                 schedule();
-                __set_current_state(TASK_INTERRUPTIBLE);
+                __set_current_state(TASK_PARKED);
         }
         clear_bit(KTHREAD_IS_PARKED, &self->flags);
         __set_current_state(TASK_RUNNING);
@@ -256,8 +256,13 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
 }
 EXPORT_SYMBOL(kthread_create_on_node);
 
-static void __kthread_bind(struct task_struct *p, unsigned int cpu)
+static void __kthread_bind(struct task_struct *p, unsigned int cpu, long state)
 {
+        /* Must have done schedule() in kthread() before we set_task_cpu */
+        if (!wait_task_inactive(p, state)) {
+                WARN_ON(1);
+                return;
+        }
         /* It's safe because the task is inactive. */
         do_set_cpus_allowed(p, cpumask_of(cpu));
         p->flags |= PF_THREAD_BOUND;
@@ -274,12 +279,7 @@ static void __kthread_bind(struct task_struct *p, unsigned int cpu)
  */
 void kthread_bind(struct task_struct *p, unsigned int cpu)
 {
-        /* Must have done schedule() in kthread() before we set_task_cpu */
-        if (!wait_task_inactive(p, TASK_UNINTERRUPTIBLE)) {
-                WARN_ON(1);
-                return;
-        }
-        __kthread_bind(p, cpu);
+        __kthread_bind(p, cpu, TASK_UNINTERRUPTIBLE);
 }
 EXPORT_SYMBOL(kthread_bind);
 
@@ -324,6 +324,22 @@ static struct kthread *task_get_live_kthread(struct task_struct *k)
         return NULL;
 }
 
+static void __kthread_unpark(struct task_struct *k, struct kthread *kthread)
+{
+        clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+        /*
+         * We clear the IS_PARKED bit here as we don't wait
+         * until the task has left the park code. So if we'd
+         * park before that happens we'd see the IS_PARKED bit
+         * which might be about to be cleared.
+         */
+        if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
+                if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
+                        __kthread_bind(k, kthread->cpu, TASK_PARKED);
+                wake_up_state(k, TASK_PARKED);
+        }
+}
+
 /**
  * kthread_unpark - unpark a thread created by kthread_create().
  * @k:          thread created by kthread_create().
@@ -336,20 +352,8 @@ void kthread_unpark(struct task_struct *k)
 {
         struct kthread *kthread = task_get_live_kthread(k);
 
-        if (kthread) {
-                clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
-                /*
-                 * We clear the IS_PARKED bit here as we don't wait
-                 * until the task has left the park code. So if we'd
-                 * park before that happens we'd see the IS_PARKED bit
-                 * which might be about to be cleared.
-                 */
-                if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
-                        if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
-                                __kthread_bind(k, kthread->cpu);
-                        wake_up_process(k);
-                }
-        }
+        if (kthread)
+                __kthread_unpark(k, kthread);
         put_task_struct(k);
 }
 
@@ -407,7 +411,7 @@ int kthread_stop(struct task_struct *k)
         trace_sched_kthread_stop(k);
         if (kthread) {
                 set_bit(KTHREAD_SHOULD_STOP, &kthread->flags);
-                clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+                __kthread_unpark(k, kthread);
                 wake_up_process(k);
                 wait_for_completion(&kthread->exited);
         }
diff --git a/kernel/signal.c b/kernel/signal.c
index dd72567767d9..598dc06be421 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2948,7 +2948,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
 
 static int do_tkill(pid_t tgid, pid_t pid, int sig)
 {
-        struct siginfo info;
+        struct siginfo info = {};
 
         info.si_signo = sig;
         info.si_errno = 0;
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index 8eaed9aa9cf0..02fc5c933673 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -185,8 +185,18 @@ __smpboot_create_thread(struct smp_hotplug_thread *ht, unsigned int cpu)
         }
         get_task_struct(tsk);
         *per_cpu_ptr(ht->store, cpu) = tsk;
-        if (ht->create)
-                ht->create(cpu);
+        if (ht->create) {
+                /*
+                 * Make sure that the task has actually scheduled out
+                 * into park position, before calling the create
+                 * callback. At least the migration thread callback
+                 * requires that the task is off the runqueue.
+                 */
+                if (!wait_task_inactive(tsk, TASK_PARKED))
+                        WARN_ON(1);
+                else
+                        ht->create(cpu);
+        }
         return 0;
 }
 
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 9e5b8c272eec..5a0f781cd729 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -739,12 +739,6 @@ static void blk_add_trace_rq_complete(void *ignore,
                                       struct request_queue *q,
                                       struct request *rq)
 {
-        struct blk_trace *bt = q->blk_trace;
-
-        /* if control ever passes through here, it's a request based driver */
-        if (unlikely(bt && !bt->rq_based))
-                bt->rq_based = true;
-
         blk_add_trace_rq(q, rq, BLK_TA_COMPLETE);
 }
 
@@ -780,24 +774,10 @@ static void blk_add_trace_bio_bounce(void *ignore,
         blk_add_trace_bio(q, bio, BLK_TA_BOUNCE, 0);
 }
 
-static void blk_add_trace_bio_complete(void *ignore, struct bio *bio, int error)
+static void blk_add_trace_bio_complete(void *ignore,
+                                       struct request_queue *q, struct bio *bio,
+                                       int error)
 {
-        struct request_queue *q;
-        struct blk_trace *bt;
-
-        if (!bio->bi_bdev)
-                return;
-
-        q = bdev_get_queue(bio->bi_bdev);
-        bt = q->blk_trace;
-
-        /*
-         * Request based drivers will generate both rq and bio completions.
-         * Ignore bio ones.
-         */
-        if (likely(!bt) || bt->rq_based)
-                return;
-
         blk_add_trace_bio(q, bio, BLK_TA_COMPLETE, error);
 }
 
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index a54f26f82eb2..e134d8f365dd 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -25,7 +25,8 @@
 
 static struct kmem_cache *user_ns_cachep __read_mostly;
 
-static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
+static bool new_idmap_permitted(const struct file *file,
+                                struct user_namespace *ns, int cap_setid,
                                 struct uid_gid_map *map);
 
 static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
@@ -612,10 +613,10 @@ static ssize_t map_write(struct file *file, const char __user *buf,
         if (map->nr_extents != 0)
                 goto out;
 
-        /* Require the appropriate privilege CAP_SETUID or CAP_SETGID
-         * over the user namespace in order to set the id mapping.
+        /*
+         * Adjusting namespace settings requires capabilities on the target.
          */
-        if (cap_valid(cap_setid) && !ns_capable(ns, cap_setid))
+        if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
                 goto out;
 
         /* Get a buffer */
@@ -700,7 +701,7 @@ static ssize_t map_write(struct file *file, const char __user *buf,
 
         ret = -EPERM;
         /* Validate the user is allowed to use user id's mapped to. */
-        if (!new_idmap_permitted(ns, cap_setid, &new_map))
+        if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
                 goto out;
 
         /* Map the lower ids from the parent user namespace to the
@@ -787,7 +788,8 @@ ssize_t proc_projid_map_write(struct file *file, const char __user *buf, size_t
                          &ns->projid_map, &ns->parent->projid_map);
 }
 
-static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
+static bool new_idmap_permitted(const struct file *file, 
+                                struct user_namespace *ns, int cap_setid,
                                 struct uid_gid_map *new_map)
 {
         /* Allow mapping to your own filesystem ids */
@@ -795,12 +797,12 @@ static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
                 u32 id = new_map->extent[0].lower_first;
                 if (cap_setid == CAP_SETUID) {
                         kuid_t uid = make_kuid(ns->parent, id);
-                        if (uid_eq(uid, current_fsuid()))
+                        if (uid_eq(uid, file->f_cred->fsuid))
                                 return true;
                 }
                 else if (cap_setid == CAP_SETGID) {
                         kgid_t gid = make_kgid(ns->parent, id);
-                        if (gid_eq(gid, current_fsgid()))
+                        if (gid_eq(gid, file->f_cred->fsgid))
                                 return true;
                 }
         }
@@ -811,8 +813,10 @@ static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
 
         /* Allow the specified ids if we have the appropriate capability
          * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
+         * And the opener of the id file also had the approprpiate capability.
          */
-        if (ns_capable(ns->parent, cap_setid))
+        if (ns_capable(ns->parent, cap_setid) &&
+            file_ns_capable(file, ns->parent, cap_setid))
                 return true;
 
         return false;
diff --git a/lib/Kconfig b/lib/Kconfig
index 3958dc4389f9..fe01d418b09a 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -404,4 +404,7 @@ config OID_REGISTRY
         help
           Enable fast lookup object identifier registry.
 
+config UCS2_STRING
+        tristate
+
 endmenu
diff --git a/lib/Makefile b/lib/Makefile
index d7946ff75b2e..6e2cc561f761 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -174,3 +174,5 @@ quiet_cmd_build_OID_registry = GEN     $@
       cmd_build_OID_registry = perl $(srctree)/$(src)/build_OID_registry $< $@
 
 clean-files     += oid_registry_data.c
+
+obj-$(CONFIG_UCS2_STRING) += ucs2_string.o
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index bfe02b8fc55b..d23762e6652c 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -105,9 +105,9 @@ setup_io_tlb_npages(char *str)
         if (!strcmp(str, "force"))
                 swiotlb_force = 1;
 
-        return 1;
+        return 0;
 }
-__setup("swiotlb=", setup_io_tlb_npages);
+early_param("swiotlb", setup_io_tlb_npages);
 /* make io_tlb_overflow tunable too? */
 
 unsigned long swiotlb_nr_tbl(void)
@@ -115,6 +115,18 @@ unsigned long swiotlb_nr_tbl(void)
         return io_tlb_nslabs;
 }
 EXPORT_SYMBOL_GPL(swiotlb_nr_tbl);
+
+/* default to 64MB */
+#define IO_TLB_DEFAULT_SIZE (64UL<<20)
+unsigned long swiotlb_size_or_default(void)
+{
+        unsigned long size;
+
+        size = io_tlb_nslabs << IO_TLB_SHIFT;
+
+        return size ? size : (IO_TLB_DEFAULT_SIZE);
+}
+
 /* Note that this doesn't work with highmem page */
 static dma_addr_t swiotlb_virt_to_bus(struct device *hwdev,
                                       volatile void *address)
@@ -188,8 +200,7 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
 void  __init
 swiotlb_init(int verbose)
 {
-        /* default to 64MB */
-        size_t default_size = 64UL<<20;
+        size_t default_size = IO_TLB_DEFAULT_SIZE;
         unsigned char *vstart;
         unsigned long bytes;
 
diff --git a/lib/ucs2_string.c b/lib/ucs2_string.c
new file mode 100644
index 000000000000..6f500ef2301d
--- /dev/null
+++ b/lib/ucs2_string.c
@@ -0,0 +1,51 @@
+#include <linux/ucs2_string.h>
+#include <linux/module.h>
+
+/* Return the number of unicode characters in data */
+unsigned long
+ucs2_strnlen(const ucs2_char_t *s, size_t maxlength)
+{
+        unsigned long length = 0;
+
+        while (*s++ != 0 && length < maxlength)
+                length++;
+        return length;
+}
+EXPORT_SYMBOL(ucs2_strnlen);
+
+unsigned long
+ucs2_strlen(const ucs2_char_t *s)
+{
+        return ucs2_strnlen(s, ~0UL);
+}
+EXPORT_SYMBOL(ucs2_strlen);
+
+/*
+ * Return the number of bytes is the length of this string
+ * Note: this is NOT the same as the number of unicode characters
+ */
+unsigned long
+ucs2_strsize(const ucs2_char_t *data, unsigned long maxlength)
+{
+        return ucs2_strnlen(data, maxlength/sizeof(ucs2_char_t)) * sizeof(ucs2_char_t);
+}
+EXPORT_SYMBOL(ucs2_strsize);
+
+int
+ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len)
+{
+        while (1) {
+                if (len == 0)
+                        return 0;
+                if (*a < *b)
+                        return -1;
+                if (*a > *b)
+                        return 1;
+                if (*a == 0) /* implies *b == 0 */
+                        return 0;
+                a++;
+                b++;
+                len--;
+        }
+}
+EXPORT_SYMBOL(ucs2_strncmp);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ca9a7c6d7e97..1a12f5b9a0ab 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2961,7 +2961,17 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                         break;
                 }
 
-                if (absent ||
+                /*
+                 * We need call hugetlb_fault for both hugepages under migration
+                 * (in which case hugetlb_fault waits for the migration,) and
+                 * hwpoisoned hugepages (in which case we need to prevent the
+                 * caller from accessing to them.) In order to do this, we use
+                 * here is_swap_pte instead of is_hugetlb_entry_migration and
+                 * is_hugetlb_entry_hwpoisoned. This is because it simply covers
+                 * both cases, and because we can't follow correct pages
+                 * directly from any kind of swap entries.
+                 */
+                if (absent || is_swap_pte(huge_ptep_get(pte)) ||
                     ((flags & FOLL_WRITE) && !pte_write(huge_ptep_get(pte)))) {
                         int ret;
 
diff --git a/mm/memory.c b/mm/memory.c
index 13cbc420fead..ba94dec5b259 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2393,6 +2393,53 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
 }
 EXPORT_SYMBOL(remap_pfn_range);
 
+/**
+ * vm_iomap_memory - remap memory to userspace
+ * @vma: user vma to map to
+ * @start: start of area
+ * @len: size of area
+ *
+ * This is a simplified io_remap_pfn_range() for common driver use. The
+ * driver just needs to give us the physical memory range to be mapped,
+ * we'll figure out the rest from the vma information.
+ *
+ * NOTE! Some drivers might want to tweak vma->vm_page_prot first to get
+ * whatever write-combining details or similar.
+ */
+int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
+{
+        unsigned long vm_len, pfn, pages;
+
+        /* Check that the physical memory area passed in looks valid */
+        if (start + len < start)
+                return -EINVAL;
+        /*
+         * You *really* shouldn't map things that aren't page-aligned,
+         * but we've historically allowed it because IO memory might
+         * just have smaller alignment.
+         */
+        len += start & ~PAGE_MASK;
+        pfn = start >> PAGE_SHIFT;
+        pages = (len + ~PAGE_MASK) >> PAGE_SHIFT;
+        if (pfn + pages < pfn)
+                return -EINVAL;
+
+        /* We start the mapping 'vm_pgoff' pages into the area */
+        if (vma->vm_pgoff > pages)
+                return -EINVAL;
+        pfn += vma->vm_pgoff;
+        pages -= vma->vm_pgoff;
+
+        /* Can we fit all of the mapping? */
+        vm_len = vma->vm_end - vma->vm_start;
+        if (vm_len >> PAGE_SHIFT > pages)
+                return -EINVAL;
+
+        /* Ok, let it rip */
+        return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
+}
+EXPORT_SYMBOL(vm_iomap_memory);
+
 static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
                                      unsigned long addr, unsigned long end,
                                      pte_fn_t fn, void *data)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 88c5fed8b9a4..669fba39be1a 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3188,9 +3188,9 @@ int kswapd_run(int nid)
         if (IS_ERR(pgdat->kswapd)) {
                 /* failure at boot is fatal */
                 BUG_ON(system_state == SYSTEM_BOOTING);
-                pgdat->kswapd = NULL;
                 pr_err("Failed to start kswapd on node %d\n", nid);
                 ret = PTR_ERR(pgdat->kswapd);
+                pgdat->kswapd = NULL;
         }
         return ret;
 }
diff --git a/net/802/mrp.c b/net/802/mrp.c
index a4cc3229952a..e085bcc754f6 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -870,8 +870,12 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
          * all pending messages before the applicant is gone.
          */
         del_timer_sync(&app->join_timer);
+
+        spin_lock(&app->lock);
         mrp_mad_event(app, MRP_EVENT_TX);
         mrp_pdu_queue(app);
+        spin_unlock(&app->lock);
+
         mrp_queue_xmit(app);
 
         dev_mc_del(dev, appl->group_address);
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 0488d70c8c35..fa563e497c48 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -169,7 +169,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
         atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
 }
 
-int batadv_is_my_mac(const uint8_t *addr)
+int batadv_is_my_mac(struct batadv_priv *bat_priv, const uint8_t *addr)
 {
         const struct batadv_hard_iface *hard_iface;
 
@@ -178,6 +178,9 @@ int batadv_is_my_mac(const uint8_t *addr)
                 if (hard_iface->if_status != BATADV_IF_ACTIVE)
                         continue;
 
+                if (hard_iface->soft_iface != bat_priv->soft_iface)
+                        continue;
+
                 if (batadv_compare_eth(hard_iface->net_dev->dev_addr, addr)) {
                         rcu_read_unlock();
                         return 1;
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index ced08b936a96..d40910dfc8ea 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -162,7 +162,7 @@ extern struct workqueue_struct *batadv_event_workqueue;
 
 int batadv_mesh_init(struct net_device *soft_iface);
 void batadv_mesh_free(struct net_device *soft_iface);
-int batadv_is_my_mac(const uint8_t *addr);
+int batadv_is_my_mac(struct batadv_priv *bat_priv, const uint8_t *addr);
 struct batadv_hard_iface *
 batadv_seq_print_text_primary_if_get(struct seq_file *seq);
 int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 5ee21cebbbb0..319f2906c71a 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -402,7 +402,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
                 goto out;
 
         /* not for me */
-        if (!batadv_is_my_mac(ethhdr->h_dest))
+        if (!batadv_is_my_mac(bat_priv, ethhdr->h_dest))
                 goto out;
 
         icmp_packet = (struct batadv_icmp_packet_rr *)skb->data;
@@ -416,7 +416,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
         }
 
         /* packet for me */
-        if (batadv_is_my_mac(icmp_packet->dst))
+        if (batadv_is_my_mac(bat_priv, icmp_packet->dst))
                 return batadv_recv_my_icmp_packet(bat_priv, skb, hdr_size);
 
         /* TTL exceeded */
@@ -548,7 +548,8 @@ batadv_find_ifalter_router(struct batadv_orig_node *primary_orig,
         return router;
 }
 
-static int batadv_check_unicast_packet(struct sk_buff *skb, int hdr_size)
+static int batadv_check_unicast_packet(struct batadv_priv *bat_priv,
+                                       struct sk_buff *skb, int hdr_size)
 {
         struct ethhdr *ethhdr;
 
@@ -567,7 +568,7 @@ static int batadv_check_unicast_packet(struct sk_buff *skb, int hdr_size)
                 return -1;
 
         /* not for me */
-        if (!batadv_is_my_mac(ethhdr->h_dest))
+        if (!batadv_is_my_mac(bat_priv, ethhdr->h_dest))
                 return -1;
 
         return 0;
@@ -582,7 +583,7 @@ int batadv_recv_tt_query(struct sk_buff *skb, struct batadv_hard_iface *recv_if)
         char tt_flag;
         size_t packet_size;
 
-        if (batadv_check_unicast_packet(skb, hdr_size) < 0)
+        if (batadv_check_unicast_packet(bat_priv, skb, hdr_size) < 0)
                 return NET_RX_DROP;
 
         /* I could need to modify it */
@@ -614,7 +615,7 @@ int batadv_recv_tt_query(struct sk_buff *skb, struct batadv_hard_iface *recv_if)
         case BATADV_TT_RESPONSE:
                 batadv_inc_counter(bat_priv, BATADV_CNT_TT_RESPONSE_RX);
 
-                if (batadv_is_my_mac(tt_query->dst)) {
+                if (batadv_is_my_mac(bat_priv, tt_query->dst)) {
                         /* packet needs to be linearized to access the TT
                          * changes
                          */
@@ -657,14 +658,15 @@ int batadv_recv_roam_adv(struct sk_buff *skb, struct batadv_hard_iface *recv_if)
         struct batadv_roam_adv_packet *roam_adv_packet;
         struct batadv_orig_node *orig_node;
 
-        if (batadv_check_unicast_packet(skb, sizeof(*roam_adv_packet)) < 0)
+        if (batadv_check_unicast_packet(bat_priv, skb,
+                                        sizeof(*roam_adv_packet)) < 0)
                 goto out;
 
         batadv_inc_counter(bat_priv, BATADV_CNT_TT_ROAM_ADV_RX);
 
         roam_adv_packet = (struct batadv_roam_adv_packet *)skb->data;
 
-        if (!batadv_is_my_mac(roam_adv_packet->dst))
+        if (!batadv_is_my_mac(bat_priv, roam_adv_packet->dst))
                 return batadv_route_unicast_packet(skb, recv_if);
 
         /* check if it is a backbone gateway. we don't accept
@@ -967,7 +969,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
          * last time) the packet had an updated information or not
          */
         curr_ttvn = (uint8_t)atomic_read(&bat_priv->tt.vn);
-        if (!batadv_is_my_mac(unicast_packet->dest)) {
+        if (!batadv_is_my_mac(bat_priv, unicast_packet->dest)) {
                 orig_node = batadv_orig_hash_find(bat_priv,
                                                   unicast_packet->dest);
                 /* if it is not possible to find the orig_node representing the
@@ -1044,14 +1046,14 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         if (is4addr)
                 hdr_size = sizeof(*unicast_4addr_packet);
 
-        if (batadv_check_unicast_packet(skb, hdr_size) < 0)
+        if (batadv_check_unicast_packet(bat_priv, skb, hdr_size) < 0)
                 return NET_RX_DROP;
 
         if (!batadv_check_unicast_ttvn(bat_priv, skb))
                 return NET_RX_DROP;
 
         /* packet for me */
-        if (batadv_is_my_mac(unicast_packet->dest)) {
+        if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) {
                 if (is4addr) {
                         batadv_dat_inc_counter(bat_priv,
                                                unicast_4addr_packet->subtype);
@@ -1088,7 +1090,7 @@ int batadv_recv_ucast_frag_packet(struct sk_buff *skb,
         struct sk_buff *new_skb = NULL;
         int ret;
 
-        if (batadv_check_unicast_packet(skb, hdr_size) < 0)
+        if (batadv_check_unicast_packet(bat_priv, skb, hdr_size) < 0)
                 return NET_RX_DROP;
 
         if (!batadv_check_unicast_ttvn(bat_priv, skb))
@@ -1097,7 +1099,7 @@ int batadv_recv_ucast_frag_packet(struct sk_buff *skb,
         unicast_packet = (struct batadv_unicast_frag_packet *)skb->data;
 
         /* packet for me */
-        if (batadv_is_my_mac(unicast_packet->dest)) {
+        if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) {
                 ret = batadv_frag_reassemble_skb(skb, bat_priv, &new_skb);
 
                 if (ret == NET_RX_DROP)
@@ -1151,13 +1153,13 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
                 goto out;
 
         /* ignore broadcasts sent by myself */
-        if (batadv_is_my_mac(ethhdr->h_source))
+        if (batadv_is_my_mac(bat_priv, ethhdr->h_source))
                 goto out;
 
         bcast_packet = (struct batadv_bcast_packet *)skb->data;
 
         /* ignore broadcasts originated by myself */
-        if (batadv_is_my_mac(bcast_packet->orig))
+        if (batadv_is_my_mac(bat_priv, bcast_packet->orig))
                 goto out;
 
         if (bcast_packet->header.ttl < 2)
@@ -1243,14 +1245,14 @@ int batadv_recv_vis_packet(struct sk_buff *skb,
         ethhdr = (struct ethhdr *)skb_mac_header(skb);
 
         /* not for me */
-        if (!batadv_is_my_mac(ethhdr->h_dest))
+        if (!batadv_is_my_mac(bat_priv, ethhdr->h_dest))
                 return NET_RX_DROP;
 
         /* ignore own packets */
-        if (batadv_is_my_mac(vis_packet->vis_orig))
+        if (batadv_is_my_mac(bat_priv, vis_packet->vis_orig))
                 return NET_RX_DROP;
 
-        if (batadv_is_my_mac(vis_packet->sender_orig))
+        if (batadv_is_my_mac(bat_priv, vis_packet->sender_orig))
                 return NET_RX_DROP;
 
         switch (vis_packet->vis_type) {
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 98a66a021a60..7abee19567e9 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1953,7 +1953,7 @@ out:
 bool batadv_send_tt_response(struct batadv_priv *bat_priv,
                              struct batadv_tt_query_packet *tt_request)
 {
-        if (batadv_is_my_mac(tt_request->dst)) {
+        if (batadv_is_my_mac(bat_priv, tt_request->dst)) {
                 /* don't answer backbone gws! */
                 if (batadv_bla_is_backbone_gw_orig(bat_priv, tt_request->src))
                         return true;
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index c053244b97bd..6a1e646be96d 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -477,7 +477,7 @@ void batadv_receive_client_update_packet(struct batadv_priv *bat_priv,
 
         /* Are we the target for this VIS packet? */
         if (vis_server == BATADV_VIS_TYPE_SERVER_SYNC   &&
-            batadv_is_my_mac(vis_packet->target_orig))
+            batadv_is_my_mac(bat_priv, vis_packet->target_orig))
                 are_target = 1;
 
         spin_lock_bh(&bat_priv->vis.hash_lock);
@@ -496,7 +496,7 @@ void batadv_receive_client_update_packet(struct batadv_priv *bat_priv,
                 batadv_send_list_add(bat_priv, info);
 
                 /* ... we're not the recipient (and thus need to forward). */
-        } else if (!batadv_is_my_mac(packet->target_orig)) {
+        } else if (!batadv_is_my_mac(bat_priv, packet->target_orig)) {
                 batadv_send_list_add(bat_priv, info);
         }
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index ef1b91431c6b..459dab22b3f6 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -67,7 +67,8 @@ void br_port_carrier_check(struct net_bridge_port *p)
         struct net_device *dev = p->dev;
         struct net_bridge *br = p->br;
 
-        if (netif_running(dev) && netif_oper_up(dev))
+        if (!(p->flags & BR_ADMIN_COST) &&
+            netif_running(dev) && netif_oper_up(dev))
                 p->path_cost = port_cost(dev);
 
         if (!netif_running(br->dev))
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 3cbf5beb3d4b..d2c043a857b6 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -156,6 +156,7 @@ struct net_bridge_port
 #define BR_BPDU_GUARD           0x00000002
 #define BR_ROOT_BLOCK           0x00000004
 #define BR_MULTICAST_FAST_LEAVE 0x00000008
+#define BR_ADMIN_COST           0x00000010
 
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
         u32                             multicast_startup_queries_sent;
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 0bdb4ebd362b..d45e760141bb 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -288,6 +288,7 @@ int br_stp_set_path_cost(struct net_bridge_port *p, unsigned long path_cost)
             path_cost > BR_MAX_PATH_COST)
                 return -ERANGE;
 
+        p->flags |= BR_ADMIN_COST;
         p->path_cost = path_cost;
         br_configuration_update(p->br);
         br_port_state_selection(p->br);
diff --git a/net/core/dev.c b/net/core/dev.c
index e7d68ed8aafe..b24ab0e98eb4 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2148,6 +2148,9 @@ static void skb_warn_bad_offload(const struct sk_buff *skb)
         struct net_device *dev = skb->dev;
         const char *driver = "";
 
+        if (!net_ratelimit())
+                return;
+
         if (dev && dev->dev.parent)
                 driver = dev_driver_string(dev->dev.parent);
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 3b4f0cd2e63e..4cfe34d4cc96 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -139,8 +139,6 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 
         /* skb is pure payload to encrypt */
 
-        err = -ENOMEM;
-
         esp = x->data;
         aead = esp->aead;
         alen = crypto_aead_authsize(aead);
@@ -176,8 +174,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
-        if (!tmp)
+        if (!tmp) {
+                err = -ENOMEM;
                 goto error;
+        }
 
         seqhi = esp_tmp_seqhi(tmp);
         iv = esp_tmp_iv(aead, tmp, seqhilen);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index a6445b843ef4..52c273ea05c3 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -248,8 +248,7 @@ static void ip_expire(unsigned long arg)
                 if (!head->dev)
                         goto out_rcu_unlock;
 
-                /* skb dst is stale, drop it, and perform route lookup again */
-                skb_dst_drop(head);
+                /* skb has no dst, perform route lookup again */
                 iph = ip_hdr(head);
                 err = ip_route_input_noref(head, iph->daddr, iph->saddr,
                                            iph->tos, head->dev);
@@ -523,9 +522,16 @@ found:
                 qp->q.max_size = skb->len + ihl;
 
         if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
-            qp->q.meat == qp->q.len)
-                return ip_frag_reasm(qp, prev, dev);
+            qp->q.meat == qp->q.len) {
+                unsigned long orefdst = skb->_skb_refdst;
 
+                skb->_skb_refdst = 0UL;
+                err = ip_frag_reasm(qp, prev, dev);
+                skb->_skb_refdst = orefdst;
+                return err;
+        }
+
+        skb_dst_drop(skb);
         inet_frag_lru_move(&qp->q);
         return -EINPROGRESS;
 
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index c30130062cd6..c49dcd0284a0 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -66,6 +66,12 @@ static bool rpfilter_lookup_reverse(struct flowi4 *fl4,
         return dev_match;
 }
 
+static bool rpfilter_is_local(const struct sk_buff *skb)
+{
+        const struct rtable *rt = skb_rtable(skb);
+        return rt && (rt->rt_flags & RTCF_LOCAL);
+}
+
 static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
         const struct xt_rpfilter_info *info;
@@ -76,7 +82,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
         info = par->matchinfo;
         invert = info->flags & XT_RPFILTER_INVERT;
 
-        if (par->in->flags & IFF_LOOPBACK)
+        if (rpfilter_is_local(skb))
                 return true ^ invert;
 
         iph = ip_hdr(skb);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index ef54377fb11c..397e0f69435f 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -349,8 +349,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * hasn't changed since we received the original syn, but I see
          * no easy way to do this.
          */
-        flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk),
-                           RT_SCOPE_UNIVERSE, IPPROTO_TCP,
+        flowi4_init_output(&fl4, sk->sk_bound_dev_if, sk->sk_mark,
+                           RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
                            inet_sk_flowi_flags(sk),
                            (opt && opt->srr) ? opt->faddr : ireq->rmt_addr,
                            ireq->loc_addr, th->source, th->dest);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3bd55bad230a..13b9c08fc158 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -113,6 +113,7 @@ int sysctl_tcp_early_retrans __read_mostly = 2;
 #define FLAG_DSACKING_ACK       0x800 /* SACK blocks contained D-SACK info */
 #define FLAG_NONHEAD_RETRANS_ACKED      0x1000 /* Non-head rexmitted data was ACKed */
 #define FLAG_SACK_RENEGING      0x2000 /* snd_una advanced to a sacked seq */
+#define FLAG_UPDATE_TS_RECENT   0x4000 /* tcp_replace_ts_recent() */
 
 #define FLAG_ACKED              (FLAG_DATA_ACKED|FLAG_SYN_ACKED)
 #define FLAG_NOT_DUP            (FLAG_DATA|FLAG_WIN_UPDATE|FLAG_ACKED)
@@ -3564,6 +3565,27 @@ static void tcp_send_challenge_ack(struct sock *sk)
         }
 }
 
+static void tcp_store_ts_recent(struct tcp_sock *tp)
+{
+        tp->rx_opt.ts_recent = tp->rx_opt.rcv_tsval;
+        tp->rx_opt.ts_recent_stamp = get_seconds();
+}
+
+static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
+{
+        if (tp->rx_opt.saw_tstamp && !after(seq, tp->rcv_wup)) {
+                /* PAWS bug workaround wrt. ACK frames, the PAWS discard
+                 * extra check below makes sure this can only happen
+                 * for pure ACK frames.  -DaveM
+                 *
+                 * Not only, also it occurs for expired timestamps.
+                 */
+
+                if (tcp_paws_check(&tp->rx_opt, 0))
+                        tcp_store_ts_recent(tp);
+        }
+}
+
 /* This routine deals with incoming acks, but not outgoing ones. */
 static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 {
@@ -3607,6 +3629,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         prior_fackets = tp->fackets_out;
         prior_in_flight = tcp_packets_in_flight(tp);
 
+        /* ts_recent update must be made after we are sure that the packet
+         * is in window.
+         */
+        if (flag & FLAG_UPDATE_TS_RECENT)
+                tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
+
         if (!(flag & FLAG_SLOWPATH) && after(ack, prior_snd_una)) {
                 /* Window is constant, pure forward advance.
                  * No more checks are required.
@@ -3927,27 +3955,6 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
 EXPORT_SYMBOL(tcp_parse_md5sig_option);
 #endif
 
-static inline void tcp_store_ts_recent(struct tcp_sock *tp)
-{
-        tp->rx_opt.ts_recent = tp->rx_opt.rcv_tsval;
-        tp->rx_opt.ts_recent_stamp = get_seconds();
-}
-
-static inline void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
-{
-        if (tp->rx_opt.saw_tstamp && !after(seq, tp->rcv_wup)) {
-                /* PAWS bug workaround wrt. ACK frames, the PAWS discard
-                 * extra check below makes sure this can only happen
-                 * for pure ACK frames.  -DaveM
-                 *
-                 * Not only, also it occurs for expired timestamps.
-                 */
-
-                if (tcp_paws_check(&tp->rx_opt, 0))
-                        tcp_store_ts_recent(tp);
-        }
-}
-
 /* Sorry, PAWS as specified is broken wrt. pure-ACKs -DaveM
  *
  * It is not fatal. If this ACK does _not_ change critical state (seqs, window)
@@ -5543,14 +5550,9 @@ slow_path:
                 return 0;
 
 step5:
-        if (tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
+        if (tcp_ack(sk, skb, FLAG_SLOWPATH | FLAG_UPDATE_TS_RECENT) < 0)
                 goto discard;
 
-        /* ts_recent update must be made after we are sure that the packet
-         * is in window.
-         */
-        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-
         tcp_rcv_rtt_measure_ts(sk, skb);
 
         /* Process urgent data. */
@@ -5986,7 +5988,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
         /* step 5: check the ACK field */
         if (true) {
-                int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;
+                int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH |
+                                                  FLAG_UPDATE_TS_RECENT) > 0;
 
                 switch (sk->sk_state) {
                 case TCP_SYN_RECV:
@@ -6137,11 +6140,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
-        /* ts_recent update must be made after we are sure that the packet
-         * is in window.
-         */
-        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-
         /* step 6: check the URG bit */
         tcp_urg(sk, skb, th);
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index b44cf81d8178..509912a5ff98 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2388,8 +2388,12 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          */
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
 
-        /* make sure skb->data is aligned on arches that require it */
-        if (unlikely(NET_IP_ALIGN && ((unsigned long)skb->data & 3))) {
+        /* make sure skb->data is aligned on arches that require it
+         * and check if ack-trimming & collapsing extended the headroom
+         * beyond what csum_start can cover.
+         */
+        if (unlikely((NET_IP_ALIGN && ((unsigned long)skb->data & 3)) ||
+                     skb_headroom(skb) >= 0xFFFF)) {
                 struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
                                                    GFP_ATOMIC);
                 return nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a459c4f5b769..dae802c0af7c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -168,8 +168,6 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
                                struct net_device *dev);
 
-static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
-
 static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .forwarding             = 0,
         .hop_limit              = IPV6_DEFAULT_HOPLIMIT,
@@ -837,7 +835,7 @@ out2:
         rcu_read_unlock_bh();
 
         if (likely(err == 0))
-                atomic_notifier_call_chain(&inet6addr_chain, NETDEV_UP, ifa);
+                inet6addr_notifier_call_chain(NETDEV_UP, ifa);
         else {
                 kfree(ifa);
                 ifa = ERR_PTR(err);
@@ -927,7 +925,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
 
         ipv6_ifa_notify(RTM_DELADDR, ifp);
 
-        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifp);
+        inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);
 
         /*
          * Purge or update corresponding prefix
@@ -2988,7 +2986,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
                 if (state != INET6_IFADDR_STATE_DEAD) {
                         __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
+                        inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
                 }
                 in6_ifa_put(ifa);
 
@@ -4869,22 +4867,6 @@ static struct pernet_operations addrconf_ops = {
         .exit = addrconf_exit_net,
 };
 
-/*
- *      Device notifier
- */
-
-int register_inet6addr_notifier(struct notifier_block *nb)
-{
-        return atomic_notifier_chain_register(&inet6addr_chain, nb);
-}
-EXPORT_SYMBOL(register_inet6addr_notifier);
-
-int unregister_inet6addr_notifier(struct notifier_block *nb)
-{
-        return atomic_notifier_chain_unregister(&inet6addr_chain, nb);
-}
-EXPORT_SYMBOL(unregister_inet6addr_notifier);
-
 static struct rtnl_af_ops inet6_ops = {
         .family           = AF_INET6,
         .fill_link_af     = inet6_fill_link_af,
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index d051e5f4bf34..72104562c864 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -78,3 +78,22 @@ int __ipv6_addr_type(const struct in6_addr *addr)
 }
 EXPORT_SYMBOL(__ipv6_addr_type);
 
+static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
+
+int register_inet6addr_notifier(struct notifier_block *nb)
+{
+        return atomic_notifier_chain_register(&inet6addr_chain, nb);
+}
+EXPORT_SYMBOL(register_inet6addr_notifier);
+
+int unregister_inet6addr_notifier(struct notifier_block *nb)
+{
+        return atomic_notifier_chain_unregister(&inet6addr_chain, nb);
+}
+EXPORT_SYMBOL(unregister_inet6addr_notifier);
+
+int inet6addr_notifier_call_chain(unsigned long val, void *v)
+{
+        return atomic_notifier_call_chain(&inet6addr_chain, val, v);
+}
+EXPORT_SYMBOL(inet6addr_notifier_call_chain);
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 5060d54199ab..e0983f3648a6 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -71,6 +71,12 @@ static bool rpfilter_lookup_reverse6(const struct sk_buff *skb,
         return ret;
 }
 
+static bool rpfilter_is_local(const struct sk_buff *skb)
+{
+        const struct rt6_info *rt = (const void *) skb_dst(skb);
+        return rt && (rt->rt6i_flags & RTF_LOCAL);
+}
+
 static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
         const struct xt_rpfilter_info *info = par->matchinfo;
@@ -78,7 +84,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
         struct ipv6hdr *iph;
         bool invert = info->flags & XT_RPFILTER_INVERT;
 
-        if (par->in->flags & IFF_LOOPBACK)
+        if (rpfilter_is_local(skb))
                 return true ^ invert;
 
         iph = ipv6_hdr(skb);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 196ab9347ad1..0ba10e53a629 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -330,9 +330,17 @@ found:
         }
 
         if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
-            fq->q.meat == fq->q.len)
-                return ip6_frag_reasm(fq, prev, dev);
+            fq->q.meat == fq->q.len) {
+                int res;
+                unsigned long orefdst = skb->_skb_refdst;
+
+                skb->_skb_refdst = 0UL;
+                res = ip6_frag_reasm(fq, prev, dev);
+                skb->_skb_refdst = orefdst;
+                return res;
+        }
 
+        skb_dst_drop(skb);
         inet_frag_lru_move(&fq->q);
         return -1;
 
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 29340a9a6fb9..e1b37f5a2691 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -303,7 +303,8 @@ static void iriap_disconnect_indication(void *instance, void *sap,
 {
         struct iriap_cb *self;
 
-        IRDA_DEBUG(4, "%s(), reason=%s\n", __func__, irlmp_reasons[reason]);
+        IRDA_DEBUG(4, "%s(), reason=%s [%d]\n", __func__,
+                   irlmp_reason_str(reason), reason);
 
         self = instance;
 
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 6115a44c0a24..1064621da6f6 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -66,8 +66,15 @@ const char *irlmp_reasons[] = {
         "LM_LAP_RESET",
         "LM_INIT_DISCONNECT",
         "ERROR, NOT USED",
+        "UNKNOWN",
 };
 
+const char *irlmp_reason_str(LM_REASON reason)
+{
+        reason = min_t(size_t, reason, ARRAY_SIZE(irlmp_reasons) - 1);
+        return irlmp_reasons[reason];
+}
+
 /*
  * Function irlmp_init (void)
  *
@@ -747,7 +754,8 @@ void irlmp_disconnect_indication(struct lsap_cb *self, LM_REASON reason,
 {
         struct lsap_cb *lsap;
 
-        IRDA_DEBUG(1, "%s(), reason=%s\n", __func__, irlmp_reasons[reason]);
+        IRDA_DEBUG(1, "%s(), reason=%s [%d]\n", __func__,
+                   irlmp_reason_str(reason), reason);
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == LMP_LSAP_MAGIC, return;);
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 58150f877ec3..9ed49ad0380f 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -78,7 +78,7 @@ void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
 }
 
-u32 ieee80211_idle_off(struct ieee80211_local *local)
+static u32 __ieee80211_idle_off(struct ieee80211_local *local)
 {
         if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
                 return 0;
@@ -87,7 +87,7 @@ u32 ieee80211_idle_off(struct ieee80211_local *local)
         return IEEE80211_CONF_CHANGE_IDLE;
 }
 
-static u32 ieee80211_idle_on(struct ieee80211_local *local)
+static u32 __ieee80211_idle_on(struct ieee80211_local *local)
 {
         if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
                 return 0;
@@ -98,16 +98,18 @@ static u32 ieee80211_idle_on(struct ieee80211_local *local)
         return IEEE80211_CONF_CHANGE_IDLE;
 }
 
-void ieee80211_recalc_idle(struct ieee80211_local *local)
+static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
+                                   bool force_active)
 {
         bool working = false, scanning, active;
         unsigned int led_trig_start = 0, led_trig_stop = 0;
         struct ieee80211_roc_work *roc;
-        u32 change;
 
         lockdep_assert_held(&local->mtx);
 
-        active = !list_empty(&local->chanctx_list) || local->monitors;
+        active = force_active ||
+                 !list_empty(&local->chanctx_list) ||
+                 local->monitors;
 
         if (!local->ops->remain_on_channel) {
                 list_for_each_entry(roc, &local->roc_list, list) {
@@ -132,9 +134,18 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
         ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
 
         if (working || scanning || active)
-                change = ieee80211_idle_off(local);
-        else
-                change = ieee80211_idle_on(local);
+                return __ieee80211_idle_off(local);
+        return __ieee80211_idle_on(local);
+}
+
+u32 ieee80211_idle_off(struct ieee80211_local *local)
+{
+        return __ieee80211_recalc_idle(local, true);
+}
+
+void ieee80211_recalc_idle(struct ieee80211_local *local)
+{
+        u32 change = __ieee80211_recalc_idle(local, false);
         if (change)
                 ieee80211_hw_config(local, change);
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 82cc30318a86..346ad4cfb013 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3964,8 +3964,16 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         /* prep auth_data so we don't go into idle on disassoc */
         ifmgd->auth_data = auth_data;
 
-        if (ifmgd->associated)
-                ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+        if (ifmgd->associated) {
+                u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+                                       WLAN_REASON_UNSPECIFIED,
+                                       false, frame_buf);
+
+                __cfg80211_send_deauth(sdata->dev, frame_buf,
+                                       sizeof(frame_buf));
+        }
 
         sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
 
@@ -4025,8 +4033,16 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
 
         mutex_lock(&ifmgd->mtx);
 
-        if (ifmgd->associated)
-                ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+        if (ifmgd->associated) {
+                u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+                                       WLAN_REASON_UNSPECIFIED,
+                                       false, frame_buf);
+
+                __cfg80211_send_deauth(sdata->dev, frame_buf,
+                                       sizeof(frame_buf));
+        }
 
         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
                 err = -EBUSY;
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 0f92dc24cb89..d7df6ac2c6f1 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -339,7 +339,11 @@ bitmap_ipmac_tlist(const struct ip_set *set,
 nla_put_failure:
         nla_nest_cancel(skb, nested);
         ipset_nest_end(skb, atd);
-        return -EMSGSIZE;
+        if (unlikely(id == first)) {
+                cb->args[2] = 0;
+                return -EMSGSIZE;
+        }
+        return 0;
 }
 
 static int
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index f2627226a087..10a30b4fc7db 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -104,6 +104,15 @@ hash_ipportnet4_data_flags(struct hash_ipportnet4_elem *dst, u32 flags)
         dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
 }
 
+static inline void
+hash_ipportnet4_data_reset_flags(struct hash_ipportnet4_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
+}
+
 static inline int
 hash_ipportnet4_data_match(const struct hash_ipportnet4_elem *elem)
 {
@@ -414,6 +423,15 @@ hash_ipportnet6_data_flags(struct hash_ipportnet6_elem *dst, u32 flags)
         dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
 }
 
+static inline void
+hash_ipportnet6_data_reset_flags(struct hash_ipportnet6_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
+}
+
 static inline int
 hash_ipportnet6_data_match(const struct hash_ipportnet6_elem *elem)
 {
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 4b677cf6bf7d..d6a59154d710 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -87,7 +87,16 @@ hash_net4_data_copy(struct hash_net4_elem *dst,
 static inline void
 hash_net4_data_flags(struct hash_net4_elem *dst, u32 flags)
 {
-        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
+}
+
+static inline void
+hash_net4_data_reset_flags(struct hash_net4_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
 }
 
 static inline int
@@ -308,7 +317,16 @@ hash_net6_data_copy(struct hash_net6_elem *dst,
 static inline void
 hash_net6_data_flags(struct hash_net6_elem *dst, u32 flags)
 {
-        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
+}
+
+static inline void
+hash_net6_data_reset_flags(struct hash_net6_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
 }
 
 static inline int
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 6ba985f1c96f..f2b0a3c30130 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -198,7 +198,16 @@ hash_netiface4_data_copy(struct hash_netiface4_elem *dst,
 static inline void
 hash_netiface4_data_flags(struct hash_netiface4_elem *dst, u32 flags)
 {
-        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
+}
+
+static inline void
+hash_netiface4_data_reset_flags(struct hash_netiface4_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
 }
 
 static inline int
@@ -494,7 +503,7 @@ hash_netiface6_data_copy(struct hash_netiface6_elem *dst,
 static inline void
 hash_netiface6_data_flags(struct hash_netiface6_elem *dst, u32 flags)
 {
-        dst->nomatch = flags & IPSET_FLAG_NOMATCH;
+        dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
 }
 
 static inline int
@@ -504,6 +513,15 @@ hash_netiface6_data_match(const struct hash_netiface6_elem *elem)
 }
 
 static inline void
+hash_netiface6_data_reset_flags(struct hash_netiface6_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
+}
+
+static inline void
 hash_netiface6_data_zero_out(struct hash_netiface6_elem *elem)
 {
         elem->elem = 0;
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index af20c0c5ced2..349deb672a2d 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -104,6 +104,15 @@ hash_netport4_data_flags(struct hash_netport4_elem *dst, u32 flags)
         dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
 }
 
+static inline void
+hash_netport4_data_reset_flags(struct hash_netport4_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
+}
+
 static inline int
 hash_netport4_data_match(const struct hash_netport4_elem *elem)
 {
@@ -375,6 +384,15 @@ hash_netport6_data_flags(struct hash_netport6_elem *dst, u32 flags)
         dst->nomatch = !!(flags & IPSET_FLAG_NOMATCH);
 }
 
+static inline void
+hash_netport6_data_reset_flags(struct hash_netport6_elem *dst, u32 *flags)
+{
+        if (dst->nomatch) {
+                *flags = IPSET_FLAG_NOMATCH;
+                dst->nomatch = 0;
+        }
+}
+
 static inline int
 hash_netport6_data_match(const struct hash_netport6_elem *elem)
 {
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 8371c2bac2e4..09c744aa8982 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -174,9 +174,13 @@ list_set_add(struct list_set *map, u32 i, ip_set_id_t id,
 {
         const struct set_elem *e = list_set_elem(map, i);
 
-        if (i == map->size - 1 && e->id != IPSET_INVALID_ID)
-                /* Last element replaced: e.g. add new,before,last */
-                ip_set_put_byindex(e->id);
+        if (e->id != IPSET_INVALID_ID) {
+                const struct set_elem *x = list_set_elem(map, map->size - 1);
+
+                /* Last element replaced or pushed off */
+                if (x->id != IPSET_INVALID_ID)
+                        ip_set_put_byindex(x->id);
+        }
         if (with_timeout(map->timeout))
                 list_elem_tadd(map, i, id, ip_set_timeout_set(timeout));
         else
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 0e7d423324c3..e0c4373b4747 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1593,10 +1593,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
                 end += strlen("\r\n\r\n") + clen;
 
                 msglen = origlen = end - dptr;
-                if (msglen > datalen) {
-                        nf_ct_helper_log(skb, ct, "incomplete/bad SIP message");
-                        return NF_DROP;
-                }
+                if (msglen > datalen)
+                        return NF_ACCEPT;
 
                 ret = process_sip_msg(skb, ct, protoff, dataoff,
                                       &dptr, &msglen);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 8d5769c6d16e..ad24be070e53 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -467,33 +467,22 @@ EXPORT_SYMBOL_GPL(nf_nat_packet);
 struct nf_nat_proto_clean {
         u8      l3proto;
         u8      l4proto;
-        bool    hash;
 };
 
-/* Clear NAT section of all conntracks, in case we're loaded again. */
-static int nf_nat_proto_clean(struct nf_conn *i, void *data)
+/* kill conntracks with affected NAT section */
+static int nf_nat_proto_remove(struct nf_conn *i, void *data)
 {
         const struct nf_nat_proto_clean *clean = data;
         struct nf_conn_nat *nat = nfct_nat(i);
 
         if (!nat)
                 return 0;
-        if (!(i->status & IPS_SRC_NAT_DONE))
-                return 0;
+
         if ((clean->l3proto && nf_ct_l3num(i) != clean->l3proto) ||
             (clean->l4proto && nf_ct_protonum(i) != clean->l4proto))
                 return 0;
 
-        if (clean->hash) {
-                spin_lock_bh(&nf_nat_lock);
-                hlist_del_rcu(&nat->bysource);
-                spin_unlock_bh(&nf_nat_lock);
-        } else {
-                memset(nat, 0, sizeof(*nat));
-                i->status &= ~(IPS_NAT_MASK | IPS_NAT_DONE_MASK |
-                               IPS_SEQ_ADJUST);
-        }
-        return 0;
+        return i->status & IPS_NAT_MASK ? 1 : 0;
 }
 
 static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
@@ -505,16 +494,8 @@ static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
         struct net *net;
 
         rtnl_lock();
-        /* Step 1 - remove from bysource hash */
-        clean.hash = true;
         for_each_net(net)
-                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
-        synchronize_rcu();
-
-        /* Step 2 - clean NAT section */
-        clean.hash = false;
-        for_each_net(net)
-                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
+                nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean);
         rtnl_unlock();
 }
 
@@ -526,16 +507,9 @@ static void nf_nat_l3proto_clean(u8 l3proto)
         struct net *net;
 
         rtnl_lock();
-        /* Step 1 - remove from bysource hash */
-        clean.hash = true;
-        for_each_net(net)
-                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
-        synchronize_rcu();
 
-        /* Step 2 - clean NAT section */
-        clean.hash = false;
         for_each_net(net)
-                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
+                nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean);
         rtnl_unlock();
 }
 
@@ -773,7 +747,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
 {
         struct nf_nat_proto_clean clean = {};
 
-        nf_ct_iterate_cleanup(net, &nf_nat_proto_clean, &clean);
+        nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean);
         synchronize_rcu();
         nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
 }
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index a4b724708a1a..6980c3e6f066 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1593,10 +1593,8 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, u32 portid,
                 return ERR_PTR(-ENOMEM);
 
         retval = ovs_vport_cmd_fill_info(vport, skb, portid, seq, 0, cmd);
-        if (retval < 0) {
-                kfree_skb(skb);
-                return ERR_PTR(retval);
-        }
+        BUG_ON(retval < 0);
+
         return skb;
 }
 
@@ -1726,24 +1724,32 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
             nla_get_u32(a[OVS_VPORT_ATTR_TYPE]) != vport->ops->type)
                 err = -EINVAL;
 
+        reply = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!reply) {
+                err = -ENOMEM;
+                goto exit_unlock;
+        }
+
         if (!err && a[OVS_VPORT_ATTR_OPTIONS])
                 err = ovs_vport_set_options(vport, a[OVS_VPORT_ATTR_OPTIONS]);
         if (err)
-                goto exit_unlock;
+                goto exit_free;
+
         if (a[OVS_VPORT_ATTR_UPCALL_PID])
                 vport->upcall_portid = nla_get_u32(a[OVS_VPORT_ATTR_UPCALL_PID]);
 
-        reply = ovs_vport_cmd_build_info(vport, info->snd_portid, info->snd_seq,
-                                         OVS_VPORT_CMD_NEW);
-        if (IS_ERR(reply)) {
-                netlink_set_err(sock_net(skb->sk)->genl_sock, 0,
-                                ovs_dp_vport_multicast_group.id, PTR_ERR(reply));
-                goto exit_unlock;
-        }
+        err = ovs_vport_cmd_fill_info(vport, reply, info->snd_portid,
+                                      info->snd_seq, 0, OVS_VPORT_CMD_NEW);
+        BUG_ON(err < 0);
 
         genl_notify(reply, genl_info_net(info), info->snd_portid,
                     ovs_dp_vport_multicast_group.id, info->nlhdr, GFP_KERNEL);
 
+        rtnl_unlock();
+        return 0;
+
+exit_free:
+        kfree_skb(reply);
 exit_unlock:
         rtnl_unlock();
         return err;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index fe0e4215c73d..67a2b783fe70 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -795,9 +795,9 @@ void ovs_flow_tbl_insert(struct flow_table *table, struct sw_flow *flow)
 
 void ovs_flow_tbl_remove(struct flow_table *table, struct sw_flow *flow)
 {
+        BUG_ON(table->count == 0);
         hlist_del_rcu(&flow->hash_node[table->node_ver]);
         table->count--;
-        BUG_ON(table->count < 0);
 }
 
 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute.  */
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 1135d8227f9b..9b97172db84a 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -204,7 +204,6 @@ fw_change_attrs(struct net *net, struct tcf_proto *tp, struct fw_filter *f,
         if (err < 0)
                 return err;
 
-        err = -EINVAL;
         if (tb[TCA_FW_CLASSID]) {
                 f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
                 tcf_bind_filter(tp, &f->res, base);
@@ -218,6 +217,7 @@ fw_change_attrs(struct net *net, struct tcf_proto *tp, struct fw_filter *f,
         }
 #endif /* CONFIG_NET_CLS_IND */
 
+        err = -EINVAL;
         if (tb[TCA_FW_MASK]) {
                 mask = nla_get_u32(tb[TCA_FW_MASK]);
                 if (mask != head->mask)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index b28cc384a5bc..4de4bc48493b 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3016,6 +3016,7 @@ sub process {
                             $dstat !~ /^'X'$/ &&                                        # character constants
                             $dstat !~ /$exceptions/ &&
                             $dstat !~ /^\.$Ident\s*=/ &&                                # .foo =
+                            $dstat !~ /^(?:\#\s*$Ident|\#\s*$Constant)\s*$/ &&          # stringification #foo
                             $dstat !~ /^do\s*$Constant\s*while\s*$Constant;?$/ &&       # do {...} while (...); // do {...} while (...)
                             $dstat !~ /^for\s*$Constant$/ &&                            # for (...)
                             $dstat !~ /^for\s*$Constant\s+(?:$Ident|-?$Constant)$/ &&   # for (...) bar()
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 71ae86ca64ac..eb560fa32321 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3222,18 +3222,10 @@ EXPORT_SYMBOL_GPL(snd_pcm_lib_default_mmap);
 int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream,
                            struct vm_area_struct *area)
 {
-        long size;
-        unsigned long offset;
+        struct snd_pcm_runtime *runtime = substream->runtime;;
 
         area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
-        area->vm_flags |= VM_IO;
-        size = area->vm_end - area->vm_start;
-        offset = area->vm_pgoff << PAGE_SHIFT;
-        if (io_remap_pfn_range(area, area->vm_start,
-                                (substream->runtime->dma_addr + offset) >> PAGE_SHIFT,
-                                size, area->vm_page_prot))
-                return -EAGAIN;
-        return 0;
+        return vm_iomap_memory(area, runtime->dma_addr, runtime->dma_bytes);
 }
 
 EXPORT_SYMBOL(snd_pcm_lib_mmap_iomem);
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 6f3214ed4444..321e066a0753 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1421,6 +1421,7 @@ int has_nehalem_turbo_ratio_limit(unsigned int family, unsigned int model)
         case 0x3C:      /* HSW */
         case 0x3F:      /* HSW */
         case 0x45:      /* HSW */
+        case 0x46:      /* HSW */
                 return 1;
         case 0x2E:      /* Nehalem-EX Xeon - Beckton */
         case 0x2F:      /* Westmere-EX Xeon - Eagleton */
@@ -1515,6 +1516,7 @@ void rapl_probe(unsigned int family, unsigned int model)
         case 0x3C:      /* HSW */
         case 0x3F:      /* HSW */
         case 0x45:      /* HSW */
+        case 0x46:      /* HSW */
                 do_rapl = RAPL_PKG | RAPL_CORES | RAPL_GFX;
                 break;
         case 0x2D:
@@ -1754,6 +1756,7 @@ int is_snb(unsigned int family, unsigned int model)
         case 0x3C:      /* HSW */
         case 0x3F:      /* HSW */
         case 0x45:      /* HSW */
+        case 0x46:      /* HSW */
                 return 1;
         }
         return 0;
@@ -2276,7 +2279,7 @@ int main(int argc, char **argv)
         cmdline(argc, argv);
 
         if (verbose)
-                fprintf(stderr, "turbostat v3.2 February 11, 2013"
+                fprintf(stderr, "turbostat v3.3 March 15, 2013"
                         " - Len Brown <lenb@kernel.org>\n");
 
         turbostat_init();