Merge tag 'drm-intel-fixes-2014-04-04' of git://anongit.freedesktop.org/drm-intel into drm-next

Merge window -fixes pull request as usual. Well, I did sneak in Jani's drm_i915_private_t typedef removal, need to have fun with a big sed job too ;-) Otherwise: - hdmi interlaced fixes (Jesse&Ville) - pipe error/underrun/crc tracking fixes, regression in late 3.14-rc (but not cc: stable since only really relevant for igt runs) - large cursor wm fixes (Chris) - fix gpu turbo boost/throttle again, was getting stuck due to vlv rps patches (Chris+Imre) - fix runtime pm fallout (Paulo) - bios framebuffer inherit fix (Chris) - a few smaller things * tag 'drm-intel-fixes-2014-04-04' of git://anongit.freedesktop.org/drm-intel: (196 commits) Skip intel_crt_init for Dell XPS 8700 drm/i915: vlv: fix RPS interrupt mask setting Revert "drm/i915/vlv: fixup DDR freq detection per Punit spec" drm/i915: move power domain init earlier during system resume drm/i915: Fix the computation of required fb size for pipe drm/i915: don't get/put runtime PM at the debugfs forcewake file drm/i915: fix WARNs when reading DDI state while suspended drm/i915: don't read cursor registers on powered down pipes drm/i915: get runtime PM at i915_display_info drm/i915: don't read pp_ctrl_reg if we're suspended drm/i915: get runtime PM at i915_reg_read_ioctl drm/i915: don't schedule force_wake_timer at gen6_read drm/i915: vlv: reserve the GT power context only once during driver init drm/i915: prefer struct drm_i915_private to drm_i915_private_t drm/i915/overlay: prefer struct drm_i915_private to drm_i915_private_t drm/i915/ringbuffer: prefer struct drm_i915_private to drm_i915_private_t drm/i915/display: prefer struct drm_i915_private to drm_i915_private_t drm/i915/irq: prefer struct drm_i915_private to drm_i915_private_t drm/i915/gem: prefer struct drm_i915_private to drm_i915_private_t drm/i915/dma: prefer struct drm_i915_private to drm_i915_private_t ...
author: Dave Airlie <airlied@redhat.com> 2014-04-05 02:14:21 -0400
committer: Dave Airlie <airlied@redhat.com> 2014-04-05 02:14:21 -0400
commit: 9f97ba806a9cb8e828baca71eca8b684939053d8 (patch)
tree: ec036e36d1d2e64b6e67c4d5d24a5ecb6475aac0
parent: 82c68b6ccd54117a87cb2d9b91c2ee6e1280cf9d (diff)
parent: 10b6ee4a87811a110cb01eaca01eb04da6801baf (diff)
189 files changed, 2169 insertions, 1502 deletions
diff --git a/Documentation/devicetree/bindings/net/micrel-ks8851.txt b/Documentation/devicetree/bindings/net/micrel-ks8851.txt
index 11ace3c3d805..4fc392763611 100644
--- a/Documentation/devicetree/bindings/net/micrel-ks8851.txt
+++ b/Documentation/devicetree/bindings/net/micrel-ks8851.txt
@@ -7,3 +7,4 @@ Required properties:
 Optional properties:
 - local-mac-address : Ethernet mac address to use
+- vdd-supply:   supply for Ethernet mac
diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt
index b26122973525..c6af4bac5aa8 100644
--- a/Documentation/networking/netlink_mmap.txt
+++ b/Documentation/networking/netlink_mmap.txt
@@ -226,9 +226,9 @@ Ring setup:
        void *rx_ring, *tx_ring;
        /* Configure ring parameters */
-        if (setsockopt(fd, NETLINK_RX_RING, &req, sizeof(req)) < 0)
+        if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0)
                exit(1);
-        if (setsockopt(fd, NETLINK_TX_RING, &req, sizeof(req)) < 0)
+        if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0)
                exit(1)
        /* Calculate size of each individual ring */
diff --git a/MAINTAINERS b/MAINTAINERS
index 4f56025da802..719e6279b80a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -911,11 +911,11 @@ F:	arch/arm/include/asm/hardware/dec21285.h
 F:      arch/arm/mach-footbridge/
 ARM/FREESCALE IMX / MXC ARM ARCHITECTURE
-M:      Shawn Guo <shawn.guo@linaro.org>
+M:      Shawn Guo <shawn.guo@freescale.com>
 M:      Sascha Hauer <kernel@pengutronix.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
 F:      arch/arm/mach-imx/
 F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
@@ -1832,8 +1832,8 @@ F:	net/bluetooth/
 F:      include/net/bluetooth/
 BONDING DRIVER
-M:      Jay Vosburgh <fubar@us.ibm.com>
+M:      Jay Vosburgh <j.vosburgh@gmail.com>
-M:      Veaceslav Falico <vfalico@redhat.com>
+M:      Veaceslav Falico <vfalico@gmail.com>
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
@@ -2801,9 +2801,9 @@ S:	Supported
 F:      drivers/acpi/dock.c
 DOCUMENTATION
-M:      Rob Landley <rob@landley.net>
+M:      Randy Dunlap <rdunlap@infradead.org>
 L:      linux-doc@vger.kernel.org
-T:      TBD
+T:      quilt http://www.infradead.org/~rdunlap/Doc/patches/
 S:      Maintained
 F:      Documentation/
@@ -4549,6 +4549,7 @@ M:	Greg Rose <gregory.v.rose@intel.com>
 M:      Alex Duyck <alexander.h.duyck@intel.com>
 M:      John Ronciak <john.ronciak@intel.com>
 M:      Mitch Williams <mitch.a.williams@intel.com>
+M:      Linux NICS <linux.nics@intel.com>
 L:      e1000-devel@lists.sourceforge.net
 W:      http://www.intel.com/support/feedback.htm
 W:      http://e1000.sourceforge.net/
@@ -6009,6 +6010,7 @@ F:	include/uapi/linux/net.h
 F:      include/uapi/linux/netdevice.h
 F:      tools/net/
 F:      tools/testing/selftests/net/
+F:      lib/random32.c
 NETWORKING [IPv4/IPv6]
 M:      "David S. Miller" <davem@davemloft.net>
diff --git a/Makefile b/Makefile
index ef779ec26f62..e5ac8a62e6e5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION =
 NAME = Shuffling Zombie Juror
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/sama5d36.dtsi b/arch/arm/boot/dts/sama5d36.dtsi
index 6c31c26e6cc0..db58cad6acd3 100644
--- a/arch/arm/boot/dts/sama5d36.dtsi
+++ b/arch/arm/boot/dts/sama5d36.dtsi
@@ -8,8 +8,8 @@
 */
 #include "sama5d3.dtsi"
 #include "sama5d3_can.dtsi"
-#include "sama5d3_emac.dtsi"
 #include "sama5d3_gmac.dtsi"
+#include "sama5d3_emac.dtsi"
 #include "sama5d3_lcd.dtsi"
 #include "sama5d3_mci2.dtsi"
 #include "sama5d3_tcb1.dtsi"
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index dcae3a7035db..95fa1f1d5c8b 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1776,12 +1776,12 @@ endchoice
 config FORCE_MAX_ZONEORDER
        int "Maximum zone order"
-        range 14 64 if HUGETLB_PAGE && PAGE_SIZE_64KB
+        range 14 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_64KB
-        default "14" if HUGETLB_PAGE && PAGE_SIZE_64KB
+        default "14" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_64KB
-        range 13 64 if HUGETLB_PAGE && PAGE_SIZE_32KB
+        range 13 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_32KB
-        default "13" if HUGETLB_PAGE && PAGE_SIZE_32KB
+        default "13" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_32KB
-        range 12 64 if HUGETLB_PAGE && PAGE_SIZE_16KB
+        range 12 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_16KB
-        default "12" if HUGETLB_PAGE && PAGE_SIZE_16KB
+        default "12" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_16KB
        range 11 64
        default "11"
        help
@@ -2353,9 +2353,8 @@ config SECCOMP
          If unsure, say Y. Only embedded should say N here.
 config MIPS_O32_FP64_SUPPORT
-        bool "Support for O32 binaries using 64-bit FP"
+        bool "Support for O32 binaries using 64-bit FP (EXPERIMENTAL)"
        depends on 32BIT || MIPS32_O32
-        default y
        help
          When this is enabled, the kernel will support use of 64-bit floating
          point registers with binaries using the O32 ABI along with the
@@ -2367,7 +2366,14 @@ config MIPS_O32_FP64_SUPPORT
          of your kernel & potentially improve FP emulation performance by
          saying N here.
-          If unsure, say Y.
+          Although binutils currently supports use of this flag the details
+          concerning its effect upon the O32 ABI in userland are still being
+          worked on. In order to avoid userland becoming dependant upon current
+          behaviour before the details have been finalised, this option should
+          be considered experimental and only enabled by those working upon
+          said details.
+          If unsure, say N.
 config USE_OF
        bool
diff --git a/arch/mips/alchemy/board-gpr.c b/arch/mips/alchemy/board-gpr.c
index 9edc35ff8cf1..acf9a2a37f5a 100644
--- a/arch/mips/alchemy/board-gpr.c
+++ b/arch/mips/alchemy/board-gpr.c
@@ -53,10 +53,8 @@ void __init prom_init(void)
        prom_init_cmdline();
        memsize_str = prom_getenv("memsize");
-        if (!memsize_str)
+        if (!memsize_str || kstrtoul(memsize_str, 0, &memsize))
                memsize = 0x04000000;
-        else
-                strict_strtoul(memsize_str, 0, &memsize);
        add_memory_region(0, memsize, BOOT_MEM_RAM);
 }
diff --git a/arch/mips/alchemy/board-mtx1.c b/arch/mips/alchemy/board-mtx1.c
index 9969dbab19e3..25a59a23547e 100644
--- a/arch/mips/alchemy/board-mtx1.c
+++ b/arch/mips/alchemy/board-mtx1.c
@@ -52,10 +52,8 @@ void __init prom_init(void)
        prom_init_cmdline();
        memsize_str = prom_getenv("memsize");
-        if (!memsize_str)
+        if (!memsize_str || kstrtoul(memsize_str, 0, &memsize))
                memsize = 0x04000000;
-        else
-                strict_strtoul(memsize_str, 0, &memsize);
        add_memory_region(0, memsize, BOOT_MEM_RAM);
 }
diff --git a/arch/mips/bcm47xx/board.c b/arch/mips/bcm47xx/board.c
index 6d612e2b949b..cdd8246f92b3 100644
--- a/arch/mips/bcm47xx/board.c
+++ b/arch/mips/bcm47xx/board.c
@@ -1,3 +1,4 @@
+#include <linux/errno.h>
 #include <linux/export.h>
 #include <linux/string.h>
 #include <bcm47xx_board.h>
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
index 6decb27cf48b..2bed73a684ae 100644
--- a/arch/mips/bcm47xx/nvram.c
+++ b/arch/mips/bcm47xx/nvram.c
@@ -196,7 +196,7 @@ int bcm47xx_nvram_gpio_pin(const char *name)
        char nvram_var[10];
        char buf[30];
-        for (i = 0; i < 16; i++) {
+        for (i = 0; i < 32; i++) {
                err = snprintf(nvram_var, sizeof(nvram_var), "gpio%i", i);
                if (err <= 0)
                        continue;
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 25fbfae06c1f..c2bb4f896ce7 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -975,10 +975,6 @@ static int octeon_irq_ciu_xlat(struct irq_domain *d,
        if (ciu > 1 || bit > 63)
                return -EINVAL;
-        /* These are the GPIO lines */
-        if (ciu == 0 && bit >= 16 && bit < 32)
-                return -EINVAL;
        *out_hwirq = (ciu << 6) | bit;
        *out_type = 0;
@@ -1007,6 +1003,10 @@ static int octeon_irq_ciu_map(struct irq_domain *d,
        if (!octeon_irq_virq_in_range(virq))
                return -EINVAL;
+        /* Don't map irq if it is reserved for GPIO. */
+        if (line == 0 && bit >= 16 && bit <32)
+                return 0;
        if (line > 1 || octeon_irq_ciu_to_irq[line][bit] != 0)
                return -EINVAL;
@@ -1525,10 +1525,6 @@ static int octeon_irq_ciu2_xlat(struct irq_domain *d,
        ciu = intspec[0];
        bit = intspec[1];
-        /* Line 7  are the GPIO lines */
-        if (ciu > 6 || bit > 63)
-                return -EINVAL;
        *out_hwirq = (ciu << 6) | bit;
        *out_type = 0;
@@ -1570,8 +1566,14 @@ static int octeon_irq_ciu2_map(struct irq_domain *d,
        if (!octeon_irq_virq_in_range(virq))
                return -EINVAL;
-        /* Line 7  are the GPIO lines */
+        /*
-        if (line > 6 || octeon_irq_ciu_to_irq[line][bit] != 0)
+         * Don't map irq if it is reserved for GPIO.
+         * (Line 7 are the GPIO lines.)
+         */
+        if (line == 7)
+                return 0;
+        if (line > 7 || octeon_irq_ciu_to_irq[line][bit] != 0)
                return -EINVAL;
        if (octeon_irq_ciu2_is_edge(line, bit))
diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
index 3220c93ea981..4225e99bd7bf 100644
--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -9,6 +9,7 @@
 #define _ASM_ASMMACRO_H
 #include <asm/hazards.h>
+#include <asm/asm-offsets.h>
 #ifdef CONFIG_32BIT
 #include <asm/asmmacro-32.h>
@@ -54,11 +55,21 @@
        .endm
        .macro  local_irq_disable reg=t0
+#ifdef CONFIG_PREEMPT
+        lw      \reg, TI_PRE_COUNT($28)
+        addi    \reg, \reg, 1
+        sw      \reg, TI_PRE_COUNT($28)
+#endif
        mfc0    \reg, CP0_STATUS
        ori     \reg, \reg, 1
        xori    \reg, \reg, 1
        mtc0    \reg, CP0_STATUS
        irq_disable_hazard
+#ifdef CONFIG_PREEMPT
+        lw      \reg, TI_PRE_COUNT($28)
+        addi    \reg, \reg, -1
+        sw      \reg, TI_PRE_COUNT($28)
+#endif
        .endm
 #endif /* CONFIG_MIPS_MT_SMTC */
@@ -106,7 +117,7 @@
        .endm
        .macro  fpu_save_double thread status tmp
-#if defined(CONFIG_MIPS64) || defined(CONFIG_CPU_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        sll     \tmp, \status, 5
        bgez    \tmp, 10f
        fpu_save_16odd \thread
@@ -159,7 +170,7 @@
        .endm
        .macro  fpu_restore_double thread status tmp
-#if defined(CONFIG_MIPS64) || defined(CONFIG_CPU_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        sll     \tmp, \status, 5
        bgez    \tmp, 10f                               # 16 register mode?
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 6b9749540edf..58e50cbdb1a6 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -57,7 +57,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
                return 0;
        case FPU_64BIT:
-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_MIPS64))
+#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_64BIT))
                /* we only have a 32-bit FPU */
                return SIGFPE;
 #endif
diff --git a/arch/mips/include/asm/ftrace.h b/arch/mips/include/asm/ftrace.h
index ce35c9af0c28..992aaba603b5 100644
--- a/arch/mips/include/asm/ftrace.h
+++ b/arch/mips/include/asm/ftrace.h
@@ -22,12 +22,12 @@ extern void _mcount(void);
 #define safe_load(load, src, dst, error)                \
 do {                                                    \
        asm volatile (                                  \
-                "1: " load " %[" STR(dst) "], 0(%[" STR(src) "])\n"\
+                "1: " load " %[tmp_dst], 0(%[tmp_src])\n"       \
-                "   li %[" STR(error) "], 0\n"          \
+                "   li %[tmp_err], 0\n"                 \
                "2:\n"                                  \
                                                        \
                ".section .fixup, \"ax\"\n"             \
-                "3: li %[" STR(error) "], 1\n"          \
+                "3: li %[tmp_err], 1\n"                 \
                "   j 2b\n"                             \
                ".previous\n"                           \
                                                        \
@@ -35,8 +35,8 @@ do {							\
                STR(PTR) "\t1b, 3b\n\t"                 \
                ".previous\n"                           \
                                                        \
-                : [dst] "=&r" (dst), [error] "=r" (error)\
+                : [tmp_dst] "=&r" (dst), [tmp_err] "=r" (error)\
-                : [src] "r" (src)                       \
+                : [tmp_src] "r" (src)                   \
                : "memory"                              \
        );                                              \
 } while (0)
@@ -44,12 +44,12 @@ do {							\
 #define safe_store(store, src, dst, error)      \
 do {                                            \
        asm volatile (                          \
-                "1: " store " %[" STR(src) "], 0(%[" STR(dst) "])\n"\
+                "1: " store " %[tmp_src], 0(%[tmp_dst])\n"\
-                "   li %[" STR(error) "], 0\n"  \
+                "   li %[tmp_err], 0\n"         \
                "2:\n"                          \
                                                \
                ".section .fixup, \"ax\"\n"     \
-                "3: li %[" STR(error) "], 1\n"  \
+                "3: li %[tmp_err], 1\n"         \
                "   j 2b\n"                     \
                ".previous\n"                   \
                                                \
@@ -57,8 +57,8 @@ do {						\
                STR(PTR) "\t1b, 3b\n\t"         \
                ".previous\n"                   \
                                                \
-                : [error] "=r" (error)          \
+                : [tmp_err] "=r" (error)        \
-                : [dst] "r" (dst), [src] "r" (src)\
+                : [tmp_dst] "r" (dst), [tmp_src] "r" (src)\
                : "memory"                      \
        );                                      \
 } while (0)
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 33e8dbfc1b63..f35b131977e6 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -13,6 +13,7 @@
 #ifndef __ASM_MIPS_SYSCALL_H
 #define __ASM_MIPS_SYSCALL_H
+#include <linux/compiler.h>
 #include <linux/audit.h>
 #include <linux/elf-em.h>
 #include <linux/kernel.h>
@@ -39,14 +40,14 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
 #ifdef CONFIG_32BIT
        case 4: case 5: case 6: case 7:
-                return get_user(*arg, (int *)usp + 4 * n);
+                return get_user(*arg, (int *)usp + n);
 #endif
 #ifdef CONFIG_64BIT
        case 4: case 5: case 6: case 7:
 #ifdef CONFIG_MIPS32_O32
                if (test_thread_flag(TIF_32BIT_REGS))
-                        return get_user(*arg, (int *)usp + 4 * n);
+                        return get_user(*arg, (int *)usp + n);
                else
 #endif
                        *arg = regs->regs[4 + n];
@@ -57,6 +58,8 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
        default:
                BUG();
        }
+        unreachable();
 }
 static inline long syscall_get_return_value(struct task_struct *task,
@@ -83,11 +86,10 @@ static inline void syscall_get_arguments(struct task_struct *task,
                                         unsigned int i, unsigned int n,
                                         unsigned long *args)
 {
-        unsigned long arg;
        int ret;
        while (n--)
-                ret |= mips_get_syscall_arg(&arg, task, regs, i++);
+                ret |= mips_get_syscall_arg(args++, task, regs, i++);
        /*
         * No way to communicate an error because this is a void function.
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index b39ba25b41cc..f25181b19941 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -163,8 +163,8 @@ enum cop1_sdw_func {
 */
 enum cop1x_func {
        lwxc1_op     =  0x00, ldxc1_op     =  0x01,
-        pfetch_op    =  0x07, swxc1_op     =  0x08,
+        swxc1_op     =  0x08, sdxc1_op     =  0x09,
-        sdxc1_op     =  0x09, madd_s_op    =  0x20,
+        pfetch_op    =  0x0f, madd_s_op    =  0x20,
        madd_d_op    =  0x21, madd_e_op    =  0x22,
        msub_s_op    =  0x28, msub_d_op    =  0x29,
        msub_e_op    =  0x2a, nmadd_s_op   =  0x30,
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 185ba258361b..374ed74cd516 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -111,11 +111,10 @@ static int ftrace_modify_code_2(unsigned long ip, unsigned int new_code1,
        safe_store_code(new_code1, ip, faulted);
        if (unlikely(faulted))
                return -EFAULT;
-        ip += 4;
+        safe_store_code(new_code2, ip + 4, faulted);
-        safe_store_code(new_code2, ip, faulted);
        if (unlikely(faulted))
                return -EFAULT;
-        flush_icache_range(ip, ip + 8); /* original ip + 12 */
+        flush_icache_range(ip, ip + 8);
        return 0;
 }
 #endif
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 253b2fb52026..73b0ddf910d4 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -35,9 +35,9 @@
 LEAF(_save_fp_context)
        cfc1    t1, fcr31
-#if defined(CONFIG_64BIT) || defined(CONFIG_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        .set    push
-#ifdef CONFIG_MIPS32_R2
+#ifdef CONFIG_CPU_MIPS32_R2
        .set    mips64r2
        mfc0    t0, CP0_STATUS
        sll     t0, t0, 5
@@ -146,11 +146,11 @@ LEAF(_save_fp_context32)
 *  - cp1 status/control register
 */
 LEAF(_restore_fp_context)
-        EX      lw t0, SC_FPC_CSR(a0)
+        EX      lw t1, SC_FPC_CSR(a0)
-#if defined(CONFIG_64BIT) || defined(CONFIG_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
        .set    push
-#ifdef CONFIG_MIPS32_R2
+#ifdef CONFIG_CPU_MIPS32_R2
        .set    mips64r2
        mfc0    t0, CP0_STATUS
        sll     t0, t0, 5
@@ -191,7 +191,7 @@ LEAF(_restore_fp_context)
        EX      ldc1 $f26, SC_FPREGS+208(a0)
        EX      ldc1 $f28, SC_FPREGS+224(a0)
        EX      ldc1 $f30, SC_FPREGS+240(a0)
-        ctc1    t0, fcr31
+        ctc1    t1, fcr31
        jr      ra
         li     v0, 0                                   # success
        END(_restore_fp_context)
@@ -199,7 +199,7 @@ LEAF(_restore_fp_context)
 #ifdef CONFIG_MIPS32_COMPAT
 LEAF(_restore_fp_context32)
        /* Restore an o32 sigcontext.  */
-        EX      lw t0, SC32_FPC_CSR(a0)
+        EX      lw t1, SC32_FPC_CSR(a0)
        mfc0    t0, CP0_STATUS
        sll     t0, t0, 5
@@ -239,7 +239,7 @@ LEAF(_restore_fp_context32)
        EX      ldc1 $f26, SC32_FPREGS+208(a0)
        EX      ldc1 $f28, SC32_FPREGS+224(a0)
        EX      ldc1 $f30, SC32_FPREGS+240(a0)
-        ctc1    t0, fcr31
+        ctc1    t1, fcr31
        jr      ra
         li     v0, 0                                   # success
        END(_restore_fp_context32)
diff --git a/arch/mips/kernel/rtlx-cmp.c b/arch/mips/kernel/rtlx-cmp.c
index 56dc69635153..758fb3cd2326 100644
--- a/arch/mips/kernel/rtlx-cmp.c
+++ b/arch/mips/kernel/rtlx-cmp.c
@@ -112,5 +112,8 @@ void __exit rtlx_module_exit(void)
        for (i = 0; i < RTLX_CHANNELS; i++)
                device_destroy(mt_class, MKDEV(major, i));
        unregister_chrdev(major, RTLX_MODULE_NAME);
+        aprp_hook = NULL;
 }
diff --git a/arch/mips/kernel/rtlx-mt.c b/arch/mips/kernel/rtlx-mt.c
index 91d61ba422b4..9c1aca00fd54 100644
--- a/arch/mips/kernel/rtlx-mt.c
+++ b/arch/mips/kernel/rtlx-mt.c
@@ -144,5 +144,8 @@ void __exit rtlx_module_exit(void)
        for (i = 0; i < RTLX_CHANNELS; i++)
                device_destroy(mt_class, MKDEV(major, i));
        unregister_chrdev(major, RTLX_MODULE_NAME);
+        aprp_hook = NULL;
 }
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 506925b2c3f3..0b4e2e38294b 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -1538,10 +1538,10 @@ static int fpux_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
                break;
        }
-        case 0x7:               /* 7 */
+        case 0x3:
-                if (MIPSInst_FUNC(ir) != pfetch_op) {
+                if (MIPSInst_FUNC(ir) != pfetch_op)
                        return SIGILL;
-                }
                /* ignore prefx operation */
                break;
diff --git a/arch/mips/mti-malta/malta-amon.c b/arch/mips/mti-malta/malta-amon.c
index 592ac0427426..84ac523b0ce0 100644
--- a/arch/mips/mti-malta/malta-amon.c
+++ b/arch/mips/mti-malta/malta-amon.c
@@ -72,7 +72,7 @@ int amon_cpu_start(int cpu,
        return 0;
 }
-#ifdef CONFIG_MIPS_VPE_LOADER
+#ifdef CONFIG_MIPS_VPE_LOADER_CMP
 int vpe_run(struct vpe *v)
 {
        struct vpe_notifications *n;
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index ca3e3a46a42f..2242181a6284 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -119,7 +119,7 @@ static void malta_hw0_irqdispatch(void)
        do_IRQ(MALTA_INT_BASE + irq);
-#ifdef MIPS_VPE_APSP_API
+#ifdef CONFIG_MIPS_VPE_APSP_API_MT
        if (aprp_hook)
                aprp_hook();
 #endif
@@ -310,7 +310,7 @@ static void ipi_call_dispatch(void)
 static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 {
-#ifdef MIPS_VPE_APSP_API
+#ifdef CONFIG_MIPS_VPE_APSP_API_CMP
        if (aprp_hook)
                aprp_hook();
 #endif
diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c
index d37be36dc659..2b91b0e61566 100644
--- a/arch/mips/pci/msi-octeon.c
+++ b/arch/mips/pci/msi-octeon.c
@@ -150,6 +150,7 @@ msi_irq_allocated:
                msg.address_lo =
                        ((128ul << 20) + CVMX_PCI_MSI_RCV) & 0xffffffff;
                msg.address_hi = ((128ul << 20) + CVMX_PCI_MSI_RCV) >> 32;
+                break;
        case OCTEON_DMA_BAR_TYPE_BIG:
                /* When using big bar, Bar 0 is based at 0 */
                msg.address_lo = (0 + CVMX_PCI_MSI_RCV) & 0xffffffff;
diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index 637fe031aa84..60d5d174dfe4 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -32,17 +32,6 @@ void copy_page_asm(void *to, void *from);
 void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
                        struct page *pg);
-/* #define CONFIG_PARISC_TMPALIAS */
-#ifdef CONFIG_PARISC_TMPALIAS
-void clear_user_highpage(struct page *page, unsigned long vaddr);
-#define clear_user_highpage clear_user_highpage
-struct vm_area_struct;
-void copy_user_highpage(struct page *to, struct page *from,
-        unsigned long vaddr, struct vm_area_struct *vma);
-#define __HAVE_ARCH_COPY_USER_HIGHPAGE
-#endif
 /*
 * These are used to make use of C type-checking..
 */
diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
index 3516e0b27044..64f2992e439f 100644
--- a/arch/parisc/include/asm/spinlock.h
+++ b/arch/parisc/include/asm/spinlock.h
@@ -191,8 +191,4 @@ static __inline__ int arch_write_can_lock(arch_rwlock_t *rw)
 #define arch_read_lock_flags(lock, flags) arch_read_lock(lock)
 #define arch_write_lock_flags(lock, flags) arch_write_lock(lock)
-#define arch_spin_relax(lock)   cpu_relax()
-#define arch_read_relax(lock)   cpu_relax()
-#define arch_write_relax(lock)  cpu_relax()
 #endif /* __ASM_SPINLOCK_H */
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 42706794a36f..265ae5190b0a 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -828,13 +828,13 @@
 #define __NR_finit_module       (__NR_Linux + 333)
 #define __NR_sched_setattr      (__NR_Linux + 334)
 #define __NR_sched_getattr      (__NR_Linux + 335)
+#define __NR_utimes             (__NR_Linux + 336)
-#define __NR_Linux_syscalls     (__NR_sched_getattr + 1)
+#define __NR_Linux_syscalls     (__NR_utimes + 1)
 #define __IGNORE_select         /* newselect */
 #define __IGNORE_fadvise64      /* fadvise64_64 */
-#define __IGNORE_utimes         /* utime */
 #define HPUX_GATEWAY_ADDR       0xC0000004
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index ac87a40502e6..a6ffc775a9f8 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -581,67 +581,3 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
        }
 }
-#ifdef CONFIG_PARISC_TMPALIAS
-void clear_user_highpage(struct page *page, unsigned long vaddr)
-{
-        void *vto;
-        unsigned long flags;
-        /* Clear using TMPALIAS region.  The page doesn't need to
-           be flushed but the kernel mapping needs to be purged.  */
-        vto = kmap_atomic(page);
-        /* The PA-RISC 2.0 Architecture book states on page F-6:
-           "Before a write-capable translation is enabled, *all*
-           non-equivalently-aliased translations must be removed
-           from the page table and purged from the TLB.  (Note
-           that the caches are not required to be flushed at this
-           time.)  Before any non-equivalent aliased translation
-           is re-enabled, the virtual address range for the writeable
-           page (the entire page) must be flushed from the cache,
-           and the write-capable translation removed from the page
-           table and purged from the TLB."  */
-        purge_kernel_dcache_page_asm((unsigned long)vto);
-        purge_tlb_start(flags);
-        pdtlb_kernel(vto);
-        purge_tlb_end(flags);
-        preempt_disable();
-        clear_user_page_asm(vto, vaddr);
-        preempt_enable();
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER0); */
-}
-void copy_user_highpage(struct page *to, struct page *from,
-        unsigned long vaddr, struct vm_area_struct *vma)
-{
-        void *vfrom, *vto;
-        unsigned long flags;
-        /* Copy using TMPALIAS region.  This has the advantage
-           that the `from' page doesn't need to be flushed.  However,
-           the `to' page must be flushed in copy_user_page_asm since
-           it can be used to bring in executable code.  */
-        vfrom = kmap_atomic(from);
-        vto = kmap_atomic(to);
-        purge_kernel_dcache_page_asm((unsigned long)vto);
-        purge_tlb_start(flags);
-        pdtlb_kernel(vto);
-        pdtlb_kernel(vfrom);
-        purge_tlb_end(flags);
-        preempt_disable();
-        copy_user_page_asm(vto, vfrom, vaddr);
-        flush_dcache_page_asm(__pa(vto), vaddr);
-        preempt_enable();
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER1); */
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER0); */
-}
-#endif /* CONFIG_PARISC_TMPALIAS */
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 8fa3fbb3e4d3..80e5dd248934 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -431,6 +431,7 @@
        ENTRY_SAME(finit_module)
        ENTRY_SAME(sched_setattr)
        ENTRY_SAME(sched_getattr)       /* 335 */
+        ENTRY_COMP(utimes)
        /* Nothing yet */
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index e66d4ec04d95..818dce344e82 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1504,73 +1504,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 1:      addi    r8,r8,16
        .endr
-        /* Save DEC */
-        mfspr   r5,SPRN_DEC
-        mftb    r6
-        extsw   r5,r5
-        add     r5,r5,r6
-        std     r5,VCPU_DEC_EXPIRES(r9)
-BEGIN_FTR_SECTION
-        b       8f
-END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
-        /* Turn on TM so we can access TFHAR/TFIAR/TEXASR */
-        mfmsr   r8
-        li      r0, 1
-        rldimi  r8, r0, MSR_TM_LG, 63-MSR_TM_LG
-        mtmsrd  r8
-        /* Save POWER8-specific registers */
-        mfspr   r5, SPRN_IAMR
-        mfspr   r6, SPRN_PSPB
-        mfspr   r7, SPRN_FSCR
-        std     r5, VCPU_IAMR(r9)
-        stw     r6, VCPU_PSPB(r9)
-        std     r7, VCPU_FSCR(r9)
-        mfspr   r5, SPRN_IC
-        mfspr   r6, SPRN_VTB
-        mfspr   r7, SPRN_TAR
-        std     r5, VCPU_IC(r9)
-        std     r6, VCPU_VTB(r9)
-        std     r7, VCPU_TAR(r9)
-#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-        mfspr   r5, SPRN_TFHAR
-        mfspr   r6, SPRN_TFIAR
-        mfspr   r7, SPRN_TEXASR
-        std     r5, VCPU_TFHAR(r9)
-        std     r6, VCPU_TFIAR(r9)
-        std     r7, VCPU_TEXASR(r9)
-#endif
-        mfspr   r8, SPRN_EBBHR
-        std     r8, VCPU_EBBHR(r9)
-        mfspr   r5, SPRN_EBBRR
-        mfspr   r6, SPRN_BESCR
-        mfspr   r7, SPRN_CSIGR
-        mfspr   r8, SPRN_TACR
-        std     r5, VCPU_EBBRR(r9)
-        std     r6, VCPU_BESCR(r9)
-        std     r7, VCPU_CSIGR(r9)
-        std     r8, VCPU_TACR(r9)
-        mfspr   r5, SPRN_TCSCR
-        mfspr   r6, SPRN_ACOP
-        mfspr   r7, SPRN_PID
-        mfspr   r8, SPRN_WORT
-        std     r5, VCPU_TCSCR(r9)
-        std     r6, VCPU_ACOP(r9)
-        stw     r7, VCPU_GUEST_PID(r9)
-        std     r8, VCPU_WORT(r9)
-8:
-        /* Save and reset AMR and UAMOR before turning on the MMU */
-BEGIN_FTR_SECTION
-        mfspr   r5,SPRN_AMR
-        mfspr   r6,SPRN_UAMOR
-        std     r5,VCPU_AMR(r9)
-        std     r6,VCPU_UAMOR(r9)
-        li      r6,0
-        mtspr   SPRN_AMR,r6
-END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
        /* Unset guest mode */
        li      r0, KVM_GUEST_MODE_NONE
        stb     r0, HSTATE_IN_GUEST(r13)
@@ -2203,7 +2136,7 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
        mfspr   r6,SPRN_VRSAVE
-        stw     r6,VCPU_VRSAVE(r3)
+        stw     r6,VCPU_VRSAVE(r31)
        mtlr    r30
        mtmsrd  r5
        isync
@@ -2240,7 +2173,7 @@ BEGIN_FTR_SECTION
        bl      .load_vr_state
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
-        lwz     r7,VCPU_VRSAVE(r4)
+        lwz     r7,VCPU_VRSAVE(r31)
        mtspr   SPRN_VRSAVE,r7
        mtlr    r30
        mr      r4,r31
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 32a280ec38c1..d7b4967f8fa6 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -58,9 +58,12 @@ void arch_cpu_idle(void)
 {
        if (tlb_type != hypervisor) {
                touch_nmi_watchdog();
+                local_irq_enable();
        } else {
                unsigned long pstate;
+                local_irq_enable();
                /* The sun4v sleeping code requires that we have PSTATE.IE cleared over
                 * the cpu sleep hypervisor call.
                 */
@@ -82,7 +85,6 @@ void arch_cpu_idle(void)
                        : "=&r" (pstate)
                        : "i" (PSTATE_IE));
        }
-        local_irq_enable();
 }
 #ifdef CONFIG_HOTPLUG_CPU
diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
index 87729fff13b9..33a17e7b3ccd 100644
--- a/arch/sparc/kernel/syscalls.S
+++ b/arch/sparc/kernel/syscalls.S
@@ -189,7 +189,8 @@ linux_sparc_syscall32:
         mov    %i0, %l5                                ! IEU1
 5:      call    %l7                                     ! CTI   Group brk forced
         srl    %i5, 0, %o5                             ! IEU1
-        ba,a,pt %xcc, 3f
+        ba,pt   %xcc, 3f
+         sra    %o0, 0, %o0
        /* Linux native system calls enter here... */
        .align  32
@@ -217,7 +218,6 @@ linux_sparc_syscall:
 3:      stx     %o0, [%sp + PTREGS_OFF + PT_V9_I0]
 ret_sys_call:
        ldx     [%sp + PTREGS_OFF + PT_V9_TSTATE], %g3
-        sra     %o0, 0, %o0
        mov     %ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2
        sllx    %g2, 32, %g2
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index 3b3a360b429a..f5d506fdddad 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -273,7 +273,7 @@ void __init pgtable_cache_init(void)
                prom_halt();
        }
-        for (i = 0; i < 8; i++) {
+        for (i = 0; i < ARRAY_SIZE(tsb_cache_names); i++) {
                unsigned long size = 8192 << i;
                const char *name = tsb_cache_names[i];
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 5ad38ad07890..bbc8b12fa443 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -445,20 +445,10 @@ static inline int pte_same(pte_t a, pte_t b)
        return a.pte == b.pte;
 }
-static inline int pteval_present(pteval_t pteval)
-{
-        /*
-         * Yes Linus, _PAGE_PROTNONE == _PAGE_NUMA. Expressing it this
-         * way clearly states that the intent is that protnone and numa
-         * hinting ptes are considered present for the purposes of
-         * pagetable operations like zapping, protection changes, gup etc.
-         */
-        return pteval & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_NUMA);
-}
 static inline int pte_present(pte_t a)
 {
-        return pteval_present(pte_flags(a));
+        return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE |
+                               _PAGE_NUMA);
 }
 #define pte_accessible pte_accessible
diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
index d35f24e231cd..1306d117967d 100644
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -119,9 +119,10 @@ static inline void setup_node_to_cpumask_map(void) { }
 extern const struct cpumask *cpu_coregroup_mask(int cpu);
-#ifdef ENABLE_TOPO_DEFINES
 #define topology_physical_package_id(cpu)       (cpu_data(cpu).phys_proc_id)
 #define topology_core_id(cpu)                   (cpu_data(cpu).cpu_core_id)
+#ifdef ENABLE_TOPO_DEFINES
 #define topology_core_cpumask(cpu)              (per_cpu(cpu_core_map, cpu))
 #define topology_thread_cpumask(cpu)            (per_cpu(cpu_sibling_map, cpu))
 #endif
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index fd972a3e4cbb..9fa8aa051f54 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -18,7 +18,6 @@
 #include <linux/pci_ids.h>
 #include <linux/pci.h>
 #include <linux/bitops.h>
-#include <linux/ioport.h>
 #include <linux/suspend.h>
 #include <asm/e820.h>
 #include <asm/io.h>
@@ -54,18 +53,6 @@ int fallback_aper_force __initdata;
 int fix_aperture __initdata = 1;
-static struct resource gart_resource = {
-        .name   = "GART",
-        .flags  = IORESOURCE_MEM,
-};
-static void __init insert_aperture_resource(u32 aper_base, u32 aper_size)
-{
-        gart_resource.start = aper_base;
-        gart_resource.end = aper_base + aper_size - 1;
-        insert_resource(&iomem_resource, &gart_resource);
-}
 /* This code runs before the PCI subsystem is initialized, so just
   access the northbridge directly. */
@@ -96,7 +83,6 @@ static u32 __init allocate_aperture(void)
        memblock_reserve(addr, aper_size);
        printk(KERN_INFO "Mapping aperture over %d KB of RAM @ %lx\n",
                        aper_size >> 10, addr);
-        insert_aperture_resource((u32)addr, aper_size);
        register_nosave_region(addr >> PAGE_SHIFT,
                               (addr+aper_size) >> PAGE_SHIFT);
@@ -444,12 +430,8 @@ int __init gart_iommu_hole_init(void)
 out:
        if (!fix && !fallback_aper_force) {
-                if (last_aper_base) {
+                if (last_aper_base)
-                        unsigned long n = (32 * 1024 * 1024) << last_aper_order;
-                        insert_aperture_resource((u32)last_aper_base, n);
                        return 1;
-                }
                return 0;
        }
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 256282e7888b..2423ef04ffea 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -365,7 +365,7 @@ void xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
 /* Assume pteval_t is equivalent to all the other *val_t types. */
 static pteval_t pte_mfn_to_pfn(pteval_t val)
 {
-        if (pteval_present(val)) {
+        if (val & _PAGE_PRESENT) {
                unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
                unsigned long pfn = mfn_to_pfn(mfn);
@@ -381,7 +381,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
 static pteval_t pte_pfn_to_mfn(pteval_t val)
 {
-        if (pteval_present(val)) {
+        if (val & _PAGE_PRESENT) {
                unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
                pteval_t flags = val & PTE_FLAGS_MASK;
                unsigned long mfn;
diff --git a/block/blk-core.c b/block/blk-core.c
index 853f92749202..bfe16d5af9f9 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -693,20 +693,11 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
        if (!uninit_q)
                return NULL;
-        uninit_q->flush_rq = kzalloc(sizeof(struct request), GFP_KERNEL);
-        if (!uninit_q->flush_rq)
-                goto out_cleanup_queue;
        q = blk_init_allocated_queue(uninit_q, rfn, lock);
        if (!q)
-                goto out_free_flush_rq;
+                blk_cleanup_queue(uninit_q);
-        return q;
-out_free_flush_rq:
+        return q;
-        kfree(uninit_q->flush_rq);
-out_cleanup_queue:
-        blk_cleanup_queue(uninit_q);
-        return NULL;
 }
 EXPORT_SYMBOL(blk_init_queue_node);
@@ -717,9 +708,13 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
        if (!q)
                return NULL;
-        if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
+        q->flush_rq = kzalloc(sizeof(struct request), GFP_KERNEL);
+        if (!q->flush_rq)
                return NULL;
+        if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
+                goto fail;
        q->request_fn           = rfn;
        q->prep_rq_fn           = NULL;
        q->unprep_rq_fn         = NULL;
@@ -742,12 +737,16 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
        /* init elevator */
        if (elevator_init(q, NULL)) {
                mutex_unlock(&q->sysfs_lock);
-                return NULL;
+                goto fail;
        }
        mutex_unlock(&q->sysfs_lock);
        return q;
+fail:
+        kfree(q->flush_rq);
+        return NULL;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);
diff --git a/block/blk-flush.c b/block/blk-flush.c
index f598f794c3c6..43e6b4755e9a 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -140,14 +140,17 @@ static void mq_flush_run(struct work_struct *work)
        blk_mq_insert_request(rq, false, true, false);
 }
-static bool blk_flush_queue_rq(struct request *rq)
+static bool blk_flush_queue_rq(struct request *rq, bool add_front)
 {
        if (rq->q->mq_ops) {
                INIT_WORK(&rq->mq_flush_work, mq_flush_run);
                kblockd_schedule_work(rq->q, &rq->mq_flush_work);
                return false;
        } else {
-                list_add_tail(&rq->queuelist, &rq->q->queue_head);
+                if (add_front)
+                        list_add(&rq->queuelist, &rq->q->queue_head);
+                else
+                        list_add_tail(&rq->queuelist, &rq->q->queue_head);
                return true;
        }
 }
@@ -193,7 +196,7 @@ static bool blk_flush_complete_seq(struct request *rq, unsigned int seq,
        case REQ_FSEQ_DATA:
                list_move_tail(&rq->flush.list, &q->flush_data_in_flight);
-                queued = blk_flush_queue_rq(rq);
+                queued = blk_flush_queue_rq(rq, true);
                break;
        case REQ_FSEQ_DONE:
@@ -326,7 +329,7 @@ static bool blk_kick_flush(struct request_queue *q)
        q->flush_rq->rq_disk = first_rq->rq_disk;
        q->flush_rq->end_io = flush_end_io;
-        return blk_flush_queue_rq(q->flush_rq);
+        return blk_flush_queue_rq(q->flush_rq, false);
 }
 static void flush_data_end_io(struct request *rq, int error)
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 516026954be6..d777bb7cea93 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4498,7 +4498,7 @@ static int mtip_pci_probe(struct pci_dev *pdev,
        }
        dev_info(&pdev->dev, "NUMA node %d (closest: %d,%d, probe on %d:%d)\n",
                my_node, pcibus_to_node(pdev->bus), dev_to_node(&pdev->dev),
-                cpu_to_node(smp_processor_id()), smp_processor_id());
+                cpu_to_node(raw_smp_processor_id()), raw_smp_processor_id());
        dd = kzalloc_node(sizeof(struct driver_data), GFP_KERNEL, my_node);
        if (dd == NULL) {
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index b365e0dfccb6..34898d53395b 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2109,7 +2109,6 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request)
        rbd_assert(img_request->obj_request_count > 0);
        rbd_assert(which != BAD_WHICH);
        rbd_assert(which < img_request->obj_request_count);
-        rbd_assert(which >= img_request->next_completion);
        spin_lock_irq(&img_request->completion_lock);
        if (which != img_request->next_completion)
diff --git a/drivers/clocksource/vf_pit_timer.c b/drivers/clocksource/vf_pit_timer.c
index 02821b06a39e..a918bc481c52 100644
--- a/drivers/clocksource/vf_pit_timer.c
+++ b/drivers/clocksource/vf_pit_timer.c
@@ -54,7 +54,7 @@ static inline void pit_irq_acknowledge(void)
 static u64 pit_read_sched_clock(void)
 {
-        return __raw_readl(clksrc_base + PITCVAL);
+        return ~__raw_readl(clksrc_base + PITCVAL);
 }
 static int __init pit_clocksource_init(unsigned long rate)
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index d04786db9627..195fe5bc0aac 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -561,7 +561,7 @@ static int i915_gem_request_info(struct seq_file *m, void *data)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        struct drm_i915_gem_request *gem_request;
        int ret, count, i;
@@ -606,7 +606,7 @@ static int i915_gem_seqno_info(struct seq_file *m, void *data)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        int ret, i;
@@ -629,7 +629,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        int ret, i, pipe;
@@ -770,7 +770,7 @@ static int i915_gem_fence_regs_info(struct seq_file *m, void *data)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int i, ret;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
@@ -799,7 +799,7 @@ static int i915_hws_info(struct seq_file *m, void *data)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        const u32 *hws;
        int i;
@@ -910,7 +910,7 @@ static int
 i915_next_seqno_get(void *data, u64 *val)
 {
        struct drm_device *dev = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
@@ -947,7 +947,7 @@ static int i915_rstdby_delays(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u16 crstanddelay;
        int ret;
@@ -970,7 +970,7 @@ static int i915_cur_delayinfo(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret = 0;
        intel_runtime_pm_get(dev_priv);
@@ -1096,7 +1096,7 @@ static int i915_delayfreq_table(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 delayfreq;
        int ret, i;
@@ -1127,7 +1127,7 @@ static int i915_inttoext_table(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 inttoext;
        int ret, i;
@@ -1151,7 +1151,7 @@ static int ironlake_drpc_info(struct seq_file *m)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 rgvmodectl, rstdbyctl;
        u16 crstandvid;
        int ret;
@@ -1377,7 +1377,7 @@ static int i915_fbc_status(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        if (!HAS_FBC(dev)) {
                seq_puts(m, "FBC unsupported on this chipset\n");
@@ -1462,7 +1462,7 @@ static int i915_sr_status(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        bool sr_enabled = false;
        intel_runtime_pm_get(dev_priv);
@@ -1488,7 +1488,7 @@ static int i915_emon_status(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long temp, chipset, gfx;
        int ret;
@@ -1516,7 +1516,7 @@ static int i915_ring_freq_table(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret = 0;
        int gpu_freq, ia_freq;
@@ -1559,7 +1559,7 @@ static int i915_gfxec(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
@@ -1579,7 +1579,7 @@ static int i915_opregion(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_opregion *opregion = &dev_priv->opregion;
        void *data = kmalloc(OPREGION_SIZE, GFP_KERNEL);
        int ret;
@@ -1653,7 +1653,7 @@ static int i915_context_status(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        struct i915_hw_context *ctx;
        int ret, i;
@@ -2319,9 +2319,11 @@ static int i915_display_info(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *crtc;
        struct drm_connector *connector;
+        intel_runtime_pm_get(dev_priv);
        drm_modeset_lock_all(dev);
        seq_printf(m, "CRTC info\n");
        seq_printf(m, "---------\n");
@@ -2332,14 +2334,15 @@ static int i915_display_info(struct seq_file *m, void *unused)
                seq_printf(m, "CRTC %d: pipe: %c, active: %s\n",
                           crtc->base.base.id, pipe_name(crtc->pipe),
                           yesno(crtc->active));
-                if (crtc->active)
+                if (crtc->active) {
                        intel_crtc_info(m, crtc);
-                active = cursor_position(dev, crtc->pipe, &x, &y);
+                        active = cursor_position(dev, crtc->pipe, &x, &y);
-                seq_printf(m, "\tcursor visible? %s, position (%d, %d), addr 0x%08x, active? %s\n",
+                        seq_printf(m, "\tcursor visible? %s, position (%d, %d), addr 0x%08x, active? %s\n",
-                           yesno(crtc->cursor_visible),
+                                   yesno(crtc->cursor_visible),
-                           x, y, crtc->cursor_addr,
+                                   x, y, crtc->cursor_addr,
-                           yesno(active));
+                                   yesno(active));
+                }
        }
        seq_printf(m, "\n");
@@ -2349,6 +2352,7 @@ static int i915_display_info(struct seq_file *m, void *unused)
                intel_connector_info(m, connector);
        }
        drm_modeset_unlock_all(dev);
+        intel_runtime_pm_put(dev_priv);
        return 0;
 }
@@ -3271,7 +3275,7 @@ static int
 i915_wedged_get(void *data, u64 *val)
 {
        struct drm_device *dev = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        *val = atomic_read(&dev_priv->gpu_error.reset_counter);
@@ -3296,7 +3300,7 @@ static int
 i915_ring_stop_get(void *data, u64 *val)
 {
        struct drm_device *dev = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        *val = dev_priv->gpu_error.stop_rings;
@@ -3473,7 +3477,7 @@ static int
 i915_max_freq_get(void *data, u64 *val)
 {
        struct drm_device *dev = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret;
        if (!(IS_GEN6(dev) || IS_GEN7(dev)))
@@ -3554,7 +3558,7 @@ static int
 i915_min_freq_get(void *data, u64 *val)
 {
        struct drm_device *dev = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret;
        if (!(IS_GEN6(dev) || IS_GEN7(dev)))
@@ -3635,7 +3639,7 @@ static int
 i915_cache_sharing_get(void *data, u64 *val)
 {
        struct drm_device *dev = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 snpcr;
        int ret;
@@ -3695,7 +3699,6 @@ static int i915_forcewake_open(struct inode *inode, struct file *file)
        if (INTEL_INFO(dev)->gen < 6)
                return 0;
-        intel_runtime_pm_get(dev_priv);
        gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
        return 0;
@@ -3710,7 +3713,6 @@ static int i915_forcewake_release(struct inode *inode, struct file *file)
                return 0;
        gen6_gt_force_wake_put(dev_priv, FORCEWAKE_ALL);
-        intel_runtime_pm_put(dev_priv);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 4e0a26a83500..96177eec0a0e 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -82,7 +82,7 @@ intel_read_legacy_status_page(struct drm_i915_private *dev_priv, int reg)
 void i915_update_dri1_breadcrumb(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv;
        /*
@@ -103,7 +103,7 @@ void i915_update_dri1_breadcrumb(struct drm_device *dev)
 static void i915_write_hws_pga(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 addr;
        addr = dev_priv->status_page_dmah->busaddr;
@@ -118,7 +118,7 @@ static void i915_write_hws_pga(struct drm_device *dev)
 */
 static void i915_free_hws(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        if (dev_priv->status_page_dmah) {
@@ -137,7 +137,7 @@ static void i915_free_hws(struct drm_device *dev)
 void i915_kernel_lost_context(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv;
        struct intel_ring_buffer *ring = LP_RING(dev_priv);
@@ -164,7 +164,7 @@ void i915_kernel_lost_context(struct drm_device * dev)
 static int i915_dma_cleanup(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int i;
        /* Make sure interrupts are disabled here because the uninstall ioctl
@@ -188,7 +188,7 @@ static int i915_dma_cleanup(struct drm_device * dev)
 static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
        int ret;
@@ -233,7 +233,7 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
 static int i915_dma_resume(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        DRM_DEBUG_DRIVER("%s\n", __func__);
@@ -357,7 +357,7 @@ static int validate_cmd(int cmd)
 static int i915_emit_cmds(struct drm_device * dev, int *buffer, int dwords)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int i, ret;
        if ((dwords+1) * sizeof(int) >= LP_RING(dev_priv)->size - 8)
@@ -431,7 +431,7 @@ i915_emit_box(struct drm_device *dev,
 static void i915_emit_breadcrumb(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
        dev_priv->dri1.counter++;
@@ -547,7 +547,7 @@ static int i915_dispatch_batchbuffer(struct drm_device * dev,
 static int i915_dispatch_flip(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv =
                dev->primary->master->driver_priv;
        int ret;
@@ -625,7 +625,7 @@ static int i915_flush_ioctl(struct drm_device *dev, void *data,
 static int i915_batchbuffer(struct drm_device *dev, void *data,
                            struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv;
        drm_i915_sarea_t *sarea_priv;
        drm_i915_batchbuffer_t *batch = data;
@@ -683,7 +683,7 @@ fail_free:
 static int i915_cmdbuffer(struct drm_device *dev, void *data,
                          struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv;
        drm_i915_sarea_t *sarea_priv;
        drm_i915_cmdbuffer_t *cmdbuf = data;
@@ -753,7 +753,7 @@ fail_batch_free:
 static int i915_emit_irq(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
        i915_kernel_lost_context(dev);
@@ -779,7 +779,7 @@ static int i915_emit_irq(struct drm_device * dev)
 static int i915_wait_irq(struct drm_device * dev, int irq_nr)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
        int ret = 0;
        struct intel_ring_buffer *ring = LP_RING(dev_priv);
@@ -816,7 +816,7 @@ static int i915_wait_irq(struct drm_device * dev, int irq_nr)
 static int i915_irq_emit(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        drm_i915_irq_emit_t *emit = data;
        int result;
@@ -847,7 +847,7 @@ static int i915_irq_emit(struct drm_device *dev, void *data,
 static int i915_irq_wait(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        drm_i915_irq_wait_t *irqwait = data;
        if (drm_core_check_feature(dev, DRIVER_MODESET))
@@ -864,7 +864,7 @@ static int i915_irq_wait(struct drm_device *dev, void *data,
 static int i915_vblank_pipe_get(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        drm_i915_vblank_pipe_t *pipe = data;
        if (drm_core_check_feature(dev, DRIVER_MODESET))
@@ -925,7 +925,7 @@ static int i915_flip_bufs(struct drm_device *dev, void *data,
 static int i915_getparam(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        drm_i915_getparam_t *param = data;
        int value;
@@ -1033,7 +1033,7 @@ static int i915_getparam(struct drm_device *dev, void *data,
 static int i915_setparam(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        drm_i915_setparam_t *param = data;
        if (!dev_priv) {
@@ -1068,7 +1068,7 @@ static int i915_setparam(struct drm_device *dev, void *data,
 static int i915_set_status_page(struct drm_device *dev, void *data,
                                struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        drm_i915_hws_addr_t *hws = data;
        struct intel_ring_buffer *ring;
@@ -1136,7 +1136,7 @@ static int i915_get_bridge_dev(struct drm_device *dev)
 static int
 intel_alloc_mchbar_resource(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int reg = INTEL_INFO(dev)->gen >= 4 ? MCHBAR_I965 : MCHBAR_I915;
        u32 temp_lo, temp_hi = 0;
        u64 mchbar_addr;
@@ -1182,7 +1182,7 @@ intel_alloc_mchbar_resource(struct drm_device *dev)
 static void
 intel_setup_mchbar(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int mchbar_reg = INTEL_INFO(dev)->gen >= 4 ? MCHBAR_I965 : MCHBAR_I915;
        u32 temp;
        bool enabled;
@@ -1222,7 +1222,7 @@ intel_setup_mchbar(struct drm_device *dev)
 static void
 intel_teardown_mchbar(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int mchbar_reg = INTEL_INFO(dev)->gen >= 4 ? MCHBAR_I965 : MCHBAR_I915;
        u32 temp;
@@ -1895,7 +1895,7 @@ int i915_driver_open(struct drm_device *dev, struct drm_file *file)
 */
 void i915_driver_lastclose(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        /* On gen6+ we refuse to init without kms enabled, but then the drm core
         * goes right around and calls lastclose. Check for this and don't clean
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index fa5d0ed76378..82f4d1f47d3b 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -537,14 +537,21 @@ static void intel_resume_hotplug(struct drm_device *dev)
        drm_helper_hpd_irq_event(dev);
 }
-static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
+static int i915_drm_thaw_early(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        int error = 0;
        intel_uncore_early_sanitize(dev);
        intel_uncore_sanitize(dev);
+        intel_power_domains_init_hw(dev_priv);
+        return 0;
+}
+static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int error = 0;
        if (drm_core_check_feature(dev, DRIVER_MODESET) &&
            restore_gtt_mappings) {
@@ -553,8 +560,6 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
                mutex_unlock(&dev->struct_mutex);
        }
-        intel_power_domains_init_hw(dev_priv);
        i915_restore_state(dev);
        intel_opregion_setup(dev);
@@ -619,19 +624,33 @@ static int i915_drm_thaw(struct drm_device *dev)
        return __i915_drm_thaw(dev, true);
 }
-int i915_resume(struct drm_device *dev)
+static int i915_resume_early(struct drm_device *dev)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret;
        if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
                return 0;
+        /*
+         * We have a resume ordering issue with the snd-hda driver also
+         * requiring our device to be power up. Due to the lack of a
+         * parent/child relationship we currently solve this with an early
+         * resume hook.
+         *
+         * FIXME: This should be solved with a special hdmi sink device or
+         * similar so that power domains can be employed.
+         */
        if (pci_enable_device(dev->pdev))
                return -EIO;
        pci_set_master(dev->pdev);
+        return i915_drm_thaw_early(dev);
+}
+int i915_resume(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int ret;
        /*
         * Platforms with opregion should have sane BIOS, older ones (gen3 and
         * earlier) need to restore the GTT mappings since the BIOS might clear
@@ -645,6 +664,14 @@ int i915_resume(struct drm_device *dev)
        return 0;
 }
+static int i915_resume_legacy(struct drm_device *dev)
+{
+        i915_resume_early(dev);
+        i915_resume(dev);
+        return 0;
+}
 /**
 * i915_reset - reset chip after a hang
 * @dev: drm device to reset
@@ -662,7 +689,7 @@ int i915_resume(struct drm_device *dev)
 */
 int i915_reset(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        bool simulated;
        int ret;
@@ -776,7 +803,6 @@ static int i915_pm_suspend(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
        struct drm_device *drm_dev = pci_get_drvdata(pdev);
-        int error;
        if (!drm_dev || !drm_dev->dev_private) {
                dev_err(dev, "DRM not initialized, aborting suspend.\n");
@@ -786,9 +812,25 @@ static int i915_pm_suspend(struct device *dev)
        if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
                return 0;
-        error = i915_drm_freeze(drm_dev);
+        return i915_drm_freeze(drm_dev);
-        if (error)
+}
-                return error;
+static int i915_pm_suspend_late(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        /*
+         * We have a suspedn ordering issue with the snd-hda driver also
+         * requiring our device to be power up. Due to the lack of a
+         * parent/child relationship we currently solve this with an late
+         * suspend hook.
+         *
+         * FIXME: This should be solved with a special hdmi sink device or
+         * similar so that power domains can be employed.
+         */
+        if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+                return 0;
        pci_disable_device(pdev);
        pci_set_power_state(pdev, PCI_D3hot);
@@ -796,6 +838,14 @@ static int i915_pm_suspend(struct device *dev)
        return 0;
 }
+static int i915_pm_resume_early(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        return i915_resume_early(drm_dev);
+}
 static int i915_pm_resume(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
@@ -817,6 +867,14 @@ static int i915_pm_freeze(struct device *dev)
        return i915_drm_freeze(drm_dev);
 }
+static int i915_pm_thaw_early(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        return i915_drm_thaw_early(drm_dev);
+}
 static int i915_pm_thaw(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
@@ -887,10 +945,14 @@ static int i915_runtime_resume(struct device *device)
 static const struct dev_pm_ops i915_pm_ops = {
        .suspend = i915_pm_suspend,
+        .suspend_late = i915_pm_suspend_late,
+        .resume_early = i915_pm_resume_early,
        .resume = i915_pm_resume,
        .freeze = i915_pm_freeze,
+        .thaw_early = i915_pm_thaw_early,
        .thaw = i915_pm_thaw,
        .poweroff = i915_pm_poweroff,
+        .restore_early = i915_pm_resume_early,
        .restore = i915_pm_resume,
        .runtime_suspend = i915_runtime_suspend,
        .runtime_resume = i915_runtime_resume,
@@ -933,7 +995,7 @@ static struct drm_driver driver = {
        /* Used in place of i915_pm_ops for non-DRIVER_MODESET */
        .suspend = i915_suspend,
-        .resume = i915_resume,
+        .resume = i915_resume_legacy,
        .device_is_agp = i915_driver_device_is_agp,
        .master_create = i915_master_create,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 3f62be0fb5c5..0905cd915589 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -351,12 +351,12 @@ struct drm_i915_error_state {
                u32 ipeir;
                u32 ipehr;
                u32 instdone;
-                u32 acthd;
                u32 bbstate;
                u32 instpm;
                u32 instps;
                u32 seqno;
                u64 bbaddr;
+                u64 acthd;
                u32 fault_reg;
                u32 faddr;
                u32 rc_psmi; /* sleep state */
@@ -1001,9 +1001,6 @@ struct intel_gen6_power_mgmt {
        u8 rp1_freq;            /* "less than" RP0 power/freqency */
        u8 rp0_freq;            /* Non-overclocked max frequency. */
-        bool rp_up_masked;
-        bool rp_down_masked;
        int last_adj;
        enum { LOW_POWER, BETWEEN, HIGH_POWER } power;
@@ -1468,6 +1465,7 @@ typedef struct drm_i915_private {
        };
        u32 gt_irq_mask;
        u32 pm_irq_mask;
+        u32 pm_rps_events;
        u32 pipestat_irq_mask[I915_MAX_PIPES];
        struct work_struct hotplug_work;
@@ -2130,11 +2128,11 @@ extern void intel_uncore_check_errors(struct drm_device *dev);
 extern void intel_uncore_fini(struct drm_device *dev);
 void
-i915_enable_pipestat(drm_i915_private_t *dev_priv, enum pipe pipe,
+i915_enable_pipestat(struct drm_i915_private *dev_priv, enum pipe pipe,
                     u32 status_mask);
 void
-i915_disable_pipestat(drm_i915_private_t *dev_priv, enum pipe pipe,
+i915_disable_pipestat(struct drm_i915_private *dev_priv, enum pipe pipe,
                      u32 status_mask);
 void valleyview_enable_display_irqs(struct drm_i915_private *dev_priv);
@@ -2504,7 +2502,7 @@ void i915_gem_object_release_stolen(struct drm_i915_gem_object *obj);
 /* i915_gem_tiling.c */
 static inline bool i915_gem_object_needs_bit17_swizzle(struct drm_i915_gem_object *obj)
 {
-        drm_i915_private_t *dev_priv = obj->base.dev->dev_private;
+        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
        return dev_priv->mm.bit_6_swizzle_x == I915_BIT_6_SWIZZLE_9_10_17 &&
                obj->tiling_mode != I915_TILING_NONE;
@@ -2745,6 +2743,17 @@ void vlv_force_wake_put(struct drm_i915_private *dev_priv, int fw_engine);
 #define I915_WRITE64(reg, val)  dev_priv->uncore.funcs.mmio_writeq(dev_priv, (reg), (val), true)
 #define I915_READ64(reg)        dev_priv->uncore.funcs.mmio_readq(dev_priv, (reg), true)
+#define I915_READ64_2x32(lower_reg, upper_reg) ({                       \
+                u32 upper = I915_READ(upper_reg);                       \
+                u32 lower = I915_READ(lower_reg);                       \
+                u32 tmp = I915_READ(upper_reg);                         \
+                if (upper != tmp) {                                     \
+                        upper = tmp;                                    \
+                        lower = I915_READ(lower_reg);                   \
+                        WARN_ON(I915_READ(upper_reg) != upper);         \
+                }                                                       \
+                (u64)upper << 32 | lower; })
 #define POSTING_READ(reg)       (void)I915_READ_NOTRACE(reg)
 #define POSTING_READ16(reg)     (void)I915_READ16_NOTRACE(reg)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 404a5456bf3a..6370a761d137 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -615,7 +615,7 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev,
                         struct drm_i915_gem_pwrite *args,
                         struct drm_file *file)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        ssize_t remain;
        loff_t offset, page_base;
        char __user *user_data;
@@ -1027,7 +1027,7 @@ static int __wait_seqno(struct intel_ring_buffer *ring, u32 seqno,
                        struct drm_i915_file_private *file_priv)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        const bool irq_test_in_progress =
                ACCESS_ONCE(dev_priv->gpu_error.test_irq_rings) & intel_ring_flag(ring);
        struct timespec before, now;
@@ -1389,7 +1389,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
        struct drm_i915_gem_object *obj = to_intel_bo(vma->vm_private_data);
        struct drm_device *dev = obj->base.dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        pgoff_t page_offset;
        unsigned long pfn;
        int ret = 0;
@@ -2164,7 +2164,7 @@ int __i915_add_request(struct intel_ring_buffer *ring,
                       struct drm_i915_gem_object *obj,
                       u32 *out_seqno)
 {
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
        struct drm_i915_gem_request *request;
        u32 request_ring_position, request_start;
        int ret;
@@ -2496,7 +2496,7 @@ i915_gem_retire_requests_ring(struct intel_ring_buffer *ring)
 bool
 i915_gem_retire_requests(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        bool idle = true;
        int i;
@@ -2588,7 +2588,7 @@ i915_gem_object_flush_active(struct drm_i915_gem_object *obj)
 int
 i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_wait *args = data;
        struct drm_i915_gem_object *obj;
        struct intel_ring_buffer *ring = NULL;
@@ -2723,7 +2723,7 @@ static void i915_gem_object_finish_gtt(struct drm_i915_gem_object *obj)
 int i915_vma_unbind(struct i915_vma *vma)
 {
        struct drm_i915_gem_object *obj = vma->obj;
-        drm_i915_private_t *dev_priv = obj->base.dev->dev_private;
+        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
        int ret;
        if (list_empty(&vma->vma_link))
@@ -2784,7 +2784,7 @@ int i915_vma_unbind(struct i915_vma *vma)
 int i915_gpu_idle(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        int ret, i;
@@ -2805,7 +2805,7 @@ int i915_gpu_idle(struct drm_device *dev)
 static void i965_write_fence_reg(struct drm_device *dev, int reg,
                                 struct drm_i915_gem_object *obj)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int fence_reg;
        int fence_pitch_shift;
@@ -2857,7 +2857,7 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
 static void i915_write_fence_reg(struct drm_device *dev, int reg,
                                 struct drm_i915_gem_object *obj)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 val;
        if (obj) {
@@ -2901,7 +2901,7 @@ static void i915_write_fence_reg(struct drm_device *dev, int reg,
 static void i830_write_fence_reg(struct drm_device *dev, int reg,
                                struct drm_i915_gem_object *obj)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        uint32_t val;
        if (obj) {
@@ -3211,7 +3211,7 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
                           unsigned flags)
 {
        struct drm_device *dev = obj->base.dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 size, fence_size, fence_alignment, unfenced_alignment;
        size_t gtt_max =
                flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
@@ -3410,7 +3410,7 @@ i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj,
 int
 i915_gem_object_set_to_gtt_domain(struct drm_i915_gem_object *obj, bool write)
 {
-        drm_i915_private_t *dev_priv = obj->base.dev->dev_private;
+        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
        uint32_t old_write_domain, old_read_domains;
        int ret;
@@ -4156,7 +4156,7 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
 {
        struct drm_i915_gem_object *obj = to_intel_bo(gem_obj);
        struct drm_device *dev = obj->base.dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct i915_vma *vma, *next;
        intel_runtime_pm_get(dev_priv);
@@ -4235,7 +4235,7 @@ void i915_gem_vma_destroy(struct i915_vma *vma)
 int
 i915_gem_suspend(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret = 0;
        mutex_lock(&dev->struct_mutex);
@@ -4277,7 +4277,7 @@ err:
 int i915_gem_l3_remap(struct intel_ring_buffer *ring, int slice)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 reg_base = GEN7_L3LOG_BASE + (slice * 0x200);
        u32 *remap_info = dev_priv->l3_parity.remap_info[slice];
        int i, ret;
@@ -4307,7 +4307,7 @@ int i915_gem_l3_remap(struct intel_ring_buffer *ring, int slice)
 void i915_gem_init_swizzling(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        if (INTEL_INFO(dev)->gen < 5 ||
            dev_priv->mm.bit_6_swizzle_x == I915_BIT_6_SWIZZLE_NONE)
@@ -4395,7 +4395,7 @@ cleanup_render_ring:
 int
 i915_gem_init_hw(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret, i;
        if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
@@ -4489,7 +4489,7 @@ int i915_gem_init(struct drm_device *dev)
 void
 i915_gem_cleanup_ringbuffer(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        int i;
@@ -4586,7 +4586,7 @@ void i915_init_vm(struct drm_i915_private *dev_priv,
 void
 i915_gem_load(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int i;
        dev_priv->slab =
@@ -4653,7 +4653,7 @@ i915_gem_load(struct drm_device *dev)
 static int i915_gem_init_phys_object(struct drm_device *dev,
                                     int id, int size, int align)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_phys_object *phys_obj;
        int ret;
@@ -4685,7 +4685,7 @@ kfree_obj:
 static void i915_gem_free_phys_object(struct drm_device *dev, int id)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_phys_object *phys_obj;
        if (!dev_priv->mm.phys_objs[id - 1])
@@ -4752,7 +4752,7 @@ i915_gem_attach_phys_object(struct drm_device *dev,
                            int align)
 {
        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret = 0;
        int page_count;
        int i;
diff --git a/drivers/gpu/drm/i915/i915_gem_debug.c b/drivers/gpu/drm/i915/i915_gem_debug.c
index 775d506b3208..f462d1b51d97 100644
--- a/drivers/gpu/drm/i915/i915_gem_debug.c
+++ b/drivers/gpu/drm/i915/i915_gem_debug.c
@@ -34,7 +34,7 @@ int
 i915_verify_lists(struct drm_device *dev)
 {
        static int warned;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj;
        int err = 0;
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 8a78f7885cba..75fca63dc8c1 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -70,7 +70,7 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
                         int min_size, unsigned alignment, unsigned cache_level,
                         unsigned flags)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct list_head eviction_list, unwind_list;
        struct i915_vma *vma;
        int ret = 0;
@@ -243,7 +243,7 @@ int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle)
 int
 i915_gem_evict_everything(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct i915_address_space *vm;
        bool lists_empty = true;
        int ret;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 3851a1b1dc88..7447160155a3 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -978,7 +978,7 @@ static int
 i915_reset_gen7_sol_offsets(struct drm_device *dev,
                            struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret, i;
        if (!IS_GEN7(dev) || ring != &dev_priv->ring[RCS])
@@ -1005,7 +1005,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                       struct drm_i915_gem_execbuffer2 *args,
                       struct drm_i915_gem_exec_object2 *exec)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct eb_vmas *eb;
        struct drm_i915_gem_object *batch_obj;
        struct drm_clip_rect *cliprects = NULL;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2b3c79923d90..ab5e93c30aa2 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -888,7 +888,7 @@ err_out:
 static int gen7_ppgtt_enable(struct i915_hw_ppgtt *ppgtt)
 {
        struct drm_device *dev = ppgtt->base.dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        uint32_t ecochk, ecobits;
        int i;
@@ -927,7 +927,7 @@ static int gen7_ppgtt_enable(struct i915_hw_ppgtt *ppgtt)
 static int gen6_ppgtt_enable(struct i915_hw_ppgtt *ppgtt)
 {
        struct drm_device *dev = ppgtt->base.dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        uint32_t ecochk, gab_ctl, ecobits;
        int i;
@@ -1340,7 +1340,7 @@ void i915_gem_suspend_gtt_mappings(struct drm_device *dev)
        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
                                       dev_priv->gtt.base.start,
                                       dev_priv->gtt.base.total,
-                                       false);
+                                       true);
 }
 void i915_gem_restore_gtt_mappings(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index d58b4e287e32..62ef55ba061c 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -214,6 +214,13 @@ int i915_gem_init_stolen(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        int bios_reserved = 0;
+#ifdef CONFIG_INTEL_IOMMU
+        if (intel_iommu_gfx_mapped && INTEL_INFO(dev)->gen < 8) {
+                DRM_INFO("DMAR active, disabling use of stolen memory\n");
+                return 0;
+        }
+#endif
        if (dev_priv->gtt.stolen_size == 0)
                return 0;
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index eb993584aa6b..cb150e8b4336 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -87,7 +87,7 @@
 void
 i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        uint32_t swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
        uint32_t swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
@@ -294,7 +294,7 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                   struct drm_file *file)
 {
        struct drm_i915_gem_set_tiling *args = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj;
        int ret = 0;
@@ -415,7 +415,7 @@ i915_gem_get_tiling(struct drm_device *dev, void *data,
                   struct drm_file *file)
 {
        struct drm_i915_gem_get_tiling *args = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj;
        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index baf1ca690dc5..12f1d43b2d68 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -247,12 +247,12 @@ static void i915_ring_error_state(struct drm_i915_error_state_buf *m,
        err_printf(m, "  TAIL: 0x%08x\n", ring->tail);
        err_printf(m, "  CTL: 0x%08x\n", ring->ctl);
        err_printf(m, "  HWS: 0x%08x\n", ring->hws);
-        err_printf(m, "  ACTHD: 0x%08x\n", ring->acthd);
+        err_printf(m, "  ACTHD: 0x%08x %08x\n", (u32)(ring->acthd>>32), (u32)ring->acthd);
        err_printf(m, "  IPEIR: 0x%08x\n", ring->ipeir);
        err_printf(m, "  IPEHR: 0x%08x\n", ring->ipehr);
        err_printf(m, "  INSTDONE: 0x%08x\n", ring->instdone);
        if (INTEL_INFO(dev)->gen >= 4) {
-                err_printf(m, "  BBADDR: 0x%08llx\n", ring->bbaddr);
+                err_printf(m, "  BBADDR: 0x%08x %08x\n", (u32)(ring->bbaddr>>32), (u32)ring->bbaddr);
                err_printf(m, "  BB_STATE: 0x%08x\n", ring->bbstate);
                err_printf(m, "  INSTPS: 0x%08x\n", ring->instps);
        }
@@ -322,7 +322,7 @@ int i915_error_state_to_str(struct drm_i915_error_state_buf *m,
                            const struct i915_error_state_file_priv *error_priv)
 {
        struct drm_device *dev = error_priv->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_error_state *error = error_priv->error;
        int i, j, offset, elt;
        int max_hangcheck_score;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index acebe511e4ef..7753249b3a95 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -82,7 +82,7 @@ static const u32 hpd_status_i915[] = { /* i915 and valleyview are the same */
 /* For display hotplug interrupt */
 static void
-ironlake_enable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
+ironlake_enable_display_irq(struct drm_i915_private *dev_priv, u32 mask)
 {
        assert_spin_locked(&dev_priv->irq_lock);
@@ -100,7 +100,7 @@ ironlake_enable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
 }
 static void
-ironlake_disable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
+ironlake_disable_display_irq(struct drm_i915_private *dev_priv, u32 mask)
 {
        assert_spin_locked(&dev_priv->irq_lock);
@@ -596,7 +596,7 @@ i915_disable_pipestat(struct drm_i915_private *dev_priv, enum pipe pipe,
 */
 static void i915_enable_asle_pipestat(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        if (!dev_priv->opregion.asle || !IS_MOBILE(dev))
@@ -624,7 +624,7 @@ static void i915_enable_asle_pipestat(struct drm_device *dev)
 static int
 i915_pipe_enabled(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
                /* Locking is horribly broken here, but whatever. */
@@ -648,7 +648,7 @@ static u32 i8xx_get_vblank_counter(struct drm_device *dev, int pipe)
 */
 static u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long high_frame;
        unsigned long low_frame;
        u32 high1, high2, low, pixel, vbl_start;
@@ -704,7 +704,7 @@ static u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
 static u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int reg = PIPE_FRMCOUNT_GM45(pipe);
        if (!i915_pipe_enabled(dev, pipe)) {
@@ -718,33 +718,25 @@ static u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
 /* raw reads, only for fast reads of display block, no need for forcewake etc. */
 #define __raw_i915_read32(dev_priv__, reg__) readl((dev_priv__)->regs + (reg__))
-#define __raw_i915_read16(dev_priv__, reg__) readw((dev_priv__)->regs + (reg__))
 static bool ilk_pipe_in_vblank_locked(struct drm_device *dev, enum pipe pipe)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        uint32_t status;
+        int reg;
-        if (INTEL_INFO(dev)->gen < 7) {
-                status = pipe == PIPE_A ?
+        if (INTEL_INFO(dev)->gen >= 8) {
-                        DE_PIPEA_VBLANK :
+                status = GEN8_PIPE_VBLANK;
-                        DE_PIPEB_VBLANK;
+                reg = GEN8_DE_PIPE_ISR(pipe);
+        } else if (INTEL_INFO(dev)->gen >= 7) {
+                status = DE_PIPE_VBLANK_IVB(pipe);
+                reg = DEISR;
        } else {
-                switch (pipe) {
+                status = DE_PIPE_VBLANK(pipe);
-                default:
+                reg = DEISR;
-                case PIPE_A:
-                        status = DE_PIPEA_VBLANK_IVB;
-                        break;
-                case PIPE_B:
-                        status = DE_PIPEB_VBLANK_IVB;
-                        break;
-                case PIPE_C:
-                        status = DE_PIPEC_VBLANK_IVB;
-                        break;
-                }
        }
-        return __raw_i915_read32(dev_priv, DEISR) & status;
+        return __raw_i915_read32(dev_priv, reg) & status;
 }
 static int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
@@ -802,7 +794,28 @@ static int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
                else
                        position = __raw_i915_read32(dev_priv, PIPEDSL(pipe)) & DSL_LINEMASK_GEN3;
-                if (HAS_PCH_SPLIT(dev)) {
+                if (HAS_DDI(dev)) {
+                        /*
+                         * On HSW HDMI outputs there seems to be a 2 line
+                         * difference, whereas eDP has the normal 1 line
+                         * difference that earlier platforms have. External
+                         * DP is unknown. For now just check for the 2 line
+                         * difference case on all output types on HSW+.
+                         *
+                         * This might misinterpret the scanline counter being
+                         * one line too far along on eDP, but that's less
+                         * dangerous than the alternative since that would lead
+                         * the vblank timestamp code astray when it sees a
+                         * scanline count before vblank_start during a vblank
+                         * interrupt.
+                         */
+                        in_vbl = ilk_pipe_in_vblank_locked(dev, pipe);
+                        if ((in_vbl && (position == vbl_start - 2 ||
+                                        position == vbl_start - 1)) ||
+                            (!in_vbl && (position == vbl_end - 2 ||
+                                         position == vbl_end - 1)))
+                                position = (position + 2) % vtotal;
+                } else if (HAS_PCH_SPLIT(dev)) {
                        /*
                         * The scanline counter increments at the leading edge
                         * of hsync, ie. it completely misses the active portion
@@ -946,8 +959,8 @@ static bool intel_hpd_irq_event(struct drm_device *dev,
 static void i915_hotplug_work_func(struct work_struct *work)
 {
-        drm_i915_private_t *dev_priv = container_of(work, drm_i915_private_t,
+        struct drm_i915_private *dev_priv =
-                                                    hotplug_work);
+                container_of(work, struct drm_i915_private, hotplug_work);
        struct drm_device *dev = dev_priv->dev;
        struct drm_mode_config *mode_config = &dev->mode_config;
        struct intel_connector *intel_connector;
@@ -1022,7 +1035,7 @@ static void intel_hpd_irq_uninstall(struct drm_i915_private *dev_priv)
 static void ironlake_rps_change_irq_handler(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 busy_up, busy_down, max_avg, min_avg;
        u8 new_delay;
@@ -1071,47 +1084,10 @@ static void notify_ring(struct drm_device *dev,
        i915_queue_hangcheck(dev);
 }
-void gen6_set_pm_mask(struct drm_i915_private *dev_priv,
-                             u32 pm_iir, int new_delay)
-{
-        if (pm_iir & GEN6_PM_RP_UP_THRESHOLD) {
-                if (new_delay >= dev_priv->rps.max_freq_softlimit) {
-                        /* Mask UP THRESHOLD Interrupts */
-                        I915_WRITE(GEN6_PMINTRMSK,
-                                   I915_READ(GEN6_PMINTRMSK) |
-                                   GEN6_PM_RP_UP_THRESHOLD);
-                        dev_priv->rps.rp_up_masked = true;
-                }
-                if (dev_priv->rps.rp_down_masked) {
-                        /* UnMask DOWN THRESHOLD Interrupts */
-                        I915_WRITE(GEN6_PMINTRMSK,
-                                   I915_READ(GEN6_PMINTRMSK) &
-                                   ~GEN6_PM_RP_DOWN_THRESHOLD);
-                        dev_priv->rps.rp_down_masked = false;
-                }
-        } else if (pm_iir & GEN6_PM_RP_DOWN_THRESHOLD) {
-                if (new_delay <= dev_priv->rps.min_freq_softlimit) {
-                        /* Mask DOWN THRESHOLD Interrupts */
-                        I915_WRITE(GEN6_PMINTRMSK,
-                                   I915_READ(GEN6_PMINTRMSK) |
-                                   GEN6_PM_RP_DOWN_THRESHOLD);
-                        dev_priv->rps.rp_down_masked = true;
-                }
-                if (dev_priv->rps.rp_up_masked) {
-                        /* UnMask UP THRESHOLD Interrupts */
-                        I915_WRITE(GEN6_PMINTRMSK,
-                                   I915_READ(GEN6_PMINTRMSK) &
-                                   ~GEN6_PM_RP_UP_THRESHOLD);
-                        dev_priv->rps.rp_up_masked = false;
-                }
-        }
-}
 static void gen6_pm_rps_work(struct work_struct *work)
 {
-        drm_i915_private_t *dev_priv = container_of(work, drm_i915_private_t,
+        struct drm_i915_private *dev_priv =
-                                                    rps.work);
+                container_of(work, struct drm_i915_private, rps.work);
        u32 pm_iir;
        int new_delay, adj;
@@ -1119,13 +1095,13 @@ static void gen6_pm_rps_work(struct work_struct *work)
        pm_iir = dev_priv->rps.pm_iir;
        dev_priv->rps.pm_iir = 0;
        /* Make sure not to corrupt PMIMR state used by ringbuffer code */
-        snb_enable_pm_irq(dev_priv, GEN6_PM_RPS_EVENTS);
+        snb_enable_pm_irq(dev_priv, dev_priv->pm_rps_events);
        spin_unlock_irq(&dev_priv->irq_lock);
        /* Make sure we didn't queue anything we're not going to process. */
-        WARN_ON(pm_iir & ~GEN6_PM_RPS_EVENTS);
+        WARN_ON(pm_iir & ~dev_priv->pm_rps_events);
-        if ((pm_iir & GEN6_PM_RPS_EVENTS) == 0)
+        if ((pm_iir & dev_priv->pm_rps_events) == 0)
                return;
        mutex_lock(&dev_priv->rps.hw_lock);
@@ -1167,7 +1143,6 @@ static void gen6_pm_rps_work(struct work_struct *work)
                            dev_priv->rps.min_freq_softlimit,
                            dev_priv->rps.max_freq_softlimit);
-        gen6_set_pm_mask(dev_priv, pm_iir, new_delay);
        dev_priv->rps.last_adj = new_delay - dev_priv->rps.cur_freq;
        if (IS_VALLEYVIEW(dev_priv->dev))
@@ -1190,8 +1165,8 @@ static void gen6_pm_rps_work(struct work_struct *work)
 */
 static void ivybridge_parity_work(struct work_struct *work)
 {
-        drm_i915_private_t *dev_priv = container_of(work, drm_i915_private_t,
+        struct drm_i915_private *dev_priv =
-                                                    l3_parity.error_work);
+                container_of(work, struct drm_i915_private, l3_parity.error_work);
        u32 error_status, row, bank, subbank;
        char *parity_event[6];
        uint32_t misccpctl;
@@ -1263,7 +1238,7 @@ out:
 static void ivybridge_parity_error_irq_handler(struct drm_device *dev, u32 iir)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        if (!HAS_L3_DPF(dev))
                return;
@@ -1374,7 +1349,7 @@ static inline void intel_hpd_irq_handler(struct drm_device *dev,
                                         u32 hotplug_trigger,
                                         const u32 *hpd)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int i;
        bool storm_detected = false;
@@ -1430,14 +1405,14 @@ static inline void intel_hpd_irq_handler(struct drm_device *dev,
 static void gmbus_irq_handler(struct drm_device *dev)
 {
-        struct drm_i915_private *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        wake_up_all(&dev_priv->gmbus_wait_queue);
 }
 static void dp_aux_irq_handler(struct drm_device *dev)
 {
-        struct drm_i915_private *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        wake_up_all(&dev_priv->gmbus_wait_queue);
 }
@@ -1543,10 +1518,10 @@ static void i9xx_pipe_crc_irq_handler(struct drm_device *dev, enum pipe pipe)
 * the work queue. */
 static void gen6_rps_irq_handler(struct drm_i915_private *dev_priv, u32 pm_iir)
 {
-        if (pm_iir & GEN6_PM_RPS_EVENTS) {
+        if (pm_iir & dev_priv->pm_rps_events) {
                spin_lock(&dev_priv->irq_lock);
-                dev_priv->rps.pm_iir |= pm_iir & GEN6_PM_RPS_EVENTS;
+                dev_priv->rps.pm_iir |= pm_iir & dev_priv->pm_rps_events;
-                snb_disable_pm_irq(dev_priv, pm_iir & GEN6_PM_RPS_EVENTS);
+                snb_disable_pm_irq(dev_priv, pm_iir & dev_priv->pm_rps_events);
                spin_unlock(&dev_priv->irq_lock);
                queue_work(dev_priv->wq, &dev_priv->rps.work);
@@ -1637,7 +1612,7 @@ static void valleyview_pipestat_irq_handler(struct drm_device *dev, u32 iir)
 static irqreturn_t valleyview_irq_handler(int irq, void *arg)
 {
        struct drm_device *dev = (struct drm_device *) arg;
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 iir, gt_iir, pm_iir;
        irqreturn_t ret = IRQ_NONE;
@@ -1684,7 +1659,7 @@ out:
 static void ibx_irq_handler(struct drm_device *dev, u32 pch_iir)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        u32 hotplug_trigger = pch_iir & SDE_HOTPLUG_MASK;
@@ -1791,7 +1766,7 @@ static void cpt_serr_int_handler(struct drm_device *dev)
 static void cpt_irq_handler(struct drm_device *dev, u32 pch_iir)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        u32 hotplug_trigger = pch_iir & SDE_HOTPLUG_MASK_CPT;
@@ -1915,7 +1890,7 @@ static void ivb_display_irq_handler(struct drm_device *dev, u32 de_iir)
 static irqreturn_t ironlake_irq_handler(int irq, void *arg)
 {
        struct drm_device *dev = (struct drm_device *) arg;
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 de_iir, gt_iir, de_ier, sde_ier = 0;
        irqreturn_t ret = IRQ_NONE;
@@ -2126,8 +2101,8 @@ static void i915_error_work_func(struct work_struct *work)
 {
        struct i915_gpu_error *error = container_of(work, struct i915_gpu_error,
                                                    work);
-        drm_i915_private_t *dev_priv = container_of(error, drm_i915_private_t,
+        struct drm_i915_private *dev_priv =
-                                                    gpu_error);
+                container_of(error, struct drm_i915_private, gpu_error);
        struct drm_device *dev = dev_priv->dev;
        char *error_event[] = { I915_ERROR_UEVENT "=1", NULL };
        char *reset_event[] = { I915_RESET_UEVENT "=1", NULL };
@@ -2336,7 +2311,7 @@ void i915_handle_error(struct drm_device *dev, bool wedged,
 static void __always_unused i915_pageflip_stall_check(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct drm_i915_gem_object *obj;
@@ -2385,7 +2360,7 @@ static void __always_unused i915_pageflip_stall_check(struct drm_device *dev, in
 */
 static int i915_enable_vblank(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        if (!i915_pipe_enabled(dev, pipe))
@@ -2409,7 +2384,7 @@ static int i915_enable_vblank(struct drm_device *dev, int pipe)
 static int ironlake_enable_vblank(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        uint32_t bit = (INTEL_INFO(dev)->gen >= 7) ? DE_PIPE_VBLANK_IVB(pipe) :
                                                     DE_PIPE_VBLANK(pipe);
@@ -2426,7 +2401,7 @@ static int ironlake_enable_vblank(struct drm_device *dev, int pipe)
 static int valleyview_enable_vblank(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        if (!i915_pipe_enabled(dev, pipe))
@@ -2461,7 +2436,7 @@ static int gen8_enable_vblank(struct drm_device *dev, int pipe)
 */
 static void i915_disable_vblank(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
@@ -2476,7 +2451,7 @@ static void i915_disable_vblank(struct drm_device *dev, int pipe)
 static void ironlake_disable_vblank(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        uint32_t bit = (INTEL_INFO(dev)->gen >= 7) ? DE_PIPE_VBLANK_IVB(pipe) :
                                                     DE_PIPE_VBLANK(pipe);
@@ -2488,7 +2463,7 @@ static void ironlake_disable_vblank(struct drm_device *dev, int pipe)
 static void valleyview_disable_vblank(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
@@ -2530,29 +2505,43 @@ static struct intel_ring_buffer *
 semaphore_waits_for(struct intel_ring_buffer *ring, u32 *seqno)
 {
        struct drm_i915_private *dev_priv = ring->dev->dev_private;
-        u32 cmd, ipehr, acthd, acthd_min;
+        u32 cmd, ipehr, head;
+        int i;
        ipehr = I915_READ(RING_IPEHR(ring->mmio_base));
        if ((ipehr & ~(0x3 << 16)) !=
            (MI_SEMAPHORE_MBOX | MI_SEMAPHORE_COMPARE | MI_SEMAPHORE_REGISTER))
                return NULL;
-        /* ACTHD is likely pointing to the dword after the actual command,
+        /*
-         * so scan backwards until we find the MBOX.
+         * HEAD is likely pointing to the dword after the actual command,
+         * so scan backwards until we find the MBOX. But limit it to just 3
+         * dwords. Note that we don't care about ACTHD here since that might
+         * point at at batch, and semaphores are always emitted into the
+         * ringbuffer itself.
         */
-        acthd = intel_ring_get_active_head(ring) & HEAD_ADDR;
+        head = I915_READ_HEAD(ring) & HEAD_ADDR;
-        acthd_min = max((int)acthd - 3 * 4, 0);
-        do {
+        for (i = 4; i; --i) {
-                cmd = ioread32(ring->virtual_start + acthd);
+                /*
+                 * Be paranoid and presume the hw has gone off into the wild -
+                 * our ring is smaller than what the hardware (and hence
+                 * HEAD_ADDR) allows. Also handles wrap-around.
+                 */
+                head &= ring->size - 1;
+                /* This here seems to blow up */
+                cmd = ioread32(ring->virtual_start + head);
                if (cmd == ipehr)
                        break;
-                acthd -= 4;
+                head -= 4;
-                if (acthd < acthd_min)
+        }
-                        return NULL;
-        } while (1);
-        *seqno = ioread32(ring->virtual_start+acthd+4)+1;
+        if (!i)
+                return NULL;
+        *seqno = ioread32(ring->virtual_start + head + 4) + 1;
        return &dev_priv->ring[(ring->id + (((ipehr >> 17) & 1) + 1)) % 3];
 }
@@ -2586,7 +2575,7 @@ static void semaphore_clear_deadlocks(struct drm_i915_private *dev_priv)
 }
 static enum intel_ring_hangcheck_action
-ring_stuck(struct intel_ring_buffer *ring, u32 acthd)
+ring_stuck(struct intel_ring_buffer *ring, u64 acthd)
 {
        struct drm_device *dev = ring->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -2641,7 +2630,7 @@ ring_stuck(struct intel_ring_buffer *ring, u32 acthd)
 static void i915_hangcheck_elapsed(unsigned long data)
 {
        struct drm_device *dev = (struct drm_device *)data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring;
        int i;
        int busy_count = 0, rings_hung = 0;
@@ -2654,7 +2643,8 @@ static void i915_hangcheck_elapsed(unsigned long data)
                return;
        for_each_ring(ring, dev_priv, i) {
-                u32 seqno, acthd;
+                u64 acthd;
+                u32 seqno;
                bool busy = true;
                semaphore_clear_deadlocks(dev_priv);
@@ -2799,7 +2789,7 @@ static void gen5_gt_irq_preinstall(struct drm_device *dev)
 */
 static void ironlake_irq_preinstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        I915_WRITE(HWSTAM, 0xeffe);
@@ -2814,7 +2804,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
 static void valleyview_irq_preinstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        /* VLV magic */
@@ -2890,7 +2880,7 @@ static void gen8_irq_preinstall(struct drm_device *dev)
 static void ibx_hpd_irq_setup(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_mode_config *mode_config = &dev->mode_config;
        struct intel_encoder *intel_encoder;
        u32 hotplug_irqs, hotplug, enabled_irqs = 0;
@@ -2925,17 +2915,16 @@ static void ibx_hpd_irq_setup(struct drm_device *dev)
 static void ibx_irq_postinstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 mask;
        if (HAS_PCH_NOP(dev))
                return;
        if (HAS_PCH_IBX(dev)) {
-                mask = SDE_GMBUS | SDE_AUX_MASK | SDE_TRANSB_FIFO_UNDER |
+                mask = SDE_GMBUS | SDE_AUX_MASK | SDE_POISON;
-                       SDE_TRANSA_FIFO_UNDER | SDE_POISON;
        } else {
-                mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT | SDE_ERROR_CPT;
+                mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT;
                I915_WRITE(SERR_INT, I915_READ(SERR_INT));
        }
@@ -2972,7 +2961,7 @@ static void gen5_gt_irq_postinstall(struct drm_device *dev)
        POSTING_READ(GTIER);
        if (INTEL_INFO(dev)->gen >= 6) {
-                pm_irqs |= GEN6_PM_RPS_EVENTS;
+                pm_irqs |= dev_priv->pm_rps_events;
                if (HAS_VEBOX(dev))
                        pm_irqs |= PM_VEBOX_USER_INTERRUPT;
@@ -2988,27 +2977,26 @@ static void gen5_gt_irq_postinstall(struct drm_device *dev)
 static int ironlake_irq_postinstall(struct drm_device *dev)
 {
        unsigned long irqflags;
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 display_mask, extra_mask;
        if (INTEL_INFO(dev)->gen >= 7) {
                display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE_IVB |
                                DE_PCH_EVENT_IVB | DE_PLANEC_FLIP_DONE_IVB |
                                DE_PLANEB_FLIP_DONE_IVB |
-                                DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB |
+                                DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB);
-                                DE_ERR_INT_IVB);
                extra_mask = (DE_PIPEC_VBLANK_IVB | DE_PIPEB_VBLANK_IVB |
-                              DE_PIPEA_VBLANK_IVB);
+                              DE_PIPEA_VBLANK_IVB | DE_ERR_INT_IVB);
                I915_WRITE(GEN7_ERR_INT, I915_READ(GEN7_ERR_INT));
        } else {
                display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
                                DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE |
                                DE_AUX_CHANNEL_A |
-                                DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN |
                                DE_PIPEB_CRC_DONE | DE_PIPEA_CRC_DONE |
                                DE_POISON);
-                extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT;
+                extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT |
+                                DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN;
        }
        dev_priv->irq_mask = ~display_mask;
@@ -3126,7 +3114,7 @@ void valleyview_disable_display_irqs(struct drm_i915_private *dev_priv)
 static int valleyview_irq_postinstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        dev_priv->irq_mask = ~0;
@@ -3193,9 +3181,9 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv)
        struct drm_device *dev = dev_priv->dev;
        uint32_t de_pipe_masked = GEN8_PIPE_FLIP_DONE |
                GEN8_PIPE_CDCLK_CRC_DONE |
-                GEN8_PIPE_FIFO_UNDERRUN |
                GEN8_DE_PIPE_IRQ_FAULT_ERRORS;
-        uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK;
+        uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK |
+                GEN8_PIPE_FIFO_UNDERRUN;
        int pipe;
        dev_priv->de_irq_mask[PIPE_A] = ~de_pipe_masked;
        dev_priv->de_irq_mask[PIPE_B] = ~de_pipe_masked;
@@ -3273,7 +3261,7 @@ static void gen8_irq_uninstall(struct drm_device *dev)
 static void valleyview_irq_uninstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        int pipe;
@@ -3304,7 +3292,7 @@ static void valleyview_irq_uninstall(struct drm_device *dev)
 static void ironlake_irq_uninstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        if (!dev_priv)
                return;
@@ -3335,7 +3323,7 @@ static void ironlake_irq_uninstall(struct drm_device *dev)
 static void i8xx_irq_preinstall(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        for_each_pipe(pipe)
@@ -3347,7 +3335,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev)
 static int i8xx_irq_postinstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
        I915_WRITE16(EMR,
@@ -3385,7 +3373,7 @@ static int i8xx_irq_postinstall(struct drm_device *dev)
 static bool i8xx_handle_vblank(struct drm_device *dev,
                               int plane, int pipe, u32 iir)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u16 flip_pending = DISPLAY_PLANE_FLIP_PENDING(plane);
        if (!drm_handle_vblank(dev, pipe))
@@ -3413,7 +3401,7 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
 static irqreturn_t i8xx_irq_handler(int irq, void *arg)
 {
        struct drm_device *dev = (struct drm_device *) arg;
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u16 iir, new_iir;
        u32 pipe_stats[2];
        unsigned long irqflags;
@@ -3483,7 +3471,7 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
 static void i8xx_irq_uninstall(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        for_each_pipe(pipe) {
@@ -3498,7 +3486,7 @@ static void i8xx_irq_uninstall(struct drm_device * dev)
 static void i915_irq_preinstall(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        if (I915_HAS_HOTPLUG(dev)) {
@@ -3516,7 +3504,7 @@ static void i915_irq_preinstall(struct drm_device * dev)
 static int i915_irq_postinstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 enable_mask;
        unsigned long irqflags;
@@ -3570,7 +3558,7 @@ static int i915_irq_postinstall(struct drm_device *dev)
 static bool i915_handle_vblank(struct drm_device *dev,
                               int plane, int pipe, u32 iir)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 flip_pending = DISPLAY_PLANE_FLIP_PENDING(plane);
        if (!drm_handle_vblank(dev, pipe))
@@ -3598,7 +3586,7 @@ static bool i915_handle_vblank(struct drm_device *dev,
 static irqreturn_t i915_irq_handler(int irq, void *arg)
 {
        struct drm_device *dev = (struct drm_device *) arg;
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 iir, new_iir, pipe_stats[I915_MAX_PIPES];
        unsigned long irqflags;
        u32 flip_mask =
@@ -3704,7 +3692,7 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
 static void i915_irq_uninstall(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        intel_hpd_irq_uninstall(dev_priv);
@@ -3728,7 +3716,7 @@ static void i915_irq_uninstall(struct drm_device * dev)
 static void i965_irq_preinstall(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        I915_WRITE(PORT_HOTPLUG_EN, 0);
@@ -3744,7 +3732,7 @@ static void i965_irq_preinstall(struct drm_device * dev)
 static int i965_irq_postinstall(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 enable_mask;
        u32 error_mask;
        unsigned long irqflags;
@@ -3803,7 +3791,7 @@ static int i965_irq_postinstall(struct drm_device *dev)
 static void i915_hpd_irq_setup(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_mode_config *mode_config = &dev->mode_config;
        struct intel_encoder *intel_encoder;
        u32 hotplug_en;
@@ -3835,7 +3823,7 @@ static void i915_hpd_irq_setup(struct drm_device *dev)
 static irqreturn_t i965_irq_handler(int irq, void *arg)
 {
        struct drm_device *dev = (struct drm_device *) arg;
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 iir, new_iir;
        u32 pipe_stats[I915_MAX_PIPES];
        unsigned long irqflags;
@@ -3953,7 +3941,7 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
 static void i965_irq_uninstall(struct drm_device * dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe;
        if (!dev_priv)
@@ -3978,7 +3966,7 @@ static void i965_irq_uninstall(struct drm_device * dev)
 static void intel_hpd_irq_reenable(unsigned long data)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *)data;
+        struct drm_i915_private *dev_priv = (struct drm_i915_private *)data;
        struct drm_device *dev = dev_priv->dev;
        struct drm_mode_config *mode_config = &dev->mode_config;
        unsigned long irqflags;
@@ -4020,6 +4008,9 @@ void intel_irq_init(struct drm_device *dev)
        INIT_WORK(&dev_priv->rps.work, gen6_pm_rps_work);
        INIT_WORK(&dev_priv->l3_parity.error_work, ivybridge_parity_work);
+        /* Let's track the enabled rps events */
+        dev_priv->pm_rps_events = GEN6_PM_RPS_EVENTS;
        setup_timer(&dev_priv->gpu_error.hangcheck_timer,
                    i915_hangcheck_elapsed,
                    (unsigned long) dev);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 74f7d853eb58..9f5b18d9d885 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -706,6 +706,7 @@ enum punit_power_well {
 #define BLT_HWS_PGA_GEN7        (0x04280)
 #define VEBOX_HWS_PGA_GEN7      (0x04380)
 #define RING_ACTHD(base)        ((base)+0x74)
+#define RING_ACTHD_UDW(base)    ((base)+0x5c)
 #define RING_NOPID(base)        ((base)+0x94)
 #define RING_IMR(base)          ((base)+0xa8)
 #define RING_TIMESTAMP(base)    ((base)+0x358)
@@ -973,7 +974,8 @@ enum punit_power_well {
 #define CACHE_MODE_0_GEN7       0x7000 /* IVB+ */
 #define   HIZ_RAW_STALL_OPT_DISABLE (1<<2)
 #define CACHE_MODE_1            0x7004 /* IVB+ */
-#define   PIXEL_SUBSPAN_COLLECT_OPT_DISABLE (1<<6)
+#define   PIXEL_SUBSPAN_COLLECT_OPT_DISABLE     (1<<6)
+#define   GEN8_4x4_STC_OPTIMIZATION_DISABLE     (1<<6)
 #define GEN6_BLITTER_ECOSKPD    0x221d0
 #define   GEN6_BLITTER_LOCK_SHIFT                       16
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 4b4e8f0f9621..aa5a3dc43342 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -804,6 +804,14 @@ static const struct dmi_system_id intel_no_crt[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "ZGB"),
                },
        },
+        {
+                .callback = intel_no_crt_dmi_callback,
+                .ident = "DELL XPS 8700",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS 8700"),
+                },
+        },
        { }
 };
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 070bf2e78d61..0ad4e9600063 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1108,8 +1108,13 @@ bool intel_ddi_connector_get_hw_state(struct intel_connector *intel_connector)
        enum port port = intel_ddi_get_encoder_port(intel_encoder);
        enum pipe pipe = 0;
        enum transcoder cpu_transcoder;
+        enum intel_display_power_domain power_domain;
        uint32_t tmp;
+        power_domain = intel_display_port_power_domain(intel_encoder);
+        if (!intel_display_power_enabled(dev_priv, power_domain))
+                return false;
        if (!intel_encoder->get_hw_state(intel_encoder, &pipe))
                return false;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 6332383abae9..dae976f51d83 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5375,21 +5375,26 @@ static void intel_set_pipe_timings(struct intel_crtc *intel_crtc)
        enum transcoder cpu_transcoder = intel_crtc->config.cpu_transcoder;
        struct drm_display_mode *adjusted_mode =
                &intel_crtc->config.adjusted_mode;
-        uint32_t vsyncshift, crtc_vtotal, crtc_vblank_end;
+        uint32_t crtc_vtotal, crtc_vblank_end;
+        int vsyncshift = 0;
        /* We need to be careful not to changed the adjusted mode, for otherwise
         * the hw state checker will get angry at the mismatch. */
        crtc_vtotal = adjusted_mode->crtc_vtotal;
        crtc_vblank_end = adjusted_mode->crtc_vblank_end;
-        if (!IS_GEN2(dev) && adjusted_mode->flags & DRM_MODE_FLAG_INTERLACE) {
+        if (adjusted_mode->flags & DRM_MODE_FLAG_INTERLACE) {
                /* the chip adds 2 halflines automatically */
                crtc_vtotal -= 1;
                crtc_vblank_end -= 1;
-                vsyncshift = adjusted_mode->crtc_hsync_start
-                             - adjusted_mode->crtc_htotal / 2;
+                if (intel_pipe_has_type(&intel_crtc->base, INTEL_OUTPUT_SDVO))
-        } else {
+                        vsyncshift = (adjusted_mode->crtc_htotal - 1) / 2;
-                vsyncshift = 0;
+                else
+                        vsyncshift = adjusted_mode->crtc_hsync_start -
+                                adjusted_mode->crtc_htotal / 2;
+                if (vsyncshift < 0)
+                        vsyncshift += adjusted_mode->crtc_htotal;
        }
        if (INTEL_INFO(dev)->gen > 3)
@@ -5539,10 +5544,13 @@ static void i9xx_set_pipeconf(struct intel_crtc *intel_crtc)
                }
        }
-        if (!IS_GEN2(dev) &&
+        if (intel_crtc->config.adjusted_mode.flags & DRM_MODE_FLAG_INTERLACE) {
-            intel_crtc->config.adjusted_mode.flags & DRM_MODE_FLAG_INTERLACE)
+                if (INTEL_INFO(dev)->gen < 4 ||
-                pipeconf |= PIPECONF_INTERLACE_W_FIELD_INDICATION;
+                    intel_pipe_has_type(&intel_crtc->base, INTEL_OUTPUT_SDVO))
-        else
+                        pipeconf |= PIPECONF_INTERLACE_W_FIELD_INDICATION;
+                else
+                        pipeconf |= PIPECONF_INTERLACE_W_SYNC_SHIFT;
+        } else
                pipeconf |= PIPECONF_PROGRESSIVE;
        if (IS_VALLEYVIEW(dev) && intel_crtc->config.limited_color_range)
@@ -7751,6 +7759,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct drm_i915_gem_object *obj;
+        unsigned old_width;
        uint32_t addr;
        int ret;
@@ -7841,13 +7850,18 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        mutex_unlock(&dev->struct_mutex);
+        old_width = intel_crtc->cursor_width;
        intel_crtc->cursor_addr = addr;
        intel_crtc->cursor_bo = obj;
        intel_crtc->cursor_width = width;
        intel_crtc->cursor_height = height;
-        if (intel_crtc->active)
+        if (intel_crtc->active) {
+                if (old_width != width)
+                        intel_update_watermarks(crtc);
                intel_crtc_update_cursor(crtc, intel_crtc->cursor_bo != NULL);
+        }
        return 0;
 fail_unpin:
@@ -8351,7 +8365,7 @@ struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
 static void intel_increase_pllclock(struct drm_crtc *crtc)
 {
        struct drm_device *dev = crtc->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        int pipe = intel_crtc->pipe;
        int dpll_reg = DPLL(pipe);
@@ -8382,7 +8396,7 @@ static void intel_increase_pllclock(struct drm_crtc *crtc)
 static void intel_decrease_pllclock(struct drm_crtc *crtc)
 {
        struct drm_device *dev = crtc->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        if (HAS_PCH_SPLIT(dev))
@@ -8523,7 +8537,7 @@ static void intel_unpin_work_fn(struct work_struct *__work)
 static void do_intel_finish_page_flip(struct drm_device *dev,
                                      struct drm_crtc *crtc)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct intel_unpin_work *work;
        unsigned long flags;
@@ -8564,7 +8578,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
 void intel_finish_page_flip(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
        do_intel_finish_page_flip(dev, crtc);
@@ -8572,7 +8586,7 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
 void intel_finish_page_flip_plane(struct drm_device *dev, int plane)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_crtc *crtc = dev_priv->plane_to_crtc_mapping[plane];
        do_intel_finish_page_flip(dev, crtc);
@@ -8580,7 +8594,7 @@ void intel_finish_page_flip_plane(struct drm_device *dev, int plane)
 void intel_prepare_page_flip(struct drm_device *dev, int plane)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc =
                to_intel_crtc(dev_priv->plane_to_crtc_mapping[plane]);
        unsigned long flags;
@@ -9755,7 +9769,7 @@ check_encoder_state(struct drm_device *dev)
 static void
 check_crtc_state(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *crtc;
        struct intel_encoder *encoder;
        struct intel_crtc_config pipe_config;
@@ -9823,7 +9837,7 @@ check_crtc_state(struct drm_device *dev)
 static void
 check_shared_dpll_state(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *crtc;
        struct intel_dpll_hw_state dpll_hw_state;
        int i;
@@ -9896,7 +9910,7 @@ static int __intel_set_mode(struct drm_crtc *crtc,
                            int x, int y, struct drm_framebuffer *fb)
 {
        struct drm_device *dev = crtc->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_display_mode *saved_mode;
        struct intel_crtc_config *pipe_config = NULL;
        struct intel_crtc *intel_crtc;
@@ -10543,7 +10557,7 @@ static void intel_shared_dpll_init(struct drm_device *dev)
 static void intel_crtc_init(struct drm_device *dev, int pipe)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc;
        int i;
@@ -11505,6 +11519,17 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                        encoder->base.crtc = NULL;
                }
        }
+        if (crtc->active) {
+                /*
+                 * We start out with underrun reporting disabled to avoid races.
+                 * For correct bookkeeping mark this on active crtcs.
+                 *
+                 * No protection against concurrent access is required - at
+                 * worst a fifo underrun happens which also sets this to false.
+                 */
+                crtc->cpu_fifo_underrun_disabled = true;
+                crtc->pch_fifo_underrun_disabled = true;
+        }
 }
 static void intel_sanitize_encoder(struct intel_encoder *encoder)
@@ -11740,6 +11765,10 @@ void intel_modeset_gem_init(struct drm_device *dev)
        struct drm_crtc *c;
        struct intel_framebuffer *fb;
+        mutex_lock(&dev->struct_mutex);
+        intel_init_gt_powersave(dev);
+        mutex_unlock(&dev->struct_mutex);
        intel_modeset_init_hw(dev);
        intel_setup_overlay(dev);
@@ -11826,6 +11855,10 @@ void intel_modeset_cleanup(struct drm_device *dev)
        drm_mode_config_cleanup(dev);
        intel_cleanup_overlay(dev);
+        mutex_lock(&dev->struct_mutex);
+        intel_cleanup_gt_powersave(dev);
+        mutex_unlock(&dev->struct_mutex);
 }
 /*
@@ -11920,7 +11953,7 @@ struct intel_display_error_state {
 struct intel_display_error_state *
 intel_display_capture_error_state(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_display_error_state *error;
        int transcoders[] = {
                TRANSCODER_A,
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 5ce5e5be7e88..a0dad1a2f819 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -314,7 +314,8 @@ static bool edp_have_panel_vdd(struct intel_dp *intel_dp)
        struct drm_device *dev = intel_dp_to_dev(intel_dp);
        struct drm_i915_private *dev_priv = dev->dev_private;
-        return (I915_READ(_pp_ctrl_reg(intel_dp)) & EDP_FORCE_VDD) != 0;
+        return !dev_priv->pm.suspended &&
+               (I915_READ(_pp_ctrl_reg(intel_dp)) & EDP_FORCE_VDD) != 0;
 }
 static void
@@ -1621,7 +1622,7 @@ static void intel_edp_psr_enable_source(struct intel_dp *intel_dp)
                val |= EDP_PSR_LINK_DISABLE;
        I915_WRITE(EDP_PSR_CTL(dev), val |
-                   IS_BROADWELL(dev) ? 0 : link_entry_time |
+                   (IS_BROADWELL(dev) ? 0 : link_entry_time) |
                   max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT |
                   idle_frames << EDP_PSR_IDLE_FRAME_SHIFT |
                   EDP_PSR_ENABLE);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index fa9910481ab0..0542de982260 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -897,6 +897,8 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
 void intel_display_power_put(struct drm_i915_private *dev_priv,
                             enum intel_display_power_domain domain);
 void intel_power_domains_init_hw(struct drm_i915_private *dev_priv);
+void intel_init_gt_powersave(struct drm_device *dev);
+void intel_cleanup_gt_powersave(struct drm_device *dev);
 void intel_enable_gt_powersave(struct drm_device *dev);
 void intel_disable_gt_powersave(struct drm_device *dev);
 void ironlake_teardown_rc6(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 2b1d42dbfe13..b4d44e62f0c7 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -518,16 +518,29 @@ static bool intel_fbdev_init_bios(struct drm_device *dev,
                /*
                 * See if the plane fb we found above will fit on this
-                 * pipe.  Note we need to use the selected fb's bpp rather
+                 * pipe.  Note we need to use the selected fb's pitch and bpp
-                 * than the current pipe's, since they could be different.
+                 * rather than the current pipe's, since they differ.
                 */
-                cur_size = intel_crtc->config.adjusted_mode.crtc_hdisplay *
+                cur_size = intel_crtc->config.adjusted_mode.crtc_hdisplay;
-                        intel_crtc->config.adjusted_mode.crtc_vdisplay;
+                cur_size = cur_size * fb->base.bits_per_pixel / 8;
-                DRM_DEBUG_KMS("pipe %c area: %d\n", pipe_name(intel_crtc->pipe),
+                if (fb->base.pitches[0] < cur_size) {
+                        DRM_DEBUG_KMS("fb not wide enough for plane %c (%d vs %d)\n",
+                                      pipe_name(intel_crtc->pipe),
+                                      cur_size, fb->base.pitches[0]);
+                        plane_config = NULL;
+                        fb = NULL;
+                        break;
+                }
+                cur_size = intel_crtc->config.adjusted_mode.crtc_vdisplay;
+                cur_size = ALIGN(cur_size, plane_config->tiled ? (IS_GEN2(dev) ? 16 : 8) : 1);
+                cur_size *= fb->base.pitches[0];
+                DRM_DEBUG_KMS("pipe %c area: %dx%d, bpp: %d, size: %d\n",
+                              pipe_name(intel_crtc->pipe),
+                              intel_crtc->config.adjusted_mode.crtc_hdisplay,
+                              intel_crtc->config.adjusted_mode.crtc_vdisplay,
+                              fb->base.bits_per_pixel,
                              cur_size);
-                cur_size *= fb->base.bits_per_pixel / 8;
-                DRM_DEBUG_KMS("total size %d (bpp %d)\n", cur_size,
-                              fb->base.bits_per_pixel / 8);
                if (cur_size > max_size) {
                        DRM_DEBUG_KMS("fb not big enough for plane %c (%d vs %d)\n",
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index 623cd328b196..d8adc9104dca 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -189,7 +189,7 @@ struct intel_overlay {
 static struct overlay_registers __iomem *
 intel_overlay_map_regs(struct intel_overlay *overlay)
 {
-        drm_i915_private_t *dev_priv = overlay->dev->dev_private;
+        struct drm_i915_private *dev_priv = overlay->dev->dev_private;
        struct overlay_registers __iomem *regs;
        if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
@@ -212,7 +212,7 @@ static int intel_overlay_do_wait_request(struct intel_overlay *overlay,
                                         void (*tail)(struct intel_overlay *))
 {
        struct drm_device *dev = overlay->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
        int ret;
@@ -262,7 +262,7 @@ static int intel_overlay_continue(struct intel_overlay *overlay,
                                  bool load_polyphase_filter)
 {
        struct drm_device *dev = overlay->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
        u32 flip_addr = overlay->flip_addr;
        u32 tmp;
@@ -362,7 +362,7 @@ static int intel_overlay_off(struct intel_overlay *overlay)
 static int intel_overlay_recover_from_interrupt(struct intel_overlay *overlay)
 {
        struct drm_device *dev = overlay->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
        int ret;
@@ -388,7 +388,7 @@ static int intel_overlay_recover_from_interrupt(struct intel_overlay *overlay)
 static int intel_overlay_release_old_vid(struct intel_overlay *overlay)
 {
        struct drm_device *dev = overlay->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
        int ret;
@@ -834,7 +834,7 @@ static int check_overlay_possible_on_crtc(struct intel_overlay *overlay,
 static void update_pfit_vscale_ratio(struct intel_overlay *overlay)
 {
        struct drm_device *dev = overlay->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 pfit_control = I915_READ(PFIT_CONTROL);
        u32 ratio;
@@ -1026,7 +1026,7 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
                            struct drm_file *file_priv)
 {
        struct drm_intel_overlay_put_image *put_image_rec = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_overlay *overlay;
        struct drm_mode_object *drmmode_obj;
        struct intel_crtc *crtc;
@@ -1226,7 +1226,7 @@ int intel_overlay_attrs(struct drm_device *dev, void *data,
                        struct drm_file *file_priv)
 {
        struct drm_intel_overlay_attrs *attrs = data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_overlay *overlay;
        struct overlay_registers __iomem *regs;
        int ret;
@@ -1311,7 +1311,7 @@ out_unlock:
 void intel_setup_overlay(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_overlay *overlay;
        struct drm_i915_gem_object *reg_bo;
        struct overlay_registers __iomem *regs;
@@ -1397,7 +1397,7 @@ out_free:
 void intel_cleanup_overlay(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        if (!dev_priv->overlay)
                return;
@@ -1421,7 +1421,7 @@ struct intel_overlay_error_state {
 static struct overlay_registers __iomem *
 intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
 {
-        drm_i915_private_t *dev_priv = overlay->dev->dev_private;
+        struct drm_i915_private *dev_priv = overlay->dev->dev_private;
        struct overlay_registers __iomem *regs;
        if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
@@ -1447,7 +1447,7 @@ static void intel_overlay_unmap_regs_atomic(struct intel_overlay *overlay,
 struct intel_overlay_error_state *
 intel_overlay_capture_error_state(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_overlay *overlay = dev_priv->overlay;
        struct intel_overlay_error_state *error;
        struct overlay_registers __iomem *regs;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 6e73125fc782..5874716774a7 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -623,7 +623,7 @@ out_disable:
 static void i915_pineview_get_mem_freq(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 tmp;
        tmp = I915_READ(CLKCFG);
@@ -662,7 +662,7 @@ static void i915_pineview_get_mem_freq(struct drm_device *dev)
 static void i915_ironlake_get_mem_freq(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u16 ddrpll, csipll;
        ddrpll = I915_READ16(DDRMPLL1);
@@ -1136,7 +1136,7 @@ static bool g4x_compute_wm0(struct drm_device *dev,
        /* Use the large buffer method to calculate cursor watermark */
        line_time_us = max(htotal * 1000 / clock, 1);
        line_count = (cursor_latency_ns / line_time_us + 1000) / 1000;
-        entries = line_count * 64 * pixel_size;
+        entries = line_count * to_intel_crtc(crtc)->cursor_width * pixel_size;
        tlb_miss = cursor->fifo_size*cursor->cacheline_size - hdisplay * 8;
        if (tlb_miss > 0)
                entries += tlb_miss;
@@ -1222,7 +1222,7 @@ static bool g4x_compute_srwm(struct drm_device *dev,
        *display_wm = entries + display->guard_size;
        /* calculate the self-refresh watermark for display cursor */
-        entries = line_count * pixel_size * 64;
+        entries = line_count * pixel_size * to_intel_crtc(crtc)->cursor_width;
        entries = DIV_ROUND_UP(entries, cursor->cacheline_size);
        *cursor_wm = entries + cursor->guard_size;
@@ -1457,7 +1457,7 @@ static void i965_update_wm(struct drm_crtc *unused_crtc)
                              entries, srwm);
                entries = (((sr_latency_ns / line_time_us) + 1000) / 1000) *
-                        pixel_size * 64;
+                        pixel_size * to_intel_crtc(crtc)->cursor_width;
                entries = DIV_ROUND_UP(entries,
                                          i965_cursor_wm_info.cacheline_size);
                cursor_sr = i965_cursor_wm_info.fifo_size -
@@ -2120,7 +2120,7 @@ static void ilk_compute_wm_parameters(struct drm_crtc *crtc,
                p->pri.bytes_per_pixel = crtc->primary->fb->bits_per_pixel / 8;
                p->cur.bytes_per_pixel = 4;
                p->pri.horiz_pixels = intel_crtc->config.pipe_src_w;
-                p->cur.horiz_pixels = 64;
+                p->cur.horiz_pixels = intel_crtc->cursor_width;
                /* TODO: for now, assume primary and cursor planes are always enabled. */
                p->pri.enabled = true;
                p->cur.enabled = true;
@@ -3006,6 +3006,24 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
        dev_priv->rps.last_adj = 0;
 }
+static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val)
+{
+        u32 mask = 0;
+        if (val > dev_priv->rps.min_freq_softlimit)
+                mask |= GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
+        if (val < dev_priv->rps.max_freq_softlimit)
+                mask |= GEN6_PM_RP_UP_THRESHOLD;
+        /* IVB and SNB hard hangs on looping batchbuffer
+         * if GEN6_PM_UP_EI_EXPIRED is masked.
+         */
+        if (INTEL_INFO(dev_priv->dev)->gen <= 7 && !IS_HASWELL(dev_priv->dev))
+                mask |= GEN6_PM_RP_UP_EI_EXPIRED;
+        return ~mask;
+}
 /* gen6_set_rps is called to update the frequency request, but should also be
 * called when the range (min_delay and max_delay) is modified so that we can
 * update the GEN6_RP_INTERRUPT_LIMITS register accordingly. */
@@ -3017,36 +3035,31 @@ void gen6_set_rps(struct drm_device *dev, u8 val)
        WARN_ON(val > dev_priv->rps.max_freq_softlimit);
        WARN_ON(val < dev_priv->rps.min_freq_softlimit);
-        if (val == dev_priv->rps.cur_freq) {
+        /* min/max delay may still have been modified so be sure to
-                /* min/max delay may still have been modified so be sure to
+         * write the limits value.
-                 * write the limits value */
+         */
-                I915_WRITE(GEN6_RP_INTERRUPT_LIMITS,
+        if (val != dev_priv->rps.cur_freq) {
-                           gen6_rps_limits(dev_priv, val));
+                gen6_set_rps_thresholds(dev_priv, val);
-                return;
+                if (IS_HASWELL(dev))
+                        I915_WRITE(GEN6_RPNSWREQ,
+                                   HSW_FREQUENCY(val));
+                else
+                        I915_WRITE(GEN6_RPNSWREQ,
+                                   GEN6_FREQUENCY(val) |
+                                   GEN6_OFFSET(0) |
+                                   GEN6_AGGRESSIVE_TURBO);
        }
-        gen6_set_rps_thresholds(dev_priv, val);
-        if (IS_HASWELL(dev))
-                I915_WRITE(GEN6_RPNSWREQ,
-                           HSW_FREQUENCY(val));
-        else
-                I915_WRITE(GEN6_RPNSWREQ,
-                           GEN6_FREQUENCY(val) |
-                           GEN6_OFFSET(0) |
-                           GEN6_AGGRESSIVE_TURBO);
        /* Make sure we continue to get interrupts
         * until we hit the minimum or maximum frequencies.
         */
-        I915_WRITE(GEN6_RP_INTERRUPT_LIMITS,
+        I915_WRITE(GEN6_RP_INTERRUPT_LIMITS, gen6_rps_limits(dev_priv, val));
-                   gen6_rps_limits(dev_priv, val));
+        I915_WRITE(GEN6_PMINTRMSK, gen6_rps_pm_mask(dev_priv, val));
        POSTING_READ(GEN6_RPNSWREQ);
        dev_priv->rps.cur_freq = val;
        trace_intel_gpu_freq_change(val * 50);
 }
@@ -3096,10 +3109,8 @@ static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
                I915_READ(VLV_GTLC_SURVIVABILITY_REG) &
                                ~VLV_GFX_CLK_FORCE_ON_BIT);
-        /* Unmask Up interrupts */
+        I915_WRITE(GEN6_PMINTRMSK,
-        dev_priv->rps.rp_up_masked = true;
+                   gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq));
-        gen6_set_pm_mask(dev_priv, GEN6_PM_RP_DOWN_THRESHOLD,
-                                                dev_priv->rps.min_freq_softlimit);
 }
 void gen6_rps_idle(struct drm_i915_private *dev_priv)
@@ -3145,13 +3156,12 @@ void valleyview_set_rps(struct drm_device *dev, u8 val)
                         dev_priv->rps.cur_freq,
                         vlv_gpu_freq(dev_priv, val), val);
-        if (val == dev_priv->rps.cur_freq)
+        if (val != dev_priv->rps.cur_freq)
-                return;
+                vlv_punit_write(dev_priv, PUNIT_REG_GPU_FREQ_REQ, val);
-        vlv_punit_write(dev_priv, PUNIT_REG_GPU_FREQ_REQ, val);
+        I915_WRITE(GEN6_PMINTRMSK, gen6_rps_pm_mask(dev_priv, val));
        dev_priv->rps.cur_freq = val;
        trace_intel_gpu_freq_change(vlv_gpu_freq(dev_priv, val));
 }
@@ -3160,7 +3170,8 @@ static void gen6_disable_rps_interrupts(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        I915_WRITE(GEN6_PMINTRMSK, 0xffffffff);
-        I915_WRITE(GEN6_PMIER, I915_READ(GEN6_PMIER) & ~GEN6_PM_RPS_EVENTS);
+        I915_WRITE(GEN6_PMIER, I915_READ(GEN6_PMIER) &
+                                ~dev_priv->pm_rps_events);
        /* Complete PM interrupt masking here doesn't race with the rps work
         * item again unmasking PM interrupts because that is using a different
         * register (PMIMR) to mask PM interrupts. The only risk is in leaving
@@ -3170,7 +3181,7 @@ static void gen6_disable_rps_interrupts(struct drm_device *dev)
        dev_priv->rps.pm_iir = 0;
        spin_unlock_irq(&dev_priv->irq_lock);
-        I915_WRITE(GEN6_PMIIR, GEN6_PM_RPS_EVENTS);
+        I915_WRITE(GEN6_PMIIR, dev_priv->pm_rps_events);
 }
 static void gen6_disable_rps(struct drm_device *dev)
@@ -3190,11 +3201,6 @@ static void valleyview_disable_rps(struct drm_device *dev)
        I915_WRITE(GEN6_RC_CONTROL, 0);
        gen6_disable_rps_interrupts(dev);
-        if (dev_priv->vlv_pctx) {
-                drm_gem_object_unreference(&dev_priv->vlv_pctx->base);
-                dev_priv->vlv_pctx = NULL;
-        }
 }
 static void intel_print_rc6_info(struct drm_device *dev, u32 mode)
@@ -3228,24 +3234,12 @@ int intel_enable_rc6(const struct drm_device *dev)
 static void gen6_enable_rps_interrupts(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 enabled_intrs;
        spin_lock_irq(&dev_priv->irq_lock);
        WARN_ON(dev_priv->rps.pm_iir);
-        snb_enable_pm_irq(dev_priv, GEN6_PM_RPS_EVENTS);
+        snb_enable_pm_irq(dev_priv, dev_priv->pm_rps_events);
-        I915_WRITE(GEN6_PMIIR, GEN6_PM_RPS_EVENTS);
+        I915_WRITE(GEN6_PMIIR, dev_priv->pm_rps_events);
        spin_unlock_irq(&dev_priv->irq_lock);
-        /* only unmask PM interrupts we need. Mask all others. */
-        enabled_intrs = GEN6_PM_RPS_EVENTS;
-        /* IVB and SNB hard hangs on looping batchbuffer
-         * if GEN6_PM_UP_EI_EXPIRED is masked.
-         */
-        if (INTEL_INFO(dev)->gen <= 7 && !IS_HASWELL(dev))
-                enabled_intrs |= GEN6_PM_RP_UP_EI_EXPIRED;
-        I915_WRITE(GEN6_PMINTRMSK, ~enabled_intrs);
 }
 static void gen8_enable_rps(struct drm_device *dev)
@@ -3550,6 +3544,15 @@ int valleyview_rps_min_freq(struct drm_i915_private *dev_priv)
        return vlv_punit_read(dev_priv, PUNIT_REG_GPU_LFM) & 0xff;
 }
+/* Check that the pctx buffer wasn't move under us. */
+static void valleyview_check_pctx(struct drm_i915_private *dev_priv)
+{
+        unsigned long pctx_addr = I915_READ(VLV_PCBR) & ~4095;
+        WARN_ON(pctx_addr != dev_priv->mm.stolen_base +
+                             dev_priv->vlv_pctx->stolen->start);
+}
 static void valleyview_setup_pctx(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -3594,6 +3597,17 @@ out:
        dev_priv->vlv_pctx = pctx;
 }
+static void valleyview_cleanup_pctx(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (WARN_ON(!dev_priv->vlv_pctx))
+                return;
+        drm_gem_object_unreference(&dev_priv->vlv_pctx->base);
+        dev_priv->vlv_pctx = NULL;
+}
 static void valleyview_enable_rps(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -3603,6 +3617,8 @@ static void valleyview_enable_rps(struct drm_device *dev)
        WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
+        valleyview_check_pctx(dev_priv);
        if ((gtfifodbg = I915_READ(GTFIFODBG))) {
                DRM_DEBUG_DRIVER("GT fifo had a previous error %x\n",
                                 gtfifodbg);
@@ -3687,9 +3703,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
        valleyview_set_rps(dev_priv->dev, dev_priv->rps.efficient_freq);
-        dev_priv->rps.rp_up_masked = false;
-        dev_priv->rps.rp_down_masked = false;
        gen6_enable_rps_interrupts(dev);
        gen6_gt_force_wake_put(dev_priv, FORCEWAKE_ALL);
@@ -4422,6 +4435,18 @@ static void intel_init_emon(struct drm_device *dev)
        dev_priv->ips.corr = (lcfuse & LCFUSE_HIV_MASK);
 }
+void intel_init_gt_powersave(struct drm_device *dev)
+{
+        if (IS_VALLEYVIEW(dev))
+                valleyview_setup_pctx(dev);
+}
+void intel_cleanup_gt_powersave(struct drm_device *dev)
+{
+        if (IS_VALLEYVIEW(dev))
+                valleyview_cleanup_pctx(dev);
+}
 void intel_disable_gt_powersave(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -4476,8 +4501,6 @@ void intel_enable_gt_powersave(struct drm_device *dev)
                ironlake_enable_rc6(dev);
                intel_init_emon(dev);
        } else if (IS_GEN6(dev) || IS_GEN7(dev)) {
-                if (IS_VALLEYVIEW(dev))
-                        valleyview_setup_pctx(dev);
                /*
                 * PCU communication is slow and this doesn't need to be
                 * done at any specific time, so do this out of our fast path
@@ -4881,6 +4904,10 @@ static void gen8_init_clock_gating(struct drm_device *dev)
        /* WaDisableSDEUnitClockGating:bdw */
        I915_WRITE(GEN8_UCGCTL6, I915_READ(GEN8_UCGCTL6) |
                   GEN8_SDEUNIT_CLOCK_GATE_DISABLE);
+        /* Wa4x4STCOptimizationDisable:bdw */
+        I915_WRITE(CACHE_MODE_1,
+                   _MASKED_BIT_ENABLE(GEN8_4x4_STC_OPTIMIZATION_DISABLE));
 }
 static void haswell_init_clock_gating(struct drm_device *dev)
@@ -5037,13 +5064,11 @@ static void valleyview_init_clock_gating(struct drm_device *dev)
        mutex_unlock(&dev_priv->rps.hw_lock);
        switch ((val >> 6) & 3) {
        case 0:
-                dev_priv->mem_freq = 800;
-                break;
        case 1:
-                dev_priv->mem_freq = 1066;
+                dev_priv->mem_freq = 800;
                break;
        case 2:
-                dev_priv->mem_freq = 1333;
+                dev_priv->mem_freq = 1066;
                break;
        case 3:
                dev_priv->mem_freq = 1333;
@@ -5253,6 +5278,9 @@ bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
        bool is_enabled;
        int i;
+        if (dev_priv->pm.suspended)
+                return false;
        power_domains = &dev_priv->power_domains;
        is_enabled = true;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 4eb3e062b4e3..6bc68bdcf433 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -406,17 +406,24 @@ gen8_render_ring_flush(struct intel_ring_buffer *ring,
 static void ring_write_tail(struct intel_ring_buffer *ring,
                            u32 value)
 {
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
        I915_WRITE_TAIL(ring, value);
 }
-u32 intel_ring_get_active_head(struct intel_ring_buffer *ring)
+u64 intel_ring_get_active_head(struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
-        u32 acthd_reg = INTEL_INFO(ring->dev)->gen >= 4 ?
+        u64 acthd;
-                        RING_ACTHD(ring->mmio_base) : ACTHD;
+        if (INTEL_INFO(ring->dev)->gen >= 8)
+                acthd = I915_READ64_2x32(RING_ACTHD(ring->mmio_base),
+                                         RING_ACTHD_UDW(ring->mmio_base));
+        else if (INTEL_INFO(ring->dev)->gen >= 4)
+                acthd = I915_READ(RING_ACTHD(ring->mmio_base));
+        else
+                acthd = I915_READ(ACTHD);
-        return I915_READ(acthd_reg);
+        return acthd;
 }
 static void ring_setup_phys_status_page(struct intel_ring_buffer *ring)
@@ -433,7 +440,7 @@ static void ring_setup_phys_status_page(struct intel_ring_buffer *ring)
 static int init_ring_common(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj = ring->obj;
        int ret = 0;
        u32 head;
@@ -566,7 +573,8 @@ static int init_render_ring(struct intel_ring_buffer *ring)
        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret = init_ring_common(ring);
-        if (INTEL_INFO(dev)->gen > 3)
+        /* WaTimedSingleVertexDispatch:cl,bw,ctg,elk,ilk,snb */
+        if (INTEL_INFO(dev)->gen >= 4 && INTEL_INFO(dev)->gen < 7)
                I915_WRITE(MI_MODE, _MASKED_BIT_ENABLE(VS_TIMER_DISPATCH));
        /* We need to disable the AsyncFlip performance optimisations in order
@@ -813,8 +821,11 @@ gen6_ring_get_seqno(struct intel_ring_buffer *ring, bool lazy_coherency)
        /* Workaround to force correct ordering between irq and seqno writes on
         * ivb (and maybe also on snb) by reading from a CS register (like
         * ACTHD) before reading the status page. */
-        if (!lazy_coherency)
+        if (!lazy_coherency) {
-                intel_ring_get_active_head(ring);
+                struct drm_i915_private *dev_priv = ring->dev->dev_private;
+                POSTING_READ(RING_ACTHD(ring->mmio_base));
+        }
        return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
 }
@@ -846,7 +857,7 @@ static bool
 gen5_ring_get_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        if (!dev->irq_enabled)
@@ -864,7 +875,7 @@ static void
 gen5_ring_put_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        spin_lock_irqsave(&dev_priv->irq_lock, flags);
@@ -877,7 +888,7 @@ static bool
 i9xx_ring_get_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        if (!dev->irq_enabled)
@@ -898,7 +909,7 @@ static void
 i9xx_ring_put_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        spin_lock_irqsave(&dev_priv->irq_lock, flags);
@@ -914,7 +925,7 @@ static bool
 i8xx_ring_get_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        if (!dev->irq_enabled)
@@ -935,7 +946,7 @@ static void
 i8xx_ring_put_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        spin_lock_irqsave(&dev_priv->irq_lock, flags);
@@ -950,7 +961,7 @@ i8xx_ring_put_irq(struct intel_ring_buffer *ring)
 void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
        u32 mmio = 0;
        /* The ring status page addresses are no longer next to the rest of
@@ -1043,7 +1054,7 @@ static bool
 gen6_ring_get_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        if (!dev->irq_enabled)
@@ -1068,7 +1079,7 @@ static void
 gen6_ring_put_irq(struct intel_ring_buffer *ring)
 {
        struct drm_device *dev = ring->dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
        spin_lock_irqsave(&dev_priv->irq_lock, flags);
@@ -1635,7 +1646,7 @@ static int __intel_ring_prepare(struct intel_ring_buffer *ring,
 int intel_ring_begin(struct intel_ring_buffer *ring,
                     int num_dwords)
 {
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
        int ret;
        ret = i915_gem_check_wedge(&dev_priv->gpu_error,
@@ -1697,7 +1708,7 @@ void intel_ring_init_seqno(struct intel_ring_buffer *ring, u32 seqno)
 static void gen6_bsd_ring_write_tail(struct intel_ring_buffer *ring,
                                     u32 value)
 {
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
       /* Every tail move must follow the sequence below */
@@ -1872,7 +1883,7 @@ static int gen6_ring_flush(struct intel_ring_buffer *ring,
 int intel_init_render_ring_buffer(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
        ring->name = "render ring";
@@ -1973,7 +1984,7 @@ int intel_init_render_ring_buffer(struct drm_device *dev)
 int intel_render_ring_init_dri(struct drm_device *dev, u64 start, u32 size)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
        int ret;
@@ -2041,7 +2052,7 @@ int intel_render_ring_init_dri(struct drm_device *dev, u64 start, u32 size)
 int intel_init_bsd_ring_buffer(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[VCS];
        ring->name = "bsd ring";
@@ -2104,7 +2115,7 @@ int intel_init_bsd_ring_buffer(struct drm_device *dev)
 int intel_init_blt_ring_buffer(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[BCS];
        ring->name = "blitter ring";
@@ -2144,7 +2155,7 @@ int intel_init_blt_ring_buffer(struct drm_device *dev)
 int intel_init_vebox_ring_buffer(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[VECS];
        ring->name = "video enhancement ring";
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index f11ceb230db4..270a6a973438 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -46,11 +46,11 @@ enum intel_ring_hangcheck_action {
 #define HANGCHECK_SCORE_RING_HUNG 31
 struct intel_ring_hangcheck {
-        bool deadlock;
+        u64 acthd;
        u32 seqno;
-        u32 acthd;
        int score;
        enum intel_ring_hangcheck_action action;
+        bool deadlock;
 };
 struct  intel_ring_buffer {
@@ -292,7 +292,7 @@ int intel_init_bsd_ring_buffer(struct drm_device *dev);
 int intel_init_blt_ring_buffer(struct drm_device *dev);
 int intel_init_vebox_ring_buffer(struct drm_device *dev);
-u32 intel_ring_get_active_head(struct intel_ring_buffer *ring);
+u64 intel_ring_get_active_head(struct intel_ring_buffer *ring);
 void intel_ring_setup_status_page(struct intel_ring_buffer *ring);
 static inline u32 intel_ring_get_tail(struct intel_ring_buffer *ring)
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 5be4ab218054..bafe92e317d5 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1536,9 +1536,14 @@ static int tv_is_present_in_vbt(struct drm_device *dev)
                /*
                 * If the device type is not TV, continue.
                 */
-                if (p_child->old.device_type != DEVICE_TYPE_INT_TV &&
+                switch (p_child->old.device_type) {
-                        p_child->old.device_type != DEVICE_TYPE_TV)
+                case DEVICE_TYPE_INT_TV:
+                case DEVICE_TYPE_TV:
+                case DEVICE_TYPE_TV_SVIDEO_COMPOSITE:
+                        break;
+                default:
                        continue;
+                }
                /* Only when the addin_offset is non-zero, it is regarded
                 * as present.
                 */
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index c3832d9270a6..f729dc71d5be 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -550,11 +550,12 @@ gen6_read##x(struct drm_i915_private *dev_priv, off_t reg, bool trace) { \
            NEEDS_FORCE_WAKE((dev_priv), (reg))) { \
                dev_priv->uncore.funcs.force_wake_get(dev_priv, \
                                                      FORCEWAKE_ALL); \
-                dev_priv->uncore.forcewake_count++; \
+                val = __raw_i915_read##x(dev_priv, reg); \
-                mod_timer_pinned(&dev_priv->uncore.force_wake_timer, \
+                dev_priv->uncore.funcs.force_wake_put(dev_priv, \
-                                 jiffies + 1); \
+                                                      FORCEWAKE_ALL); \
+        } else { \
+                val = __raw_i915_read##x(dev_priv, reg); \
        } \
-        val = __raw_i915_read##x(dev_priv, reg); \
        REG_READ_FOOTER; \
 }
@@ -865,7 +866,7 @@ int i915_reg_read_ioctl(struct drm_device *dev,
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_reg_read *reg = data;
        struct register_whitelist const *entry = whitelist;
-        int i;
+        int i, ret = 0;
        for (i = 0; i < ARRAY_SIZE(whitelist); i++, entry++) {
                if (entry->offset == reg->offset &&
@@ -876,6 +877,8 @@ int i915_reg_read_ioctl(struct drm_device *dev,
        if (i == ARRAY_SIZE(whitelist))
                return -EINVAL;
+        intel_runtime_pm_get(dev_priv);
        switch (entry->size) {
        case 8:
                reg->val = I915_READ64(reg->offset);
@@ -891,10 +894,13 @@ int i915_reg_read_ioctl(struct drm_device *dev,
                break;
        default:
                WARN_ON(1);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
        }
-        return 0;
+out:
+        intel_runtime_pm_put(dev_priv);
+        return ret;
 }
 int i915_get_reset_stats_ioctl(struct drm_device *dev,
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 7147b87c5e5d..ddd83756b9a2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -891,13 +891,16 @@ static int nouveau_pmops_runtime_suspend(struct device *dev)
        struct drm_device *drm_dev = pci_get_drvdata(pdev);
        int ret;
-        if (nouveau_runtime_pm == 0)
+        if (nouveau_runtime_pm == 0) {
-                return -EINVAL;
+                pm_runtime_forbid(dev);
+                return -EBUSY;
+        }
        /* are we optimus enabled? */
        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
-                return -EINVAL;
+                pm_runtime_forbid(dev);
+                return -EBUSY;
        }
        nv_debug_level(SILENT);
@@ -946,12 +949,15 @@ static int nouveau_pmops_runtime_idle(struct device *dev)
        struct nouveau_drm *drm = nouveau_drm(drm_dev);
        struct drm_crtc *crtc;
-        if (nouveau_runtime_pm == 0)
+        if (nouveau_runtime_pm == 0) {
+                pm_runtime_forbid(dev);
                return -EBUSY;
+        }
        /* are we optimus enabled? */
        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+                pm_runtime_forbid(dev);
                return -EBUSY;
        }
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index be4fcd0f0e0f..c041cd73f399 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -177,8 +177,10 @@ void udl_gem_free_object(struct drm_gem_object *gem_obj)
        if (obj->vmapping)
                udl_gem_vunmap(obj);
-        if (gem_obj->import_attach)
+        if (gem_obj->import_attach) {
                drm_prime_gem_destroy(gem_obj, obj->sg);
+                put_device(gem_obj->dev->dev);
+        }
        if (obj->pages)
                udl_gem_put_pages(obj);
@@ -256,9 +258,12 @@ struct drm_gem_object *udl_gem_prime_import(struct drm_device *dev,
        int ret;
        /* need to attach */
+        get_device(dev->dev);
        attach = dma_buf_attach(dma_buf, dev->dev);
-        if (IS_ERR(attach))
+        if (IS_ERR(attach)) {
+                put_device(dev->dev);
                return ERR_CAST(attach);
+        }
        get_dma_buf(dma_buf);
@@ -282,6 +287,6 @@ fail_unmap:
 fail_detach:
        dma_buf_detach(dma_buf, attach);
        dma_buf_put(dma_buf);
+        put_device(dev->dev);
        return ERR_PTR(ret);
 }
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index befe0e336471..24883b4d1a49 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -43,6 +43,7 @@
 #define G25_REV_MIN 0x22
 #define G27_REV_MAJ 0x12
 #define G27_REV_MIN 0x38
+#define G27_2_REV_MIN 0x39
 #define to_hid_device(pdev) container_of(pdev, struct hid_device, dev)
@@ -130,6 +131,7 @@ static const struct lg4ff_usb_revision lg4ff_revs[] = {
        {DFP_REV_MAJ,  DFP_REV_MIN,  &native_dfp},      /* Driving Force Pro */
        {G25_REV_MAJ,  G25_REV_MIN,  &native_g25},      /* G25 */
        {G27_REV_MAJ,  G27_REV_MIN,  &native_g27},      /* G27 */
+        {G27_REV_MAJ,  G27_2_REV_MIN,  &native_g27},    /* G27 v2 */
 };
 /* Recalculates X axis value accordingly to currently selected range */
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 12354055d474..2f19b15f47f2 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -42,6 +42,7 @@
 #define DUALSHOCK4_CONTROLLER_BT  BIT(6)
 #define SONY_LED_SUPPORT (SIXAXIS_CONTROLLER_USB | BUZZ_CONTROLLER | DUALSHOCK4_CONTROLLER_USB)
+#define SONY_FF_SUPPORT (SIXAXIS_CONTROLLER_USB | DUALSHOCK4_CONTROLLER_USB)
 #define MAX_LEDS 4
@@ -499,6 +500,7 @@ struct sony_sc {
        __u8 right;
 #endif
+        __u8 worker_initialized;
        __u8 led_state[MAX_LEDS];
        __u8 led_count;
 };
@@ -993,22 +995,11 @@ static int sony_init_ff(struct hid_device *hdev)
        return input_ff_create_memless(input_dev, NULL, sony_play_effect);
 }
-static void sony_destroy_ff(struct hid_device *hdev)
-{
-        struct sony_sc *sc = hid_get_drvdata(hdev);
-        cancel_work_sync(&sc->state_worker);
-}
 #else
 static int sony_init_ff(struct hid_device *hdev)
 {
        return 0;
 }
-static void sony_destroy_ff(struct hid_device *hdev)
-{
-}
 #endif
 static int sony_set_output_report(struct sony_sc *sc, int req_id, int req_size)
@@ -1077,6 +1068,8 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
        if (sc->quirks & SIXAXIS_CONTROLLER_USB) {
                hdev->hid_output_raw_report = sixaxis_usb_output_raw_report;
                ret = sixaxis_set_operational_usb(hdev);
+                sc->worker_initialized = 1;
                INIT_WORK(&sc->state_worker, sixaxis_state_worker);
        }
        else if (sc->quirks & SIXAXIS_CONTROLLER_BT)
@@ -1087,6 +1080,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                if (ret < 0)
                        goto err_stop;
+                sc->worker_initialized = 1;
                INIT_WORK(&sc->state_worker, dualshock4_state_worker);
        } else {
                ret = 0;
@@ -1101,9 +1095,11 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                        goto err_stop;
        }
-        ret = sony_init_ff(hdev);
+        if (sc->quirks & SONY_FF_SUPPORT) {
-        if (ret < 0)
+                ret = sony_init_ff(hdev);
-                goto err_stop;
+                if (ret < 0)
+                        goto err_stop;
+        }
        return 0;
 err_stop:
@@ -1120,7 +1116,8 @@ static void sony_remove(struct hid_device *hdev)
        if (sc->quirks & SONY_LED_SUPPORT)
                sony_leds_remove(hdev);
-        sony_destroy_ff(hdev);
+        if (sc->worker_initialized)
+                cancel_work_sync(&sc->state_worker);
        hid_hw_stop(hdev);
 }
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index cb0137b3718d..ab24ce2eb28f 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -320,13 +320,13 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
                        hid_hw_close(hidraw->hid);
                        wake_up_interruptible(&hidraw->wait);
                }
+                device_destroy(hidraw_class,
+                               MKDEV(hidraw_major, hidraw->minor));
        } else {
                --hidraw->open;
        }
        if (!hidraw->open) {
                if (!hidraw->exist) {
-                        device_destroy(hidraw_class,
-                                        MKDEV(hidraw_major, hidraw->minor));
                        hidraw_table[hidraw->minor] = NULL;
                        kfree(hidraw);
                } else {
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index be7f0a20d634..f3b89a4698b6 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -39,7 +39,9 @@
 #include <linux/i2c.h>
 #include <linux/io.h>
 #include <linux/dma-mapping.h>
+#include <linux/of_address.h>
 #include <linux/of_device.h>
+#include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <sysdev/fsl_soc.h>
 #include <asm/cpm.h>
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index a06e12552886..ce953d895f5b 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -954,11 +954,13 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                        return -EFAULT;
                error = input_ff_upload(dev, &effect, file);
+                if (error)
+                        return error;
                if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
                        return -EFAULT;
-                return error;
+                return 0;
        }
        /* Multi-number variable-length handlers */
diff --git a/drivers/input/keyboard/adp5588-keys.c b/drivers/input/keyboard/adp5588-keys.c
index bb3b57bea8ba..5ef7fcf0e250 100644
--- a/drivers/input/keyboard/adp5588-keys.c
+++ b/drivers/input/keyboard/adp5588-keys.c
@@ -76,8 +76,18 @@ static int adp5588_gpio_get_value(struct gpio_chip *chip, unsigned off)
        struct adp5588_kpad *kpad = container_of(chip, struct adp5588_kpad, gc);
        unsigned int bank = ADP5588_BANK(kpad->gpiomap[off]);
        unsigned int bit = ADP5588_BIT(kpad->gpiomap[off]);
+        int val;
-        return !!(adp5588_read(kpad->client, GPIO_DAT_STAT1 + bank) & bit);
+        mutex_lock(&kpad->gpio_lock);
+        if (kpad->dir[bank] & bit)
+                val = kpad->dat_out[bank];
+        else
+                val = adp5588_read(kpad->client, GPIO_DAT_STAT1 + bank);
+        mutex_unlock(&kpad->gpio_lock);
+        return !!(val & bit);
 }
 static void adp5588_gpio_set_value(struct gpio_chip *chip,
diff --git a/drivers/input/misc/da9052_onkey.c b/drivers/input/misc/da9052_onkey.c
index 1f695f229ea8..184c8f21ab59 100644
--- a/drivers/input/misc/da9052_onkey.c
+++ b/drivers/input/misc/da9052_onkey.c
@@ -27,29 +27,32 @@ struct da9052_onkey {
 static void da9052_onkey_query(struct da9052_onkey *onkey)
 {
-        int key_stat;
+        int ret;
-        key_stat = da9052_reg_read(onkey->da9052, DA9052_EVENT_B_REG);
+        ret = da9052_reg_read(onkey->da9052, DA9052_STATUS_A_REG);
-        if (key_stat < 0) {
+        if (ret < 0) {
                dev_err(onkey->da9052->dev,
-                        "Failed to read onkey event %d\n", key_stat);
+                        "Failed to read onkey event err=%d\n", ret);
        } else {
                /*
                 * Since interrupt for deassertion of ONKEY pin is not
                 * generated, onkey event state determines the onkey
                 * button state.
                 */
-                key_stat &= DA9052_EVENTB_ENONKEY;
+                bool pressed = !(ret & DA9052_STATUSA_NONKEY);
-                input_report_key(onkey->input, KEY_POWER, key_stat);
+                input_report_key(onkey->input, KEY_POWER, pressed);
                input_sync(onkey->input);
-        }
-        /*
+                /*
-         * Interrupt is generated only when the ONKEY pin is asserted.
+                 * Interrupt is generated only when the ONKEY pin
-         * Hence the deassertion of the pin is simulated through work queue.
+                 * is asserted.  Hence the deassertion of the pin
-         */
+                 * is simulated through work queue.
-        if (key_stat)
+                 */
-                schedule_delayed_work(&onkey->work, msecs_to_jiffies(50));
+                if (pressed)
+                        schedule_delayed_work(&onkey->work,
+                                                msecs_to_jiffies(50));
+        }
 }
 static void da9052_onkey_work(struct work_struct *work)
diff --git a/drivers/input/mouse/cypress_ps2.c b/drivers/input/mouse/cypress_ps2.c
index 87095e2f5153..8af34ffe208b 100644
--- a/drivers/input/mouse/cypress_ps2.c
+++ b/drivers/input/mouse/cypress_ps2.c
@@ -409,7 +409,6 @@ static int cypress_set_input_params(struct input_dev *input,
        __clear_bit(REL_X, input->relbit);
        __clear_bit(REL_Y, input->relbit);
-        __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
        __set_bit(EV_KEY, input->evbit);
        __set_bit(BTN_LEFT, input->keybit);
        __set_bit(BTN_RIGHT, input->keybit);
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 26386f9d2569..d8d49d10f9bb 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -265,11 +265,22 @@ static int synaptics_identify(struct psmouse *psmouse)
 * Read touchpad resolution and maximum reported coordinates
 * Resolution is left zero if touchpad does not support the query
 */
+static const int *quirk_min_max;
 static int synaptics_resolution(struct psmouse *psmouse)
 {
        struct synaptics_data *priv = psmouse->private;
        unsigned char resp[3];
+        if (quirk_min_max) {
+                priv->x_min = quirk_min_max[0];
+                priv->x_max = quirk_min_max[1];
+                priv->y_min = quirk_min_max[2];
+                priv->y_max = quirk_min_max[3];
+                return 0;
+        }
        if (SYN_ID_MAJOR(priv->identity) < 4)
                return 0;
@@ -1485,10 +1496,54 @@ static const struct dmi_system_id olpc_dmi_table[] __initconst = {
        { }
 };
+static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+#if defined(CONFIG_DMI)
+        {
+                /* Lenovo ThinkPad Helix */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"),
+                },
+                .driver_data = (int []){1024, 5052, 2258, 4832},
+        },
+        {
+                /* Lenovo ThinkPad X240 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"),
+                },
+                .driver_data = (int []){1232, 5710, 1156, 4696},
+        },
+        {
+                /* Lenovo ThinkPad T440s */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"),
+                },
+                .driver_data = (int []){1024, 5112, 2024, 4832},
+        },
+        {
+                /* Lenovo ThinkPad T540p */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"),
+                },
+                .driver_data = (int []){1024, 5056, 2058, 4832},
+        },
+#endif
+        { }
+};
 void __init synaptics_module_init(void)
 {
+        const struct dmi_system_id *min_max_dmi;
        impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table);
        broken_olpc_ec = dmi_check_system(olpc_dmi_table);
+        min_max_dmi = dmi_first_match(min_max_dmi_table);
+        if (min_max_dmi)
+                quirk_min_max = min_max_dmi->driver_data;
 }
 static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index 4c842c320c2e..b604564dec5c 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -67,7 +67,6 @@ struct mousedev {
        struct device dev;
        struct cdev cdev;
        bool exist;
-        bool is_mixdev;
        struct list_head mixdev_node;
        bool opened_by_mixdev;
@@ -77,6 +76,9 @@ struct mousedev {
        int old_x[4], old_y[4];
        int frac_dx, frac_dy;
        unsigned long touch;
+        int (*open_device)(struct mousedev *mousedev);
+        void (*close_device)(struct mousedev *mousedev);
 };
 enum mousedev_emul {
@@ -116,9 +118,6 @@ static unsigned char mousedev_imex_seq[] = { 0xf3, 200, 0xf3, 200, 0xf3, 80 };
 static struct mousedev *mousedev_mix;
 static LIST_HEAD(mousedev_mix_list);
-static void mixdev_open_devices(void);
-static void mixdev_close_devices(void);
 #define fx(i)  (mousedev->old_x[(mousedev->pkt_count - (i)) & 03])
 #define fy(i)  (mousedev->old_y[(mousedev->pkt_count - (i)) & 03])
@@ -428,9 +427,7 @@ static int mousedev_open_device(struct mousedev *mousedev)
        if (retval)
                return retval;
-        if (mousedev->is_mixdev)
+        if (!mousedev->exist)
-                mixdev_open_devices();
-        else if (!mousedev->exist)
                retval = -ENODEV;
        else if (!mousedev->open++) {
                retval = input_open_device(&mousedev->handle);
@@ -446,9 +443,7 @@ static void mousedev_close_device(struct mousedev *mousedev)
 {
        mutex_lock(&mousedev->mutex);
-        if (mousedev->is_mixdev)
+        if (mousedev->exist && !--mousedev->open)
-                mixdev_close_devices();
-        else if (mousedev->exist && !--mousedev->open)
                input_close_device(&mousedev->handle);
        mutex_unlock(&mousedev->mutex);
@@ -459,21 +454,29 @@ static void mousedev_close_device(struct mousedev *mousedev)
 * stream. Note that this function is called with mousedev_mix->mutex
 * held.
 */
-static void mixdev_open_devices(void)
+static int mixdev_open_devices(struct mousedev *mixdev)
 {
-        struct mousedev *mousedev;
+        int error;
+        error = mutex_lock_interruptible(&mixdev->mutex);
+        if (error)
+                return error;
-        if (mousedev_mix->open++)
+        if (!mixdev->open++) {
-                return;
+                struct mousedev *mousedev;
-        list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
+                list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
-                if (!mousedev->opened_by_mixdev) {
+                        if (!mousedev->opened_by_mixdev) {
-                        if (mousedev_open_device(mousedev))
+                                if (mousedev_open_device(mousedev))
-                                continue;
+                                        continue;
-                        mousedev->opened_by_mixdev = true;
+                                mousedev->opened_by_mixdev = true;
+                        }
                }
        }
+        mutex_unlock(&mixdev->mutex);
+        return 0;
 }
 /*
@@ -481,19 +484,22 @@ static void mixdev_open_devices(void)
 * device. Note that this function is called with mousedev_mix->mutex
 * held.
 */
-static void mixdev_close_devices(void)
+static void mixdev_close_devices(struct mousedev *mixdev)
 {
-        struct mousedev *mousedev;
+        mutex_lock(&mixdev->mutex);
-        if (--mousedev_mix->open)
+        if (!--mixdev->open) {
-                return;
+                struct mousedev *mousedev;
-        list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
+                list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) {
-                if (mousedev->opened_by_mixdev) {
+                        if (mousedev->opened_by_mixdev) {
-                        mousedev->opened_by_mixdev = false;
+                                mousedev->opened_by_mixdev = false;
-                        mousedev_close_device(mousedev);
+                                mousedev_close_device(mousedev);
+                        }
                }
        }
+        mutex_unlock(&mixdev->mutex);
 }
@@ -522,7 +528,7 @@ static int mousedev_release(struct inode *inode, struct file *file)
        mousedev_detach_client(mousedev, client);
        kfree(client);
-        mousedev_close_device(mousedev);
+        mousedev->close_device(mousedev);
        return 0;
 }
@@ -550,7 +556,7 @@ static int mousedev_open(struct inode *inode, struct file *file)
        client->mousedev = mousedev;
        mousedev_attach_client(mousedev, client);
-        error = mousedev_open_device(mousedev);
+        error = mousedev->open_device(mousedev);
        if (error)
                goto err_free_client;
@@ -861,16 +867,21 @@ static struct mousedev *mousedev_create(struct input_dev *dev,
        if (mixdev) {
                dev_set_name(&mousedev->dev, "mice");
+                mousedev->open_device = mixdev_open_devices;
+                mousedev->close_device = mixdev_close_devices;
        } else {
                int dev_no = minor;
                /* Normalize device number if it falls into legacy range */
                if (dev_no < MOUSEDEV_MINOR_BASE + MOUSEDEV_MINORS)
                        dev_no -= MOUSEDEV_MINOR_BASE;
                dev_set_name(&mousedev->dev, "mouse%d", dev_no);
+                mousedev->open_device = mousedev_open_device;
+                mousedev->close_device = mousedev_close_device;
        }
        mousedev->exist = true;
-        mousedev->is_mixdev = mixdev;
        mousedev->handle.dev = input_get_device(dev);
        mousedev->handle.name = dev_name(&mousedev->dev);
        mousedev->handle.handler = handler;
@@ -919,7 +930,7 @@ static void mousedev_destroy(struct mousedev *mousedev)
        device_del(&mousedev->dev);
        mousedev_cleanup(mousedev);
        input_free_minor(MINOR(mousedev->dev.devt));
-        if (!mousedev->is_mixdev)
+        if (mousedev != mousedev_mix)
                input_unregister_handle(&mousedev->handle);
        put_device(&mousedev->dev);
 }
diff --git a/drivers/isdn/capi/Kconfig b/drivers/isdn/capi/Kconfig
index f04686580040..9816c51eb5c2 100644
--- a/drivers/isdn/capi/Kconfig
+++ b/drivers/isdn/capi/Kconfig
@@ -16,9 +16,17 @@ config CAPI_TRACE
          This will increase the size of the kernelcapi module by 20 KB.
          If unsure, say Y.
+config ISDN_CAPI_CAPI20
+        tristate "CAPI2.0 /dev/capi support"
+        help
+          This option will provide the CAPI 2.0 interface to userspace
+          applications via /dev/capi20. Applications should use the
+          standardized libcapi20 to access this functionality.  You should say
+          Y/M here.
 config ISDN_CAPI_MIDDLEWARE
        bool "CAPI2.0 Middleware support"
-        depends on TTY
+        depends on ISDN_CAPI_CAPI20 && TTY
        help
          This option will enhance the capabilities of the /dev/capi20
          interface.  It will provide a means of moving a data connection,
@@ -26,14 +34,6 @@ config ISDN_CAPI_MIDDLEWARE
          device.  If you want to use pppd with pppdcapiplugin to dial up to
          your ISP, say Y here.
-config ISDN_CAPI_CAPI20
-        tristate "CAPI2.0 /dev/capi support"
-        help
-          This option will provide the CAPI 2.0 interface to userspace
-          applications via /dev/capi20. Applications should use the
-          standardized libcapi20 to access this functionality.  You should say
-          Y/M here.
 config ISDN_CAPI_CAPIDRV
        tristate "CAPI2.0 capidrv interface support"
        depends on ISDN_I4L
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 2e45f6ec1bf0..380d24922049 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1248,19 +1248,13 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         * shared register for the high 32 bits, so only a single, aligned,
         * 4 GB physical address range can be used for descriptors.
         */
-        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
+        if (!dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64))) {
-            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
                dev_dbg(&pdev->dev, "DMA to 64-BIT addresses\n");
        } else {
-                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+                err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
                if (err) {
-                        err = dma_set_coherent_mask(&pdev->dev,
+                        dev_err(&pdev->dev, "No usable DMA config, aborting\n");
-                                                    DMA_BIT_MASK(32));
+                        goto out_pci_disable;
-                        if (err) {
-                                dev_err(&pdev->dev,
-                                        "No usable DMA config, aborting\n");
-                                goto out_pci_disable;
-                        }
                }
        }
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index d5c2d3e912e5..422aab27ea1b 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -2436,7 +2436,7 @@ err_reset:
 err_register:
 err_sw_init:
 err_eeprom:
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
 err_init_netdev:
 err_ioremap:
        free_netdev(netdev);
@@ -2474,7 +2474,7 @@ static void atl1e_remove(struct pci_dev *pdev)
        unregister_netdev(netdev);
        atl1e_free_ring_resources(adapter);
        atl1e_force_ps(&adapter->hw);
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
        pci_release_regions(pdev);
        free_netdev(netdev);
        pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index fcf9105a5476..09f3fefcbf9c 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1,6 +1,6 @@
 /* cnic.c: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -342,7 +342,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
        while (retry < 3) {
                rc = 0;
                rcu_read_lock();
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
+                ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
                if (ulp_ops)
                        rc = ulp_ops->iscsi_nl_send_msg(
                                cp->ulp_handle[CNIC_ULP_ISCSI],
@@ -726,7 +726,7 @@ static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
        for (i = 0; i < dma->num_pages; i++) {
                if (dma->pg_arr[i]) {
-                        dma_free_coherent(&dev->pcidev->dev, BNX2_PAGE_SIZE,
+                        dma_free_coherent(&dev->pcidev->dev, CNIC_PAGE_SIZE,
                                          dma->pg_arr[i], dma->pg_map_arr[i]);
                        dma->pg_arr[i] = NULL;
                }
@@ -785,7 +785,7 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
        for (i = 0; i < pages; i++) {
                dma->pg_arr[i] = dma_alloc_coherent(&dev->pcidev->dev,
-                                                    BNX2_PAGE_SIZE,
+                                                    CNIC_PAGE_SIZE,
                                                    &dma->pg_map_arr[i],
                                                    GFP_ATOMIC);
                if (dma->pg_arr[i] == NULL)
@@ -794,8 +794,8 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
        if (!use_pg_tbl)
                return 0;
-        dma->pgtbl_size = ((pages * 8) + BNX2_PAGE_SIZE - 1) &
+        dma->pgtbl_size = ((pages * 8) + CNIC_PAGE_SIZE - 1) &
-                          ~(BNX2_PAGE_SIZE - 1);
+                          ~(CNIC_PAGE_SIZE - 1);
        dma->pgtbl = dma_alloc_coherent(&dev->pcidev->dev, dma->pgtbl_size,
                                        &dma->pgtbl_map, GFP_ATOMIC);
        if (dma->pgtbl == NULL)
@@ -900,8 +900,8 @@ static int cnic_alloc_context(struct cnic_dev *dev)
        if (BNX2_CHIP(cp) == BNX2_CHIP_5709) {
                int i, k, arr_size;
-                cp->ctx_blk_size = BNX2_PAGE_SIZE;
+                cp->ctx_blk_size = CNIC_PAGE_SIZE;
-                cp->cids_per_blk = BNX2_PAGE_SIZE / 128;
+                cp->cids_per_blk = CNIC_PAGE_SIZE / 128;
                arr_size = BNX2_MAX_CID / cp->cids_per_blk *
                           sizeof(struct cnic_ctx);
                cp->ctx_arr = kzalloc(arr_size, GFP_KERNEL);
@@ -933,7 +933,7 @@ static int cnic_alloc_context(struct cnic_dev *dev)
                for (i = 0; i < cp->ctx_blks; i++) {
                        cp->ctx_arr[i].ctx =
                                dma_alloc_coherent(&dev->pcidev->dev,
-                                                   BNX2_PAGE_SIZE,
+                                                   CNIC_PAGE_SIZE,
                                                   &cp->ctx_arr[i].mapping,
                                                   GFP_KERNEL);
                        if (cp->ctx_arr[i].ctx == NULL)
@@ -1013,7 +1013,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
        if (udev->l2_ring)
                return 0;
-        udev->l2_ring_size = pages * BNX2_PAGE_SIZE;
+        udev->l2_ring_size = pages * CNIC_PAGE_SIZE;
        udev->l2_ring = dma_alloc_coherent(&udev->pdev->dev, udev->l2_ring_size,
                                           &udev->l2_ring_map,
                                           GFP_KERNEL | __GFP_COMP);
@@ -1021,7 +1021,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
                return -ENOMEM;
        udev->l2_buf_size = (cp->l2_rx_ring_size + 1) * cp->l2_single_buf_size;
-        udev->l2_buf_size = PAGE_ALIGN(udev->l2_buf_size);
+        udev->l2_buf_size = CNIC_PAGE_ALIGN(udev->l2_buf_size);
        udev->l2_buf = dma_alloc_coherent(&udev->pdev->dev, udev->l2_buf_size,
                                          &udev->l2_buf_map,
                                          GFP_KERNEL | __GFP_COMP);
@@ -1102,7 +1102,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
                                                     TX_MAX_TSS_RINGS + 1);
                uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
-                                        PAGE_MASK;
+                                        CNIC_PAGE_MASK;
                if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
                        uinfo->mem[1].size = BNX2_SBLK_MSIX_ALIGN_SIZE * 9;
                else
@@ -1113,7 +1113,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
                uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
-                        PAGE_MASK;
+                        CNIC_PAGE_MASK;
                uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
                uinfo->name = "bnx2x_cnic";
@@ -1267,14 +1267,14 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
        for (i = MAX_ISCSI_TBL_SZ; i < cp->max_cid_space; i++)
                cp->ctx_tbl[i].ulp_proto_id = CNIC_ULP_FCOE;
-        pages = PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
+        pages = CNIC_PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
-                PAGE_SIZE;
+                CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
        if (ret)
                return -ENOMEM;
-        n = PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
+        n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
        for (i = 0, j = 0; i < cp->max_cid_space; i++) {
                long off = CNIC_KWQ16_DATA_SIZE * (i % n);
@@ -1296,7 +1296,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
                        goto error;
        }
-        pages = PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &cp->gbl_buf_info, pages, 0);
        if (ret)
                goto error;
@@ -1466,8 +1466,8 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        cp->r2tq_size = cp->num_iscsi_tasks * BNX2X_ISCSI_MAX_PENDING_R2TS *
                        BNX2X_ISCSI_R2TQE_SIZE;
        cp->hq_size = cp->num_ccells * BNX2X_ISCSI_HQ_BD_SIZE;
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
-        hq_bds = pages * (PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
+        hq_bds = pages * (CNIC_PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
        cp->num_cqs = req1->num_cqs;
        if (!dev->max_iscsi_conn)
@@ -1477,9 +1477,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_RQ_SIZE_OFFSET(pfid),
                  req1->rq_num_wqes);
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM +
                  TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1489,9 +1489,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
                  USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(pfid),
                  req1->rq_buffer_size);
        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_USTRORM_INTMEM +
-                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_USTRORM_INTMEM +
                  USTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1504,9 +1504,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        /* init Xstorm RAM */
        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
                  XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1519,9 +1519,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        /* init Cstorm RAM */
        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
                  CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1623,18 +1623,18 @@ static int cnic_alloc_bnx2x_conn_resc(struct cnic_dev *dev, u32 l5_cid)
        }
        ctx->cid = cid;
-        pages = PAGE_ALIGN(cp->task_array_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->task_array_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->task_array_info, pages, 1);
        if (ret)
                goto error;
-        pages = PAGE_ALIGN(cp->r2tq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->r2tq_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->r2tq_info, pages, 1);
        if (ret)
                goto error;
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->hq_info, pages, 1);
        if (ret)
                goto error;
@@ -1760,7 +1760,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
        ictx->tstorm_st_context.iscsi.hdr_bytes_2_fetch = ISCSI_HEADER_SIZE;
        /* TSTORM requires the base address of RQ DB & not PTE */
        ictx->tstorm_st_context.iscsi.rq_db_phy_addr.lo =
-                req2->rq_page_table_addr_lo & PAGE_MASK;
+                req2->rq_page_table_addr_lo & CNIC_PAGE_MASK;
        ictx->tstorm_st_context.iscsi.rq_db_phy_addr.hi =
                req2->rq_page_table_addr_hi;
        ictx->tstorm_st_context.iscsi.iscsi_conn_id = req1->iscsi_conn_id;
@@ -1842,7 +1842,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
        /* CSTORM and USTORM initialization is different, CSTORM requires
         * CQ DB base & not PTE addr */
        ictx->cstorm_st_context.cq_db_base.lo =
-                req1->cq_page_table_addr_lo & PAGE_MASK;
+                req1->cq_page_table_addr_lo & CNIC_PAGE_MASK;
        ictx->cstorm_st_context.cq_db_base.hi = req1->cq_page_table_addr_hi;
        ictx->cstorm_st_context.iscsi_conn_id = req1->iscsi_conn_id;
        ictx->cstorm_st_context.cq_proc_en_bit_map = (1 << cp->num_cqs) - 1;
@@ -2911,7 +2911,7 @@ static int cnic_l2_completion(struct cnic_local *cp)
        u16 hw_cons, sw_cons;
        struct cnic_uio_dev *udev = cp->udev;
        union eth_rx_cqe *cqe, *cqe_ring = (union eth_rx_cqe *)
-                                        (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                        (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
        u32 cmd;
        int comp = 0;
@@ -3244,7 +3244,8 @@ static int cnic_copy_ulp_stats(struct cnic_dev *dev, int ulp_type)
        int rc;
        mutex_lock(&cnic_lock);
-        ulp_ops = cnic_ulp_tbl_prot(ulp_type);
+        ulp_ops = rcu_dereference_protected(cp->ulp_ops[ulp_type],
+                                            lockdep_is_held(&cnic_lock));
        if (ulp_ops && ulp_ops->cnic_get_stats)
                rc = ulp_ops->cnic_get_stats(cp->ulp_handle[ulp_type]);
        else
@@ -4384,7 +4385,7 @@ static int cnic_setup_5709_context(struct cnic_dev *dev, int valid)
                u32 idx = cp->ctx_arr[i].cid / cp->cids_per_blk;
                u32 val;
-                memset(cp->ctx_arr[i].ctx, 0, BNX2_PAGE_SIZE);
+                memset(cp->ctx_arr[i].ctx, 0, CNIC_PAGE_SIZE);
                CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA0,
                        (cp->ctx_arr[i].mapping & 0xffffffff) | valid_bit);
@@ -4628,7 +4629,7 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                val = BNX2_L2CTX_L2_STATUSB_NUM(sb_id);
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_HOST_BDIDX, val);
-        rxbd = udev->l2_ring + BNX2_PAGE_SIZE;
+        rxbd = udev->l2_ring + CNIC_PAGE_SIZE;
        for (i = 0; i < BNX2_MAX_RX_DESC_CNT; i++, rxbd++) {
                dma_addr_t buf_map;
                int n = (i % cp->l2_rx_ring_size) + 1;
@@ -4639,11 +4640,11 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                rxbd->rx_bd_haddr_hi = (u64) buf_map >> 32;
                rxbd->rx_bd_haddr_lo = (u64) buf_map & 0xffffffff;
        }
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_HI, val);
        rxbd->rx_bd_haddr_hi = val;
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_LO, val);
        rxbd->rx_bd_haddr_lo = val;
@@ -4709,10 +4710,10 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        val = CNIC_RD(dev, BNX2_MQ_CONFIG);
        val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
-        if (BNX2_PAGE_BITS > 12)
+        if (CNIC_PAGE_BITS > 12)
                val |= (12 - 8)  << 4;
        else
-                val |= (BNX2_PAGE_BITS - 8)  << 4;
+                val |= (CNIC_PAGE_BITS - 8)  << 4;
        CNIC_WR(dev, BNX2_MQ_CONFIG, val);
@@ -4742,13 +4743,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        /* Initialize the kernel work queue context. */
        val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_TYPE, val);
-        val = (BNX2_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
        val = (u32) ((u64) cp->kwq_info.pgtbl_map >> 32);
@@ -4768,13 +4769,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        /* Initialize the kernel complete queue context. */
        val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_TYPE, val);
-        val = (BNX2_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
        val = (u32) ((u64) cp->kcq1.dma.pgtbl_map >> 32);
@@ -4918,7 +4919,7 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev,
        u32 cli = cp->ethdev->iscsi_l2_client_id;
        u32 val;
-        memset(txbd, 0, BNX2_PAGE_SIZE);
+        memset(txbd, 0, CNIC_PAGE_SIZE);
        buf_map = udev->l2_buf_map;
        for (i = 0; i < BNX2_MAX_TX_DESC_CNT; i += 3, txbd += 3) {
@@ -4978,9 +4979,9 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
        struct bnx2x *bp = netdev_priv(dev->netdev);
        struct cnic_uio_dev *udev = cp->udev;
        struct eth_rx_bd *rxbd = (struct eth_rx_bd *) (udev->l2_ring +
-                                BNX2_PAGE_SIZE);
+                                CNIC_PAGE_SIZE);
        struct eth_rx_cqe_next_page *rxcqe = (struct eth_rx_cqe_next_page *)
-                                (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
        struct host_sp_status_block *sb = cp->bnx2x_def_status_blk;
        int i;
        u32 cli = cp->ethdev->iscsi_l2_client_id;
@@ -5004,20 +5005,20 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
                rxbd->addr_lo = cpu_to_le32(buf_map & 0xffffffff);
        }
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
        rxbd->addr_hi = cpu_to_le32(val);
        data->rx.bd_page_base.hi = cpu_to_le32(val);
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
        rxbd->addr_lo = cpu_to_le32(val);
        data->rx.bd_page_base.lo = cpu_to_le32(val);
        rxcqe += BNX2X_MAX_RCQ_DESC_CNT;
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) >> 32;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) >> 32;
        rxcqe->addr_hi = cpu_to_le32(val);
        data->rx.cqe_page_base.hi = cpu_to_le32(val);
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) & 0xffffffff;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) & 0xffffffff;
        rxcqe->addr_lo = cpu_to_le32(val);
        data->rx.cqe_page_base.lo = cpu_to_le32(val);
@@ -5265,8 +5266,8 @@ static void cnic_shutdown_rings(struct cnic_dev *dev)
                msleep(10);
        }
        clear_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags);
-        rx_ring = udev->l2_ring + BNX2_PAGE_SIZE;
+        rx_ring = udev->l2_ring + CNIC_PAGE_SIZE;
-        memset(rx_ring, 0, BNX2_PAGE_SIZE);
+        memset(rx_ring, 0, CNIC_PAGE_SIZE);
 }
 static int cnic_register_netdev(struct cnic_dev *dev)
diff --git a/drivers/net/ethernet/broadcom/cnic.h b/drivers/net/ethernet/broadcom/cnic.h
index 0d6b13f854d9..d535ae4228b4 100644
--- a/drivers/net/ethernet/broadcom/cnic.h
+++ b/drivers/net/ethernet/broadcom/cnic.h
@@ -1,6 +1,6 @@
 /* cnic.h: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_defs.h b/drivers/net/ethernet/broadcom/cnic_defs.h
index 95a8e4b11c9f..dcbca6997e8f 100644
--- a/drivers/net/ethernet/broadcom/cnic_defs.h
+++ b/drivers/net/ethernet/broadcom/cnic_defs.h
@@ -1,7 +1,7 @@
 /* cnic.c: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_if.h b/drivers/net/ethernet/broadcom/cnic_if.h
index 8cf6b1926069..5f4d5573a73d 100644
--- a/drivers/net/ethernet/broadcom/cnic_if.h
+++ b/drivers/net/ethernet/broadcom/cnic_if.h
@@ -1,6 +1,6 @@
 /* cnic_if.h: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -14,8 +14,8 @@
 #include "bnx2x/bnx2x_mfw_req.h"
-#define CNIC_MODULE_VERSION     "2.5.19"
+#define CNIC_MODULE_VERSION     "2.5.20"
-#define CNIC_MODULE_RELDATE     "December 19, 2013"
+#define CNIC_MODULE_RELDATE     "March 14, 2014"
 #define CNIC_ULP_RDMA           0
 #define CNIC_ULP_ISCSI          1
@@ -24,6 +24,16 @@
 #define MAX_CNIC_ULP_TYPE_EXT   3
 #define MAX_CNIC_ULP_TYPE       4
+/* Use CPU native page size up to 16K for cnic ring sizes.  */
+#if (PAGE_SHIFT > 14)
+#define CNIC_PAGE_BITS  14
+#else
+#define CNIC_PAGE_BITS  PAGE_SHIFT
+#endif
+#define CNIC_PAGE_SIZE  (1 << (CNIC_PAGE_BITS))
+#define CNIC_PAGE_ALIGN(addr) ALIGN(addr, CNIC_PAGE_SIZE)
+#define CNIC_PAGE_MASK  (~((CNIC_PAGE_SIZE) - 1))
 struct kwqe {
        u32 kwqe_op_flag;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3b6d0ba86c71..70a225c8df5c 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17649,8 +17649,6 @@ static int tg3_init_one(struct pci_dev *pdev,
        tg3_init_bufmgr_config(tp);
-        features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX;
        /* 5700 B0 chips do not support checksumming correctly due
         * to hardware bugs.
         */
@@ -17682,7 +17680,8 @@ static int tg3_init_one(struct pci_dev *pdev,
                        features |= NETIF_F_TSO_ECN;
        }
-        dev->features |= features;
+        dev->features |= features | NETIF_F_HW_VLAN_CTAG_TX |
+                         NETIF_F_HW_VLAN_CTAG_RX;
        dev->vlan_features |= features;
        /*
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index f418f4f20f94..8d76fca7fde7 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -22,6 +22,7 @@
 #include <linux/interrupt.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
+#include <linux/io.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
 #include <linux/of_mdio.h>
@@ -88,8 +89,9 @@
 #define      MVNETA_TX_IN_PRGRS                  BIT(1)
 #define      MVNETA_TX_FIFO_EMPTY                BIT(8)
 #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
-#define MVNETA_SGMII_SERDES_CFG                  0x24A0
+#define MVNETA_SERDES_CFG                        0x24A0
 #define      MVNETA_SGMII_SERDES_PROTO           0x0cc7
+#define      MVNETA_RGMII_SERDES_PROTO           0x0667
 #define MVNETA_TYPE_PRIO                         0x24bc
 #define      MVNETA_FORCE_UNI                    BIT(21)
 #define MVNETA_TXQ_CMD_1                         0x24e4
@@ -161,7 +163,7 @@
 #define      MVNETA_GMAC_MAX_RX_SIZE_MASK        0x7ffc
 #define      MVNETA_GMAC0_PORT_ENABLE            BIT(0)
 #define MVNETA_GMAC_CTRL_2                       0x2c08
-#define      MVNETA_GMAC2_PSC_ENABLE             BIT(3)
+#define      MVNETA_GMAC2_PCS_ENABLE             BIT(3)
 #define      MVNETA_GMAC2_PORT_RGMII             BIT(4)
 #define      MVNETA_GMAC2_PORT_RESET             BIT(6)
 #define MVNETA_GMAC_STATUS                       0x2c10
@@ -710,35 +712,6 @@ static void mvneta_rxq_bm_disable(struct mvneta_port *pp,
        mvreg_write(pp, MVNETA_RXQ_CONFIG_REG(rxq->id), val);
 }
-/* Sets the RGMII Enable bit (RGMIIEn) in port MAC control register */
-static void mvneta_gmac_rgmii_set(struct mvneta_port *pp, int enable)
-{
-        u32  val;
-        val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
-        if (enable)
-                val |= MVNETA_GMAC2_PORT_RGMII;
-        else
-                val &= ~MVNETA_GMAC2_PORT_RGMII;
-        mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
-}
-/* Config SGMII port */
-static void mvneta_port_sgmii_config(struct mvneta_port *pp)
-{
-        u32 val;
-        val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
-        val |= MVNETA_GMAC2_PSC_ENABLE;
-        mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
-        mvreg_write(pp, MVNETA_SGMII_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
-}
 /* Start the Ethernet port RX and TX activity */
 static void mvneta_port_up(struct mvneta_port *pp)
 {
@@ -2756,12 +2729,15 @@ static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
        mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0);
        if (phy_mode == PHY_INTERFACE_MODE_SGMII)
-                mvneta_port_sgmii_config(pp);
+                mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
+        else
+                mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_RGMII_SERDES_PROTO);
+        val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
-        mvneta_gmac_rgmii_set(pp, 1);
+        val |= MVNETA_GMAC2_PCS_ENABLE | MVNETA_GMAC2_PORT_RGMII;
        /* Cancel Port Reset */
-        val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
        val &= ~MVNETA_GMAC2_PORT_RESET;
        mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
@@ -2774,6 +2750,7 @@ static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
 static int mvneta_probe(struct platform_device *pdev)
 {
        const struct mbus_dram_target_info *dram_target_info;
+        struct resource *res;
        struct device_node *dn = pdev->dev.of_node;
        struct device_node *phy_node;
        u32 phy_addr;
@@ -2838,9 +2815,15 @@ static int mvneta_probe(struct platform_device *pdev)
        clk_prepare_enable(pp->clk);
-        pp->base = of_iomap(dn, 0);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                err = -ENODEV;
+                goto err_clk;
+        }
+        pp->base = devm_ioremap_resource(&pdev->dev, res);
        if (pp->base == NULL) {
-                err = -ENOMEM;
+                err = PTR_ERR(pp->base);
                goto err_clk;
        }
@@ -2848,7 +2831,7 @@ static int mvneta_probe(struct platform_device *pdev)
        pp->stats = alloc_percpu(struct mvneta_pcpu_stats);
        if (!pp->stats) {
                err = -ENOMEM;
-                goto err_unmap;
+                goto err_clk;
        }
        for_each_possible_cpu(cpu) {
@@ -2913,8 +2896,6 @@ err_deinit:
        mvneta_deinit(pp);
 err_free_stats:
        free_percpu(pp->stats);
-err_unmap:
-        iounmap(pp->base);
 err_clk:
        clk_disable_unprepare(pp->clk);
 err_free_irq:
@@ -2934,7 +2915,6 @@ static int mvneta_remove(struct platform_device *pdev)
        mvneta_deinit(pp);
        clk_disable_unprepare(pp->clk);
        free_percpu(pp->stats);
-        iounmap(pp->base);
        irq_dispose_mapping(dev->irq);
        free_netdev(dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 936c15364739..d413e60071d4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2681,7 +2681,11 @@ static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev,
 static pci_ers_result_t mlx4_pci_slot_reset(struct pci_dev *pdev)
 {
-        int ret = __mlx4_init_one(pdev, 0);
+        const struct pci_device_id *id;
+        int ret;
+        id = pci_match_id(mlx4_pci_table, pdev);
+        ret = __mlx4_init_one(pdev, id->driver_data);
        return ret ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
 }
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 727b546a9eb8..e0c92e0e5e1d 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -23,6 +23,7 @@
 #include <linux/crc32.h>
 #include <linux/mii.h>
 #include <linux/eeprom_93cx6.h>
+#include <linux/regulator/consumer.h>
 #include <linux/spi/spi.h>
@@ -83,6 +84,7 @@ union ks8851_tx_hdr {
 * @rc_rxqcr: Cached copy of KS_RXQCR.
 * @eeprom_size: Companion eeprom size in Bytes, 0 if no eeprom
 * @eeprom: 93CX6 EEPROM state for accessing on-board EEPROM.
+ * @vdd_reg:    Optional regulator supplying the chip
 *
 * The @lock ensures that the chip is protected when certain operations are
 * in progress. When the read or write packet transfer is in progress, most
@@ -130,6 +132,7 @@ struct ks8851_net {
        struct spi_transfer     spi_xfer2[2];
        struct eeprom_93cx6     eeprom;
+        struct regulator        *vdd_reg;
 };
 static int msg_enable;
@@ -1414,6 +1417,21 @@ static int ks8851_probe(struct spi_device *spi)
        ks->spidev = spi;
        ks->tx_space = 6144;
+        ks->vdd_reg = regulator_get_optional(&spi->dev, "vdd");
+        if (IS_ERR(ks->vdd_reg)) {
+                ret = PTR_ERR(ks->vdd_reg);
+                if (ret == -EPROBE_DEFER)
+                        goto err_reg;
+        } else {
+                ret = regulator_enable(ks->vdd_reg);
+                if (ret) {
+                        dev_err(&spi->dev, "regulator enable fail: %d\n",
+                                ret);
+                        goto err_reg_en;
+                }
+        }
        mutex_init(&ks->lock);
        spin_lock_init(&ks->statelock);
@@ -1508,8 +1526,14 @@ static int ks8851_probe(struct spi_device *spi)
 err_netdev:
        free_irq(ndev->irq, ks);
-err_id:
 err_irq:
+err_id:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_disable(ks->vdd_reg);
+err_reg_en:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_put(ks->vdd_reg);
+err_reg:
        free_netdev(ndev);
        return ret;
 }
@@ -1523,6 +1547,10 @@ static int ks8851_remove(struct spi_device *spi)
        unregister_netdev(priv->netdev);
        free_irq(spi->irq, priv);
+        if (!IS_ERR(priv->vdd_reg)) {
+                regulator_disable(priv->vdd_reg);
+                regulator_put(priv->vdd_reg);
+        }
        free_netdev(priv->netdev);
        return 0;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index ce2cfddbed50..656c65ddadb4 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4765,7 +4765,9 @@ static int qlge_probe(struct pci_dev *pdev,
        ndev->features = ndev->hw_features;
        ndev->vlan_features = ndev->hw_features;
        /* vlan gets same features (except vlan filter) */
-        ndev->vlan_features &= ~NETIF_F_HW_VLAN_CTAG_FILTER;
+        ndev->vlan_features &= ~(NETIF_F_HW_VLAN_CTAG_FILTER |
+                                 NETIF_F_HW_VLAN_CTAG_TX |
+                                 NETIF_F_HW_VLAN_CTAG_RX);
        if (test_bit(QL_DMA64, &qdev->flags))
                ndev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index ffd4d12acf6d..7d6d8ec676c8 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2229,10 +2229,6 @@ static int cpsw_probe(struct platform_device *pdev)
                goto clean_ale_ret;
        }
-        if (cpts_register(&pdev->dev, priv->cpts,
-                          data->cpts_clock_mult, data->cpts_clock_shift))
-                dev_err(priv->dev, "error registering cpts device\n");
        cpsw_notice(priv, probe, "initialized device (regs %pa, irq %d)\n",
                    &ss_res->start, ndev->irq);
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 364d0c7952c0..88ef27067bf2 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -355,7 +355,7 @@ int cpdma_ctlr_stop(struct cpdma_ctlr *ctlr)
        int i;
        spin_lock_irqsave(&ctlr->lock, flags);
-        if (ctlr->state != CPDMA_STATE_ACTIVE) {
+        if (ctlr->state == CPDMA_STATE_TEARDOWN) {
                spin_unlock_irqrestore(&ctlr->lock, flags);
                return -EINVAL;
        }
@@ -891,7 +891,7 @@ int cpdma_chan_stop(struct cpdma_chan *chan)
        unsigned                timeout;
        spin_lock_irqsave(&chan->lock, flags);
-        if (chan->state != CPDMA_STATE_ACTIVE) {
+        if (chan->state == CPDMA_STATE_TEARDOWN) {
                spin_unlock_irqrestore(&chan->lock, flags);
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index cd9b164a0434..8f0e69ce07ca 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1532,9 +1532,9 @@ static int emac_dev_open(struct net_device *ndev)
        struct device *emac_dev = &ndev->dev;
        u32 cnt;
        struct resource *res;
-        int ret;
+        int q, m, ret;
+        int res_num = 0, irq_num = 0;
        int i = 0;
-        int k = 0;
        struct emac_priv *priv = netdev_priv(ndev);
        pm_runtime_get(&priv->pdev->dev);
@@ -1564,15 +1564,24 @@ static int emac_dev_open(struct net_device *ndev)
        }
        /* Request IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ,
+                                            res_num))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++) {
+                        dev_err(emac_dev, "Request IRQ %d\n", irq_num);
+                        if (request_irq(irq_num, emac_irq, 0, ndev->name,
+                                        ndev)) {
+                                dev_err(emac_dev,
+                                        "DaVinci EMAC: request_irq() failed\n");
+                                ret = -EBUSY;
-        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
-                for (i = res->start; i <= res->end; i++) {
-                        if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
-                                             0, ndev->name, ndev))
                                goto rollback;
+                        }
                }
-                k++;
+                res_num++;
        }
+        /* prepare counters for rollback in case of an error */
+        res_num--;
+        irq_num--;
        /* Start/Enable EMAC hardware */
        emac_hw_enable(priv);
@@ -1639,11 +1648,23 @@ static int emac_dev_open(struct net_device *ndev)
        return 0;
-rollback:
-        dev_err(emac_dev, "DaVinci EMAC: devm_request_irq() failed");
-        ret = -EBUSY;
 err:
+        emac_int_disable(priv);
+        napi_disable(&priv->napi);
+rollback:
+        for (q = res_num; q >= 0; q--) {
+                res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, q);
+                /* at the first iteration, irq_num is already set to the
+                 * right value
+                 */
+                if (q != res_num)
+                        irq_num = res->end;
+                for (m = irq_num; m >= res->start; m--)
+                        free_irq(m, ndev);
+        }
+        cpdma_ctlr_stop(priv->dma);
        pm_runtime_put(&priv->pdev->dev);
        return ret;
 }
@@ -1659,6 +1680,9 @@ err:
 */
 static int emac_dev_stop(struct net_device *ndev)
 {
+        struct resource *res;
+        int i = 0;
+        int irq_num;
        struct emac_priv *priv = netdev_priv(ndev);
        struct device *emac_dev = &ndev->dev;
@@ -1674,6 +1698,13 @@ static int emac_dev_stop(struct net_device *ndev)
        if (priv->phydev)
                phy_disconnect(priv->phydev);
+        /* Free IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, i))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++)
+                        free_irq(irq_num, priv->ndev);
+                i++;
+        }
        if (netif_msg_drv(priv))
                dev_notice(emac_dev, "DaVinci EMAC: %s stopped\n", ndev->name);
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index ef312bc6b865..6ac20a6738f4 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -923,7 +923,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (rc) {
                dev_err(&pdev->dev,
                        "32-bit PCI DMA addresses not supported by the card!?\n");
-                goto err_out;
+                goto err_out_pci_disable;
        }
        /* sanity check */
@@ -931,7 +931,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
            (pci_resource_len(pdev, 1) < io_size)) {
                rc = -EIO;
                dev_err(&pdev->dev, "Insufficient PCI resources, aborting\n");
-                goto err_out;
+                goto err_out_pci_disable;
        }
        pioaddr = pci_resource_start(pdev, 0);
@@ -942,7 +942,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        dev = alloc_etherdev(sizeof(struct rhine_private));
        if (!dev) {
                rc = -ENOMEM;
-                goto err_out;
+                goto err_out_pci_disable;
        }
        SET_NETDEV_DEV(dev, &pdev->dev);
@@ -1084,6 +1084,8 @@ err_out_free_res:
        pci_release_regions(pdev);
 err_out_free_netdev:
        free_netdev(dev);
+err_out_pci_disable:
+        pci_disable_device(pdev);
 err_out:
        return rc;
 }
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index c14d39bf32d0..d7b2e947184b 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -180,7 +180,8 @@ static void ifb_setup(struct net_device *dev)
        dev->tx_queue_len = TX_Q_LIMIT;
        dev->features |= IFB_FEATURES;
-        dev->vlan_features |= IFB_FEATURES;
+        dev->vlan_features |= IFB_FEATURES & ~(NETIF_F_HW_VLAN_CTAG_TX |
+                                               NETIF_F_HW_VLAN_STAG_TX);
        dev->flags |= IFF_NOARP;
        dev->flags &= ~IFF_MULTICAST;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 4b970f7624c0..2f6989b1e0dc 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -683,10 +683,9 @@ EXPORT_SYMBOL(phy_detach);
 int phy_suspend(struct phy_device *phydev)
 {
        struct phy_driver *phydrv = to_phy_driver(phydev->dev.driver);
-        struct ethtool_wolinfo wol;
+        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
        /* If the device has WOL enabled, we cannot suspend the PHY */
-        wol.cmd = ETHTOOL_GWOL;
        phy_ethtool_get_wol(phydev, &wol);
        if (wol.wolopts)
                return -EBUSY;
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index dbff290ed0e4..d350d2795e10 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -68,7 +68,6 @@ static struct usb_driver cdc_ncm_driver;
 static int cdc_ncm_setup(struct usbnet *dev)
 {
        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
-        struct usb_cdc_ncm_ntb_parameters ncm_parm;
        u32 val;
        u8 flags;
        u8 iface_no;
@@ -82,22 +81,22 @@ static int cdc_ncm_setup(struct usbnet *dev)
        err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_PARAMETERS,
                              USB_TYPE_CLASS | USB_DIR_IN
                              |USB_RECIP_INTERFACE,
-                              0, iface_no, &ncm_parm,
+                              0, iface_no, &ctx->ncm_parm,
-                              sizeof(ncm_parm));
+                              sizeof(ctx->ncm_parm));
        if (err < 0) {
                dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
                return err; /* GET_NTB_PARAMETERS is required */
        }
        /* read correct set of parameters according to device mode */
-        ctx->rx_max = le32_to_cpu(ncm_parm.dwNtbInMaxSize);
+        ctx->rx_max = le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize);
-        ctx->tx_max = le32_to_cpu(ncm_parm.dwNtbOutMaxSize);
+        ctx->tx_max = le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize);
-        ctx->tx_remainder = le16_to_cpu(ncm_parm.wNdpOutPayloadRemainder);
+        ctx->tx_remainder = le16_to_cpu(ctx->ncm_parm.wNdpOutPayloadRemainder);
-        ctx->tx_modulus = le16_to_cpu(ncm_parm.wNdpOutDivisor);
+        ctx->tx_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutDivisor);
-        ctx->tx_ndp_modulus = le16_to_cpu(ncm_parm.wNdpOutAlignment);
+        ctx->tx_ndp_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutAlignment);
        /* devices prior to NCM Errata shall set this field to zero */
-        ctx->tx_max_datagrams = le16_to_cpu(ncm_parm.wNtbOutMaxDatagrams);
+        ctx->tx_max_datagrams = le16_to_cpu(ctx->ncm_parm.wNtbOutMaxDatagrams);
-        ntb_fmt_supported = le16_to_cpu(ncm_parm.bmNtbFormatsSupported);
+        ntb_fmt_supported = le16_to_cpu(ctx->ncm_parm.bmNtbFormatsSupported);
        /* there are some minor differences in NCM and MBIM defaults */
        if (cdc_ncm_comm_intf_is_mbim(ctx->control->cur_altsetting)) {
@@ -146,7 +145,7 @@ static int cdc_ncm_setup(struct usbnet *dev)
        }
        /* inform device about NTB input size changes */
-        if (ctx->rx_max != le32_to_cpu(ncm_parm.dwNtbInMaxSize)) {
+        if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
                __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
                err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_INPUT_SIZE,
@@ -162,14 +161,6 @@ static int cdc_ncm_setup(struct usbnet *dev)
                dev_dbg(&dev->intf->dev, "Using default maximum transmit length=%d\n",
                        CDC_NCM_NTB_MAX_SIZE_TX);
                ctx->tx_max = CDC_NCM_NTB_MAX_SIZE_TX;
-                /* Adding a pad byte here simplifies the handling in
-                 * cdc_ncm_fill_tx_frame, by making tx_max always
-                 * represent the real skb max size.
-                 */
-                if (ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
-                        ctx->tx_max++;
        }
        /*
@@ -439,6 +430,10 @@ advance:
                goto error2;
        }
+        /* initialize data interface */
+        if (cdc_ncm_setup(dev))
+                goto error2;
        /* configure data interface */
        temp = usb_set_interface(dev->udev, iface_no, data_altsetting);
        if (temp) {
@@ -453,12 +448,6 @@ advance:
                goto error2;
        }
-        /* initialize data interface */
-        if (cdc_ncm_setup(dev)) {
-                dev_dbg(&intf->dev, "cdc_ncm_setup() failed\n");
-                goto error2;
-        }
        usb_set_intfdata(ctx->data, dev);
        usb_set_intfdata(ctx->control, dev);
@@ -475,6 +464,15 @@ advance:
        dev->hard_mtu = ctx->tx_max;
        dev->rx_urb_size = ctx->rx_max;
+        /* cdc_ncm_setup will override dwNtbOutMaxSize if it is
+         * outside the sane range. Adding a pad byte here if necessary
+         * simplifies the handling in cdc_ncm_fill_tx_frame, making
+         * tx_max always represent the real skb max size.
+         */
+        if (ctx->tx_max != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
+            ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
+                ctx->tx_max++;
        return 0;
 error2:
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index dd10d5817d2a..f9e96c427558 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -752,14 +752,12 @@ EXPORT_SYMBOL_GPL(usbnet_unlink_rx_urbs);
 // precondition: never called in_interrupt
 static void usbnet_terminate_urbs(struct usbnet *dev)
 {
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(unlink_wakeup);
        DECLARE_WAITQUEUE(wait, current);
        int temp;
        /* ensure there are no more active urbs */
-        add_wait_queue(&unlink_wakeup, &wait);
+        add_wait_queue(&dev->wait, &wait);
        set_current_state(TASK_UNINTERRUPTIBLE);
-        dev->wait = &unlink_wakeup;
        temp = unlink_urbs(dev, &dev->txq) +
                unlink_urbs(dev, &dev->rxq);
@@ -773,15 +771,14 @@ static void usbnet_terminate_urbs(struct usbnet *dev)
                                  "waited for %d urb completions\n", temp);
        }
        set_current_state(TASK_RUNNING);
-        dev->wait = NULL;
+        remove_wait_queue(&dev->wait, &wait);
-        remove_wait_queue(&unlink_wakeup, &wait);
 }
 int usbnet_stop (struct net_device *net)
 {
        struct usbnet           *dev = netdev_priv(net);
        struct driver_info      *info = dev->driver_info;
-        int                     retval;
+        int                     retval, pm;
        clear_bit(EVENT_DEV_OPEN, &dev->flags);
        netif_stop_queue (net);
@@ -791,6 +788,8 @@ int usbnet_stop (struct net_device *net)
                   net->stats.rx_packets, net->stats.tx_packets,
                   net->stats.rx_errors, net->stats.tx_errors);
+        /* to not race resume */
+        pm = usb_autopm_get_interface(dev->intf);
        /* allow minidriver to stop correctly (wireless devices to turn off
         * radio etc) */
        if (info->stop) {
@@ -817,6 +816,9 @@ int usbnet_stop (struct net_device *net)
        dev->flags = 0;
        del_timer_sync (&dev->delay);
        tasklet_kill (&dev->bh);
+        if (!pm)
+                usb_autopm_put_interface(dev->intf);
        if (info->manage_power &&
            !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags))
                info->manage_power(dev, 0);
@@ -1437,11 +1439,12 @@ static void usbnet_bh (unsigned long param)
        /* restart RX again after disabling due to high error rate */
        clear_bit(EVENT_RX_KILL, &dev->flags);
-        // waiting for all pending urbs to complete?
+        /* waiting for all pending urbs to complete?
-        if (dev->wait) {
+         * only then can we forgo submitting anew
-                if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
+         */
-                        wake_up (dev->wait);
+        if (waitqueue_active(&dev->wait)) {
-                }
+                if (dev->txq.qlen + dev->rxq.qlen + dev->done.qlen == 0)
+                        wake_up_all(&dev->wait);
        // or are we maybe short a few urbs?
        } else if (netif_running (dev->net) &&
@@ -1580,6 +1583,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        dev->driver_name = name;
        dev->msg_enable = netif_msg_init (msg_level, NETIF_MSG_DRV
                                | NETIF_MSG_PROBE | NETIF_MSG_LINK);
+        init_waitqueue_head(&dev->wait);
        skb_queue_head_init (&dev->rxq);
        skb_queue_head_init (&dev->txq);
        skb_queue_head_init (&dev->done);
@@ -1791,9 +1795,10 @@ int usbnet_resume (struct usb_interface *intf)
                spin_unlock_irq(&dev->txq.lock);
                if (test_bit(EVENT_DEV_OPEN, &dev->flags)) {
-                        /* handle remote wakeup ASAP */
+                        /* handle remote wakeup ASAP
-                        if (!dev->wait &&
+                         * we cannot race against stop
-                                netif_device_present(dev->net) &&
+                         */
+                        if (netif_device_present(dev->net) &&
                                !timer_pending(&dev->delay) &&
                                !test_bit(EVENT_RX_HALT, &dev->flags))
                                        rx_alloc_submit(dev, GFP_NOIO);
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 5b374370f71c..c0e7c64765ab 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -286,7 +286,10 @@ static void veth_setup(struct net_device *dev)
        dev->features |= NETIF_F_LLTX;
        dev->features |= VETH_FEATURES;
        dev->vlan_features = dev->features &
-                             ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX);
+                             ~(NETIF_F_HW_VLAN_CTAG_TX |
+                               NETIF_F_HW_VLAN_STAG_TX |
+                               NETIF_F_HW_VLAN_CTAG_RX |
+                               NETIF_F_HW_VLAN_STAG_RX);
        dev->destructor = veth_dev_free;
        dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 5632a99cbbd2..841b60831df1 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -671,8 +671,7 @@ static bool try_fill_recv(struct receive_queue *rq, gfp_t gfp)
                if (err)
                        break;
        } while (rq->vq->num_free);
-        if (unlikely(!virtqueue_kick(rq->vq)))
+        virtqueue_kick(rq->vq);
-                return false;
        return !oom;
 }
@@ -877,7 +876,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
        err = xmit_skb(sq, skb);
        /* This should not happen! */
-        if (unlikely(err) || unlikely(!virtqueue_kick(sq->vq))) {
+        if (unlikely(err)) {
                dev->stats.tx_fifo_errors++;
                if (net_ratelimit())
                        dev_warn(&dev->dev,
@@ -886,6 +885,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
                kfree_skb(skb);
                return NETDEV_TX_OK;
        }
+        virtqueue_kick(sq->vq);
        /* Don't wait up for transmitted skbs to be freed. */
        skb_orphan(skb);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index b0f705c2378f..1236812c7be6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1318,6 +1318,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb)
                neigh_release(n);
+                if (reply == NULL)
+                        goto out;
                skb_reset_mac_header(reply);
                __skb_pull(reply, skb_network_offset(reply));
                reply->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1339,15 +1342,103 @@ out:
 }
 #if IS_ENABLED(CONFIG_IPV6)
+static struct sk_buff *vxlan_na_create(struct sk_buff *request,
+        struct neighbour *n, bool isrouter)
+{
+        struct net_device *dev = request->dev;
+        struct sk_buff *reply;
+        struct nd_msg *ns, *na;
+        struct ipv6hdr *pip6;
+        u8 *daddr;
+        int na_olen = 8; /* opt hdr + ETH_ALEN for target */
+        int ns_olen;
+        int i, len;
+        if (dev == NULL)
+                return NULL;
+        len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
+                sizeof(*na) + na_olen + dev->needed_tailroom;
+        reply = alloc_skb(len, GFP_ATOMIC);
+        if (reply == NULL)
+                return NULL;
+        reply->protocol = htons(ETH_P_IPV6);
+        reply->dev = dev;
+        skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
+        skb_push(reply, sizeof(struct ethhdr));
+        skb_set_mac_header(reply, 0);
+        ns = (struct nd_msg *)skb_transport_header(request);
+        daddr = eth_hdr(request)->h_source;
+        ns_olen = request->len - skb_transport_offset(request) - sizeof(*ns);
+        for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
+                if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
+                        daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+                        break;
+                }
+        }
+        /* Ethernet header */
+        ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+        ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
+        eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
+        reply->protocol = htons(ETH_P_IPV6);
+        skb_pull(reply, sizeof(struct ethhdr));
+        skb_set_network_header(reply, 0);
+        skb_put(reply, sizeof(struct ipv6hdr));
+        /* IPv6 header */
+        pip6 = ipv6_hdr(reply);
+        memset(pip6, 0, sizeof(struct ipv6hdr));
+        pip6->version = 6;
+        pip6->priority = ipv6_hdr(request)->priority;
+        pip6->nexthdr = IPPROTO_ICMPV6;
+        pip6->hop_limit = 255;
+        pip6->daddr = ipv6_hdr(request)->saddr;
+        pip6->saddr = *(struct in6_addr *)n->primary_key;
+        skb_pull(reply, sizeof(struct ipv6hdr));
+        skb_set_transport_header(reply, 0);
+        na = (struct nd_msg *)skb_put(reply, sizeof(*na) + na_olen);
+        /* Neighbor Advertisement */
+        memset(na, 0, sizeof(*na)+na_olen);
+        na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+        na->icmph.icmp6_router = isrouter;
+        na->icmph.icmp6_override = 1;
+        na->icmph.icmp6_solicited = 1;
+        na->target = ns->target;
+        ether_addr_copy(&na->opt[2], n->ha);
+        na->opt[0] = ND_OPT_TARGET_LL_ADDR;
+        na->opt[1] = na_olen >> 3;
+        na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
+                &pip6->daddr, sizeof(*na)+na_olen, IPPROTO_ICMPV6,
+                csum_partial(na, sizeof(*na)+na_olen, 0));
+        pip6->payload_len = htons(sizeof(*na)+na_olen);
+        skb_push(reply, sizeof(struct ipv6hdr));
+        reply->ip_summed = CHECKSUM_UNNECESSARY;
+        return reply;
+}
 static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
 {
        struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct neighbour *n;
+        struct nd_msg *msg;
-        union vxlan_addr ipa;
        const struct ipv6hdr *iphdr;
        const struct in6_addr *saddr, *daddr;
-        struct nd_msg *msg;
+        struct neighbour *n;
-        struct inet6_dev *in6_dev = NULL;
+        struct inet6_dev *in6_dev;
        in6_dev = __in6_dev_get(dev);
        if (!in6_dev)
@@ -1360,19 +1451,20 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
        saddr = &iphdr->saddr;
        daddr = &iphdr->daddr;
-        if (ipv6_addr_loopback(daddr) ||
-            ipv6_addr_is_multicast(daddr))
-                goto out;
        msg = (struct nd_msg *)skb_transport_header(skb);
        if (msg->icmph.icmp6_code != 0 ||
            msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
                goto out;
-        n = neigh_lookup(ipv6_stub->nd_tbl, daddr, dev);
+        if (ipv6_addr_loopback(daddr) ||
+            ipv6_addr_is_multicast(&msg->target))
+                goto out;
+        n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev);
        if (n) {
                struct vxlan_fdb *f;
+                struct sk_buff *reply;
                if (!(n->nud_state & NUD_CONNECTED)) {
                        neigh_release(n);
@@ -1386,13 +1478,23 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
                        goto out;
                }
-                ipv6_stub->ndisc_send_na(dev, n, saddr, &msg->target,
+                reply = vxlan_na_create(skb, n,
-                                         !!in6_dev->cnf.forwarding,
+                                        !!(f ? f->flags & NTF_ROUTER : 0));
-                                         true, false, false);
                neigh_release(n);
+                if (reply == NULL)
+                        goto out;
+                if (netif_rx_ni(reply) == NET_RX_DROP)
+                        dev->stats.rx_dropped++;
        } else if (vxlan->flags & VXLAN_F_L3MISS) {
-                ipa.sin6.sin6_addr = *daddr;
+                union vxlan_addr ipa = {
-                ipa.sa.sa_family = AF_INET6;
+                        .sin6.sin6_addr = msg->target,
+                        .sa.sa_family = AF_INET6,
+                };
                vxlan_ip_miss(dev, &ipa);
        }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 303ce27964c1..9078a6c5a74e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1548,6 +1548,7 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
                if (reg != last_val)
                        return true;
+                udelay(1);
                last_val = reg;
                if ((reg & 0x7E7FFFEF) == 0x00702400)
                        continue;
@@ -1560,8 +1561,6 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
                default:
                        return true;
                }
-                udelay(1);
        } while (count-- > 0);
        return false;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index f042a18c8495..55897d508a76 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2063,7 +2063,7 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
        ATH_TXBUF_RESET(bf);
-        if (tid) {
+        if (tid && ieee80211_is_data_present(hdr->frame_control)) {
                fragno = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
                seqno = tid->seq_next;
                hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
@@ -2186,7 +2186,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                txq->stopped = true;
        }
-        if (txctl->an)
+        if (txctl->an && ieee80211_is_data_present(hdr->frame_control))
                tid = ath_get_skb_tid(sc, txctl->an, skb);
        if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 119ee6eaf1c3..ddaa9efd053d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -1948,8 +1948,10 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
                if (pkt_pad == NULL)
                        return -ENOMEM;
                ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
-                if (unlikely(ret < 0))
+                if (unlikely(ret < 0)) {
+                        kfree_skb(pkt_pad);
                        return ret;
+                }
                memcpy(pkt_pad->data,
                       pkt->data + pkt->len - tail_chop,
                       tail_chop);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 7f8b5d156c8c..41d4a8167dc3 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -5460,14 +5460,15 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
        rt2800_bbp_write(rt2x00dev, 68, 0x0b);
-        rt2800_bbp_write(rt2x00dev, 69, 0x0d);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
-        rt2800_bbp_write(rt2x00dev, 70, 0x06);
        rt2800_bbp_write(rt2x00dev, 73, 0x13);
        rt2800_bbp_write(rt2x00dev, 75, 0x46);
        rt2800_bbp_write(rt2x00dev, 76, 0x28);
        rt2800_bbp_write(rt2x00dev, 77, 0x59);
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
        rt2800_bbp_write(rt2x00dev, 79, 0x13);
        rt2800_bbp_write(rt2x00dev, 80, 0x05);
        rt2800_bbp_write(rt2x00dev, 81, 0x33);
@@ -5510,7 +5511,6 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
        if (rt2x00_rt(rt2x00dev, RT5392)) {
                rt2800_bbp_write(rt2x00dev, 134, 0xd0);
                rt2800_bbp_write(rt2x00dev, 135, 0xf6);
-                rt2800_bbp_write(rt2x00dev, 148, 0x84);
        }
        rt2800_disable_unused_dac_adc(rt2x00dev);
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index ed880891cb7c..e9279a8c1e1c 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -594,13 +594,13 @@ static void bnx2fc_free_mp_resc(struct bnx2fc_cmd *io_req)
                mp_req->mp_resp_bd = NULL;
        }
        if (mp_req->req_buf) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                     mp_req->req_buf,
                                     mp_req->req_buf_dma);
                mp_req->req_buf = NULL;
        }
        if (mp_req->resp_buf) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                     mp_req->resp_buf,
                                     mp_req->resp_buf_dma);
                mp_req->resp_buf = NULL;
@@ -622,7 +622,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
        mp_req->req_len = sizeof(struct fcp_cmnd);
        io_req->data_xfer_len = mp_req->req_len;
-        mp_req->req_buf = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        mp_req->req_buf = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                             &mp_req->req_buf_dma,
                                             GFP_ATOMIC);
        if (!mp_req->req_buf) {
@@ -631,7 +631,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
                return FAILED;
        }
-        mp_req->resp_buf = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        mp_req->resp_buf = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                              &mp_req->resp_buf_dma,
                                              GFP_ATOMIC);
        if (!mp_req->resp_buf) {
@@ -639,8 +639,8 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
                bnx2fc_free_mp_resc(io_req);
                return FAILED;
        }
-        memset(mp_req->req_buf, 0, PAGE_SIZE);
+        memset(mp_req->req_buf, 0, CNIC_PAGE_SIZE);
-        memset(mp_req->resp_buf, 0, PAGE_SIZE);
+        memset(mp_req->resp_buf, 0, CNIC_PAGE_SIZE);
        /* Allocate and map mp_req_bd and mp_resp_bd */
        sz = sizeof(struct fcoe_bd_ctx);
@@ -665,7 +665,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
        mp_req_bd = mp_req->mp_req_bd;
        mp_req_bd->buf_addr_lo = (u32)addr & 0xffffffff;
        mp_req_bd->buf_addr_hi = (u32)((u64)addr >> 32);
-        mp_req_bd->buf_len = PAGE_SIZE;
+        mp_req_bd->buf_len = CNIC_PAGE_SIZE;
        mp_req_bd->flags = 0;
        /*
@@ -677,7 +677,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
        addr = mp_req->resp_buf_dma;
        mp_resp_bd->buf_addr_lo = (u32)addr & 0xffffffff;
        mp_resp_bd->buf_addr_hi = (u32)((u64)addr >> 32);
-        mp_resp_bd->buf_len = PAGE_SIZE;
+        mp_resp_bd->buf_len = CNIC_PAGE_SIZE;
        mp_resp_bd->flags = 0;
        return SUCCESS;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c
index 4d93177dfb53..d9bae5672273 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c
@@ -673,7 +673,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map SQ */
        tgt->sq_mem_size = tgt->max_sqes * BNX2FC_SQ_WQE_SIZE;
-        tgt->sq_mem_size = (tgt->sq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->sq_mem_size = (tgt->sq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->sq = dma_alloc_coherent(&hba->pcidev->dev, tgt->sq_mem_size,
                                     &tgt->sq_dma, GFP_KERNEL);
@@ -686,7 +687,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map CQ */
        tgt->cq_mem_size = tgt->max_cqes * BNX2FC_CQ_WQE_SIZE;
-        tgt->cq_mem_size = (tgt->cq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->cq_mem_size = (tgt->cq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->cq = dma_alloc_coherent(&hba->pcidev->dev, tgt->cq_mem_size,
                                     &tgt->cq_dma, GFP_KERNEL);
@@ -699,7 +701,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map RQ and RQ PBL */
        tgt->rq_mem_size = tgt->max_rqes * BNX2FC_RQ_WQE_SIZE;
-        tgt->rq_mem_size = (tgt->rq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->rq_mem_size = (tgt->rq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->rq = dma_alloc_coherent(&hba->pcidev->dev, tgt->rq_mem_size,
                                        &tgt->rq_dma, GFP_KERNEL);
@@ -710,8 +713,9 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        }
        memset(tgt->rq, 0, tgt->rq_mem_size);
-        tgt->rq_pbl_size = (tgt->rq_mem_size / PAGE_SIZE) * sizeof(void *);
+        tgt->rq_pbl_size = (tgt->rq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
-        tgt->rq_pbl_size = (tgt->rq_pbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->rq_pbl_size = (tgt->rq_pbl_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
        tgt->rq_pbl = dma_alloc_coherent(&hba->pcidev->dev, tgt->rq_pbl_size,
                                         &tgt->rq_pbl_dma, GFP_KERNEL);
@@ -722,7 +726,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        }
        memset(tgt->rq_pbl, 0, tgt->rq_pbl_size);
-        num_pages = tgt->rq_mem_size / PAGE_SIZE;
+        num_pages = tgt->rq_mem_size / CNIC_PAGE_SIZE;
        page = tgt->rq_dma;
        pbl = (u32 *)tgt->rq_pbl;
@@ -731,13 +735,13 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
                pbl++;
                *pbl = (u32)((u64)page >> 32);
                pbl++;
-                page += PAGE_SIZE;
+                page += CNIC_PAGE_SIZE;
        }
        /* Allocate and map XFERQ */
        tgt->xferq_mem_size = tgt->max_sqes * BNX2FC_XFERQ_WQE_SIZE;
-        tgt->xferq_mem_size = (tgt->xferq_mem_size + (PAGE_SIZE - 1)) &
+        tgt->xferq_mem_size = (tgt->xferq_mem_size + (CNIC_PAGE_SIZE - 1)) &
-                               PAGE_MASK;
+                               CNIC_PAGE_MASK;
        tgt->xferq = dma_alloc_coherent(&hba->pcidev->dev, tgt->xferq_mem_size,
                                        &tgt->xferq_dma, GFP_KERNEL);
@@ -750,8 +754,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map CONFQ & CONFQ PBL */
        tgt->confq_mem_size = tgt->max_sqes * BNX2FC_CONFQ_WQE_SIZE;
-        tgt->confq_mem_size = (tgt->confq_mem_size + (PAGE_SIZE - 1)) &
+        tgt->confq_mem_size = (tgt->confq_mem_size + (CNIC_PAGE_SIZE - 1)) &
-                               PAGE_MASK;
+                               CNIC_PAGE_MASK;
        tgt->confq = dma_alloc_coherent(&hba->pcidev->dev, tgt->confq_mem_size,
                                        &tgt->confq_dma, GFP_KERNEL);
@@ -763,9 +767,9 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        memset(tgt->confq, 0, tgt->confq_mem_size);
        tgt->confq_pbl_size =
-                (tgt->confq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (tgt->confq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        tgt->confq_pbl_size =
-                (tgt->confq_pbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (tgt->confq_pbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        tgt->confq_pbl = dma_alloc_coherent(&hba->pcidev->dev,
                                            tgt->confq_pbl_size,
@@ -777,7 +781,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        }
        memset(tgt->confq_pbl, 0, tgt->confq_pbl_size);
-        num_pages = tgt->confq_mem_size / PAGE_SIZE;
+        num_pages = tgt->confq_mem_size / CNIC_PAGE_SIZE;
        page = tgt->confq_dma;
        pbl = (u32 *)tgt->confq_pbl;
@@ -786,7 +790,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
                pbl++;
                *pbl = (u32)((u64)page >> 32);
                pbl++;
-                page += PAGE_SIZE;
+                page += CNIC_PAGE_SIZE;
        }
        /* Allocate and map ConnDB */
@@ -805,8 +809,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
        /* Allocate and map LCQ */
        tgt->lcq_mem_size = (tgt->max_sqes + 8) * BNX2FC_SQ_WQE_SIZE;
-        tgt->lcq_mem_size = (tgt->lcq_mem_size + (PAGE_SIZE - 1)) &
+        tgt->lcq_mem_size = (tgt->lcq_mem_size + (CNIC_PAGE_SIZE - 1)) &
-                             PAGE_MASK;
+                             CNIC_PAGE_MASK;
        tgt->lcq = dma_alloc_coherent(&hba->pcidev->dev, tgt->lcq_mem_size,
                                      &tgt->lcq_dma, GFP_KERNEL);
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index e4cf23df4b4f..b87a1933f880 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -61,7 +61,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
         * yield integral num of page buffers
         */
        /* adjust SQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
        if (hba->max_sqes < num_elements_per_pg)
                hba->max_sqes = num_elements_per_pg;
        else if (hba->max_sqes % num_elements_per_pg)
@@ -69,7 +69,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
                                 ~(num_elements_per_pg - 1);
        /* adjust CQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_CQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_CQE_SIZE;
        if (hba->max_cqes < num_elements_per_pg)
                hba->max_cqes = num_elements_per_pg;
        else if (hba->max_cqes % num_elements_per_pg)
@@ -77,7 +77,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
                                 ~(num_elements_per_pg - 1);
        /* adjust RQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_RQ_WQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_RQ_WQE_SIZE;
        if (hba->max_rqes < num_elements_per_pg)
                hba->max_rqes = num_elements_per_pg;
        else if (hba->max_rqes % num_elements_per_pg)
@@ -959,7 +959,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
        /* SQ page table */
        memset(ep->qp.sq_pgtbl_virt, 0, ep->qp.sq_pgtbl_size);
-        num_pages = ep->qp.sq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.sq_mem_size / CNIC_PAGE_SIZE;
        page = ep->qp.sq_phys;
        if (cnic_dev_10g)
@@ -973,7 +973,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) ((u64) page >> 32);
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                } else {
                        /* PTE is written in big endian format for
                         * 5706/5708/5709 devices */
@@ -981,13 +981,13 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) page;
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                }
        }
        /* RQ page table */
        memset(ep->qp.rq_pgtbl_virt, 0, ep->qp.rq_pgtbl_size);
-        num_pages = ep->qp.rq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.rq_mem_size / CNIC_PAGE_SIZE;
        page = ep->qp.rq_phys;
        if (cnic_dev_10g)
@@ -1001,7 +1001,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) ((u64) page >> 32);
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                } else {
                        /* PTE is written in big endian format for
                         * 5706/5708/5709 devices */
@@ -1009,13 +1009,13 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) page;
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                }
        }
        /* CQ page table */
        memset(ep->qp.cq_pgtbl_virt, 0, ep->qp.cq_pgtbl_size);
-        num_pages = ep->qp.cq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.cq_mem_size / CNIC_PAGE_SIZE;
        page = ep->qp.cq_phys;
        if (cnic_dev_10g)
@@ -1029,7 +1029,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) ((u64) page >> 32);
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                } else {
                        /* PTE is written in big endian format for
                         * 5706/5708/5709 devices */
@@ -1037,7 +1037,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                        ptbl++;
                        *ptbl = (u32) page;
                        ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                }
        }
 }
@@ -1064,11 +1064,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
        /* Allocate page table memory for SQ which is page aligned */
        ep->qp.sq_mem_size = hba->max_sqes * BNX2I_SQ_WQE_SIZE;
        ep->qp.sq_mem_size =
-                (ep->qp.sq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.sq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.sq_pgtbl_size =
-                (ep->qp.sq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.sq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        ep->qp.sq_pgtbl_size =
-                (ep->qp.sq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.sq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.sq_pgtbl_virt =
                dma_alloc_coherent(&hba->pcidev->dev, ep->qp.sq_pgtbl_size,
@@ -1101,11 +1101,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
        /* Allocate page table memory for CQ which is page aligned */
        ep->qp.cq_mem_size = hba->max_cqes * BNX2I_CQE_SIZE;
        ep->qp.cq_mem_size =
-                (ep->qp.cq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.cq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.cq_pgtbl_size =
-                (ep->qp.cq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.cq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        ep->qp.cq_pgtbl_size =
-                (ep->qp.cq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.cq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.cq_pgtbl_virt =
                dma_alloc_coherent(&hba->pcidev->dev, ep->qp.cq_pgtbl_size,
@@ -1144,11 +1144,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
        /* Allocate page table memory for RQ which is page aligned */
        ep->qp.rq_mem_size = hba->max_rqes * BNX2I_RQ_WQE_SIZE;
        ep->qp.rq_mem_size =
-                (ep->qp.rq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.rq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.rq_pgtbl_size =
-                (ep->qp.rq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.rq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
        ep->qp.rq_pgtbl_size =
-                (ep->qp.rq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.rq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
        ep->qp.rq_pgtbl_virt =
                dma_alloc_coherent(&hba->pcidev->dev, ep->qp.rq_pgtbl_size,
@@ -1270,7 +1270,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
        bnx2i_adjust_qp_size(hba);
        iscsi_init.flags =
-                ISCSI_PAGE_SIZE_4K << ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT;
+                (CNIC_PAGE_BITS - 8) << ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT;
        if (en_tcp_dack)
                iscsi_init.flags |= ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE;
        iscsi_init.reserved0 = 0;
@@ -1288,15 +1288,15 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
                        ((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16));
        iscsi_init.num_ccells_per_conn = hba->num_ccell;
        iscsi_init.num_tasks_per_conn = hba->max_sqes;
-        iscsi_init.sq_wqes_per_page = PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
+        iscsi_init.sq_wqes_per_page = CNIC_PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
        iscsi_init.sq_num_wqes = hba->max_sqes;
        iscsi_init.cq_log_wqes_per_page =
-                (u8) bnx2i_power_of2(PAGE_SIZE / BNX2I_CQE_SIZE);
+                (u8) bnx2i_power_of2(CNIC_PAGE_SIZE / BNX2I_CQE_SIZE);
        iscsi_init.cq_num_wqes = hba->max_cqes;
        iscsi_init.cq_num_pages = (hba->max_cqes * BNX2I_CQE_SIZE +
-                                   (PAGE_SIZE - 1)) / PAGE_SIZE;
+                                   (CNIC_PAGE_SIZE - 1)) / CNIC_PAGE_SIZE;
        iscsi_init.sq_num_pages = (hba->max_sqes * BNX2I_SQ_WQE_SIZE +
-                                   (PAGE_SIZE - 1)) / PAGE_SIZE;
+                                   (CNIC_PAGE_SIZE - 1)) / CNIC_PAGE_SIZE;
        iscsi_init.rq_buffer_size = BNX2I_RQ_WQE_SIZE;
        iscsi_init.rq_num_wqes = hba->max_rqes;
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
index 854dad7d5b03..c8b0aff5bbd4 100644
--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -525,7 +525,7 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
        struct iscsi_bd *mp_bdt;
        u64 addr;
-        hba->mp_bd_tbl = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        hba->mp_bd_tbl = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                            &hba->mp_bd_dma, GFP_KERNEL);
        if (!hba->mp_bd_tbl) {
                printk(KERN_ERR "unable to allocate Middle Path BDT\n");
@@ -533,11 +533,12 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
                goto out;
        }
-        hba->dummy_buffer = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        hba->dummy_buffer = dma_alloc_coherent(&hba->pcidev->dev,
+                                               CNIC_PAGE_SIZE,
                                               &hba->dummy_buf_dma, GFP_KERNEL);
        if (!hba->dummy_buffer) {
                printk(KERN_ERR "unable to alloc Middle Path Dummy Buffer\n");
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  hba->mp_bd_tbl, hba->mp_bd_dma);
                hba->mp_bd_tbl = NULL;
                rc = -1;
@@ -548,7 +549,7 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
        addr = (unsigned long) hba->dummy_buf_dma;
        mp_bdt->buffer_addr_lo = addr & 0xffffffff;
        mp_bdt->buffer_addr_hi = addr >> 32;
-        mp_bdt->buffer_length = PAGE_SIZE;
+        mp_bdt->buffer_length = CNIC_PAGE_SIZE;
        mp_bdt->flags = ISCSI_BD_LAST_IN_BD_CHAIN |
                        ISCSI_BD_FIRST_IN_BD_CHAIN;
 out:
@@ -565,12 +566,12 @@ out:
 static void bnx2i_free_mp_bdt(struct bnx2i_hba *hba)
 {
        if (hba->mp_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  hba->mp_bd_tbl, hba->mp_bd_dma);
                hba->mp_bd_tbl = NULL;
        }
        if (hba->dummy_buffer) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  hba->dummy_buffer, hba->dummy_buf_dma);
                hba->dummy_buffer = NULL;
        }
@@ -934,14 +935,14 @@ static void bnx2i_conn_free_login_resources(struct bnx2i_hba *hba,
                                            struct bnx2i_conn *bnx2i_conn)
 {
        if (bnx2i_conn->gen_pdu.resp_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  bnx2i_conn->gen_pdu.resp_bd_tbl,
                                  bnx2i_conn->gen_pdu.resp_bd_dma);
                bnx2i_conn->gen_pdu.resp_bd_tbl = NULL;
        }
        if (bnx2i_conn->gen_pdu.req_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                  bnx2i_conn->gen_pdu.req_bd_tbl,
                                  bnx2i_conn->gen_pdu.req_bd_dma);
                bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
@@ -998,13 +999,13 @@ static int bnx2i_conn_alloc_login_resources(struct bnx2i_hba *hba,
        bnx2i_conn->gen_pdu.resp_wr_ptr = bnx2i_conn->gen_pdu.resp_buf;
        bnx2i_conn->gen_pdu.req_bd_tbl =
-                dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   &bnx2i_conn->gen_pdu.req_bd_dma, GFP_KERNEL);
        if (bnx2i_conn->gen_pdu.req_bd_tbl == NULL)
                goto login_req_bd_tbl_failure;
        bnx2i_conn->gen_pdu.resp_bd_tbl =
-                dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   &bnx2i_conn->gen_pdu.resp_bd_dma,
                                   GFP_KERNEL);
        if (bnx2i_conn->gen_pdu.resp_bd_tbl == NULL)
@@ -1013,7 +1014,7 @@ static int bnx2i_conn_alloc_login_resources(struct bnx2i_hba *hba,
        return 0;
 login_resp_bd_tbl_failure:
-        dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                          bnx2i_conn->gen_pdu.req_bd_tbl,
                          bnx2i_conn->gen_pdu.req_bd_dma);
        bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index cf86e729532b..dc697cee248a 100644
--- a/drivers/tty/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
@@ -433,13 +433,10 @@ static void sunhv_console_write_paged(struct console *con, const char *s, unsign
        unsigned long flags;
        int locked = 1;
-        local_irq_save(flags);
+        if (port->sysrq || oops_in_progress)
-        if (port->sysrq) {
+                locked = spin_trylock_irqsave(&port->lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&port->lock, flags);
-                locked = spin_trylock(&port->lock);
-        } else
-                spin_lock(&port->lock);
        while (n > 0) {
                unsigned long ra = __pa(con_write_page);
@@ -470,8 +467,7 @@ static void sunhv_console_write_paged(struct console *con, const char *s, unsign
        }
        if (locked)
-                spin_unlock(&port->lock);
+                spin_unlock_irqrestore(&port->lock, flags);
-        local_irq_restore(flags);
 }
 static inline void sunhv_console_putchar(struct uart_port *port, char c)
@@ -492,7 +488,10 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
        unsigned long flags;
        int i, locked = 1;
-        local_irq_save(flags);
+        if (port->sysrq || oops_in_progress)
+                locked = spin_trylock_irqsave(&port->lock, flags);
+        else
+                spin_lock_irqsave(&port->lock, flags);
        if (port->sysrq) {
                locked = 0;
        } else if (oops_in_progress) {
@@ -507,8 +506,7 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
        }
        if (locked)
-                spin_unlock(&port->lock);
+                spin_unlock_irqrestore(&port->lock, flags);
-        local_irq_restore(flags);
 }
 static struct console sunhv_console = {
diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
index 380fb5355cb2..5faa8e905e98 100644
--- a/drivers/tty/serial/sunsab.c
+++ b/drivers/tty/serial/sunsab.c
@@ -844,20 +844,16 @@ static void sunsab_console_write(struct console *con, const char *s, unsigned n)
        unsigned long flags;
        int locked = 1;
-        local_irq_save(flags);
+        if (up->port.sysrq || oops_in_progress)
-        if (up->port.sysrq) {
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&up->port.lock, flags);
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
        uart_console_write(&up->port, s, n, sunsab_console_putchar);
        sunsab_tec_wait(up);
        if (locked)
-                spin_unlock(&up->port.lock);
+                spin_unlock_irqrestore(&up->port.lock, flags);
-        local_irq_restore(flags);
 }
 static int sunsab_console_setup(struct console *con, char *options)
diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
index db79b76f5c8e..9a0f24f83720 100644
--- a/drivers/tty/serial/sunsu.c
+++ b/drivers/tty/serial/sunsu.c
@@ -1295,13 +1295,10 @@ static void sunsu_console_write(struct console *co, const char *s,
        unsigned int ier;
        int locked = 1;
-        local_irq_save(flags);
+        if (up->port.sysrq || oops_in_progress)
-        if (up->port.sysrq) {
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&up->port.lock, flags);
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
        /*
         *      First save the UER then disable the interrupts
@@ -1319,8 +1316,7 @@ static void sunsu_console_write(struct console *co, const char *s,
        serial_out(up, UART_IER, ier);
        if (locked)
-                spin_unlock(&up->port.lock);
+                spin_unlock_irqrestore(&up->port.lock, flags);
-        local_irq_restore(flags);
 }
 /*
diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
index 45a8c6aa5837..a2c40ed287d2 100644
--- a/drivers/tty/serial/sunzilog.c
+++ b/drivers/tty/serial/sunzilog.c
@@ -1195,20 +1195,16 @@ sunzilog_console_write(struct console *con, const char *s, unsigned int count)
        unsigned long flags;
        int locked = 1;
-        local_irq_save(flags);
+        if (up->port.sysrq || oops_in_progress)
-        if (up->port.sysrq) {
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
-                locked = 0;
+        else
-        } else if (oops_in_progress) {
+                spin_lock_irqsave(&up->port.lock, flags);
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
        uart_console_write(&up->port, s, count, sunzilog_putchar);
        udelay(2);
        if (locked)
-                spin_unlock(&up->port.lock);
+                spin_unlock_irqrestore(&up->port.lock, flags);
-        local_irq_restore(flags);
 }
 static int __init sunzilog_console_setup(struct console *con, char *options)
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index a0fa5de210cf..e1e22e0f01e8 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -505,9 +505,13 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
                        r = -ENOBUFS;
                        goto err;
                }
-                d = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg,
+                r = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg,
                                      ARRAY_SIZE(vq->iov) - seg, &out,
                                      &in, log, log_num);
+                if (unlikely(r < 0))
+                        goto err;
+                d = r;
                if (d == vq->num) {
                        r = 0;
                        goto err;
@@ -532,6 +536,12 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
        *iovcount = seg;
        if (unlikely(log))
                *log_num = nlogs;
+        /* Detect overrun */
+        if (unlikely(datalen > 0)) {
+                r = UIO_MAXIOV + 1;
+                goto err;
+        }
        return headcount;
 err:
        vhost_discard_vq_desc(vq, headcount);
@@ -587,6 +597,14 @@ static void handle_rx(struct vhost_net *net)
                /* On error, stop handling until the next kick. */
                if (unlikely(headcount < 0))
                        break;
+                /* On overrun, truncate and discard */
+                if (unlikely(headcount > UIO_MAXIOV)) {
+                        msg.msg_iovlen = 1;
+                        err = sock->ops->recvmsg(NULL, sock, &msg,
+                                                 1, MSG_DONTWAIT | MSG_TRUNC);
+                        pr_debug("Discarded rx packet: len %zd\n", sock_len);
+                        continue;
+                }
                /* OK, now we need to know about added descriptors. */
                if (!headcount) {
                        if (unlikely(vhost_enable_notify(&net->dev, vq))) {
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 37d06ea624aa..61a6ac8fa8fc 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -399,11 +399,25 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                        state = BP_EAGAIN;
                        break;
                }
+                scrub_page(page);
-                pfn = page_to_pfn(page);
+                frame_list[i] = page_to_pfn(page);
-                frame_list[i] = pfn_to_mfn(pfn);
+        }
-                scrub_page(page);
+        /*
+         * Ensure that ballooned highmem pages don't have kmaps.
+         *
+         * Do this before changing the p2m as kmap_flush_unused()
+         * reads PTEs to obtain pages (and hence needs the original
+         * p2m entry).
+         */
+        kmap_flush_unused();
+        /* Update direct mapping, invalidate P2M, and add to balloon. */
+        for (i = 0; i < nr_pages; i++) {
+                pfn = frame_list[i];
+                frame_list[i] = pfn_to_mfn(pfn);
+                page = pfn_to_page(pfn);
 #ifdef CONFIG_XEN_HAVE_PVMMU
                /*
@@ -429,11 +443,9 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                }
 #endif
-                balloon_append(pfn_to_page(pfn));
+                balloon_append(page);
        }
-        /* Ensure that ballooned highmem pages don't have kmaps. */
-        kmap_flush_unused();
        flush_tlb_all();
        set_xen_guest_handle(reservation.extent_start, frame_list);
diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
index 24084732b1d0..80ef38c73e5a 100644
--- a/fs/anon_inodes.c
+++ b/fs/anon_inodes.c
@@ -41,19 +41,8 @@ static const struct dentry_operations anon_inodefs_dentry_operations = {
 static struct dentry *anon_inodefs_mount(struct file_system_type *fs_type,
                                int flags, const char *dev_name, void *data)
 {
-        struct dentry *root;
+        return mount_pseudo(fs_type, "anon_inode:", NULL,
-        root = mount_pseudo(fs_type, "anon_inode:", NULL,
                        &anon_inodefs_dentry_operations, ANON_INODE_FS_MAGIC);
-        if (!IS_ERR(root)) {
-                struct super_block *s = root->d_sb;
-                anon_inode_inode = alloc_anon_inode(s);
-                if (IS_ERR(anon_inode_inode)) {
-                        dput(root);
-                        deactivate_locked_super(s);
-                        root = ERR_CAST(anon_inode_inode);
-                }
-        }
-        return root;
 }
 static struct file_system_type anon_inode_fs_type = {
@@ -175,22 +164,15 @@ EXPORT_SYMBOL_GPL(anon_inode_getfd);
 static int __init anon_inode_init(void)
 {
-        int error;
-        error = register_filesystem(&anon_inode_fs_type);
-        if (error)
-                goto err_exit;
        anon_inode_mnt = kern_mount(&anon_inode_fs_type);
-        if (IS_ERR(anon_inode_mnt)) {
+        if (IS_ERR(anon_inode_mnt))
-                error = PTR_ERR(anon_inode_mnt);
+                panic("anon_inode_init() kernel mount failed (%ld)\n", PTR_ERR(anon_inode_mnt));
-                goto err_unregister_filesystem;
-        }
-        return 0;
-err_unregister_filesystem:
+        anon_inode_inode = alloc_anon_inode(anon_inode_mnt->mnt_sb);
-        unregister_filesystem(&anon_inode_fs_type);
+        if (IS_ERR(anon_inode_inode))
-err_exit:
+                panic("anon_inode_init() inode allocation failed (%ld)\n", PTR_ERR(anon_inode_inode));
-        panic(KERN_ERR "anon_inode_init() failed (%d)\n", error);
+        return 0;
 }
 fs_initcall(anon_inode_init);
diff --git a/fs/dcache.c b/fs/dcache.c
index 66dc62cb766d..089f681ac952 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2833,9 +2833,9 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)
        u32 dlen = ACCESS_ONCE(name->len);
        char *p;
-        if (*buflen < dlen + 1)
-                return -ENAMETOOLONG;
        *buflen -= dlen + 1;
+        if (*buflen < 0)
+                return -ENAMETOOLONG;
        p = *buffer -= dlen + 1;
        *p++ = '/';
        while (dlen--) {
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 6e39895a91b8..24bfd7ff3049 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -38,6 +38,7 @@
 #include <linux/slab.h>
 #include <linux/ratelimit.h>
 #include <linux/aio.h>
+#include <linux/bitops.h>
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -3921,18 +3922,20 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc)
 void ext4_set_inode_flags(struct inode *inode)
 {
        unsigned int flags = EXT4_I(inode)->i_flags;
+        unsigned int new_fl = 0;
-        inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
        if (flags & EXT4_SYNC_FL)
-                inode->i_flags |= S_SYNC;
+                new_fl |= S_SYNC;
        if (flags & EXT4_APPEND_FL)
-                inode->i_flags |= S_APPEND;
+                new_fl |= S_APPEND;
        if (flags & EXT4_IMMUTABLE_FL)
-                inode->i_flags |= S_IMMUTABLE;
+                new_fl |= S_IMMUTABLE;
        if (flags & EXT4_NOATIME_FL)
-                inode->i_flags |= S_NOATIME;
+                new_fl |= S_NOATIME;
        if (flags & EXT4_DIRSYNC_FL)
-                inode->i_flags |= S_DIRSYNC;
+                new_fl |= S_DIRSYNC;
+        set_mask_bits(&inode->i_flags,
+                      S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC, new_fl);
 }
 /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */
diff --git a/fs/file.c b/fs/file.c
index 60a45e9f5323..eb56a13dab3e 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -713,27 +713,16 @@ unsigned long __fdget_raw(unsigned int fd)
 unsigned long __fdget_pos(unsigned int fd)
 {
-        struct files_struct *files = current->files;
+        unsigned long v = __fdget(fd);
-        struct file *file;
+        struct file *file = (struct file *)(v & ~3);
-        unsigned long v;
-        if (atomic_read(&files->count) == 1) {
-                file = __fcheck_files(files, fd);
-                v = 0;
-        } else {
-                file = __fget(fd, 0);
-                v = FDPUT_FPUT;
-        }
-        if (!file)
-                return 0;
-        if (file->f_mode & FMODE_ATOMIC_POS) {
+        if (file && (file->f_mode & FMODE_ATOMIC_POS)) {
                if (file_count(file) > 1) {
                        v |= FDPUT_POS_UNLOCK;
                        mutex_lock(&file->f_pos_lock);
                }
        }
-        return v | (unsigned long)file;
+        return v;
 }
 /*
diff --git a/fs/mount.h b/fs/mount.h
index a17458ca6f29..b29e42f05f34 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -19,13 +19,13 @@ struct mnt_pcp {
 };
 struct mountpoint {
-        struct list_head m_hash;
+        struct hlist_node m_hash;
        struct dentry *m_dentry;
        int m_count;
 };
 struct mount {
-        struct list_head mnt_hash;
+        struct hlist_node mnt_hash;
        struct mount *mnt_parent;
        struct dentry *mnt_mountpoint;
        struct vfsmount mnt;
diff --git a/fs/namei.c b/fs/namei.c
index 2f730ef9b4b3..4b491b431990 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1109,7 +1109,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                        return false;
                if (!d_mountpoint(path->dentry))
-                        break;
+                        return true;
                mounted = __lookup_mnt(path->mnt, path->dentry);
                if (!mounted)
@@ -1125,20 +1125,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                 */
                *inode = path->dentry->d_inode;
        }
-        return true;
+        return read_seqretry(&mount_lock, nd->m_seq);
-}
-static void follow_mount_rcu(struct nameidata *nd)
-{
-        while (d_mountpoint(nd->path.dentry)) {
-                struct mount *mounted;
-                mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
-                if (!mounted)
-                        break;
-                nd->path.mnt = &mounted->mnt;
-                nd->path.dentry = mounted->mnt.mnt_root;
-                nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
-        }
 }
 static int follow_dotdot_rcu(struct nameidata *nd)
@@ -1166,7 +1153,17 @@ static int follow_dotdot_rcu(struct nameidata *nd)
                        break;
                nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
        }
-        follow_mount_rcu(nd);
+        while (d_mountpoint(nd->path.dentry)) {
+                struct mount *mounted;
+                mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
+                if (!mounted)
+                        break;
+                nd->path.mnt = &mounted->mnt;
+                nd->path.dentry = mounted->mnt.mnt_root;
+                nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+                if (!read_seqretry(&mount_lock, nd->m_seq))
+                        goto failed;
+        }
        nd->inode = nd->path.dentry->d_inode;
        return 0;
diff --git a/fs/namespace.c b/fs/namespace.c
index 22e536705c45..2ffc5a2905d4 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -23,11 +23,34 @@
 #include <linux/uaccess.h>
 #include <linux/proc_ns.h>
 #include <linux/magic.h>
+#include <linux/bootmem.h>
 #include "pnode.h"
 #include "internal.h"
-#define HASH_SHIFT ilog2(PAGE_SIZE / sizeof(struct list_head))
+static unsigned int m_hash_mask __read_mostly;
-#define HASH_SIZE (1UL << HASH_SHIFT)
+static unsigned int m_hash_shift __read_mostly;
+static unsigned int mp_hash_mask __read_mostly;
+static unsigned int mp_hash_shift __read_mostly;
+static __initdata unsigned long mhash_entries;
+static int __init set_mhash_entries(char *str)
+{
+        if (!str)
+                return 0;
+        mhash_entries = simple_strtoul(str, &str, 0);
+        return 1;
+}
+__setup("mhash_entries=", set_mhash_entries);
+static __initdata unsigned long mphash_entries;
+static int __init set_mphash_entries(char *str)
+{
+        if (!str)
+                return 0;
+        mphash_entries = simple_strtoul(str, &str, 0);
+        return 1;
+}
+__setup("mphash_entries=", set_mphash_entries);
 static int event;
 static DEFINE_IDA(mnt_id_ida);
@@ -36,8 +59,8 @@ static DEFINE_SPINLOCK(mnt_id_lock);
 static int mnt_id_start = 0;
 static int mnt_group_start = 1;
-static struct list_head *mount_hashtable __read_mostly;
+static struct hlist_head *mount_hashtable __read_mostly;
-static struct list_head *mountpoint_hashtable __read_mostly;
+static struct hlist_head *mountpoint_hashtable __read_mostly;
 static struct kmem_cache *mnt_cache __read_mostly;
 static DECLARE_RWSEM(namespace_sem);
@@ -55,12 +78,19 @@ EXPORT_SYMBOL_GPL(fs_kobj);
 */
 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
-static inline unsigned long hash(struct vfsmount *mnt, struct dentry *dentry)
+static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
 {
        unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
        tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
-        tmp = tmp + (tmp >> HASH_SHIFT);
+        tmp = tmp + (tmp >> m_hash_shift);
-        return tmp & (HASH_SIZE - 1);
+        return &mount_hashtable[tmp & m_hash_mask];
+}
+static inline struct hlist_head *mp_hash(struct dentry *dentry)
+{
+        unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
+        tmp = tmp + (tmp >> mp_hash_shift);
+        return &mountpoint_hashtable[tmp & mp_hash_mask];
 }
 /*
@@ -187,7 +217,7 @@ static struct mount *alloc_vfsmnt(const char *name)
                mnt->mnt_writers = 0;
 #endif
-                INIT_LIST_HEAD(&mnt->mnt_hash);
+                INIT_HLIST_NODE(&mnt->mnt_hash);
                INIT_LIST_HEAD(&mnt->mnt_child);
                INIT_LIST_HEAD(&mnt->mnt_mounts);
                INIT_LIST_HEAD(&mnt->mnt_list);
@@ -575,10 +605,10 @@ bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
 */
 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
 {
-        struct list_head *head = mount_hashtable + hash(mnt, dentry);
+        struct hlist_head *head = m_hash(mnt, dentry);
        struct mount *p;
-        list_for_each_entry_rcu(p, head, mnt_hash)
+        hlist_for_each_entry_rcu(p, head, mnt_hash)
                if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
                        return p;
        return NULL;
@@ -590,13 +620,17 @@ struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
 */
 struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry)
 {
-        struct list_head *head = mount_hashtable + hash(mnt, dentry);
+        struct mount *p, *res;
-        struct mount *p;
+        res = p = __lookup_mnt(mnt, dentry);
+        if (!p)
-        list_for_each_entry_reverse(p, head, mnt_hash)
+                goto out;
-                if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
+        hlist_for_each_entry_continue(p, mnt_hash) {
-                        return p;
+                if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry)
-        return NULL;
+                        break;
+                res = p;
+        }
+out:
+        return res;
 }
 /*
@@ -633,11 +667,11 @@ struct vfsmount *lookup_mnt(struct path *path)
 static struct mountpoint *new_mountpoint(struct dentry *dentry)
 {
-        struct list_head *chain = mountpoint_hashtable + hash(NULL, dentry);
+        struct hlist_head *chain = mp_hash(dentry);
        struct mountpoint *mp;
        int ret;
-        list_for_each_entry(mp, chain, m_hash) {
+        hlist_for_each_entry(mp, chain, m_hash) {
                if (mp->m_dentry == dentry) {
                        /* might be worth a WARN_ON() */
                        if (d_unlinked(dentry))
@@ -659,7 +693,7 @@ static struct mountpoint *new_mountpoint(struct dentry *dentry)
        mp->m_dentry = dentry;
        mp->m_count = 1;
-        list_add(&mp->m_hash, chain);
+        hlist_add_head(&mp->m_hash, chain);
        return mp;
 }
@@ -670,7 +704,7 @@ static void put_mountpoint(struct mountpoint *mp)
                spin_lock(&dentry->d_lock);
                dentry->d_flags &= ~DCACHE_MOUNTED;
                spin_unlock(&dentry->d_lock);
-                list_del(&mp->m_hash);
+                hlist_del(&mp->m_hash);
                kfree(mp);
        }
 }
@@ -712,7 +746,7 @@ static void detach_mnt(struct mount *mnt, struct path *old_path)
        mnt->mnt_parent = mnt;
        mnt->mnt_mountpoint = mnt->mnt.mnt_root;
        list_del_init(&mnt->mnt_child);
-        list_del_init(&mnt->mnt_hash);
+        hlist_del_init_rcu(&mnt->mnt_hash);
        put_mountpoint(mnt->mnt_mp);
        mnt->mnt_mp = NULL;
 }
@@ -739,15 +773,14 @@ static void attach_mnt(struct mount *mnt,
                        struct mountpoint *mp)
 {
        mnt_set_mountpoint(parent, mp, mnt);
-        list_add_tail(&mnt->mnt_hash, mount_hashtable +
+        hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry));
-                        hash(&parent->mnt, mp->m_dentry));
        list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
 }
 /*
 * vfsmount lock must be held for write
 */
-static void commit_tree(struct mount *mnt)
+static void commit_tree(struct mount *mnt, struct mount *shadows)
 {
        struct mount *parent = mnt->mnt_parent;
        struct mount *m;
@@ -762,8 +795,11 @@ static void commit_tree(struct mount *mnt)
        list_splice(&head, n->list.prev);
-        list_add_tail(&mnt->mnt_hash, mount_hashtable +
+        if (shadows)
-                                hash(&parent->mnt, mnt->mnt_mountpoint));
+                hlist_add_after_rcu(&shadows->mnt_hash, &mnt->mnt_hash);
+        else
+                hlist_add_head_rcu(&mnt->mnt_hash,
+                                m_hash(&parent->mnt, mnt->mnt_mountpoint));
        list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
        touch_mnt_namespace(n);
 }
@@ -1153,26 +1189,28 @@ int may_umount(struct vfsmount *mnt)
 EXPORT_SYMBOL(may_umount);
-static LIST_HEAD(unmounted);    /* protected by namespace_sem */
+static HLIST_HEAD(unmounted);   /* protected by namespace_sem */
 static void namespace_unlock(void)
 {
        struct mount *mnt;
-        LIST_HEAD(head);
+        struct hlist_head head = unmounted;
-        if (likely(list_empty(&unmounted))) {
+        if (likely(hlist_empty(&head))) {
                up_write(&namespace_sem);
                return;
        }
-        list_splice_init(&unmounted, &head);
+        head.first->pprev = &head.first;
+        INIT_HLIST_HEAD(&unmounted);
        up_write(&namespace_sem);
        synchronize_rcu();
-        while (!list_empty(&head)) {
+        while (!hlist_empty(&head)) {
-                mnt = list_first_entry(&head, struct mount, mnt_hash);
+                mnt = hlist_entry(head.first, struct mount, mnt_hash);
-                list_del_init(&mnt->mnt_hash);
+                hlist_del_init(&mnt->mnt_hash);
                if (mnt->mnt_ex_mountpoint.mnt)
                        path_put(&mnt->mnt_ex_mountpoint);
                mntput(&mnt->mnt);
@@ -1193,16 +1231,19 @@ static inline void namespace_lock(void)
 */
 void umount_tree(struct mount *mnt, int how)
 {
-        LIST_HEAD(tmp_list);
+        HLIST_HEAD(tmp_list);
        struct mount *p;
+        struct mount *last = NULL;
-        for (p = mnt; p; p = next_mnt(p, mnt))
+        for (p = mnt; p; p = next_mnt(p, mnt)) {
-                list_move(&p->mnt_hash, &tmp_list);
+                hlist_del_init_rcu(&p->mnt_hash);
+                hlist_add_head(&p->mnt_hash, &tmp_list);
+        }
        if (how)
                propagate_umount(&tmp_list);
-        list_for_each_entry(p, &tmp_list, mnt_hash) {
+        hlist_for_each_entry(p, &tmp_list, mnt_hash) {
                list_del_init(&p->mnt_expire);
                list_del_init(&p->mnt_list);
                __touch_mnt_namespace(p->mnt_ns);
@@ -1220,8 +1261,13 @@ void umount_tree(struct mount *mnt, int how)
                        p->mnt_mp = NULL;
                }
                change_mnt_propagation(p, MS_PRIVATE);
+                last = p;
+        }
+        if (last) {
+                last->mnt_hash.next = unmounted.first;
+                unmounted.first = tmp_list.first;
+                unmounted.first->pprev = &unmounted.first;
        }
-        list_splice(&tmp_list, &unmounted);
 }
 static void shrink_submounts(struct mount *mnt);
@@ -1605,24 +1651,23 @@ static int attach_recursive_mnt(struct mount *source_mnt,
                        struct mountpoint *dest_mp,
                        struct path *parent_path)
 {
-        LIST_HEAD(tree_list);
+        HLIST_HEAD(tree_list);
        struct mount *child, *p;
+        struct hlist_node *n;
        int err;
        if (IS_MNT_SHARED(dest_mnt)) {
                err = invent_group_ids(source_mnt, true);
                if (err)
                        goto out;
-        }
+                err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
-        err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
+                if (err)
-        if (err)
+                        goto out_cleanup_ids;
-                goto out_cleanup_ids;
+                lock_mount_hash();
-        lock_mount_hash();
-        if (IS_MNT_SHARED(dest_mnt)) {
                for (p = source_mnt; p; p = next_mnt(p, source_mnt))
                        set_mnt_shared(p);
+        } else {
+                lock_mount_hash();
        }
        if (parent_path) {
                detach_mnt(source_mnt, parent_path);
@@ -1630,20 +1675,22 @@ static int attach_recursive_mnt(struct mount *source_mnt,
                touch_mnt_namespace(source_mnt->mnt_ns);
        } else {
                mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
-                commit_tree(source_mnt);
+                commit_tree(source_mnt, NULL);
        }
-        list_for_each_entry_safe(child, p, &tree_list, mnt_hash) {
+        hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
-                list_del_init(&child->mnt_hash);
+                struct mount *q;
-                commit_tree(child);
+                hlist_del_init(&child->mnt_hash);
+                q = __lookup_mnt_last(&child->mnt_parent->mnt,
+                                      child->mnt_mountpoint);
+                commit_tree(child, q);
        }
        unlock_mount_hash();
        return 0;
 out_cleanup_ids:
-        if (IS_MNT_SHARED(dest_mnt))
+        cleanup_group_ids(source_mnt, NULL);
-                cleanup_group_ids(source_mnt, NULL);
 out:
        return err;
 }
@@ -2777,18 +2824,24 @@ void __init mnt_init(void)
        mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
                        0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL);
-        mount_hashtable = (struct list_head *)__get_free_page(GFP_ATOMIC);
+        mount_hashtable = alloc_large_system_hash("Mount-cache",
-        mountpoint_hashtable = (struct list_head *)__get_free_page(GFP_ATOMIC);
+                                sizeof(struct hlist_head),
+                                mhash_entries, 19,
+                                0,
+                                &m_hash_shift, &m_hash_mask, 0, 0);
+        mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
+                                sizeof(struct hlist_head),
+                                mphash_entries, 19,
+                                0,
+                                &mp_hash_shift, &mp_hash_mask, 0, 0);
        if (!mount_hashtable || !mountpoint_hashtable)
                panic("Failed to allocate mount hash table\n");
-        printk(KERN_INFO "Mount-cache hash table entries: %lu\n", HASH_SIZE);
+        for (u = 0; u <= m_hash_mask; u++)
+                INIT_HLIST_HEAD(&mount_hashtable[u]);
-        for (u = 0; u < HASH_SIZE; u++)
+        for (u = 0; u <= mp_hash_mask; u++)
-                INIT_LIST_HEAD(&mount_hashtable[u]);
+                INIT_HLIST_HEAD(&mountpoint_hashtable[u]);
-        for (u = 0; u < HASH_SIZE; u++)
-                INIT_LIST_HEAD(&mountpoint_hashtable[u]);
        kernfs_init();
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 017d3cb5e99b..6d7be3f80356 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -449,6 +449,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
        fh_lock(fhp);
        host_err = notify_change(dentry, iap, NULL);
        fh_unlock(fhp);
+        err = nfserrno(host_err);
 out_put_write_access:
        if (size_change)
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index 1324e6600e57..ca5ce14cbddc 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -346,7 +346,9 @@ int ocfs2_cluster_connect(const char *stack_name,
        strlcpy(new_conn->cc_name, group, GROUP_NAME_MAX + 1);
        new_conn->cc_namelen = grouplen;
-        strlcpy(new_conn->cc_cluster_name, cluster_name, CLUSTER_NAME_MAX + 1);
+        if (cluster_name_len)
+                strlcpy(new_conn->cc_cluster_name, cluster_name,
+                        CLUSTER_NAME_MAX + 1);
        new_conn->cc_cluster_name_len = cluster_name_len;
        new_conn->cc_recovery_handler = recovery_handler;
        new_conn->cc_recovery_data = recovery_data;
diff --git a/fs/pnode.c b/fs/pnode.c
index c7221bb19801..88396df725b4 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -220,14 +220,14 @@ static struct mount *get_source(struct mount *dest,
 * @tree_list : list of heads of trees to be attached.
 */
 int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
-                    struct mount *source_mnt, struct list_head *tree_list)
+                    struct mount *source_mnt, struct hlist_head *tree_list)
 {
        struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
        struct mount *m, *child;
        int ret = 0;
        struct mount *prev_dest_mnt = dest_mnt;
        struct mount *prev_src_mnt  = source_mnt;
-        LIST_HEAD(tmp_list);
+        HLIST_HEAD(tmp_list);
        for (m = propagation_next(dest_mnt, dest_mnt); m;
                        m = propagation_next(m, dest_mnt)) {
@@ -246,27 +246,29 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
                child = copy_tree(source, source->mnt.mnt_root, type);
                if (IS_ERR(child)) {
                        ret = PTR_ERR(child);
-                        list_splice(tree_list, tmp_list.prev);
+                        tmp_list = *tree_list;
+                        tmp_list.first->pprev = &tmp_list.first;
+                        INIT_HLIST_HEAD(tree_list);
                        goto out;
                }
                if (is_subdir(dest_mp->m_dentry, m->mnt.mnt_root)) {
                        mnt_set_mountpoint(m, dest_mp, child);
-                        list_add_tail(&child->mnt_hash, tree_list);
+                        hlist_add_head(&child->mnt_hash, tree_list);
                } else {
                        /*
                         * This can happen if the parent mount was bind mounted
                         * on some subdirectory of a shared/slave mount.
                         */
-                        list_add_tail(&child->mnt_hash, &tmp_list);
+                        hlist_add_head(&child->mnt_hash, &tmp_list);
                }
                prev_dest_mnt = m;
                prev_src_mnt  = child;
        }
 out:
        lock_mount_hash();
-        while (!list_empty(&tmp_list)) {
+        while (!hlist_empty(&tmp_list)) {
-                child = list_first_entry(&tmp_list, struct mount, mnt_hash);
+                child = hlist_entry(tmp_list.first, struct mount, mnt_hash);
                umount_tree(child, 0);
        }
        unlock_mount_hash();
@@ -338,8 +340,10 @@ static void __propagate_umount(struct mount *mnt)
                 * umount the child only if the child has no
                 * other children
                 */
-                if (child && list_empty(&child->mnt_mounts))
+                if (child && list_empty(&child->mnt_mounts)) {
-                        list_move_tail(&child->mnt_hash, &mnt->mnt_hash);
+                        hlist_del_init_rcu(&child->mnt_hash);
+                        hlist_add_before_rcu(&child->mnt_hash, &mnt->mnt_hash);
+                }
        }
 }
@@ -350,11 +354,11 @@ static void __propagate_umount(struct mount *mnt)
 *
 * vfsmount lock must be held for write
 */
-int propagate_umount(struct list_head *list)
+int propagate_umount(struct hlist_head *list)
 {
        struct mount *mnt;
-        list_for_each_entry(mnt, list, mnt_hash)
+        hlist_for_each_entry(mnt, list, mnt_hash)
                __propagate_umount(mnt);
        return 0;
 }
diff --git a/fs/pnode.h b/fs/pnode.h
index 59e7eda1851e..fc28a27fa892 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -36,8 +36,8 @@ static inline void set_mnt_shared(struct mount *mnt)
 void change_mnt_propagation(struct mount *, int);
 int propagate_mnt(struct mount *, struct mountpoint *, struct mount *,
-                struct list_head *);
+                struct hlist_head *);
-int propagate_umount(struct list_head *);
+int propagate_umount(struct hlist_head *);
 int propagate_mount_busy(struct mount *, int);
 void mnt_release_group_id(struct mount *);
 int get_dominating_id(struct mount *mnt, const struct path *root);
diff --git a/fs/read_write.c b/fs/read_write.c
index 54e19b9392dc..28cc9c810744 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -307,7 +307,7 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned long, offset_high,
                unsigned int, whence)
 {
        int retval;
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        loff_t offset;
        if (!f.file)
@@ -327,7 +327,7 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned long, offset_high,
                        retval = 0;
        }
 out_putf:
-        fdput(f);
+        fdput_pos(f);
        return retval;
 }
 #endif
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index abc9ca778456..be5fd38bd5a0 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -196,6 +196,21 @@ static inline unsigned long __ffs64(u64 word)
 #ifdef __KERNEL__
+#ifndef set_mask_bits
+#define set_mask_bits(ptr, _mask, _bits)        \
+({                                                              \
+        const typeof(*ptr) mask = (_mask), bits = (_bits);      \
+        typeof(*ptr) old, new;                                  \
+                                                                \
+        do {                                                    \
+                old = ACCESS_ONCE(*ptr);                        \
+                new = (old & ~mask) | bits;                     \
+        } while (cmpxchg(ptr, old, new) != old);                \
+                                                                \
+        new;                                                    \
+})
+#endif
 #ifndef find_last_bit
 /**
 * find_last_bit - find the last set bit in a memory region
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 4e4cc28623ad..4cdb3a17bcb5 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -495,10 +495,6 @@ enum {
        FILTER_TRACE_FN,
 };
-#define EVENT_STORAGE_SIZE 128
-extern struct mutex event_storage_mutex;
-extern char event_storage[EVENT_STORAGE_SIZE];
 extern int trace_event_raw_init(struct ftrace_event_call *call);
 extern int trace_define_field(struct ftrace_event_call *call, const char *type,
                              const char *name, int offset, int size,
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 1005ebf17575..5a09a48f2658 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -163,4 +163,11 @@ enum {
 /* changeable features with no special hardware requirements */
 #define NETIF_F_SOFT_FEATURES   (NETIF_F_GSO | NETIF_F_GRO)
+#define NETIF_F_VLAN_FEATURES   (NETIF_F_HW_VLAN_CTAG_FILTER | \
+                                 NETIF_F_HW_VLAN_CTAG_RX | \
+                                 NETIF_F_HW_VLAN_CTAG_TX | \
+                                 NETIF_F_HW_VLAN_STAG_FILTER | \
+                                 NETIF_F_HW_VLAN_STAG_RX | \
+                                 NETIF_F_HW_VLAN_STAG_TX)
 #endif  /* _LINUX_NETDEV_FEATURES_H */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index e8eeebd49a98..daafd9561cbc 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3014,7 +3014,7 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, netdev_features_t features)
 {
        return __skb_gso_segment(skb, features, true);
 }
-__be16 skb_network_protocol(struct sk_buff *skb);
+__be16 skb_network_protocol(struct sk_buff *skb, int *depth);
 static inline bool can_checksum_protocol(netdev_features_t features,
                                         __be16 protocol)
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 1da693d51255..b66c2110cb1f 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -250,8 +250,7 @@ struct rmap_walk_control {
        int (*rmap_one)(struct page *page, struct vm_area_struct *vma,
                                        unsigned long addr, void *arg);
        int (*done)(struct page *page);
-        int (*file_nonlinear)(struct page *, struct address_space *,
+        int (*file_nonlinear)(struct page *, struct address_space *, void *arg);
-                                        struct vm_area_struct *vma);
        struct anon_vma *(*anon_lock)(struct page *page);
        bool (*invalid_vma)(struct vm_area_struct *vma, void *arg);
 };
diff --git a/include/linux/security.h b/include/linux/security.h
index 5623a7f965b7..2fc42d191f79 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1040,6 +1040,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
 *      Allocate a security structure to the xp->security field; the security
 *      field is initialized to NULL when the xfrm_policy is allocated.
 *      Return 0 if operation was successful (memory to allocate, legal context)
+ *      @gfp is to specify the context for the allocation
 * @xfrm_policy_clone_security:
 *      @old_ctx contains an existing xfrm_sec_ctx.
 *      @new_ctxp contains a new xfrm_sec_ctx being cloned from old.
@@ -1683,7 +1684,7 @@ struct security_operations {
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
        int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp,
-                        struct xfrm_user_sec_ctx *sec_ctx);
+                        struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
        int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
        void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
        int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
@@ -2859,7 +2860,8 @@ static inline void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
-int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx);
+int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                               struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
 int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
 void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
 int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
@@ -2877,7 +2879,9 @@ void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);
 #else   /* CONFIG_SECURITY_NETWORK_XFRM */
-static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
+static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                                             struct xfrm_user_sec_ctx *sec_ctx,
+                                             gfp_t gfp)
 {
        return 0;
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5e1e6f2d98c2..15ede6a823a6 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2451,8 +2451,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                    unsigned int flags);
 void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to);
 unsigned int skb_zerocopy_headlen(const struct sk_buff *from);
-void skb_zerocopy(struct sk_buff *to, const struct sk_buff *from,
+int skb_zerocopy(struct sk_buff *to, struct sk_buff *from,
-                  int len, int hlen);
+                 int len, int hlen);
 void skb_split(struct sk_buff *skb, struct sk_buff *skb1, const u32 len);
 int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen);
 void skb_scrub_packet(struct sk_buff *skb, bool xnet);
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index c3fa80745996..2c14d9cdd57a 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -88,6 +88,7 @@
 #define cdc_ncm_data_intf_is_mbim(x)  ((x)->desc.bInterfaceProtocol == USB_CDC_MBIM_PROTO_NTB)
 struct cdc_ncm_ctx {
+        struct usb_cdc_ncm_ntb_parameters ncm_parm;
        struct hrtimer tx_timer;
        struct tasklet_struct bh;
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index e303eef94dd5..0662e98fef72 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -30,7 +30,7 @@ struct usbnet {
        struct driver_info      *driver_info;
        const char              *driver_name;
        void                    *driver_priv;
-        wait_queue_head_t       *wait;
+        wait_queue_head_t       wait;
        struct mutex            phy_mutex;
        unsigned char           suspend_count;
        unsigned char           pkt_cnt, pkt_err;
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 9650a3ffd2d2..b4956a5fcc3f 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -31,8 +31,10 @@
 #define IF_PREFIX_AUTOCONF      0x02
 enum {
+        INET6_IFADDR_STATE_PREDAD,
        INET6_IFADDR_STATE_DAD,
        INET6_IFADDR_STATE_POSTDAD,
+        INET6_IFADDR_STATE_ERRDAD,
        INET6_IFADDR_STATE_UP,
        INET6_IFADDR_STATE_DEAD,
 };
@@ -58,7 +60,7 @@ struct inet6_ifaddr {
        unsigned long           cstamp; /* created timestamp */
        unsigned long           tstamp; /* updated timestamp */
-        struct timer_list       dad_timer;
+        struct delayed_work     dad_work;
        struct inet6_dev        *idev;
        struct rt6_info         *rt;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 8c4dd63134d4..743accec6c76 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -480,20 +480,21 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 #ifdef CONFIG_SYN_COOKIES
 #include <linux/ktime.h>
-/* Syncookies use a monotonic timer which increments every 64 seconds.
+/* Syncookies use a monotonic timer which increments every 60 seconds.
 * This counter is used both as a hash input and partially encoded into
 * the cookie value.  A cookie is only validated further if the delta
 * between the current counter value and the encoded one is less than this,
- * i.e. a sent cookie is valid only at most for 128 seconds (or less if
+ * i.e. a sent cookie is valid only at most for 2*60 seconds (or less if
 * the counter advances immediately after a cookie is generated).
 */
 #define MAX_SYNCOOKIE_AGE 2
 static inline u32 tcp_cookie_time(void)
 {
-        struct timespec now;
+        u64 val = get_jiffies_64();
-        getnstimeofday(&now);
-        return now.tv_sec >> 6; /* 64 seconds granularity */
+        do_div(val, 60 * HZ);
+        return val;
 }
 u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 1a8b28db3775..1ee19a24cc5f 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -310,15 +310,12 @@ static struct trace_event_functions ftrace_event_type_funcs_##call = {	\
 #undef __array
 #define __array(type, item, len)                                        \
        do {                                                            \
-                mutex_lock(&event_storage_mutex);                       \
+                char *type_str = #type"["__stringify(len)"]";           \
                BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);                 \
-                snprintf(event_storage, sizeof(event_storage),          \
+                ret = trace_define_field(event_call, type_str, #item,   \
-                         "%s[%d]", #type, len);                         \
-                ret = trace_define_field(event_call, event_storage, #item, \
                                 offsetof(typeof(field), item),         \
                                 sizeof(field.item),                    \
                                 is_signed_type(type), FILTER_OTHER);   \
-                mutex_unlock(&event_storage_mutex);                     \
                if (ret)                                                \
                        return ret;                                     \
        } while (0);
diff --git a/kernel/audit.c b/kernel/audit.c
index 3392d3e0254a..95a20f3f52f1 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -608,9 +608,19 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
        int err = 0;
        /* Only support the initial namespaces for now. */
+        /*
+         * We return ECONNREFUSED because it tricks userspace into thinking
+         * that audit was not configured into the kernel.  Lots of users
+         * configure their PAM stack (because that's what the distro does)
+         * to reject login if unable to send messages to audit.  If we return
+         * ECONNREFUSED the PAM stack thinks the kernel does not have audit
+         * configured in and will let login proceed.  If we return EPERM
+         * userspace will reject all logins.  This should be removed when we
+         * support non init namespaces!!
+         */
        if ((current_user_ns() != &init_user_ns) ||
            (task_active_pid_ns(current) != &init_pid_ns))
-                return -EPERM;
+                return -ECONNREFUSED;
        switch (msg_type) {
        case AUDIT_LIST:
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 105f273b6f86..0c753ddd223b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4112,17 +4112,17 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        err = percpu_ref_init(&css->refcnt, css_release);
        if (err)
-                goto err_free;
+                goto err_free_css;
        init_css(css, ss, cgrp);
        err = cgroup_populate_dir(cgrp, 1 << ss->subsys_id);
        if (err)
-                goto err_free;
+                goto err_free_percpu_ref;
        err = online_css(css);
        if (err)
-                goto err_free;
+                goto err_clear_dir;
        dget(cgrp->dentry);
        css_get(css->parent);
@@ -4138,8 +4138,11 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
        return 0;
-err_free:
+err_clear_dir:
+        cgroup_clear_dir(css->cgroup, 1 << css->ss->subsys_id);
+err_free_percpu_ref:
        percpu_ref_cancel_init(&css->refcnt);
+err_free_css:
        ss->css_free(css);
        return err;
 }
diff --git a/kernel/futex.c b/kernel/futex.c
index 44a1261cb9ff..08ec814ad9d2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -234,6 +234,7 @@ static const struct futex_q futex_q_init = {
 * waiting on a futex.
 */
 struct futex_hash_bucket {
+        atomic_t waiters;
        spinlock_t lock;
        struct plist_head chain;
 } ____cacheline_aligned_in_smp;
@@ -253,22 +254,37 @@ static inline void futex_get_mm(union futex_key *key)
        smp_mb__after_atomic_inc();
 }
-static inline bool hb_waiters_pending(struct futex_hash_bucket *hb)
+/*
+ * Reflects a new waiter being added to the waitqueue.
+ */
+static inline void hb_waiters_inc(struct futex_hash_bucket *hb)
 {
 #ifdef CONFIG_SMP
+        atomic_inc(&hb->waiters);
        /*
-         * Tasks trying to enter the critical region are most likely
+         * Full barrier (A), see the ordering comment above.
-         * potential waiters that will be added to the plist. Ensure
-         * that wakers won't miss to-be-slept tasks in the window between
-         * the wait call and the actual plist_add.
         */
-        if (spin_is_locked(&hb->lock))
+        smp_mb__after_atomic_inc();
-                return true;
+#endif
-        smp_rmb(); /* Make sure we check the lock state first */
+}
+/*
+ * Reflects a waiter being removed from the waitqueue by wakeup
+ * paths.
+ */
+static inline void hb_waiters_dec(struct futex_hash_bucket *hb)
+{
+#ifdef CONFIG_SMP
+        atomic_dec(&hb->waiters);
+#endif
+}
-        return !plist_head_empty(&hb->chain);
+static inline int hb_waiters_pending(struct futex_hash_bucket *hb)
+{
+#ifdef CONFIG_SMP
+        return atomic_read(&hb->waiters);
 #else
-        return true;
+        return 1;
 #endif
 }
@@ -954,6 +970,7 @@ static void __unqueue_futex(struct futex_q *q)
        hb = container_of(q->lock_ptr, struct futex_hash_bucket, lock);
        plist_del(&q->list, &hb->chain);
+        hb_waiters_dec(hb);
 }
 /*
@@ -1257,7 +1274,9 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
         */
        if (likely(&hb1->chain != &hb2->chain)) {
                plist_del(&q->list, &hb1->chain);
+                hb_waiters_dec(hb1);
                plist_add(&q->list, &hb2->chain);
+                hb_waiters_inc(hb2);
                q->lock_ptr = &hb2->lock;
        }
        get_futex_key_refs(key2);
@@ -1600,6 +1619,17 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
        struct futex_hash_bucket *hb;
        hb = hash_futex(&q->key);
+        /*
+         * Increment the counter before taking the lock so that
+         * a potential waker won't miss a to-be-slept task that is
+         * waiting for the spinlock. This is safe as all queue_lock()
+         * users end up calling queue_me(). Similarly, for housekeeping,
+         * decrement the counter at queue_unlock() when some error has
+         * occurred and we don't end up adding the task to the list.
+         */
+        hb_waiters_inc(hb);
        q->lock_ptr = &hb->lock;
        spin_lock(&hb->lock); /* implies MB (A) */
@@ -1611,6 +1641,7 @@ queue_unlock(struct futex_hash_bucket *hb)
        __releases(&hb->lock)
 {
        spin_unlock(&hb->lock);
+        hb_waiters_dec(hb);
 }
 /**
@@ -2342,6 +2373,7 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                 * Unqueue the futex_q and determine which it was.
                 */
                plist_del(&q->list, &hb->chain);
+                hb_waiters_dec(hb);
                /* Handle spurious wakeups gracefully */
                ret = -EWOULDBLOCK;
@@ -2875,6 +2907,7 @@ static int __init futex_init(void)
                futex_cmpxchg_enabled = 1;
        for (i = 0; i < futex_hashsize; i++) {
+                atomic_set(&futex_queues[i].waiters, 0);
                plist_head_init(&futex_queues[i].chain);
                spin_lock_init(&futex_queues[i].lock);
        }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 0aa4ce81bc16..5b40279ecd71 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1435,7 +1435,8 @@ void update_wall_time(void)
 out:
        raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
        if (clock_set)
-                clock_was_set();
+                /* Have to call _delayed version, since in irq context*/
+                clock_was_set_delayed();
 }
 /**
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 815c878f409b..24c1f2382557 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1600,15 +1600,31 @@ void trace_buffer_unlock_commit(struct ring_buffer *buffer,
 }
 EXPORT_SYMBOL_GPL(trace_buffer_unlock_commit);
+static struct ring_buffer *temp_buffer;
 struct ring_buffer_event *
 trace_event_buffer_lock_reserve(struct ring_buffer **current_rb,
                          struct ftrace_event_file *ftrace_file,
                          int type, unsigned long len,
                          unsigned long flags, int pc)
 {
+        struct ring_buffer_event *entry;
        *current_rb = ftrace_file->tr->trace_buffer.buffer;
-        return trace_buffer_lock_reserve(*current_rb,
+        entry = trace_buffer_lock_reserve(*current_rb,
                                         type, len, flags, pc);
+        /*
+         * If tracing is off, but we have triggers enabled
+         * we still need to look at the event data. Use the temp_buffer
+         * to store the trace event for the tigger to use. It's recusive
+         * safe and will not be recorded anywhere.
+         */
+        if (!entry && ftrace_file->flags & FTRACE_EVENT_FL_TRIGGER_COND) {
+                *current_rb = temp_buffer;
+                entry = trace_buffer_lock_reserve(*current_rb,
+                                                  type, len, flags, pc);
+        }
+        return entry;
 }
 EXPORT_SYMBOL_GPL(trace_event_buffer_lock_reserve);
@@ -6494,11 +6510,16 @@ __init static int tracer_alloc_buffers(void)
        raw_spin_lock_init(&global_trace.start_lock);
+        /* Used for event triggers */
+        temp_buffer = ring_buffer_alloc(PAGE_SIZE, RB_FL_OVERWRITE);
+        if (!temp_buffer)
+                goto out_free_cpumask;
        /* TODO: make the number of buffers hot pluggable with CPUS */
        if (allocate_trace_buffers(&global_trace, ring_buf_size) < 0) {
                printk(KERN_ERR "tracer: failed to allocate ring buffer!\n");
                WARN_ON(1);
-                goto out_free_cpumask;
+                goto out_free_temp_buffer;
        }
        if (global_trace.buffer_disabled)
@@ -6540,6 +6561,8 @@ __init static int tracer_alloc_buffers(void)
        return 0;
+out_free_temp_buffer:
+        ring_buffer_free(temp_buffer);
 out_free_cpumask:
        free_percpu(global_trace.trace_buffer.data);
 #ifdef CONFIG_TRACER_MAX_TRACE
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index f3989ceb5cd5..7b16d40bd64d 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -27,12 +27,6 @@
 DEFINE_MUTEX(event_mutex);
-DEFINE_MUTEX(event_storage_mutex);
-EXPORT_SYMBOL_GPL(event_storage_mutex);
-char event_storage[EVENT_STORAGE_SIZE];
-EXPORT_SYMBOL_GPL(event_storage);
 LIST_HEAD(ftrace_events);
 static LIST_HEAD(ftrace_common_fields);
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index 7c3e3e72e2b6..ee0a5098ac43 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -95,15 +95,12 @@ static void __always_unused ____ftrace_check_##name(void)		\
 #undef __array
 #define __array(type, item, len)                                        \
        do {                                                            \
+                char *type_str = #type"["__stringify(len)"]";           \
                BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);                 \
-                mutex_lock(&event_storage_mutex);                       \
+                ret = trace_define_field(event_call, type_str, #item,   \
-                snprintf(event_storage, sizeof(event_storage),          \
-                         "%s[%d]", #type, len);                         \
-                ret = trace_define_field(event_call, event_storage, #item, \
                                 offsetof(typeof(field), item),         \
                                 sizeof(field.item),                    \
                                 is_signed_type(type), filter_type);    \
-                mutex_unlock(&event_storage_mutex);                     \
                if (ret)                                                \
                        return ret;                                     \
        } while (0);
diff --git a/lib/fonts/Kconfig b/lib/fonts/Kconfig
index 4dc1b990aa23..34fd931b54b5 100644
--- a/lib/fonts/Kconfig
+++ b/lib/fonts/Kconfig
@@ -9,7 +9,7 @@ if FONT_SUPPORT
 config FONTS
        bool "Select compiled-in fonts"
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
        help
          Say Y here if you would like to use fonts other than the default
          your frame buffer console usually use.
@@ -22,7 +22,7 @@ config FONTS
 config FONT_8x8
        bool "VGA 8x8 font" if FONTS
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
        default y if !SPARC && !FONTS
        help
          This is the "high resolution" font for the VGA frame buffer (the one
@@ -45,7 +45,7 @@ config FONT_8x16
 config FONT_6x11
        bool "Mac console 6x11 font (not supported by all drivers)" if FONTS
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
        default y if !SPARC && !FONTS && MAC
        help
          Small console font with Macintosh-style high-half glyphs.  Some Mac
diff --git a/lib/random32.c b/lib/random32.c
index 1e5b2df44291..614896778700 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -244,8 +244,19 @@ static void __prandom_reseed(bool late)
        static bool latch = false;
        static DEFINE_SPINLOCK(lock);
+        /* Asking for random bytes might result in bytes getting
+         * moved into the nonblocking pool and thus marking it
+         * as initialized. In this case we would double back into
+         * this function and attempt to do a late reseed.
+         * Ignore the pointless attempt to reseed again if we're
+         * already waiting for bytes when the nonblocking pool
+         * got initialized.
+         */
        /* only allow initial seeding (late == false) once */
-        spin_lock_irqsave(&lock, flags);
+        if (!spin_trylock_irqsave(&lock, flags))
+                return;
        if (latch && !late)
                goto out;
        latch = true;
diff --git a/mm/fremap.c b/mm/fremap.c
index bbc4d660221a..34feba60a17e 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -23,28 +23,44 @@
 #include "internal.h"
+static int mm_counter(struct page *page)
+{
+        return PageAnon(page) ? MM_ANONPAGES : MM_FILEPAGES;
+}
 static void zap_pte(struct mm_struct *mm, struct vm_area_struct *vma,
                        unsigned long addr, pte_t *ptep)
 {
        pte_t pte = *ptep;
+        struct page *page;
+        swp_entry_t entry;
        if (pte_present(pte)) {
-                struct page *page;
                flush_cache_page(vma, addr, pte_pfn(pte));
                pte = ptep_clear_flush(vma, addr, ptep);
                page = vm_normal_page(vma, addr, pte);
                if (page) {
                        if (pte_dirty(pte))
                                set_page_dirty(page);
+                        update_hiwater_rss(mm);
+                        dec_mm_counter(mm, mm_counter(page));
                        page_remove_rmap(page);
                        page_cache_release(page);
+                }
+        } else {        /* zap_pte() is not called when pte_none() */
+                if (!pte_file(pte)) {
                        update_hiwater_rss(mm);
-                        dec_mm_counter(mm, MM_FILEPAGES);
+                        entry = pte_to_swp_entry(pte);
+                        if (non_swap_entry(entry)) {
+                                if (is_migration_entry(entry)) {
+                                        page = migration_entry_to_page(entry);
+                                        dec_mm_counter(mm, mm_counter(page));
+                                }
+                        } else {
+                                free_swap_and_cache(entry);
+                                dec_mm_counter(mm, MM_SWAPENTS);
+                        }
                }
-        } else {
-                if (!pte_file(pte))
-                        free_swap_and_cache(pte_to_swp_entry(pte));
                pte_clear_not_present_full(mm, addr, ptep, 0);
        }
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index b494fdb9a636..bed48809e5d0 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -178,6 +178,37 @@ out:
 }
 /*
+ * Congratulations to trinity for discovering this bug.
+ * mm/fremap.c's remap_file_pages() accepts any range within a single vma to
+ * convert that vma to VM_NONLINEAR; and generic_file_remap_pages() will then
+ * replace the specified range by file ptes throughout (maybe populated after).
+ * If page migration finds a page within that range, while it's still located
+ * by vma_interval_tree rather than lost to i_mmap_nonlinear list, no problem:
+ * zap_pte() clears the temporary migration entry before mmap_sem is dropped.
+ * But if the migrating page is in a part of the vma outside the range to be
+ * remapped, then it will not be cleared, and remove_migration_ptes() needs to
+ * deal with it.  Fortunately, this part of the vma is of course still linear,
+ * so we just need to use linear location on the nonlinear list.
+ */
+static int remove_linear_migration_ptes_from_nonlinear(struct page *page,
+                struct address_space *mapping, void *arg)
+{
+        struct vm_area_struct *vma;
+        /* hugetlbfs does not support remap_pages, so no huge pgoff worries */
+        pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+        unsigned long addr;
+        list_for_each_entry(vma,
+                &mapping->i_mmap_nonlinear, shared.nonlinear) {
+                addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
+                if (addr >= vma->vm_start && addr < vma->vm_end)
+                        remove_migration_pte(page, vma, addr, arg);
+        }
+        return SWAP_AGAIN;
+}
+/*
 * Get rid of all migration entries and replace them by
 * references to the indicated page.
 */
@@ -186,6 +217,7 @@ static void remove_migration_ptes(struct page *old, struct page *new)
        struct rmap_walk_control rwc = {
                .rmap_one = remove_migration_pte,
                .arg = old,
+                .file_nonlinear = remove_linear_migration_ptes_from_nonlinear,
        };
        rmap_walk(new, &rwc);
diff --git a/mm/rmap.c b/mm/rmap.c
index d9d42316a99a..8fc049f9a5a6 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1360,8 +1360,9 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
 }
 static int try_to_unmap_nonlinear(struct page *page,
-                struct address_space *mapping, struct vm_area_struct *vma)
+                struct address_space *mapping, void *arg)
 {
+        struct vm_area_struct *vma;
        int ret = SWAP_AGAIN;
        unsigned long cursor;
        unsigned long max_nl_cursor = 0;
@@ -1663,7 +1664,7 @@ static int rmap_walk_file(struct page *page, struct rmap_walk_control *rwc)
        if (list_empty(&mapping->i_mmap_nonlinear))
                goto done;
-        ret = rwc->file_nonlinear(page, mapping, vma);
+        ret = rwc->file_nonlinear(page, mapping, rwc->arg);
 done:
        mutex_unlock(&mapping->i_mmap_mutex);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index ec9909935fb6..175273f38cb1 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -307,9 +307,11 @@ static void vlan_sync_address(struct net_device *dev,
 static void vlan_transfer_features(struct net_device *dev,
                                   struct net_device *vlandev)
 {
+        struct vlan_dev_priv *vlan = vlan_dev_priv(vlandev);
        vlandev->gso_max_size = dev->gso_max_size;
-        if (dev->features & NETIF_F_HW_VLAN_CTAG_TX)
+        if (vlan_hw_offload_capable(dev->features, vlan->vlan_proto))
                vlandev->hard_header_len = dev->hard_header_len;
        else
                vlandev->hard_header_len = dev->hard_header_len + VLAN_HLEN;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4b65aa492fb6..27bfe2f8e2de 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -578,6 +578,9 @@ static int vlan_dev_init(struct net_device *dev)
        dev->features |= real_dev->vlan_features | NETIF_F_LLTX;
        dev->gso_max_size = real_dev->gso_max_size;
+        if (dev->features & NETIF_F_VLAN_FEATURES)
+                netdev_warn(real_dev, "VLAN features are set incorrectly.  Q-in-Q configurations may not work correctly.\n");
        /* ipv6 shared card related stuff */
        dev->dev_id = real_dev->dev_id;
@@ -592,7 +595,8 @@ static int vlan_dev_init(struct net_device *dev)
 #endif
        dev->needed_headroom = real_dev->needed_headroom;
-        if (real_dev->features & NETIF_F_HW_VLAN_CTAG_TX) {
+        if (vlan_hw_offload_capable(real_dev->features,
+                                    vlan_dev_priv(dev)->vlan_proto)) {
                dev->header_ops      = &vlan_passthru_header_ops;
                dev->hard_header_len = real_dev->hard_header_len;
        } else {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 63f0455c0bc3..8fe8b71b487a 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -49,14 +49,14 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
        brstats->tx_bytes += skb->len;
        u64_stats_update_end(&brstats->syncp);
-        if (!br_allowed_ingress(br, br_get_vlan_info(br), skb, &vid))
-                goto out;
        BR_INPUT_SKB_CB(skb)->brdev = dev;
        skb_reset_mac_header(skb);
        skb_pull(skb, ETH_HLEN);
+        if (!br_allowed_ingress(br, br_get_vlan_info(br), skb, &vid))
+                goto out;
        if (is_broadcast_ether_addr(dest))
                br_flood_deliver(br, skb, false);
        else if (is_multicast_ether_addr(dest)) {
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 28d544627422..d0cca3c65f01 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -29,6 +29,7 @@ static int br_pass_frame_up(struct sk_buff *skb)
        struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
        struct net_bridge *br = netdev_priv(brdev);
        struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
+        struct net_port_vlans *pv;
        u64_stats_update_begin(&brstats->syncp);
        brstats->rx_packets++;
@@ -39,18 +40,18 @@ static int br_pass_frame_up(struct sk_buff *skb)
         * packet is allowed except in promisc modue when someone
         * may be running packet capture.
         */
+        pv = br_get_vlan_info(br);
        if (!(brdev->flags & IFF_PROMISC) &&
-            !br_allowed_egress(br, br_get_vlan_info(br), skb)) {
+            !br_allowed_egress(br, pv, skb)) {
                kfree_skb(skb);
                return NET_RX_DROP;
        }
-        skb = br_handle_vlan(br, br_get_vlan_info(br), skb);
-        if (!skb)
-                return NET_RX_DROP;
        indev = skb->dev;
        skb->dev = brdev;
+        skb = br_handle_vlan(br, pv, skb);
+        if (!skb)
+                return NET_RX_DROP;
        return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
                       netif_receive_skb);
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 8249ca764c79..f23c74b3a953 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -119,22 +119,6 @@ static void __vlan_flush(struct net_port_vlans *v)
        kfree_rcu(v, rcu);
 }
-/* Strip the tag from the packet.  Will return skb with tci set 0.  */
-static struct sk_buff *br_vlan_untag(struct sk_buff *skb)
-{
-        if (skb->protocol != htons(ETH_P_8021Q)) {
-                skb->vlan_tci = 0;
-                return skb;
-        }
-        skb->vlan_tci = 0;
-        skb = vlan_untag(skb);
-        if (skb)
-                skb->vlan_tci = 0;
-        return skb;
-}
 struct sk_buff *br_handle_vlan(struct net_bridge *br,
                               const struct net_port_vlans *pv,
                               struct sk_buff *skb)
@@ -144,13 +128,27 @@ struct sk_buff *br_handle_vlan(struct net_bridge *br,
        if (!br->vlan_enabled)
                goto out;
+        /* Vlan filter table must be configured at this point.  The
+         * only exception is the bridge is set in promisc mode and the
+         * packet is destined for the bridge device.  In this case
+         * pass the packet as is.
+         */
+        if (!pv) {
+                if ((br->dev->flags & IFF_PROMISC) && skb->dev == br->dev) {
+                        goto out;
+                } else {
+                        kfree_skb(skb);
+                        return NULL;
+                }
+        }
        /* At this point, we know that the frame was filtered and contains
         * a valid vlan id.  If the vlan id is set in the untagged bitmap,
         * send untagged; otherwise, send tagged.
         */
        br_vlan_get_tag(skb, &vid);
        if (test_bit(vid, pv->untagged_bitmap))
-                skb = br_vlan_untag(skb);
+                skb->vlan_tci = 0;
 out:
        return skb;
@@ -174,6 +172,18 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
        if (!v)
                return false;
+        /* If vlan tx offload is disabled on bridge device and frame was
+         * sent from vlan device on the bridge device, it does not have
+         * HW accelerated vlan tag.
+         */
+        if (unlikely(!vlan_tx_tag_present(skb) &&
+                     (skb->protocol == htons(ETH_P_8021Q) ||
+                      skb->protocol == htons(ETH_P_8021AD)))) {
+                skb = vlan_untag(skb);
+                if (unlikely(!skb))
+                        return false;
+        }
        err = br_vlan_get_tag(skb, vid);
        if (!*vid) {
                u16 pvid = br_get_pvid(v);
diff --git a/net/core/dev.c b/net/core/dev.c
index b1b0c8d4d7df..45fa2f11f84d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2286,7 +2286,7 @@ out:
 }
 EXPORT_SYMBOL(skb_checksum_help);
-__be16 skb_network_protocol(struct sk_buff *skb)
+__be16 skb_network_protocol(struct sk_buff *skb, int *depth)
 {
        __be16 type = skb->protocol;
        int vlan_depth = ETH_HLEN;
@@ -2313,6 +2313,8 @@ __be16 skb_network_protocol(struct sk_buff *skb)
                vlan_depth += VLAN_HLEN;
        }
+        *depth = vlan_depth;
        return type;
 }
@@ -2326,12 +2328,13 @@ struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
 {
        struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
        struct packet_offload *ptype;
-        __be16 type = skb_network_protocol(skb);
+        int vlan_depth = skb->mac_len;
+        __be16 type = skb_network_protocol(skb, &vlan_depth);
        if (unlikely(!type))
                return ERR_PTR(-EINVAL);
-        __skb_pull(skb, skb->mac_len);
+        __skb_pull(skb, vlan_depth);
        rcu_read_lock();
        list_for_each_entry_rcu(ptype, &offload_base, list) {
@@ -2498,8 +2501,10 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
                                            const struct net_device *dev,
                                            netdev_features_t features)
 {
+        int tmp;
        if (skb->ip_summed != CHECKSUM_NONE &&
-            !can_checksum_protocol(features, skb_network_protocol(skb))) {
+            !can_checksum_protocol(features, skb_network_protocol(skb, &tmp))) {
                features &= ~NETIF_F_ALL_CSUM;
        } else if (illegal_highdma(dev, skb)) {
                features &= ~NETIF_F_SG;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a664f7829a6d..df9e6b1a9759 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -742,7 +742,7 @@ static bool pkt_is_ns(struct sk_buff *skb)
        struct nd_msg *msg;
        struct ipv6hdr *hdr;
-        if (skb->protocol != htons(ETH_P_ARP))
+        if (skb->protocol != htons(ETH_P_IPV6))
                return false;
        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)))
                return false;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1a0dac2ef9ad..120eecc0f5a4 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2121,12 +2121,13 @@ EXPORT_SYMBOL(rtmsg_ifinfo);
 static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
                                   struct net_device *dev,
                                   u8 *addr, u32 pid, u32 seq,
-                                   int type, unsigned int flags)
+                                   int type, unsigned int flags,
+                                   int nlflags)
 {
        struct nlmsghdr *nlh;
        struct ndmsg *ndm;
-        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), nlflags);
        if (!nlh)
                return -EMSGSIZE;
@@ -2164,7 +2165,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, int type)
        if (!skb)
                goto errout;
-        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF);
+        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF, 0);
        if (err < 0) {
                kfree_skb(skb);
                goto errout;
@@ -2389,7 +2390,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb,
                err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
                                              portid, seq,
-                                              RTM_NEWNEIGH, NTF_SELF);
+                                              RTM_NEWNEIGH, NTF_SELF,
+                                              NLM_F_MULTI);
                if (err < 0)
                        return err;
 skip:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 869c7afe3b07..90b96a11b974 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2127,25 +2127,31 @@ EXPORT_SYMBOL_GPL(skb_zerocopy_headlen);
 *
 *      The `hlen` as calculated by skb_zerocopy_headlen() specifies the
 *      headroom in the `to` buffer.
+ *
+ *      Return value:
+ *      0: everything is OK
+ *      -ENOMEM: couldn't orphan frags of @from due to lack of memory
+ *      -EFAULT: skb_copy_bits() found some problem with skb geometry
 */
-void
+int
-skb_zerocopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
+skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 {
        int i, j = 0;
        int plen = 0; /* length of skb->head fragment */
+        int ret;
        struct page *page;
        unsigned int offset;
        BUG_ON(!from->head_frag && !hlen);
        /* dont bother with small payloads */
-        if (len <= skb_tailroom(to)) {
+        if (len <= skb_tailroom(to))
-                skb_copy_bits(from, 0, skb_put(to, len), len);
+                return skb_copy_bits(from, 0, skb_put(to, len), len);
-                return;
-        }
        if (hlen) {
-                skb_copy_bits(from, 0, skb_put(to, hlen), hlen);
+                ret = skb_copy_bits(from, 0, skb_put(to, hlen), hlen);
+                if (unlikely(ret))
+                        return ret;
                len -= hlen;
        } else {
                plen = min_t(int, skb_headlen(from), len);
@@ -2163,6 +2169,11 @@ skb_zerocopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
        to->len += len + plen;
        to->data_len += len + plen;
+        if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
+                skb_tx_error(from);
+                return -ENOMEM;
+        }
        for (i = 0; i < skb_shinfo(from)->nr_frags; i++) {
                if (!len)
                        break;
@@ -2173,6 +2184,8 @@ skb_zerocopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
                j++;
        }
        skb_shinfo(to)->nr_frags = j;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(skb_zerocopy);
@@ -2866,8 +2879,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
        int err = -ENOMEM;
        int i = 0;
        int pos;
+        int dummy;
-        proto = skb_network_protocol(head_skb);
+        proto = skb_network_protocol(head_skb, &dummy);
        if (unlikely(!proto))
                return ERR_PTR(-EINVAL);
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index 1863422fb7d5..250be7421ab3 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -182,6 +182,14 @@ static int gre_cisco_rcv(struct sk_buff *skb)
        int i;
        bool csum_err = false;
+#ifdef CONFIG_NET_IPGRE_BROADCAST
+        if (ipv4_is_multicast(ip_hdr(skb)->daddr)) {
+                /* Looped back packet, drop it! */
+                if (rt_is_output_route(skb_rtable(skb)))
+                        goto drop;
+        }
+#endif
        if (parse_gre_header(skb, &tpi, &csum_err) < 0)
                goto drop;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 78a89e61925d..a82a22d8f77f 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -416,9 +416,6 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
 #ifdef CONFIG_NET_IPGRE_BROADCAST
        if (ipv4_is_multicast(iph->daddr)) {
-                /* Looped back packet, drop it! */
-                if (rt_is_output_route(skb_rtable(skb)))
-                        goto drop;
                tunnel->dev->stats.multicast++;
                skb->pkt_type = PACKET_BROADCAST;
        }
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 6f847dd56dbc..8d69626f2206 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -108,6 +108,7 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
        nf_reset(skb);
        secpath_reset(skb);
        skb_clear_hash_if_not_l4(skb);
+        skb_dst_drop(skb);
        skb->vlan_tci = 0;
        skb_set_queue_mapping(skb, 0);
        skb->pkt_type = PACKET_HOST;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b9b3472975ba..28863570dd60 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2255,13 +2255,14 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
 }
 static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
-                            u32 portid, u32 seq, struct mfc_cache *c, int cmd)
+                            u32 portid, u32 seq, struct mfc_cache *c, int cmd,
+                            int flags)
 {
        struct nlmsghdr *nlh;
        struct rtmsg *rtm;
        int err;
-        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
        if (nlh == NULL)
                return -EMSGSIZE;
@@ -2329,7 +2330,7 @@ static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc,
        if (skb == NULL)
                goto errout;
-        err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd);
+        err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
        if (err < 0)
                goto errout;
@@ -2368,7 +2369,8 @@ static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
                                if (ipmr_fill_mroute(mrt, skb,
                                                     NETLINK_CB(cb->skb).portid,
                                                     cb->nlh->nlmsg_seq,
-                                                     mfc, RTM_NEWROUTE) < 0)
+                                                     mfc, RTM_NEWROUTE,
+                                                     NLM_F_MULTI) < 0)
                                        goto done;
 next_entry:
                                e++;
@@ -2382,7 +2384,8 @@ next_entry:
                        if (ipmr_fill_mroute(mrt, skb,
                                             NETLINK_CB(cb->skb).portid,
                                             cb->nlh->nlmsg_seq,
-                                             mfc, RTM_NEWROUTE) < 0) {
+                                             mfc, RTM_NEWROUTE,
+                                             NLM_F_MULTI) < 0) {
                                spin_unlock_bh(&mfc_unres_lock);
                                goto done;
                        }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3cf976510497..1e4eac779f51 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2628,7 +2628,7 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
 {
        __be32 dest, src;
        __u16 destp, srcp;
-        long delta = tw->tw_ttd - jiffies;
+        s32 delta = tw->tw_ttd - inet_tw_time_stamp();
        dest  = tw->tw_daddr;
        src   = tw->tw_rcv_saddr;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 344e972426df..6c7fa0853fc7 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -133,10 +133,12 @@ static int ipv6_count_addresses(struct inet6_dev *idev);
 static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];
 static DEFINE_SPINLOCK(addrconf_hash_lock);
-static void addrconf_verify(unsigned long);
+static void addrconf_verify(void);
+static void addrconf_verify_rtnl(void);
+static void addrconf_verify_work(struct work_struct *);
-static DEFINE_TIMER(addr_chk_timer, addrconf_verify, 0, 0);
+static struct workqueue_struct *addrconf_wq;
-static DEFINE_SPINLOCK(addrconf_verify_lock);
+static DECLARE_DELAYED_WORK(addr_chk_work, addrconf_verify_work);
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
@@ -151,7 +153,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
                                                  u32 flags, u32 noflags);
 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
-static void addrconf_dad_timer(unsigned long data);
+static void addrconf_dad_work(struct work_struct *w);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
 static void addrconf_dad_run(struct inet6_dev *idev);
 static void addrconf_rs_timer(unsigned long data);
@@ -247,9 +249,9 @@ static void addrconf_del_rs_timer(struct inet6_dev *idev)
                __in6_dev_put(idev);
 }
-static void addrconf_del_dad_timer(struct inet6_ifaddr *ifp)
+static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
 {
-        if (del_timer(&ifp->dad_timer))
+        if (cancel_delayed_work(&ifp->dad_work))
                __in6_ifa_put(ifp);
 }
@@ -261,12 +263,12 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev,
        mod_timer(&idev->rs_timer, jiffies + when);
 }
-static void addrconf_mod_dad_timer(struct inet6_ifaddr *ifp,
+static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
-                                   unsigned long when)
+                                   unsigned long delay)
 {
-        if (!timer_pending(&ifp->dad_timer))
+        if (!delayed_work_pending(&ifp->dad_work))
                in6_ifa_hold(ifp);
-        mod_timer(&ifp->dad_timer, jiffies + when);
+        mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
 }
 static int snmp6_alloc_dev(struct inet6_dev *idev)
@@ -751,8 +753,9 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
        in6_dev_put(ifp->idev);
-        if (del_timer(&ifp->dad_timer))
+        if (cancel_delayed_work(&ifp->dad_work))
-                pr_notice("Timer is still running, when freeing ifa=%p\n", ifp);
+                pr_notice("delayed DAD work was pending while freeing ifa=%p\n",
+                          ifp);
        if (ifp->state != INET6_IFADDR_STATE_DEAD) {
                pr_warn("Freeing alive inet6 address %p\n", ifp);
@@ -849,8 +852,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
        spin_lock_init(&ifa->lock);
        spin_lock_init(&ifa->state_lock);
-        setup_timer(&ifa->dad_timer, addrconf_dad_timer,
+        INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);
-                    (unsigned long)ifa);
        INIT_HLIST_NODE(&ifa->addr_lst);
        ifa->scope = scope;
        ifa->prefix_len = pfxlen;
@@ -990,6 +992,8 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
        enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_NOP;
        unsigned long expires;
+        ASSERT_RTNL();
        spin_lock_bh(&ifp->state_lock);
        state = ifp->state;
        ifp->state = INET6_IFADDR_STATE_DEAD;
@@ -1021,7 +1025,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
        write_unlock_bh(&ifp->idev->lock);
-        addrconf_del_dad_timer(ifp);
+        addrconf_del_dad_work(ifp);
        ipv6_ifa_notify(RTM_DELADDR, ifp);
@@ -1604,7 +1608,7 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
 {
        if (ifp->flags&IFA_F_PERMANENT) {
                spin_lock_bh(&ifp->lock);
-                addrconf_del_dad_timer(ifp);
+                addrconf_del_dad_work(ifp);
                ifp->flags |= IFA_F_TENTATIVE;
                if (dad_failed)
                        ifp->flags |= IFA_F_DADFAILED;
@@ -1625,20 +1629,21 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
                        spin_unlock_bh(&ifp->lock);
                }
                ipv6_del_addr(ifp);
-        } else
+        } else {
                ipv6_del_addr(ifp);
+        }
 }
 static int addrconf_dad_end(struct inet6_ifaddr *ifp)
 {
        int err = -ENOENT;
-        spin_lock(&ifp->state_lock);
+        spin_lock_bh(&ifp->state_lock);
        if (ifp->state == INET6_IFADDR_STATE_DAD) {
                ifp->state = INET6_IFADDR_STATE_POSTDAD;
                err = 0;
        }
-        spin_unlock(&ifp->state_lock);
+        spin_unlock_bh(&ifp->state_lock);
        return err;
 }
@@ -1671,7 +1676,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                }
        }
-        addrconf_dad_stop(ifp, 1);
+        spin_lock_bh(&ifp->state_lock);
+        /* transition from _POSTDAD to _ERRDAD */
+        ifp->state = INET6_IFADDR_STATE_ERRDAD;
+        spin_unlock_bh(&ifp->state_lock);
+        addrconf_mod_dad_work(ifp, 0);
 }
 /* Join to solicited addr multicast group. */
@@ -1680,6 +1690,8 @@ void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
 {
        struct in6_addr maddr;
+        ASSERT_RTNL();
        if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
                return;
@@ -1691,6 +1703,8 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 {
        struct in6_addr maddr;
+        ASSERT_RTNL();
        if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
                return;
@@ -1701,6 +1715,9 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 {
        struct in6_addr addr;
+        ASSERT_RTNL();
        if (ifp->prefix_len >= 127) /* RFC 6164 */
                return;
        ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -1712,6 +1729,9 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
 {
        struct in6_addr addr;
+        ASSERT_RTNL();
        if (ifp->prefix_len >= 127) /* RFC 6164 */
                return;
        ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -2271,11 +2291,13 @@ ok:
                                return;
                        }
-                        ifp->flags |= IFA_F_MANAGETEMPADDR;
                        update_lft = 0;
                        create = 1;
+                        spin_lock_bh(&ifp->lock);
+                        ifp->flags |= IFA_F_MANAGETEMPADDR;
                        ifp->cstamp = jiffies;
                        ifp->tokenized = tokenized;
+                        spin_unlock_bh(&ifp->lock);
                        addrconf_dad_start(ifp);
                }
@@ -2326,7 +2348,7 @@ ok:
                                         create, now);
                        in6_ifa_put(ifp);
-                        addrconf_verify(0);
+                        addrconf_verify();
                }
        }
        inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
@@ -2475,7 +2497,7 @@ static int inet6_addr_add(struct net *net, int ifindex,
                        manage_tempaddrs(idev, ifp, valid_lft, prefered_lft,
                                         true, jiffies);
                in6_ifa_put(ifp);
-                addrconf_verify(0);
+                addrconf_verify_rtnl();
                return 0;
        }
@@ -3011,7 +3033,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                hlist_for_each_entry_rcu(ifa, h, addr_lst) {
                        if (ifa->idev == idev) {
                                hlist_del_init_rcu(&ifa->addr_lst);
-                                addrconf_del_dad_timer(ifa);
+                                addrconf_del_dad_work(ifa);
                                goto restart;
                        }
                }
@@ -3049,7 +3071,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        while (!list_empty(&idev->addr_list)) {
                ifa = list_first_entry(&idev->addr_list,
                                       struct inet6_ifaddr, if_list);
-                addrconf_del_dad_timer(ifa);
+                addrconf_del_dad_work(ifa);
                list_del(&ifa->if_list);
@@ -3148,10 +3170,10 @@ static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
                rand_num = prandom_u32() % (idev->cnf.rtr_solicit_delay ? : 1);
        ifp->dad_probes = idev->cnf.dad_transmits;
-        addrconf_mod_dad_timer(ifp, rand_num);
+        addrconf_mod_dad_work(ifp, rand_num);
 }
-static void addrconf_dad_start(struct inet6_ifaddr *ifp)
+static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 {
        struct inet6_dev *idev = ifp->idev;
        struct net_device *dev = idev->dev;
@@ -3203,25 +3225,68 @@ out:
        read_unlock_bh(&idev->lock);
 }
-static void addrconf_dad_timer(unsigned long data)
+static void addrconf_dad_start(struct inet6_ifaddr *ifp)
 {
-        struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
+        bool begin_dad = false;
+        spin_lock_bh(&ifp->state_lock);
+        if (ifp->state != INET6_IFADDR_STATE_DEAD) {
+                ifp->state = INET6_IFADDR_STATE_PREDAD;
+                begin_dad = true;
+        }
+        spin_unlock_bh(&ifp->state_lock);
+        if (begin_dad)
+                addrconf_mod_dad_work(ifp, 0);
+}
+static void addrconf_dad_work(struct work_struct *w)
+{
+        struct inet6_ifaddr *ifp = container_of(to_delayed_work(w),
+                                                struct inet6_ifaddr,
+                                                dad_work);
        struct inet6_dev *idev = ifp->idev;
        struct in6_addr mcaddr;
+        enum {
+                DAD_PROCESS,
+                DAD_BEGIN,
+                DAD_ABORT,
+        } action = DAD_PROCESS;
+        rtnl_lock();
+        spin_lock_bh(&ifp->state_lock);
+        if (ifp->state == INET6_IFADDR_STATE_PREDAD) {
+                action = DAD_BEGIN;
+                ifp->state = INET6_IFADDR_STATE_DAD;
+        } else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
+                action = DAD_ABORT;
+                ifp->state = INET6_IFADDR_STATE_POSTDAD;
+        }
+        spin_unlock_bh(&ifp->state_lock);
+        if (action == DAD_BEGIN) {
+                addrconf_dad_begin(ifp);
+                goto out;
+        } else if (action == DAD_ABORT) {
+                addrconf_dad_stop(ifp, 1);
+                goto out;
+        }
        if (!ifp->dad_probes && addrconf_dad_end(ifp))
                goto out;
-        write_lock(&idev->lock);
+        write_lock_bh(&idev->lock);
        if (idev->dead || !(idev->if_flags & IF_READY)) {
-                write_unlock(&idev->lock);
+                write_unlock_bh(&idev->lock);
                goto out;
        }
        spin_lock(&ifp->lock);
        if (ifp->state == INET6_IFADDR_STATE_DEAD) {
                spin_unlock(&ifp->lock);
-                write_unlock(&idev->lock);
+                write_unlock_bh(&idev->lock);
                goto out;
        }
@@ -3232,7 +3297,7 @@ static void addrconf_dad_timer(unsigned long data)
                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                spin_unlock(&ifp->lock);
-                write_unlock(&idev->lock);
+                write_unlock_bh(&idev->lock);
                addrconf_dad_completed(ifp);
@@ -3240,16 +3305,17 @@ static void addrconf_dad_timer(unsigned long data)
        }
        ifp->dad_probes--;
-        addrconf_mod_dad_timer(ifp,
+        addrconf_mod_dad_work(ifp,
-                               NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME));
+                              NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME));
        spin_unlock(&ifp->lock);
-        write_unlock(&idev->lock);
+        write_unlock_bh(&idev->lock);
        /* send a neighbour solicitation for our addr */
        addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
        ndisc_send_ns(ifp->idev->dev, NULL, &ifp->addr, &mcaddr, &in6addr_any);
 out:
        in6_ifa_put(ifp);
+        rtnl_unlock();
 }
 /* ifp->idev must be at least read locked */
@@ -3276,7 +3342,7 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
        struct in6_addr lladdr;
        bool send_rs, send_mld;
-        addrconf_del_dad_timer(ifp);
+        addrconf_del_dad_work(ifp);
        /*
         *      Configure the address for reception. Now it is valid.
@@ -3517,23 +3583,23 @@ int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
 *      Periodic address status verification
 */
-static void addrconf_verify(unsigned long foo)
+static void addrconf_verify_rtnl(void)
 {
        unsigned long now, next, next_sec, next_sched;
        struct inet6_ifaddr *ifp;
        int i;
+        ASSERT_RTNL();
        rcu_read_lock_bh();
-        spin_lock(&addrconf_verify_lock);
        now = jiffies;
        next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
-        del_timer(&addr_chk_timer);
+        cancel_delayed_work(&addr_chk_work);
        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
 restart:
-                hlist_for_each_entry_rcu_bh(ifp,
+                hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[i], addr_lst) {
-                                         &inet6_addr_lst[i], addr_lst) {
                        unsigned long age;
                        /* When setting preferred_lft to a value not zero or
@@ -3628,13 +3694,22 @@ restart:
        ADBG(KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
              now, next, next_sec, next_sched);
+        mod_delayed_work(addrconf_wq, &addr_chk_work, next_sched - now);
-        addr_chk_timer.expires = next_sched;
-        add_timer(&addr_chk_timer);
-        spin_unlock(&addrconf_verify_lock);
        rcu_read_unlock_bh();
 }
+static void addrconf_verify_work(struct work_struct *w)
+{
+        rtnl_lock();
+        addrconf_verify_rtnl();
+        rtnl_unlock();
+}
+static void addrconf_verify(void)
+{
+        mod_delayed_work(addrconf_wq, &addr_chk_work, 0);
+}
 static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
                                     struct in6_addr **peer_pfx)
 {
@@ -3691,6 +3766,8 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u32 ifa_flags,
        bool was_managetempaddr;
        bool had_prefixroute;
+        ASSERT_RTNL();
        if (!valid_lft || (prefered_lft > valid_lft))
                return -EINVAL;
@@ -3756,7 +3833,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u32 ifa_flags,
                                 !was_managetempaddr, jiffies);
        }
-        addrconf_verify(0);
+        addrconf_verify_rtnl();
        return 0;
 }
@@ -4386,6 +4463,8 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
        bool update_rs = false;
        struct in6_addr ll_addr;
+        ASSERT_RTNL();
        if (token == NULL)
                return -EINVAL;
        if (ipv6_addr_any(token))
@@ -4434,7 +4513,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
        }
        write_unlock_bh(&idev->lock);
-        addrconf_verify(0);
+        addrconf_verify_rtnl();
        return 0;
 }
@@ -4636,6 +4715,9 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
        struct net *net = dev_net(ifp->idev->dev);
+        if (event)
+                ASSERT_RTNL();
        inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
        switch (event) {
@@ -5244,6 +5326,12 @@ int __init addrconf_init(void)
        if (err < 0)
                goto out_addrlabel;
+        addrconf_wq = create_workqueue("ipv6_addrconf");
+        if (!addrconf_wq) {
+                err = -ENOMEM;
+                goto out_nowq;
+        }
        /* The addrconf netdev notifier requires that loopback_dev
         * has it's ipv6 private information allocated and setup
         * before it can bring up and give link-local addresses
@@ -5274,7 +5362,7 @@ int __init addrconf_init(void)
        register_netdevice_notifier(&ipv6_dev_notf);
-        addrconf_verify(0);
+        addrconf_verify();
        rtnl_af_register(&inet6_ops);
@@ -5302,6 +5390,8 @@ errout:
        rtnl_af_unregister(&inet6_ops);
        unregister_netdevice_notifier(&ipv6_dev_notf);
 errlo:
+        destroy_workqueue(addrconf_wq);
+out_nowq:
        unregister_pernet_subsys(&addrconf_ops);
 out_addrlabel:
        ipv6_addr_label_cleanup();
@@ -5337,7 +5427,8 @@ void addrconf_cleanup(void)
        for (i = 0; i < IN6_ADDR_HSIZE; i++)
                WARN_ON(!hlist_empty(&inet6_addr_lst[i]));
        spin_unlock_bh(&addrconf_hash_lock);
+        cancel_delayed_work(&addr_chk_work);
-        del_timer(&addr_chk_timer);
        rtnl_unlock();
+        destroy_workqueue(addrconf_wq);
 }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 16f91a2e7888..64d6073731d3 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1101,21 +1101,19 @@ static void ip6_append_data_mtu(unsigned int *mtu,
                                unsigned int fragheaderlen,
                                struct sk_buff *skb,
                                struct rt6_info *rt,
-                                bool pmtuprobe)
+                                unsigned int orig_mtu)
 {
        if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
                if (skb == NULL) {
                        /* first fragment, reserve header_len */
-                        *mtu = *mtu - rt->dst.header_len;
+                        *mtu = orig_mtu - rt->dst.header_len;
                } else {
                        /*
                         * this fragment is not first, the headers
                         * space is regarded as data space.
                         */
-                        *mtu = min(*mtu, pmtuprobe ?
+                        *mtu = orig_mtu;
-                                   rt->dst.dev->mtu :
-                                   dst_mtu(rt->dst.path));
                }
                *maxfraglen = ((*mtu - fragheaderlen) & ~7)
                              + fragheaderlen - sizeof(struct frag_hdr);
@@ -1132,7 +1130,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct inet_cork *cork;
        struct sk_buff *skb, *skb_prev = NULL;
-        unsigned int maxfraglen, fragheaderlen, mtu;
+        unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
        int exthdrlen;
        int dst_exthdrlen;
        int hh_len;
@@ -1214,6 +1212,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                dst_exthdrlen = 0;
                mtu = cork->fragsize;
        }
+        orig_mtu = mtu;
        hh_len = LL_RESERVED_SPACE(rt->dst.dev);
@@ -1311,8 +1310,7 @@ alloc_new_skb:
                        if (skb == NULL || skb_prev == NULL)
                                ip6_append_data_mtu(&mtu, &maxfraglen,
                                                    fragheaderlen, skb, rt,
-                                                    np->pmtudisc >=
+                                                    orig_mtu);
-                                                    IPV6_PMTUDISC_PROBE);
                        skb_prev = skb;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0eb4038a4d63..8737400af0a0 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2349,13 +2349,14 @@ int ip6mr_get_route(struct net *net,
 }
 static int ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
-                             u32 portid, u32 seq, struct mfc6_cache *c, int cmd)
+                             u32 portid, u32 seq, struct mfc6_cache *c, int cmd,
+                             int flags)
 {
        struct nlmsghdr *nlh;
        struct rtmsg *rtm;
        int err;
-        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
        if (nlh == NULL)
                return -EMSGSIZE;
@@ -2423,7 +2424,7 @@ static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
        if (skb == NULL)
                goto errout;
-        err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd);
+        err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
        if (err < 0)
                goto errout;
@@ -2462,7 +2463,8 @@ static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
                                if (ip6mr_fill_mroute(mrt, skb,
                                                      NETLINK_CB(cb->skb).portid,
                                                      cb->nlh->nlmsg_seq,
-                                                      mfc, RTM_NEWROUTE) < 0)
+                                                      mfc, RTM_NEWROUTE,
+                                                      NLM_F_MULTI) < 0)
                                        goto done;
 next_entry:
                                e++;
@@ -2476,7 +2478,8 @@ next_entry:
                        if (ip6mr_fill_mroute(mrt, skb,
                                              NETLINK_CB(cb->skb).portid,
                                              cb->nlh->nlmsg_seq,
-                                              mfc, RTM_NEWROUTE) < 0) {
+                                              mfc, RTM_NEWROUTE,
+                                              NLM_F_MULTI) < 0) {
                                spin_unlock_bh(&mfc_unres_lock);
                                goto done;
                        }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1a04c1329362..79326978517a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -433,12 +433,13 @@ static inline int verify_sec_ctx_len(const void *p)
        return 0;
 }
-static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx)
+static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx,
+                                                                     gfp_t gfp)
 {
        struct xfrm_user_sec_ctx *uctx = NULL;
        int ctx_size = sec_ctx->sadb_x_ctx_len;
-        uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL);
+        uctx = kmalloc((sizeof(*uctx)+ctx_size), gfp);
        if (!uctx)
                return NULL;
@@ -1124,7 +1125,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
        sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
        if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
                if (!uctx)
                        goto out;
@@ -2231,14 +2232,14 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
        sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
        if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
                if (!uctx) {
                        err = -ENOBUFS;
                        goto out;
                }
-                err = security_xfrm_policy_alloc(&xp->security, uctx);
+                err = security_xfrm_policy_alloc(&xp->security, uctx, GFP_KERNEL);
                kfree(uctx);
                if (err)
@@ -2335,12 +2336,12 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
        sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
        if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
                if (!uctx)
                        return -ENOMEM;
-                err = security_xfrm_policy_alloc(&pol_ctx, uctx);
+                err = security_xfrm_policy_alloc(&pol_ctx, uctx, GFP_KERNEL);
                kfree(uctx);
                if (err)
                        return err;
@@ -3239,8 +3240,8 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                }
                if ((*dir = verify_sec_ctx_len(p)))
                        goto out;
-                uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_ATOMIC);
-                *dir = security_xfrm_policy_alloc(&xp->security, uctx);
+                *dir = security_xfrm_policy_alloc(&xp->security, uctx, GFP_ATOMIC);
                kfree(uctx);
                if (*dir)
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index f072fe803510..108120f216b1 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -354,13 +354,16 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
        skb = nfnetlink_alloc_skb(net, size, queue->peer_portid,
                                  GFP_ATOMIC);
-        if (!skb)
+        if (!skb) {
+                skb_tx_error(entskb);
                return NULL;
+        }
        nlh = nlmsg_put(skb, 0, 0,
                        NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET,
                        sizeof(struct nfgenmsg), 0);
        if (!nlh) {
+                skb_tx_error(entskb);
                kfree_skb(skb);
                return NULL;
        }
@@ -488,13 +491,15 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
                nla->nla_type = NFQA_PAYLOAD;
                nla->nla_len = nla_attr_size(data_len);
-                skb_zerocopy(skb, entskb, data_len, hlen);
+                if (skb_zerocopy(skb, entskb, data_len, hlen))
+                        goto nla_put_failure;
        }
        nlh->nlmsg_len = skb->len;
        return skb;
 nla_put_failure:
+        skb_tx_error(entskb);
        kfree_skb(skb);
        net_err_ratelimited("nf_queue: error creating packet message\n");
        return NULL;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index e9a48baf8551..270b77dfac30 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -464,7 +464,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
        }
        nla->nla_len = nla_attr_size(skb->len);
-        skb_zerocopy(user_skb, skb, skb->len, hlen);
+        err = skb_zerocopy(user_skb, skb, skb->len, hlen);
+        if (err)
+                goto out;
        /* Pad OVS_PACKET_ATTR_PACKET if linear copy was performed */
        if (!(dp->user_features & OVS_DP_F_UNALIGNED)) {
@@ -478,6 +480,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
        err = genlmsg_unicast(ovs_dp_get_net(dp), user_skb, upcall_info->portid);
 out:
+        if (err)
+                skb_tx_error(skb);
        kfree_skb(nskb);
        return err;
 }
@@ -1174,7 +1178,7 @@ static void ovs_dp_reset_user_features(struct sk_buff *skb, struct genl_info *in
        struct datapath *dp;
        dp = lookup_datapath(sock_net(skb->sk), info->userhdr, info->attrs);
-        if (!dp)
+        if (IS_ERR(dp))
                return;
        WARN(dp->user_features, "Dropping previously announced user features\n");
@@ -1762,11 +1766,12 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
        int bucket = cb->args[0], skip = cb->args[1];
        int i, j = 0;
+        rcu_read_lock();
        dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
-        if (!dp)
+        if (!dp) {
+                rcu_read_unlock();
                return -ENODEV;
+        }
-        rcu_read_lock();
        for (i = bucket; i < DP_VPORT_HASH_BUCKETS; i++) {
                struct vport *vport;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 16f4b46161d4..2998989e76db 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -73,6 +73,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, struct sk_buff *skb)
        if ((flow->key.eth.type == htons(ETH_P_IP) ||
             flow->key.eth.type == htons(ETH_P_IPV6)) &&
+            flow->key.ip.frag != OVS_FRAG_TYPE_LATER &&
            flow->key.ip.proto == IPPROTO_TCP &&
            likely(skb->len >= skb_transport_offset(skb) + sizeof(struct tcphdr))) {
                tcp_flags = TCP_FLAGS_BE16(tcp_hdr(skb));
@@ -91,7 +92,7 @@ static void stats_read(struct flow_stats *stats,
                       unsigned long *used, __be16 *tcp_flags)
 {
        spin_lock(&stats->lock);
-        if (time_after(stats->used, *used))
+        if (!*used || time_after(stats->used, *used))
                *used = stats->used;
        *tcp_flags |= stats->tcp_flags;
        ovs_stats->n_packets += stats->packet_count;
@@ -102,30 +103,24 @@ static void stats_read(struct flow_stats *stats,
 void ovs_flow_stats_get(struct sw_flow *flow, struct ovs_flow_stats *ovs_stats,
                        unsigned long *used, __be16 *tcp_flags)
 {
-        int cpu, cur_cpu;
+        int cpu;
        *used = 0;
        *tcp_flags = 0;
        memset(ovs_stats, 0, sizeof(*ovs_stats));
+        local_bh_disable();
        if (!flow->stats.is_percpu) {
                stats_read(flow->stats.stat, ovs_stats, used, tcp_flags);
        } else {
-                cur_cpu = get_cpu();
                for_each_possible_cpu(cpu) {
                        struct flow_stats *stats;
-                        if (cpu == cur_cpu)
-                                local_bh_disable();
                        stats = per_cpu_ptr(flow->stats.cpu_stats, cpu);
                        stats_read(stats, ovs_stats, used, tcp_flags);
-                        if (cpu == cur_cpu)
-                                local_bh_enable();
                }
-                put_cpu();
        }
+        local_bh_enable();
 }
 static void stats_reset(struct flow_stats *stats)
@@ -140,25 +135,17 @@ static void stats_reset(struct flow_stats *stats)
 void ovs_flow_stats_clear(struct sw_flow *flow)
 {
-        int cpu, cur_cpu;
+        int cpu;
+        local_bh_disable();
        if (!flow->stats.is_percpu) {
                stats_reset(flow->stats.stat);
        } else {
-                cur_cpu = get_cpu();
                for_each_possible_cpu(cpu) {
-                        if (cpu == cur_cpu)
-                                local_bh_disable();
                        stats_reset(per_cpu_ptr(flow->stats.cpu_stats, cpu));
-                        if (cpu == cur_cpu)
-                                local_bh_enable();
                }
-                put_cpu();
        }
+        local_bh_enable();
 }
 static int check_header(struct sk_buff *skb, int len)
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 11c9ae00837d..642437231ad5 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -263,9 +263,9 @@ static void subscr_cancel(struct tipc_subscr *s,
 *
 * Called with subscriber lock held.
 */
-static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
+static int subscr_subscribe(struct tipc_subscr *s,
-                                             struct tipc_subscriber *subscriber)
+                            struct tipc_subscriber *subscriber,
-{
+                            struct tipc_subscription **sub_p) {
        struct tipc_subscription *sub;
        int swap;
@@ -276,23 +276,21 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
        if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
                s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
                subscr_cancel(s, subscriber);
-                return NULL;
+                return 0;
        }
        /* Refuse subscription if global limit exceeded */
        if (atomic_read(&subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
                pr_warn("Subscription rejected, limit reached (%u)\n",
                        TIPC_MAX_SUBSCRIPTIONS);
-                subscr_terminate(subscriber);
+                return -EINVAL;
-                return NULL;
        }
        /* Allocate subscription object */
        sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
        if (!sub) {
                pr_warn("Subscription rejected, no memory\n");
-                subscr_terminate(subscriber);
+                return -ENOMEM;
-                return NULL;
        }
        /* Initialize subscription object */
@@ -306,8 +304,7 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
            (sub->seq.lower > sub->seq.upper)) {
                pr_warn("Subscription rejected, illegal request\n");
                kfree(sub);
-                subscr_terminate(subscriber);
+                return -EINVAL;
-                return NULL;
        }
        INIT_LIST_HEAD(&sub->nameseq_list);
        list_add(&sub->subscription_list, &subscriber->subscription_list);
@@ -320,8 +317,8 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
                             (Handler)subscr_timeout, (unsigned long)sub);
                k_start_timer(&sub->timer, sub->timeout);
        }
+        *sub_p = sub;
-        return sub;
+        return 0;
 }
 /* Handle one termination request for the subscriber */
@@ -335,10 +332,14 @@ static void subscr_conn_msg_event(int conid, struct sockaddr_tipc *addr,
                                  void *usr_data, void *buf, size_t len)
 {
        struct tipc_subscriber *subscriber = usr_data;
-        struct tipc_subscription *sub;
+        struct tipc_subscription *sub = NULL;
        spin_lock_bh(&subscriber->lock);
-        sub = subscr_subscribe((struct tipc_subscr *)buf, subscriber);
+        if (subscr_subscribe((struct tipc_subscr *)buf, subscriber, &sub) < 0) {
+                spin_unlock_bh(&subscriber->lock);
+                subscr_terminate(subscriber);
+                return;
+        }
        if (sub)
                tipc_nametbl_subscribe(sub);
        spin_unlock_bh(&subscriber->lock);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ce6ec6c2f4de..94404f19f9de 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1787,8 +1787,11 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
                goto out;
        err = mutex_lock_interruptible(&u->readlock);
-        if (err) {
+        if (unlikely(err)) {
-                err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
+                /* recvmsg() in non blocking mode is supposed to return -EAGAIN
+                 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
+                 */
+                err = noblock ? -EAGAIN : -ERESTARTSYS;
                goto out;
        }
@@ -1913,6 +1916,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
        struct unix_sock *u = unix_sk(sk);
        DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, msg->msg_name);
        int copied = 0;
+        int noblock = flags & MSG_DONTWAIT;
        int check_creds = 0;
        int target;
        int err = 0;
@@ -1928,7 +1932,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                goto out;
        target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
-        timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
+        timeo = sock_rcvtimeo(sk, noblock);
        /* Lock the socket to prevent queue disordering
         * while sleeps in memcpy_tomsg
@@ -1940,8 +1944,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
        }
        err = mutex_lock_interruptible(&u->readlock);
-        if (err) {
+        if (unlikely(err)) {
-                err = sock_intr_errno(timeo);
+                /* recvmsg() in non blocking mode is supposed to return -EAGAIN
+                 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
+                 */
+                err = noblock ? -EAGAIN : -ERESTARTSYS;
                goto out;
        }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c274179d60a2..2f7ddc3a59b4 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1221,7 +1221,7 @@ static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs
                return 0;
        uctx = nla_data(rt);
-        return security_xfrm_policy_alloc(&pol->security, uctx);
+        return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL);
 }
 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
@@ -1626,7 +1626,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                if (rt) {
                        struct xfrm_user_sec_ctx *uctx = nla_data(rt);
-                        err = security_xfrm_policy_alloc(&ctx, uctx);
+                        err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
                        if (err)
                                return err;
                }
@@ -1928,7 +1928,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                if (rt) {
                        struct xfrm_user_sec_ctx *uctx = nla_data(rt);
-                        err = security_xfrm_policy_alloc(&ctx, uctx);
+                        err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
                        if (err)
                                return err;
                }
diff --git a/security/capability.c b/security/capability.c
index 8b4f24ae4338..21e2b9cae685 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -757,7 +757,8 @@ static void cap_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 static int cap_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp,
-                                          struct xfrm_user_sec_ctx *sec_ctx)
+                                          struct xfrm_user_sec_ctx *sec_ctx,
+                                          gfp_t gfp)
 {
        return 0;
 }
diff --git a/security/security.c b/security/security.c
index 15b6928592ef..919cad93ac82 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1317,9 +1317,11 @@ void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
-int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
+int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                               struct xfrm_user_sec_ctx *sec_ctx,
+                               gfp_t gfp)
 {
-        return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx);
+        return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx, gfp);
 }
 EXPORT_SYMBOL(security_xfrm_policy_alloc);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4b34847208cc..b332e2cc0954 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -668,7 +668,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                if (flags[i] == SBLABEL_MNT)
                        continue;
                rc = security_context_to_sid(mount_options[i],
-                                             strlen(mount_options[i]), &sid);
+                                             strlen(mount_options[i]), &sid, GFP_KERNEL);
                if (rc) {
                        printk(KERN_WARNING "SELinux: security_context_to_sid"
                               "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2489,7 +2489,8 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
                if (flags[i] == SBLABEL_MNT)
                        continue;
                len = strlen(mount_options[i]);
-                rc = security_context_to_sid(mount_options[i], len, &sid);
+                rc = security_context_to_sid(mount_options[i], len, &sid,
+                                             GFP_KERNEL);
                if (rc) {
                        printk(KERN_WARNING "SELinux: security_context_to_sid"
                               "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2893,7 +2894,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
        if (rc)
                return rc;
-        rc = security_context_to_sid(value, size, &newsid);
+        rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
        if (rc == -EINVAL) {
                if (!capable(CAP_MAC_ADMIN)) {
                        struct audit_buffer *ab;
@@ -3050,7 +3051,7 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
        if (!value || !size)
                return -EACCES;
-        rc = security_context_to_sid((void *)value, size, &newsid);
+        rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
        if (rc)
                return rc;
@@ -5529,7 +5530,7 @@ static int selinux_setprocattr(struct task_struct *p,
                        str[size-1] = 0;
                        size--;
                }
-                error = security_context_to_sid(value, size, &sid);
+                error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
                if (error == -EINVAL && !strcmp(name, "fscreate")) {
                        if (!capable(CAP_MAC_ADMIN)) {
                                struct audit_buffer *ab;
@@ -5638,7 +5639,7 @@ static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 {
-        return security_context_to_sid(secdata, seclen, secid);
+        return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
 }
 static void selinux_release_secctx(char *secdata, u32 seclen)
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 8ed8daf7f1ee..ce7852cf526b 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -134,7 +134,7 @@ int security_sid_to_context(u32 sid, char **scontext,
 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len);
 int security_context_to_sid(const char *scontext, u32 scontext_len,
-        u32 *out_sid);
+                            u32 *out_sid, gfp_t gfp);
 int security_context_to_sid_default(const char *scontext, u32 scontext_len,
                                    u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 48c3cc94c168..9f0584710c85 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -10,7 +10,8 @@
 #include <net/flow.h>
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
-                              struct xfrm_user_sec_ctx *uctx);
+                              struct xfrm_user_sec_ctx *uctx,
+                              gfp_t gfp);
 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
                              struct xfrm_sec_ctx **new_ctxp);
 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 5122affe06a8..d60c0ee66387 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -576,7 +576,7 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
        if (length)
                goto out;
-        length = security_context_to_sid(buf, size, &sid);
+        length = security_context_to_sid(buf, size, &sid, GFP_KERNEL);
        if (length)
                goto out;
@@ -731,11 +731,13 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                goto out;
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
@@ -817,11 +819,13 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
                objname = namebuf;
        }
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
@@ -878,11 +882,13 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                goto out;
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
@@ -934,7 +940,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s", con, user) != 2)
                goto out;
-        length = security_context_to_sid(con, strlen(con) + 1, &sid);
+        length = security_context_to_sid(con, strlen(con) + 1, &sid, GFP_KERNEL);
        if (length)
                goto out;
@@ -994,11 +1000,13 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                goto out;
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
        if (length)
                goto out;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 5d0144ee8ed6..4bca49414a40 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1289,16 +1289,18 @@ out:
 * @scontext: security context
 * @scontext_len: length in bytes
 * @sid: security identifier, SID
+ * @gfp: context for the allocation
 *
 * Obtains a SID associated with the security context that
 * has the string representation specified by @scontext.
 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
 * memory is available, or 0 on success.
 */
-int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid)
+int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,
+                            gfp_t gfp)
 {
        return security_context_to_sid_core(scontext, scontext_len,
-                                            sid, SECSID_NULL, GFP_KERNEL, 0);
+                                            sid, SECSID_NULL, gfp, 0);
 }
 /**
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 0462cb3ff0a7..98b042630a9e 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -78,7 +78,8 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
 * xfrm_user_sec_ctx context.
 */
 static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
-                                   struct xfrm_user_sec_ctx *uctx)
+                                   struct xfrm_user_sec_ctx *uctx,
+                                   gfp_t gfp)
 {
        int rc;
        const struct task_security_struct *tsec = current_security();
@@ -94,7 +95,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
        if (str_len >= PAGE_SIZE)
                return -ENOMEM;
-        ctx = kmalloc(sizeof(*ctx) + str_len + 1, GFP_KERNEL);
+        ctx = kmalloc(sizeof(*ctx) + str_len + 1, gfp);
        if (!ctx)
                return -ENOMEM;
@@ -103,7 +104,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
        ctx->ctx_len = str_len;
        memcpy(ctx->ctx_str, &uctx[1], str_len);
        ctx->ctx_str[str_len] = '\0';
-        rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid);
+        rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid, gfp);
        if (rc)
                goto err;
@@ -282,9 +283,10 @@ int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
 * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
 */
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
-                              struct xfrm_user_sec_ctx *uctx)
+                              struct xfrm_user_sec_ctx *uctx,
+                              gfp_t gfp)
 {
-        return selinux_xfrm_alloc_user(ctxp, uctx);
+        return selinux_xfrm_alloc_user(ctxp, uctx, gfp);
 }
 /*
@@ -332,7 +334,7 @@ int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 int selinux_xfrm_state_alloc(struct xfrm_state *x,
                             struct xfrm_user_sec_ctx *uctx)
 {
-        return selinux_xfrm_alloc_user(&x->security, uctx);
+        return selinux_xfrm_alloc_user(&x->security, uctx, GFP_KERNEL);
 }
 /*
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 7a20897d33db..7403f348ed14 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -133,7 +133,7 @@ static int snd_compr_open(struct inode *inode, struct file *f)
                kfree(data);
        }
        snd_card_unref(compr->card);
-        return 0;
+        return ret;
 }
 static int snd_compr_free(struct inode *inode, struct file *f)
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index ed6f199f8a38..4cf3200e988b 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -238,11 +238,21 @@ void set_cs4245_adc_params(struct oxygen *chip,
        cs4245_write_spi(chip, CS4245_MCLK_FREQ);
 }
+static inline unsigned int shift_bits(unsigned int value,
+                                      unsigned int shift_from,
+                                      unsigned int shift_to,
+                                      unsigned int mask)
+{
+        if (shift_from < shift_to)
+                return (value << (shift_to - shift_from)) & mask;
+        else
+                return (value >> (shift_from - shift_to)) & mask;
+}
 unsigned int adjust_dg_dac_routing(struct oxygen *chip,
                                          unsigned int play_routing)
 {
        struct dg *data = chip->model_data;
-        unsigned int routing = 0;
        switch (data->output_sel) {
        case PLAYBACK_DST_HP:
@@ -252,15 +262,23 @@ unsigned int adjust_dg_dac_routing(struct oxygen *chip,
                        OXYGEN_PLAY_MUTE67, OXYGEN_PLAY_MUTE_MASK);
                break;
        case PLAYBACK_DST_MULTICH:
-                routing = (0 << OXYGEN_PLAY_DAC0_SOURCE_SHIFT) |
-                          (2 << OXYGEN_PLAY_DAC1_SOURCE_SHIFT) |
-                          (1 << OXYGEN_PLAY_DAC2_SOURCE_SHIFT) |
-                          (0 << OXYGEN_PLAY_DAC3_SOURCE_SHIFT);
                oxygen_write8_masked(chip, OXYGEN_PLAY_ROUTING,
                        OXYGEN_PLAY_MUTE01, OXYGEN_PLAY_MUTE_MASK);
                break;
        }
-        return routing;
+        return (play_routing & OXYGEN_PLAY_DAC0_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC0_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_MASK);
 }
 void dump_cs4245_registers(struct oxygen *chip,
diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index d4c83c60b9b2..97d86d828190 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -1593,6 +1593,7 @@ static void init_params(struct params *p, const char *name, int argc, const char
        p->data_rand_walk               = true;
        p->nr_loops                     = -1;
        p->init_random                  = true;
+        p->run_all                      = argc == 1;
 }
 static int run_bench_numa(const char *name, const char **argv)
diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c
index e47f90cc7b98..8a987d252780 100644
--- a/tools/perf/builtin-bench.c
+++ b/tools/perf/builtin-bench.c
@@ -76,7 +76,7 @@ static struct collection collections[] = {
 /* Iterate over all benchmarks within a collection: */
 #define for_each_bench(coll, bench) \
-        for (bench = coll->benchmarks; bench->name; bench++)
+        for (bench = coll->benchmarks; bench && bench->name; bench++)
 static void dump_benchmarks(struct collection *coll)
 {
author	Dave Airlie <airlied@redhat.com>	2014-04-05 02:14:21 -0400
committer	Dave Airlie <airlied@redhat.com>	2014-04-05 02:14:21 -0400
commit	9f97ba806a9cb8e828baca71eca8b684939053d8 (patch)
tree	ec036e36d1d2e64b6e67c4d5d24a5ecb6475aac0
parent	82c68b6ccd54117a87cb2d9b91c2ee6e1280cf9d (diff)
parent	10b6ee4a87811a110cb01eaca01eb04da6801baf (diff)